mirror of
https://github.com/turnstonelabs/turnstone.git
synced 2026-08-12 23:12:23 -06:00
Patrick Buckley
047680d669
* Add user identity, JWT auth, and admin console UI (#23) JWT-based authentication with three token types: config-file (hmac, backward-compat), API tokens (ts_ prefix, SHA-256 hashed), and JWTs (HS256, 24h expiry). Username:password login via bcrypt. Hierarchical scopes: read < write < approve. New tables: users (username, password_hash), api_tokens (token_hash, scopes, expires), channel_users (future channel integrations). user_id column added to sessions and workstreams for attribution. Console owns admin CRUD (6 endpoints under /api/admin/). Server validates JWTs locally with shared signing secret. Public /api/auth/setup endpoint for first-time admin creation (atomic, only works with zero users). turnstone-admin CLI for user/token management. Admin console UI: Users and Tokens tabs with full CRUD modals, scope badges, token show-once with clipboard copy, keyboard accessibility (focus traps, Escape, arrow key tabs, ARIA roles). Login UI redesigned: username:password primary, token toggle for legacy, setup wizard auto-detected via /api/auth/status. Python + TypeScript SDKs updated with login(username, password), authStatus(), setup(). New docs/security.md + diagram 15-auth-architecture.puml. All existing docs updated. OpenAPI specs include all new endpoints. 64 new tests (1023 total). Dependencies: PyJWT, bcrypt. * Fix auth bugs, XSS vector, and doc inaccuracies from PR #23 review Address Copilot review feedback: escape double quotes in escapeHtml() to prevent XSS in HTML attributes, add JWT validation fallback so config tokens containing dots still work, add user_id to AuthLoginResponse schema, return created field from admin_create_user, and correct five documentation files to match actual API behavior.
30 lines
1.2 KiB
Bash
30 lines
1.2 KiB
Bash
# =============================================================================
|
|
# Turnstone Environment Variables
|
|
# Copy to .env and adjust values for your deployment
|
|
# =============================================================================
|
|
|
|
# -- LLM Backend --------------------------------------------------------------
|
|
LLM_BASE_URL=http://host.docker.internal:8000/v1
|
|
OPENAI_API_KEY=sk-...
|
|
# ANTHROPIC_API_KEY=sk-ant-... # Set instead for Anthropic provider
|
|
# TAVILY_API_KEY=tvly-... # For web search fallback (local models only)
|
|
|
|
# -- Database (production profile) --------------------------------------------
|
|
# DB_BACKEND=postgresql
|
|
# POSTGRES_USER=turnstone
|
|
# POSTGRES_PASSWORD=changeme
|
|
# DATABASE_URL=postgresql+psycopg://turnstone:changeme@postgres:5432/turnstone
|
|
|
|
# -- Redis ---------------------------------------------------------------------
|
|
# REDIS_PASSWORD=
|
|
# REDIS_PORT=6379
|
|
|
|
# -- Authentication ------------------------------------------------------------
|
|
# TURNSTONE_AUTH_ENABLED=true
|
|
# TURNSTONE_AUTH_TOKEN=your-secret-token
|
|
# TURNSTONE_JWT_SECRET=python -c "import secrets; print(secrets.token_hex(32))"
|
|
|
|
# -- Ports ---------------------------------------------------------------------
|
|
# SERVER_PORT=8080
|
|
# CONSOLE_PORT=8090
|