Add phase 1: Docker setup, auth with invitations and roles
- Django 5.2 + PostgreSQL 17 via docker compose (app + db, volumes, healthcheck on /healthz, test profile running pytest against Postgres) - Custom e-mail user model with user/admin roles - Invitation-only registration with single-use, hashed, expiring links - Admin area: invitations, role changes, deactivation, password reset via one-time link or temporary password (forced change on login) - First admin created from ADMIN_EMAIL/ADMIN_PASSWORD on startup - Login rate limiting per e-mail and IP (DB-backed, worker-safe) - Proxy middleware honouring X-Forwarded-* only from TRUSTED_PROXIES, optional CLIENT_IP_HEADER (e.g. CF-Connecting-IP) - Security headers (CSP, HSTS, Permissions-Policy), secure __Host- cookies - Mobile-first German UI, CLAUDE.md, README, init-env script - 65 tests for auth, permissions, proxy handling and rate limiting Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
Kyle Dammann
@@ -0,0 +1,35 @@
|
||||
{% extends "base.html" %}
|
||||
{% block title %}Einladungen{% endblock %}
|
||||
{% block content %}
|
||||
<h1>Einladungen</h1>
|
||||
<form method="post" class="card" novalidate>
|
||||
{% csrf_token %}
|
||||
<h2>Neue Einladung</h2>
|
||||
{% include "form_fields.html" %}
|
||||
<button type="submit" class="button">Einladungslink erzeugen</button>
|
||||
</form>
|
||||
|
||||
<h2>Bisherige Einladungen</h2>
|
||||
{% if invitations %}
|
||||
<ul class="list">
|
||||
{% for inv in invitations %}
|
||||
<li class="card">
|
||||
<div class="row-head">
|
||||
<strong>{{ inv.note|default:inv.email|default:"Einladung" }}</strong>
|
||||
<span class="badge{% if inv.status != 'open' %} badge-muted{% endif %}">{{ inv.status_label }}</span>
|
||||
<span class="badge badge-muted">{{ inv.get_role_display }}</span>
|
||||
</div>
|
||||
<div class="muted">
|
||||
{% if inv.email %}{{ inv.email }} · {% endif %}erstellt {{ inv.created_at|date:"d.m.Y" }}
|
||||
{% if inv.used_by %} · verwendet von {{ inv.used_by.display_name }}{% else %} · gültig bis {{ inv.expires_at|date:"d.m.Y H:i" }}{% endif %}
|
||||
</div>
|
||||
{% if inv.status == "open" %}
|
||||
<form method="post" action="{% url 'accounts:admin_invitation_revoke' inv.pk %}">{% csrf_token %}<button class="button danger small">Widerrufen</button></form>
|
||||
{% endif %}
|
||||
</li>
|
||||
{% endfor %}
|
||||
</ul>
|
||||
{% else %}
|
||||
<p class="muted">Noch keine Einladungen.</p>
|
||||
{% endif %}
|
||||
{% endblock %}
|
||||
@@ -0,0 +1,16 @@
|
||||
{% extends "base.html" %}
|
||||
{% block title %}{{ title }}{% endblock %}
|
||||
{% block content %}
|
||||
<div class="narrow">
|
||||
<h1>{{ title }}</h1>
|
||||
<div class="card">
|
||||
<label for="secret-value">Nur jetzt sichtbar – bitte kopieren:</label>
|
||||
<div class="copyrow">
|
||||
<input id="secret-value" type="text" value="{{ value }}" readonly>
|
||||
<button type="button" class="button" data-copy="#secret-value">Kopieren</button>
|
||||
</div>
|
||||
<p class="muted">{{ hint }}</p>
|
||||
</div>
|
||||
<p><a href="{% url 'accounts:admin_users' %}">Zurück zur Nutzerverwaltung</a> · <a href="{% url 'accounts:admin_invitations' %}">Einladungen</a></p>
