feat(server): token auth, registration, admin panel, email redesign, and security hardening - #189

Merged

YaoYinYing merged 62 commits into

mainfrom

feat/token-auth-and-register

Jul 15, 2026

Commits on Jul 12, 2026

feat(server): replace HTTP Basic Auth with token auth, add registration workflow

YaoYinYing
and
claude
committed
eeed5f0
refactor(server): seed user DB from users file only on first startup

YaoYinYing
and
claude
committed
1227119
refactor(server): drop users.txt seeding, bootstrap admin only

YaoYinYing
and
claude
committed
3afcaa7
feat(server): token auth, API keys, registration workflow, module split

YaoYinYing
and
claude
committed
f45512e
refactor(server): consolidate _env_bool, shrink error branch

YaoYinYing
and
claude
committed
3426f4d
fix(server): add server/ to sys.path for test module loading

YaoYinYing
and
claude
committed
dfef7f4
feat(server): add ALLOWED_EMAIL_DOMAINS and +suffix normalisation

YaoYinYing
and
claude
committed
24b6db6
docs: update CHANGELOG for email domain and test fix

YaoYinYing
and
claude
committed
95d726a
test(server): switch integration tests from Basic Auth to Bearer token

YaoYinYing
and
claude
committed
1d86b88
fix(server): restore root group in Docker socket access

YaoYinYing
and
claude
committed
b7e994f

Commits on Jul 13, 2026

fix(server): harden auth, fix gunicorn worker crash, redesign auth pages

YaoYinYing
and
claude
committed
55b2b2a
fix(server): replace bare file input with labeled upload trigger

YaoYinYing
and
claude
committed
fee2e98
fix(server): use JS click delegation for file upload trigger

YaoYinYing
and
claude
committed
d972305
fix(server): replace hidden attr with visually-hidden for file input

YaoYinYing
and
claude
committed
c2cc1e8
fix(server): download/logout buttons, error page CSS extraction, file-upload CSS revert

YaoYinYing
and
claude
committed
1f842cd
fix(server): add drag-and-drop file upload, fix create-task UI classes

YaoYinYing
and
claude
committed
a25a21f
chore(server): remove test-click diagnostic endpoint, update changelog

YaoYinYing
and
claude
committed
9c856dc
docs(server): document drag-and-drop upload, new module structure

YaoYinYing
and
claude
committed
f4ecf6c
feat(server): add admin user control panel with registration audit and batch management

YaoYinYing
and
claude
committed
e2e5aee
fix(server): accept email in login, not just username

YaoYinYing
and
claude
committed
9672047
refactor(server): add explicit username field to admin add-user form

YaoYinYing
and
claude
committed
2773f62
feat(server): add forgot/reset password flow

YaoYinYing
and
claude
committed
42c7c13
feat(server): add inline Modify button to user management table

YaoYinYing
and
claude
committed
9adbc03
refactor(server): harden API data models with Pydantic

YaoYinYing
and
claude
committed
e8ab0e3
refactor(server): rename to pssm_gremlin_server pip package, move tests

YaoYinYing
and
claude
committed
d43bb5f

Commits on Jul 14, 2026

docs: update server docs, dev guide, and CHANGELOG; prune REvoDesign test deps

YaoYinYing
and
claude
committed
48c72d3
fix(server): harden auth gate, redact secrets from logs, unify admin checks

YaoYinYing
and
claude
committed
94f8b67
fix(server): require email verification in auth gate; drop root group from docker compose

YaoYinYing
and
claude
committed
31ed5c7
fix(server): add CSRF bearer-auth gate, close email-verification bypass

YaoYinYing
and
claude
committed
ecb5fe3
fix(server): extend CSRF bearer gate to task mutation routes

YaoYinYing
and
claude
committed
d7f4882
Harden server auth admin controls
YaoYinYing
committed
9d8cca6
Auto-detect Docker socket group at runtime
YaoYinYing
committed
576148f
feat(server): add optional Resend SDK email backend, consolidate to pyproject.toml

YaoYinYing
and
claude
committed
7f6c4f1
feat(server): add role system (admin/user/guest), CAPTCHA, email redesign, and UI polish

YaoYinYing
and
claude
committed
0291f34
feat(server): add Terms of Service page

YaoYinYing
and
claude
committed
2ce0879
feat(dev): add CHANGELOG.md duplicate-section checker with pre-commit hook

YaoYinYing
and
claude
committed
e3e98f3
fix(server): unblock guest Bearer-token auth, add guest delete guard

YaoYinYing
and
claude
committed
14adbe1
fix(server): use request Host header for email links, fix CAPTCHA tests

YaoYinYing
and
claude
committed
401c450

Commits on Jul 15, 2026

feat(server): browser hardening, upload quotas, runner de-escalation, admin digest

YaoYinYing
and
claude
committed
c1dd6e2
chore(server): tidy env files, add comments, remove obsolete requirements.txt

YaoYinYing
and
claude
committed
5c251f7
chore(server): auto-derive RUNNER_UID/GID, remove DEFAULT_ADMIN_PASSWORD from env files

YaoYinYing
and
claude
committed
dccd1e1
chore(server): remove DEFAULT_ADMIN_PASSWORD, always auto-generate

YaoYinYing
and
claude
committed
88a7198
fix(test): inject admin password via sqlite3 after server bootstrap

YaoYinYing
and
claude
committed
5286784
fix(server): restore DEFAULT_ADMIN_PASSWORD env plumbing, fix GID resolution

YaoYinYing
and
claude
committed
2c93ec5
fix(server): replace noreply@ with hello@ in all from-address defaults

YaoYinYing
and
claude
committed
b764dd4
fix(server): prevent duplicate admin digest emails

YaoYinYing
and
claude
committed
1a044ed
fix(server): add ±5s jitter to digest sleep so workers drift apart

YaoYinYing
and
claude
committed
2802b71
feat(server): add HTML email templates with warm design

YaoYinYing
and
claude
committed
8f57955
fix(server): backfill admin_notified on upgrade, exclude admins from digest, backup DB

YaoYinYing
and
claude
committed
c86c8cd
docs(server): clarify that flock auto-releases on process death

YaoYinYing
and
claude
committed
abef676
feat(server): capture registration IP and display in user management

YaoYinYing
and
claude
committed
72c35ba
feat(server): configurable client IP/country headers, track country on registration

YaoYinYing
and
claude
committed
375e625
docs(server): document CDN IP header reference in env.example and README

YaoYinYing
and
claude
committed
be21724
fix(server): strip quotes from CLIENT_IP_HEADERS values, quote examples in docs

YaoYinYing
and
claude
committed
d650419
Update .env.example
YaoYinYing
committed
fb6a026
fix(server): run DB backup inside web container to avoid host permission error

YaoYinYing
and
claude
committed
c32adac
fix(server): avoid FASTA filename collision in shared upload folder

YaoYinYing
and
claude
committed
9552719
feat(server): allow download of partial results from failed tasks

YaoYinYing
and
claude
committed
d2070cb
feat(server): show error tooltip on failed task cards in dashboard

YaoYinYing
and
claude
committed
4a8f845
docs: add changelog entries for filename collision, backup, failed-task download, and error tooltip

YaoYinYing
and
claude
committed
c94c9a8
fix(server): three bugs — escapeAttr corrupting user data, approved_by overwrite, email template safety

YaoYinYing
and
claude
committed
2122a5d
Improve failed task runner log downloads
YaoYinYing
committed
fece3f8