Repository navigation
feat: gate the control panel behind a login session - #1
Open
yixian-huang wants to merge 3 commits into
Open
yixian-huang wants to merge 3 commits into
yixian-huang wants to merge 3 commits into
Conversation
When api_keys is set, / and /panel serve a login form instead of the admin UI. A correct key sets an HttpOnly cookie accepted only on /api/panel/*; the model API still requires Bearer or x-api-key.
LOOMY_PROXY accepts socks5://, http:// and https://. The panel can save that proxy without returning the password, and it takes effect immediately.
refresh_models waits out the upstream timeout, which left the port closed while the model gateway's TLS handshake hung.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
/panelwas a public admin page. Withapi_keysset, the JSON API required a Bearer token, but the page itself still shipped the whole console (add account, passwords, logs) and asked the browser to keep that key inlocalStorage. On a public hostname there is no login gate, and the key is readable by any script on the page.What changed
When
api_keysis non-empty:GET /andGET /panelreturn a login form until a session exists. The admin HTML is not sent.POST /api/panel/loginchecks the same gateway key and sets an HttpOnly,SameSite=Laxcookie. The cookie value is a random session id, not the key. BehindX-Forwarded-Proto: httpsthe cookie is alsoSecure./api/panel/*accepts that cookie or the existing Bearer /x-api-keyheader./v1/*does not accept the panel cookie, so a panel login cannot be used as a model credential.POST /api/panel/logoutrevokes the session. Eight failed logins from one client lock that address out for 60 seconds.accounts.json.With
api_keysempty, the panel stays open. That path is only for localhost./healthis unchanged and still public.Test plan
python3 -m unittest discover -s tests -t .(119 tests)/panelwithapi_keysset and confirm the login form is the only UI/v1/modelswith the panel cookie and confirm 401; the same call withAuthorization: Bearerstill works