saopig1andClaude Opus 4.7 f7c16888e7 docs(spec): WebUI authentication design ...

Spec for adding username+password auth to the WebUI to close the
unauthenticated-API exposure (all /api/* and /ws currently open).

Design: SQLite users + sessions tables, bcryptjs, 7-day rolling
HTTP-only cookie sessions, first-run setup wizard, Origin/Referer
CSRF check, WebSocket upgrade gated on the same session cookie.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-27 13:07:51 +08:00

..

plans

docs(plan): custom avatar + album search implementation plans

2026-05-07 19:55:52 +08:00

specs

docs(spec): WebUI authentication design

2026-05-27 13:07:51 +08:00