Scott Idem a9bbb668b5 feat: session auth + per-user/persona UI at /{user}/{persona} ...

Replaces nginx basic auth with a proper per-user session system:

- auth_utils.py: bcrypt password hashing, JWT cookie creation/decode
- auth_middleware.py: validates JWT cookie on all routes except /login,
  /health, /static/, and webhook endpoints (/channels/, /webhook/)
- routers/ui.py: GET /login, POST /login, POST /logout,
  GET /{username}/{persona} — serves index.html with CORTEX_CONFIG injected
- static/login.html: minimal login form (dark theme, matches UI)
- main.py: registers SessionAuthMiddleware + ui.router
- config.py: jwt_secret, jwt_expire_days settings
- manage_passwords.py: CLI tool to set/check/list user passwords
- app.js: reads window.CORTEX_CONFIG (user + persona), sends both on
  every /chat and /orchestrate request; persona name shown in header;
  logout button (⏏) added to header
- requirements.txt: bcrypt, PyJWT, python-multipart
- .env.default: JWT_SECRET, JWT_EXPIRE_DAYS documented
- tests: client fixture injects JWT cookie; security test assertions
  updated for URL-normalized path traversal paths (still secure, codes differ)

All 80 tests pass.

Setup for a new user:
  python manage_passwords.py set scott
  python manage_passwords.py set holly

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-03-20 22:54:12 -04:00

..

routers

feat: session auth + per-user/persona UI at /{user}/{persona}

2026-03-20 22:54:12 -04:00

static

feat: session auth + per-user/persona UI at /{user}/{persona}

2026-03-20 22:54:12 -04:00

tests

feat: session auth + per-user/persona UI at /{user}/{persona}

2026-03-20 22:54:12 -04:00

tools

feat: multi-user/multi-persona support with two-level home directory layout

2026-03-20 22:35:40 -04:00

.dockerignore

Initial commit — Cortex API + Inara identity

2026-03-06 03:41:00 -05:00

.env.example

Initial commit — Cortex API + Inara identity

2026-03-06 03:41:00 -05:00

.env.holly

feat: multi-instance support — agent_name and user_name configurable

2026-03-18 20:13:11 -04:00

auth_middleware.py

feat: session auth + per-user/persona UI at /{user}/{persona}

2026-03-20 22:54:12 -04:00

auth_utils.py

feat: session auth + per-user/persona UI at /{user}/{persona}

2026-03-20 22:54:12 -04:00

config.py

feat: session auth + per-user/persona UI at /{user}/{persona}

2026-03-20 22:54:12 -04:00

context_loader.py

feat: multi-persona support (single Cortex, multiple users)

2026-03-20 21:50:02 -04:00

cortex.service

Add edit/delete history, named sessions, scroll fix, systemd service

2026-03-10 23:38:39 -04:00

cron_runner.py

feat: multi-user/multi-persona support with two-level home directory layout

2026-03-20 22:35:40 -04:00

Dockerfile

Initial commit — Cortex API + Inara identity

2026-03-06 03:41:00 -05:00

event_bus.py

Add SSE real-time Talk activity, file editor UI, and identity file API

2026-03-17 21:10:07 -04:00

llm_client.py

feat: multi-instance support — agent_name and user_name configurable

2026-03-18 20:13:11 -04:00

main.py

feat: session auth + per-user/persona UI at /{user}/{persona}

2026-03-20 22:54:12 -04:00

manage_passwords.py

feat: session auth + per-user/persona UI at /{user}/{persona}

2026-03-20 22:54:12 -04:00

memory_distiller.py

feat: multi-user/multi-persona support with two-level home directory layout

2026-03-20 22:35:40 -04:00

orchestrator_engine.py

feat: Intelligence Layer Phase 1 — orchestrator service

2026-03-18 19:37:49 -04:00

persona.py

feat: multi-user/multi-persona support with two-level home directory layout

2026-03-20 22:35:40 -04:00

pytest.ini

test: add Cortex test suite (77 tests, no LLM calls)

2026-03-20 22:03:42 -04:00

requirements.txt

feat: session auth + per-user/persona UI at /{user}/{persona}

2026-03-20 22:54:12 -04:00

scheduler.py

feat: multi-user/multi-persona support with two-level home directory layout

2026-03-20 22:35:40 -04:00

session_logger.py

feat: multi-persona support (single Cortex, multiple users)

2026-03-20 21:50:02 -04:00

session_store.py

feat: session delete + touch-friendly message controls

2026-03-18 19:43:20 -04:00