|
||||
</div>
|
||||
{% endblock %}
|
||||
@@ -0,0 +1,38 @@
|
||||
{% extends "base.html" %}
|
||||
{% block title %}Nutzer verwalten{% endblock %}
|
||||
{% block content %}
|
||||
<h1>Nutzer</h1>
|
||||
<p><a class="button" href="{% url 'accounts:admin_invitations' %}">Neue Einladung</a></p>
|
||||
<ul class="list">
|
||||
{% for u in users %}
|
||||
<li class="card{% if not u.is_active %} inactive{% endif %}">
|
||||
<div class="row-head">
|
||||
<strong>{{ u.display_name }}</strong>
|
||||
<span class="badge">{{ u.get_role_display }}</span>
|
||||
{% if not u.is_active %}<span class="badge badge-muted">deaktiviert</span>{% endif %}
|
||||
{% if u.must_change_password %}<span class="badge badge-muted">temp. Passwort</span>{% endif %}
|
||||
</div>
|
||||
<div class="muted">{{ u.email }} · seit {{ u.date_joined|date:"d.m.Y" }}</div>
|
||||
<details class="actions">
|
||||
<summary>Aktionen</summary>
|
||||
<div class="action-buttons">
|
||||
{% if u.is_active %}
|
||||
<form method="post" action="{% url 'accounts:admin_user_action' u.pk 'reset_link' %}">{% csrf_token %}<button class="button secondary">Reset-Link erzeugen</button></form>
|
||||
<form method="post" action="{% url 'accounts:admin_user_action' u.pk 'temp_password' %}">{% csrf_token %}<button class="button secondary">Temporäres Passwort</button></form>
|
||||
{% if u != user %}
|
||||
{% if u.role == "admin" %}
|
||||
<form method="post" action="{% url 'accounts:admin_user_action' u.pk 'make_user' %}">{% csrf_token %}<button class="button secondary">Zu Nutzer machen</button></form>
|
||||
{% else %}
|
||||
<form method="post" action="{% url 'accounts:admin_user_action' u.pk 'make_admin' %}">{% csrf_token %}<button class="button secondary">Zu Admin machen</button></form>
|
||||
{% endif %}
|
||||
<form method="post" action="{% url 'accounts:admin_user_action' u.pk 'deactivate' %}">{% csrf_token %}<button class="button danger">Deaktivieren</button></form>
|
||||
{% endif %}
|
||||
{% else %}
|
||||
<form method="post" action="{% url 'accounts:admin_user_action' u.pk 'activate' %}">{% csrf_token %}<button class="button secondary">Aktivieren</button></form>
|
||||
{% endif %}
|
||||
</div>
|
||||
</details>
|
||||
</li>
|
||||
{% endfor %}
|
||||
</ul>
|
||||
{% endblock %}
|
||||
@@ -0,0 +1,12 @@
|
||||
{% extends "base.html" %}
|
||||
{% block title %}Bereits angemeldet{% endblock %}
|
||||
{% block content %}
|
||||
<div class="narrow">
|
||||
<h1>Du bist bereits angemeldet</h1>
|
||||
<p>Um mit diesem Einladungslink ein neues Konto anzulegen, melde dich zuerst ab. Der Link bleibt gültig.</p>
|
||||
<form method="post" action="{% url 'accounts:logout' %}">
|
||||
{% csrf_token %}
|
||||
<button type="submit" class="button">Abmelden</button>
|
||||
</form>
|
||||
</div>
|
||||
{% endblock %}
|
||||
@@ -0,0 +1,9 @@
|
||||
{% extends "base.html" %}
|
||||
{% block title %}Link ungültig{% endblock %}
|
||||
{% block content %}
|
||||
<div class="narrow">
|
||||
<h1>Link ungültig</h1>
|
||||
<p>Dieser {{ kind }} ist ungültig, abgelaufen oder wurde bereits verwendet. Bitte frag beim Admin nach einem neuen Link.</p>
|
||||
