feat(auth): login, roles, user mgmt, setup wizard, and session guard

- New skald-setup crate: interactive first-run wizard that creates the admin user, prompts for encryption choice and password - Auth system: session-based login/logout with cookie, guard middleware - Roles API: CRUD for data-driven roles, seeded on first boot - Users management API: create, list, edit, delete users - Setup state API: check if first admin has been created - Frontend: login-page, setup-page, users-page, roles-page, profile-page components with corresponding CSS - Topbar: avatar dropdown with profile link and logout - Sidebar: nav entries for Users and Roles (admin only) - Page shell CSS: layout support for the new pages - build.sh: builds both skald and skald-setup binaries - run.sh: runs skald-setup before the server loop - CLAUDE.md: updated workspace layout and build/run docs
2026-07-10 19:19:25 +01:00
parent 178a38357e
commit 7dd77d4ef4
36 changed files with 2660 additions and 27 deletions
@@ -0,0 +1,106 @@
+import { html } from 'lit';
+import { LightElement } from '../lib/base.js';
+
+export class LoginPage extends LightElement {
+
+  static get properties() {
+    return {
+      _username: { state: true },
+      _password: { state: true },
+      _error:    { state: true },
+      _busy:     { state: true },
+    };
+  }
+
+  constructor() {
+    super();
+    this._username = '';
+    this._password = '';
+    this._error    = null;
+    this._busy     = false;
+  }
+
+  _submit(e) {
+    e.preventDefault();
+    if (this._busy) return;
+
+    this._error = null;
+
+    if (!this._username.trim() || !this._password) {
+      this._error = 'Enter your username and password.';
+      return;
+    }
+
+    this._doLogin();
+  }
+
+  async _doLogin() {
+    this._busy = true;
+    try {
+      const res = await fetch('/api/auth/login', {
+        method:  'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body:    JSON.stringify({
+          username: this._username.trim(),
+          password: this._password,
+        }),
+      });
+      if (!res.ok) {
+        this._error = 'Invalid username or password.';
+        return;
+      }
+      // Logged in — reload into the app.
+      window.location.reload();
+    } catch {
+      this._error = 'Network error — please try again.';
+    } finally {
+      this._busy = false;
+    }
+  }
+
+  render() {
+    const btnLabel = this._busy
+      ? html`<span class="login-spinner"></span>Signing in…`
+      : 'Sign in';
+
+    return html`
+      <div class="login-page">
+        <form class="login-card" @submit=${this._submit} autocomplete="on">
+          <div class="login-logo">
+            <img src="/assets/icons/icon-192.png" alt="Skald" />
+          </div>
+          <h1 class="login-title">Welcome back</h1>
+          <p class="login-subtitle">Sign in to your account.</p>
+
+          ${this._error ? html`<div class="login-error">${this._error}</div>` : null}
+
+          <div class="mb-3">
+            <label class="form-label">Username</label>
+            <input
+              type="text"
+              class="form-control"
+              autocomplete="username"
+              .value=${this._username}
+              @input=${e => this._username = e.target.value}
+              ?disabled=${this._busy} />
+          </div>
+
+          <div class="mb-3">
+            <label class="form-label">Password</label>
+            <input
+              type="password"
+              class="form-control"
+              autocomplete="current-password"
+              .value=${this._password}
+              @input=${e => this._password = e.target.value}
+              ?disabled=${this._busy} />
+          </div>
+
+          <button type="submit" class="btn btn-primary login-submit" ?disabled=${this._busy}>
+            ${btnLabel}
+          </button>
+        </form>
+      </div>
+    `;
+  }
+}