feat(web): add password protection for web console

- Add `web_password` config to enable login authentication
- Use stateless HMAC-signed token (survives restart, invalidates on password change)
- Add `web_session_expire_days` config (default 30 days)
- Protect all API endpoints with auth check (401 on failure)
- Add login page UI with auto-redirect on session expiry
- Add password management in config page (masked display, inline edit)
- Add tooltip hints for Agent config fields
- Update default agent_max_context_turns to 20, agent_max_steps to 20
- Update docs and docker-compose.yml
This commit is contained in:
zhayujie
2026-04-12 20:37:04 +08:00
parent 4dd497fb6d
commit fbe48a4b4e
14 changed files with 498 additions and 56 deletions

View File

@@ -26,9 +26,10 @@
"dingtalk_client_secret":"",
"wecom_bot_id": "",
"wecom_bot_secret": "",
"web_password": "",
"agent": true,
"agent_max_context_tokens": 40000,
"agent_max_context_tokens": 50000,
"agent_max_context_turns": 20,
"agent_max_steps": 15,
"agent_max_steps": 20,
"knowledge": true
}