Auth + dashboard (HANDOFF2 phases 1-2): guests local-only, system snapshot
Phase 1 — multi-user auth:
- server/auth.py: bcrypt passwords, itsdangerous signed-cookie sessions, sha256
bearer tokens, FastAPI current_user/require_owner deps, login rate limit
- users + api_tokens tables + jobs/assets.user_id (additive migrations)
- HARD RULE enforced server-side: guests are local-only — /api/operators filters
out requires_env operators, POST /api/jobs 403s cloud ops for non-owners (proven
via direct POST in smoke.sh, not just UI). Settings owner-only. auth_secret
hidden from the settings API. Per-user active-job cap (owner exempt). Own-asset/
own-job checks. WS auth via cookie or ?token=. Owner bootstrap prints pw once.
- mb-ready: bearer MB_TOKEN; scripts/users.py for out-of-band management
- Frontend: Login gate, header user chip + logout, guest note, username on jobs,
Users panel in Settings (owner)
Phase 2 — dashboard:
- server/sysinfo.py: psutil CPU/RAM/disk + macmon Apple GPU (util/power/temp, no
sudo), computed lane occupancy, 24h job summary, recent jobs w/ output thumbs;
all cached (5s stats, 5min du). /api/system + /api/jobs/recent.
- Dashboard.jsx: snapshot-on-refresh (no polling) — stat cards, per-core strip,
lane strip, running/queued, recent grid.
tests/smoke.sh rewritten for auth: 28 checks passing incl. all guest-security
rules. Browser-verified owner + guest + dashboard.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
810400fb60