<p><a href="{% url 'accounts:login' %}">Zur Anmeldung</a></p>
|
||||
</div>
|
||||
{% endblock %}
|
||||
@@ -0,0 +1,14 @@
|
||||
{% extends "base.html" %}
|
||||
{% block title %}Anmelden{% endblock %}
|
||||
{% block content %}
|
||||
<div class="narrow">
|
||||
<h1>Anmelden</h1>
|
||||
<form method="post" class="card" novalidate>
|
||||
{% csrf_token %}
|
||||
{% include "form_fields.html" %}
|
||||
<input type="hidden" name="next" value="{{ next }}">
|
||||
<button type="submit" class="button wide">Anmelden</button>
|
||||
</form>
|
||||
<p class="muted">Kein Konto? Die Registrierung ist nur mit einer Einladung möglich. Passwort vergessen? Bitte wende dich an den Admin.</p>
|
||||
</div>
|
||||
{% endblock %}
|
||||
@@ -0,0 +1,13 @@
|
||||
{% extends "base.html" %}
|
||||
{% block title %}Passwort ändern{% endblock %}
|
||||
{% block content %}
|
||||
<div class="narrow">
|
||||
<h1>Passwort ändern</h1>
|
||||
{% if forced %}<p class="msg msg-warning">Du hast ein temporäres Passwort erhalten. Bitte lege jetzt ein eigenes fest.</p>{% endif %}
|
||||
<form method="post" class="card" novalidate>
|
||||
{% csrf_token %}
|
||||
{% include "form_fields.html" %}
|
||||
<button type="submit" class="button wide">Passwort speichern</button>
|
||||
</form>
|
||||
</div>
|
||||
{% endblock %}
|
||||
@@ -0,0 +1,13 @@
|
||||
{% extends "base.html" %}
|
||||
{% block title %}Passwort zurücksetzen{% endblock %}
|
||||
{% block content %}
|
||||
<div class="narrow">
|
||||
<h1>Neues Passwort</h1>
|
||||
<p>Lege ein neues Passwort für <strong>{{ reset_user.email }}</strong> fest.</p>
|
||||
<form method="post" class="card" novalidate>
|
||||
{% csrf_token %}
|
||||
{% include "form_fields.html" %}
|
||||
<button type="submit" class="button wide">Passwort speichern</button>
|
||||
</form>
|
||||
</div>
|
||||
{% endblock %}
|
||||
@@ -0,0 +1,14 @@
|
||||
{% extends "base.html" %}
|
||||
{% block title %}Mein Konto{% endblock %}
|
||||
{% block content %}
|
||||
<div class="narrow">
|
||||
<h1>Mein Konto</h1>
|
||||
<p class="muted">{{ user.email }} · {{ user.get_role_display }}</p>
|
||||
<form method="post" class="card" novalidate>
|
||||
{% csrf_token %}
|
||||
{% include "form_fields.html" %}
|
||||
<button type="submit" class="button">Speichern</button>
|
||||
</form>
|
||||
<p><a href="{% url 'accounts:password_change' %}">Passwort ändern</a></p>
|
||||
</div>
|
||||
{% endblock %}
|
||||
@@ -0,0 +1,13 @@
|
||||
{% extends "base.html" %}
|
||||
{% block title %}Registrieren{% endblock %}
|
||||
{% block content %}
|
||||
<div class="narrow">
|
||||
<h1>Konto anlegen</h1>
|
||||
<p>Du wurdest zum Kochbuch eingeladen. Lege jetzt dein Konto an.</p>
|
||||
<form method="post" class="card" novalidate>
|
||||
{% csrf_token %}
|
||||
{% include "form_fields.html" %}
|
||||
<button type="submit" class="button wide">Konto anlegen</button>
|
||||
</form>
|
||||
</div>
|
||||
{% endblock %}
|
||||
@@ -0,0 +1,43 @@
|
||||
{% load static %}<!doctype html>
|
||||
<html lang="de">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
|
||||
<meta name="theme-color" content="#b4532a">
|
||||
<meta name="robots" content="noindex, nofollow">
|
||||
