1b835c3a3e
Implemented optional authentication to keep strangers out of the Claude OS frontend when deployed to production servers. Backend (FastAPI): - mcp_server/auth.py: JWT-based authentication * Bcrypt password hashing * Environment-based user credentials (no database needed) * 7-day token expiration * Optional - disabled by default - mcp_server/server.py: Auth endpoints * POST /api/auth/login - Returns JWT token * GET /api/auth/me - Get current user * GET /api/auth/status - Check if auth enabled - requirements.txt: Added dependencies * passlib[bcrypt] for password hashing * python-jose[cryptography] for JWT * python-multipart for form data Frontend (React): - frontend/src/lib/auth.tsx: Auth context and hooks * Manages authentication state * Automatic token validation * localStorage for token persistence - frontend/src/pages/Login.tsx: Beautiful login page * Gradient design matching Claude OS branding * Clear error messages * Loading states - frontend/src/components/ProtectedRoute.tsx: Route protection * Automatically redirects to login if not authenticated * Shows loading state during auth check * Bypasses auth if disabled - frontend/src/App.tsx: Integrated auth * Wrapped app in AuthProvider * Protected routes for Welcome and MainApp * Login route for authentication Documentation: - AUTH_SETUP.md: Complete authentication guide * Quick start instructions * Password hash generation * Production deployment steps * Troubleshooting guide - .env.example: Added auth configuration * CLAUDE_OS_EMAIL (login email) * CLAUDE_OS_PASSWORD (dev - plain text) * CLAUDE_OS_PASSWORD_HASH (production - bcrypt hash) * CLAUDE_OS_SECRET_KEY (JWT secret) - docs/PRODUCTION_DEPLOYMENT.md: Added Step 5 * Authentication setup for production * Hash and secret generation commands * Testing instructions Features: ✅ Optional authentication (disabled by default) ✅ Single user via environment variables ✅ Secure bcrypt hashing ✅ JWT tokens with 7-day expiration ✅ Beautiful login UI ✅ No database required for user management Usage: 1. Set CLAUDE_OS_EMAIL and CLAUDE_OS_PASSWORD in .env 2. Restart Claude OS 3. Visit /login to authenticate 4. Token valid for 7 days To disable auth: Remove CLAUDE_OS_EMAIL from .env 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
43 lines
1.4 KiB
Text
43 lines
1.4 KiB
Text
# ============================================================================
|
|
# Authentication (Optional - Leave empty to disable auth)
|
|
# ============================================================================
|
|
|
|
# Login email (required to enable auth)
|
|
CLAUDE_OS_EMAIL=admin@example.com
|
|
|
|
# Option 1: Plain password (development only - auto-hashed)
|
|
CLAUDE_OS_PASSWORD=your_secure_password_here
|
|
|
|
# Option 2: Pre-hashed password (production - recommended)
|
|
# Generate: python3 -c "from passlib.context import CryptContext; print(CryptContext(schemes=['bcrypt']).hash('your_password'))"
|
|
# CLAUDE_OS_PASSWORD_HASH=$2b$12$xyz...
|
|
|
|
# JWT secret key (auto-generated if not set)
|
|
# Generate: python3 -c "import secrets; print(secrets.token_urlsafe(32))"
|
|
# CLAUDE_OS_SECRET_KEY=your-super-secret-key-min-32-chars
|
|
|
|
# ============================================================================
|
|
# Ollama Configuration
|
|
# ============================================================================
|
|
|
|
OLLAMA_HOST=http://localhost:11434
|
|
OLLAMA_MODEL=llama3.1:latest
|
|
OLLAMA_EMBED_MODEL=nomic-embed-text
|
|
|
|
# SQLite Database
|
|
SQLITE_DB_PATH=data/claude-os.db
|
|
|
|
# MCP Server Configuration
|
|
MCP_SERVER_HOST=0.0.0.0
|
|
MCP_SERVER_PORT=8051
|
|
|
|
# RAG Configuration
|
|
CHUNK_SIZE=1536
|
|
CHUNK_OVERLAP=256
|
|
TOP_K_RETRIEVAL=20
|
|
RERANK_TOP_N=10
|
|
|
|
# KB Type Configuration
|
|
# Default type for new knowledge bases: generic, code, documentation, agent-os
|
|
DEFAULT_KB_TYPE=generic
|
|
|