From b99e7ddf38233120ea19485968c12c5548e7fa61 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 7 Nov 2026 22:35:22 +0100 Subject: auth: a login page and browser sessions GET /login without authentication: log in by password or with a token (from a login by key). POST/DELETE /auth/session keep the token as an HttpOnly, SameSite=Strict cookie; the dashboard sends a browser without a user there and renews the session while open. Auth plan M2/M3 (browsers). --- src/api/dashboard/mod.rs | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'src/api/dashboard/mod.rs') diff --git a/src/api/dashboard/mod.rs b/src/api/dashboard/mod.rs index 9cb4ea4..24fdacb 100644 --- a/src/api/dashboard/mod.rs +++ b/src/api/dashboard/mod.rs @@ -602,6 +602,13 @@ fn page() -> &'static (String, String) { }) } +/// `GET /login`: a page to log in on, by password or with a token, without +/// authentication (it holds nothing): it keeps a session for the browser +/// (`POST /auth/session`) and opens the dashboard. +pub(crate) async fn login_page() -> Html<&'static str> { + Html(include_str!("login.html")) +} + /// `GET /admin/dashboard`: the page. async fn page_html() -> Html<&'static str> { Html(page().1.as_str()) -- cgit v1.3.1