2 Commits

Author	SHA1	Message	Date
Ariel AI	c0ff87ea10	feat(cp): add optional access-key login for Control Plane (#1530) ... Add HINDSIGHT_CP_ACCESS_KEY env var to enable a lightweight shared-secret authentication gate for the Control Plane UI. Features: - Login page at /login with access key input form - /api/auth/login endpoint validates key and sets HttpOnly session cookie - /api/auth/logout endpoint clears session cookie - Middleware protects all routes except /login, /api/auth/*, /api/health, /api/version, static assets, and _next - returnTo query param preserves redirect after login - Constant-time comparison for access key to prevent timing attacks - Logout button in sidebar (when a bank is selected) and dashboard header - Updated .env.example and docker-compose docs Security: - HttpOnly, SameSite=lax, Secure (production only) cookie - 24-hour session lifetime - Constant-time string comparison to prevent timing attacks	2026-05-08 09:37:30 +02:00
Nicolò Boschi	93ddd41621	feat: add reverse proxy support (#346) ... * feat: add reverse proxy support * improve * improve * improve * improve * improve * fix: update integration test to use modern 'docker compose' command - Replace 'docker-compose' with 'docker compose' (Docker Compose v2+) - Add fallback to legacy docker-compose command for compatibility - Fixes test failures on systems using Docker Compose plugin * ci: trigger test rerun * fix: make docker-compose detection more robust for CI - Add get_docker_compose_command() to detect available command - Use shutil.which() to check command availability - Dynamically use correct command (docker compose vs docker-compose) - Should work in both modern and legacy Docker environments * fix: docker-compose networking in base path integration test Fix connection refused error in test_reverse_proxy_simple_config by handling host vs bridge networking modes correctly: - Linux (host mode): nginx listens on 18080 directly, no port mapping - Mac/Windows (bridge mode): nginx listens on 80, mapped to 18080 With host networking, port mappings in docker-compose don't work since the container binds directly to the host's network namespace.	2026-02-12 10:09:53 +01:00