- New pipekit/web/auth.py: itsdangerous-signed cookie, 8hr expiry,
auto-generates signing secret in settings table on first use
- GET/POST /login and POST /logout routes (public, no auth dependency)
- All other web routes protected via router-level require_web_auth dep
- Starlette middleware injects request.state.current_user for templates
- Topbar shows logged-in username + logout button when session active
- Reuses existing api_user/api_pass credentials and api_auth_enabled flag
- Add itsdangerous>=2.1 to requirements.txt
- Enable api_auth_enabled in config.yaml
Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Paul Trowbridge
31135cf5be