feat: cookie-based auth with admin/viewer access control#20

Merged

Rio517 merged 16 commits intomainfrom

Mar 13, 2026

Commits on Mar 13, 2026

docs: restructure plans, add deployment and hosted service docs

Rio517
and
claude
committed
docs: add viewer password (privacy mode) to auth plan

Rio517
and
claude
committed
feat: add cookie-based auth with admin/viewer access control

Rio517
and
claude
committed
test: speed up sorting E2E test with API-based racer creation

Rio517
and
claude
committed
fix: address security review — mask key, protect WS, add viewer logout

Rio517
and
claude
committed
test: export cookie constants, add middleware unit tests
Rio517
committed
feat: add UI gating for viewer mode with e2e tests

Rio517
and
claude
committed
feat: add admin login/logout in nav, fix viewer navigation

Rio517
and
claude
committed
feat: private mode login gate, unified auth, password UX, README screenshots

Rio517
and
claude
committed
chore: colorize screenshot output, add dev logout docs

Rio517
and
claude
committed
fix: address code review — consolidate login, timing-safe compare, private mode tests

Rio517
and
claude
committed
fix: address GitHub review — secure cookies, timing-safe validation, docs alignment

Rio517
and
claude
committed
fix: make auth unit tests self-contained with dynamic import

Rio517
and
claude
committed
fix: address second GitHub review round

Rio517
and
claude
committed
fix: HMAC caching, rate limiting, review round 4 fixes

Rio517
and
claude
committed
fix: privateMode logic, secure cookie clearing, stale docs

Rio517
and
claude
committed