agatha
5fbbc1e67f
Protects image upload, delete, and tag-update endpoints behind Bearer token auth. Public read endpoints remain open. Angular SPA gains a login page, auth interceptor, and route guard for /upload. - JWTAuthProvider (HS256, sub/iat/exp, secrets.compare_digest) - POST /api/v1/auth/token login endpoint - require_auth FastAPI dependency on all write routes - AuthService, LoginComponent, authInterceptor, authGuard - Detail page hides write controls for unauthenticated visitors - 43 unit tests passing; integration tests require Docker stack Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
22 lines
638 B
Plaintext
22 lines
638 B
Plaintext
# PostgreSQL — async DSN for SQLAlchemy + asyncpg
|
|
DATABASE_URL=postgresql+asyncpg://reactbin:reactbin@postgres:5432/reactbin
|
|
|
|
# S3-compatible object storage (MinIO in local dev)
|
|
S3_ENDPOINT_URL=http://minio:9000
|
|
S3_BUCKET_NAME=reactbin
|
|
S3_ACCESS_KEY_ID=minioadmin
|
|
S3_SECRET_ACCESS_KEY=minioadmin
|
|
S3_REGION=us-east-1
|
|
|
|
# Angular SPA — injected at build or runtime
|
|
API_BASE_URL=http://localhost:8000
|
|
|
|
# Upload size limit in bytes (default 50 MiB)
|
|
MAX_UPLOAD_BYTES=52428800
|
|
|
|
# Owner credentials and JWT signing secret
|
|
JWT_SECRET_KEY=change-me-to-a-long-random-string
|
|
JWT_EXPIRY_SECONDS=86400
|
|
OWNER_USERNAME=owner
|
|
OWNER_PASSWORD=change-me
|