Skip to content

Beta - #1

Merged
li63050a merged 10 commits into
mainfrom
beta
Oct 1, 2026
Merged

li63050a merged 10 commits into
mainfrom
beta

Conversation

@li63050a

@li63050a li63050a commented Oct 1, 2026

Copy link
Copy Markdown
Contributor

全面更新

… transitions); delete old single-file frontend
…n banner

- web: new /login page + auth layout; 401 and missing-token now route to /login instead of window.prompt; update all pages to drop setToken param

- main: print boxed, easy-to-spot admin token on startup (plaintext by default, LIAPI_MASK_ADMIN_TOKEN=1 to mask)

- rebuild embedded adminui artifact
Admin UI login now uses a username + password (PBKDF2-HMAC-SHA256 salted hash) instead of pasting the admin token. Login issues a short-lived session token; logout invalidates it server-side. The static admin_token remains valid for /metrics and automation. Client API keys for calling models are unchanged.

- common/password.go: PBKDF2 hash/verify + random password (stdlib only, go 1.22 compatible)

- config: admin_username/admin_password_hash fields; seed random credentials on first run

- auth: Login/Logout + in-memory session store; Authenticate accepts session or admin token

- server: POST /admin/api/login|logout, GET /admin/api/me; mask/restore password hash in config round-trip

- web: login page username+password; useApi login()/logout(); rebuild server/adminui

- docs: sync DEVELOPMENT.md and README.md
@li63050a
li63050a merged commit 9ad8927 into main Oct 1, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants