Two gaps found while wiring auth into the data routes:
1. mcp_server/auth.py: HTTPBearer() defaults to auto_error=True, which
rejects any request with no Authorization header before
get_current_user's own "auth not configured -> allow as guest"
check ever runs. That meant turning on Depends(get_current_user)
anywhere 401'd every request even with auth fully disabled.
Switched to auto_error=False and handle the missing-credentials
case explicitly inside get_current_user instead.
2. Frontend never actually sent the stored token on data requests.
auth.tsx only attached it to its own /api/auth/me check; api.ts's
fetch() calls (chat, stats, documents, upload, delete) and every
axios call elsewhere in the app (projects, kanban, hooks) had no
Authorization header at all. Added an authHeaders() helper in
api.ts, and a single axios request interceptor in auth.tsx that
attaches the token app-wide since every component imports the same
default axios instance.
Known gap not addressed here: mcp_server/claude_code_mcp.py (the
code-forge stdio MCP server) calls the REST API with no token at all.
Harmless while auth is disabled (current state), but it will start
getting 401'd the moment CLAUDE_OS_EMAIL/PASSWORD are actually set -
needs a service-token bypass if that's ever turned on.
Implemented optional authentication to keep strangers out of the
Claude OS frontend when deployed to production servers.
Backend (FastAPI):
- mcp_server/auth.py: JWT-based authentication
* Bcrypt password hashing
* Environment-based user credentials (no database needed)
* 7-day token expiration
* Optional - disabled by default
- mcp_server/server.py: Auth endpoints
* POST /api/auth/login - Returns JWT token
* GET /api/auth/me - Get current user
* GET /api/auth/status - Check if auth enabled
- requirements.txt: Added dependencies
* passlib[bcrypt] for password hashing
* python-jose[cryptography] for JWT
* python-multipart for form data
Frontend (React):
- frontend/src/lib/auth.tsx: Auth context and hooks
* Manages authentication state
* Automatic token validation
* localStorage for token persistence
- frontend/src/pages/Login.tsx: Beautiful login page
* Gradient design matching Claude OS branding
* Clear error messages
* Loading states
- frontend/src/components/ProtectedRoute.tsx: Route protection
* Automatically redirects to login if not authenticated
* Shows loading state during auth check
* Bypasses auth if disabled
- frontend/src/App.tsx: Integrated auth
* Wrapped app in AuthProvider
* Protected routes for Welcome and MainApp
* Login route for authentication
Documentation:
- AUTH_SETUP.md: Complete authentication guide
* Quick start instructions
* Password hash generation
* Production deployment steps
* Troubleshooting guide
- .env.example: Added auth configuration
* CLAUDE_OS_EMAIL (login email)
* CLAUDE_OS_PASSWORD (dev - plain text)
* CLAUDE_OS_PASSWORD_HASH (production - bcrypt hash)
* CLAUDE_OS_SECRET_KEY (JWT secret)
- docs/PRODUCTION_DEPLOYMENT.md: Added Step 5
* Authentication setup for production
* Hash and secret generation commands
* Testing instructions
Features:
✅ Optional authentication (disabled by default)
✅ Single user via environment variables
✅ Secure bcrypt hashing
✅ JWT tokens with 7-day expiration
✅ Beautiful login UI
✅ No database required for user management
Usage:
1. Set CLAUDE_OS_EMAIL and CLAUDE_OS_PASSWORD in .env
2. Restart Claude OS
3. Visit /login to authenticate
4. Token valid for 7 days
To disable auth: Remove CLAUDE_OS_EMAIL from .env
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
