ChuckandClaude Opus 5.5 e3c85cece6 feat(web): optional web login and API tokens, off by default (stacked on #674) (#683) ...

Optional web login, off by default: a device that sets no password behaves
exactly as before. Set under General > Security; then every page and API
route needs a session login or an API token (Authorization: Bearer).
Loopback, the Wi-Fi setup flow in AP mode, static files, captive-portal
probes and a reduced /api/v3/health stay open. Secrets live in the web_auth
section of config_secrets.json and no API returns them.
scripts/reset_web_password.py turns login off. Stacked on #674.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-09-30 09:09:40 -04:00

..

partials

feat(web): optional web login and API tokens, off by default (stacked on #674) (#683)

2026-09-30 09:09:40 -04:00

base.html

feat(web): optional web login and API tokens, off by default (stacked on #674) (#683)

2026-09-30 09:09:40 -04:00

captive_setup.html

fix(wifi): make Connect work from the setup AP (#571)

2026-09-14 12:40:41 -04:00

login.html

feat(web): optional web login and API tokens, off by default (stacked on #674) (#683)

2026-09-30 09:09:40 -04:00