Add user identity, JWT auth, and admin console UI (#23)

mirror of https://github.com/turnstonelabs/turnstone.git synced 2026-08-12 23:12:23 -06:00

* Add user identity, JWT auth, and admin console UI (#23)

JWT-based authentication with three token types: config-file (hmac,
backward-compat), API tokens (ts_ prefix, SHA-256 hashed), and JWTs
(HS256, 24h expiry). Username:password login via bcrypt. Hierarchical
scopes: read < write < approve.

New tables: users (username, password_hash), api_tokens (token_hash,
scopes, expires), channel_users (future channel integrations). user_id
column added to sessions and workstreams for attribution.

Console owns admin CRUD (6 endpoints under /api/admin/). Server
validates JWTs locally with shared signing secret. Public /api/auth/setup
endpoint for first-time admin creation (atomic, only works with zero
users). turnstone-admin CLI for user/token management.

Admin console UI: Users and Tokens tabs with full CRUD modals, scope
badges, token show-once with clipboard copy, keyboard accessibility
(focus traps, Escape, arrow key tabs, ARIA roles).

Login UI redesigned: username:password primary, token toggle for legacy,
setup wizard auto-detected via /api/auth/status. Python + TypeScript
SDKs updated with login(username, password), authStatus(), setup().

New docs/security.md + diagram 15-auth-architecture.puml. All existing
docs updated. OpenAPI specs include all new endpoints. 64 new tests
(1023 total). Dependencies: PyJWT, bcrypt.

* Fix auth bugs, XSS vector, and doc inaccuracies from PR #23 review

Address Copilot review feedback: escape double quotes in escapeHtml()
to prevent XSS in HTML attributes, add JWT validation fallback so
config tokens containing dots still work, add user_id to
AuthLoginResponse schema, return created field from admin_create_user,
and correct five documentation files to match actual API behavior.

This commit is contained in:

Patrick Buckley

2026-03-04 09:12:18 -08:00

committed by

GitHub

parent 0fd0ad3b2d

commit 047680d669

42 changed files with 5024 additions and 253 deletions

									
										.env.example
									
		+1
		
												View File
												
				@@ -22,6 +22,7 @@ OPENAI_API_KEY=sk-...

				# -- Authentication ------------------------------------------------------------

				# TURNSTONE_AUTH_ENABLED=true

				# TURNSTONE_AUTH_TOKEN=your-secret-token

				# TURNSTONE_JWT_SECRET=python -c "import secrets; print(secrets.token_hex(32))"

				# -- Ports ---------------------------------------------------------------------

				# SERVER_PORT=8080