<title>{% block title %}Kochbuch{% endblock %} · Kochbuch</title>
|
||||
<link rel="stylesheet" href="{% static 'css/app.css' %}">
|
||||
<script src="{% static 'js/app.js' %}" defer></script>
|
||||
</head>
|
||||
<body>
|
||||
<header class="topbar">
|
||||
<a class="brand" href="{% url 'core:home' %}">Kochbuch</a>
|
||||
{% if user.is_authenticated %}
|
||||
<details class="menu">
|
||||
<summary aria-label="Menü">☰</summary>
|
||||
<nav>
|
||||
<a href="{% url 'core:home' %}">Rezepte</a>
|
||||
<a href="{% url 'accounts:profile' %}">Mein Konto</a>
|
||||
{% if user.is_admin %}
|
||||
<a href="{% url 'accounts:admin_users' %}">Nutzer verwalten</a>
|
||||
<a href="{% url 'accounts:admin_invitations' %}">Einladungen</a>
|
||||
{% endif %}
|
||||
<form method="post" action="{% url 'accounts:logout' %}">
|
||||
{% csrf_token %}
|
||||
<button type="submit" class="linklike">Abmelden</button>
|
||||
</form>
|
||||
</nav>
|
||||
</details>
|
||||
{% endif %}
|
||||
</header>
|
||||
|
||||
<main class="container">
|
||||
{% if messages %}
|
||||
<ul class="messages">
|
||||
{% for message in messages %}<li class="msg msg-{{ message.tags }}">{{ message }}</li>{% endfor %}
|
||||
</ul>
|
||||
{% endif %}
|
||||
{% block content %}{% endblock %}
|
||||
</main>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,11 @@
|
||||
{% extends "base.html" %}
|
||||
{% block title %}Rezepte{% endblock %}
|
||||
{% block content %}
|
||||
<h1>Hallo {{ user.display_name }}!</h1>
|
||||
<div class="card">
|
||||
<p>Hier entstehen bald die Rezepte. Konto, Einladungen und Rollen sind bereits eingerichtet.</p>
|
||||
{% if user.is_admin %}
|
||||
<p><a class="button" href="{% url 'accounts:admin_invitations' %}">Jemanden einladen</a></p>
|
||||
{% endif %}
|
||||
</div>
|
||||
{% endblock %}
|
||||
@@ -0,0 +1,7 @@
|
||||
{% extends "base.html" %}
|
||||
{% block title %}Kein Zugriff{% endblock %}
|
||||
{% block content %}
|
||||
<h1>Kein Zugriff</h1>
|
||||
<p>Dafür fehlen dir die Berechtigungen.</p>
|
||||
<p><a href="{% url 'core:home' %}">Zur Startseite</a></p>
|
||||
{% endblock %}
|
||||
@@ -0,0 +1,7 @@
|
||||
{% extends "base.html" %}
|
||||
{% block title %}Nicht gefunden{% endblock %}
|
||||
{% block content %}
|
||||
<h1>Nicht gefunden</h1>
|
||||
<p>Diese Seite gibt es nicht oder du hast keinen Zugriff darauf.</p>
|
||||
<p><a href="{% url 'core:home' %}">Zur Startseite</a></p>
|
||||
{% endblock %}
|
||||
@@ -0,0 +1,12 @@
|
||||
{% if form.non_field_errors %}
|
||||
<div class="msg msg-error" role="alert">{% for e in form.non_field_errors %}{{ e }}{% if not forloop.last %}<br>{% endif %}{% endfor %}</div>
|
||||
{% endif %}
|
||||
{% for field in form.visible_fields %}
|
||||
<div class="field{% if field.errors %} has-error{% endif %}">
|
||||
<label for="{{ field.id_for_label }}">{{ field.label }}</label>
|
||||
{{ field }}
|
||||
{% if field.help_text %}<small class="help">{{ field.help_text }}</small>{% endif %}
|
||||
{% for e in field.errors %}<small class="error">{{ e }}</small>{% endfor %}
|
||||
</div>
|
||||
{% endfor %}
|
||||
{% for field in form.hidden_fields %}{{ field }}{% endfor %}
|
||||
Reference in New Issue
Block a user