informatics-isi-edu / deriva-mcp-ui / 23918235458

90%

push

github

Add anonymous / zero-auth mode

  When DERIVA_CHATBOT_CREDENZA_URL is not set, the UI operates without login.
  Sessions are browser-scoped using a random opaque cookie (deriva_chatbot_anon).

  - auth_enabled property (config.py): bool(credenza_url) -- auto-detected,
    no explicit mode flag; validate_for_http() branches on it so Credenza fields
    are only required when auth is enabled
  - Session.bearer_token: str | None = None (storage/base.py); mcp_client.py
    omits Authorization header when token is None
  - _get_or_create_anonymous_session() (auth.py): creates or resumes a
    uid:anonymous/{anon_id} session; require_session() branches on auth_enabled;
    /login redirects to / in anonymous mode; /logout clears cookie and returns
  - _anon_cookie_middleware (server.py): FastAPI does not merge cookies set on
    an injected Response dependency into JSONResponse; workaround stores cookie
    info in request.state.new_anon_id and attaches Set-Cookie in middleware
  - session_info returns "Anonymous" display name when auth is disabled

52 of 52 new or added lines in 5 files covered. (100.0%)

685 of 736 relevant lines covered (93.07%)

0.93 hits per line