a9bbb668b5
Replaces nginx basic auth with a proper per-user session system:
- auth_utils.py: bcrypt password hashing, JWT cookie creation/decode
- auth_middleware.py: validates JWT cookie on all routes except /login,
/health, /static/, and webhook endpoints (/channels/, /webhook/)
- routers/ui.py: GET /login, POST /login, POST /logout,
GET /{username}/{persona} — serves index.html with CORTEX_CONFIG injected
- static/login.html: minimal login form (dark theme, matches UI)
- main.py: registers SessionAuthMiddleware + ui.router
- config.py: jwt_secret, jwt_expire_days settings
- manage_passwords.py: CLI tool to set/check/list user passwords
- app.js: reads window.CORTEX_CONFIG (user + persona), sends both on
every /chat and /orchestrate request; persona name shown in header;
logout button (⏏) added to header
- requirements.txt: bcrypt, PyJWT, python-multipart
- .env.default: JWT_SECRET, JWT_EXPIRE_DAYS documented
- tests: client fixture injects JWT cookie; security test assertions
updated for URL-normalized path traversal paths (still secure, codes differ)
All 80 tests pass.
Setup for a new user:
python manage_passwords.py set scott
python manage_passwords.py set holly
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
79 lines
4.1 KiB
Plaintext
79 lines
4.1 KiB
Plaintext
# Cortex .env reference — copy to .env and fill in values
|
|
# DO NOT commit .env — it contains secrets
|
|
|
|
# ── Agent identity ───────────────────────────────────────────────────────────
|
|
# Global display names used in distillation prompts and session logs.
|
|
# Individual persona identities live in home/{username}/persona/{name}/IDENTITY.md
|
|
AGENT_NAME=Inara
|
|
USER_NAME=Scott
|
|
|
|
# ── Home directory ────────────────────────────────────────────────────────────
|
|
# Root for all user/persona data. Layout: home/{username}/persona/{name}/
|
|
# Relative paths are resolved from the cortex/ directory.
|
|
# Default: ../home (i.e. Cortex_and_Inara_dev/home/)
|
|
# HOME_DIR=../home
|
|
|
|
# ── Session auth ─────────────────────────────────────────────────────────────
|
|
# Generate with: python3 -c "import secrets; print(secrets.token_hex(32))"
|
|
JWT_SECRET=change-me-in-dotenv
|
|
JWT_EXPIRE_DAYS=30
|
|
|
|
# ── Server ──────────────────────────────────────────────────────────────────
|
|
HOST=0.0.0.0
|
|
PORT=8000
|
|
|
|
# ── Google Chat bot ──────────────────────────────────────────────────────────
|
|
# JWT audience for verifying inbound Workspace Add-on Chat webhook requests.
|
|
# For Workspace Add-on Chat apps, the aud claim = the endpoint URL.
|
|
# Leave blank to disable verification (dev/testing only).
|
|
GOOGLE_CHAT_AUDIENCE=https://cortex.dgrzone.com/channels/google-chat
|
|
|
|
# ── Nextcloud Talk bot ───────────────────────────────────────────────────────
|
|
NEXTCLOUD_URL=https://cloud.dgrzone.com
|
|
NEXTCLOUD_TALK_BOT_SECRET=
|
|
|
|
# ── LLM backends ────────────────────────────────────────────────────────────
|
|
# Primary backend: "claude" or "gemini" (other is always fallback)
|
|
PRIMARY_BACKEND=claude
|
|
|
|
# Timeouts in seconds
|
|
TIMEOUT_CLAUDE=60
|
|
TIMEOUT_GEMINI=120
|
|
|
|
# ── Orchestrator (Gemini API — not Gemini CLI) ───────────────────────────────
|
|
# Required for /orchestrate endpoint and tool use
|
|
# Free tier key: https://aistudio.google.com/apikey
|
|
GEMINI_API_KEY=
|
|
|
|
# Model for the orchestration tool loop (not the user-facing response)
|
|
ORCHESTRATOR_MODEL=gemini-2.5-flash
|
|
|
|
# Safety cap on tool loop iterations
|
|
ORCHESTRATOR_MAX_ROUNDS=10
|
|
|
|
# ── DuckDuckGo search ────────────────────────────────────────────────────────
|
|
# Leave blank for free unauthenticated tier
|
|
# Set to your API key for higher rate limits (paid DuckDuckGo account)
|
|
DDG_API_KEY=
|
|
DDG_MAX_RESULTS=5
|
|
|
|
# ── Aether Platform API ───────────────────────────────────────────────────────
|
|
# Used by orchestrator tools: ae_journal_search, ae_journal_entry_create, ae_task_list
|
|
# Same values as agents_sync/mcp/.env — copy from there
|
|
AE_API_URL=https://dev-api.oneskyit.com
|
|
AE_API_KEY=
|
|
AE_ACCOUNT_ID=
|
|
AE_API_TIMEOUT=15
|
|
|
|
# ── Distillation schedule ────────────────────────────────────────────────────
|
|
SCHEDULER_TIMEZONE=America/New_York
|
|
AUTO_DISTILL=true
|
|
AUTO_DISTILL_SHORT=true
|
|
AUTO_DISTILL_MID=true
|
|
AUTO_DISTILL_LONG=false # manual review recommended before enabling
|
|
|
|
# Memory tier token budgets (soft caps)
|
|
MEMORY_BUDGET_SHORT=3000
|
|
MEMORY_BUDGET_MID=2000
|
|
MEMORY_BUDGET_LONG=2000
|