add auth

backend/app/settings_schema.py

@@ -276,6 +276,32 @@ class NotificationsSettings(BaseModel):
     report: ReportSettings = Field(default_factory=ReportSettings)
 
 
+# --------------------------------------------------------------------------
+# Web login
+# --------------------------------------------------------------------------
+class AuthSettings(BaseModel):
+    """Gates the browser UI. The desktop app and scripts keep using `API_TOKEN`.
+
+    The web UI is closed the moment either credential is configured: a password
+    (`password_hash` set) or Telegram sign-in (`telegram_login_enabled` with an
+    `telegram_owner_id`). With neither set, the browser is open — the same
+    "friction-free on a laptop" default `API_TOKEN` already has.
+    """
+
+    username: str = "timka"
+    password_hash: str = ""
+    """`pbkdf2_sha256$<iterations>$<salt>$<hash>`, never the plaintext password."""
+
+    telegram_login_enabled: bool = False
+    telegram_owner_id: str = ""
+    """The numeric Telegram user id allowed to sign in with the Login Widget."""
+
+    telegram_bot_username: str = ""
+    """Without the `@`, e.g. `kadence_bot` — the widget needs it to render."""
+
+    session_days: int = Field(default=30, ge=1, le=365)
+
+
 # --------------------------------------------------------------------------
 # Root
 # --------------------------------------------------------------------------
@@ -298,6 +324,7 @@ class AppSettings(BaseModel):
     blocker: BlockerSettings = Field(default_factory=BlockerSettings)
     notifications: NotificationsSettings = Field(default_factory=NotificationsSettings)
     appearance: AppearanceSettings = Field(default_factory=AppearanceSettings)
+    auth: AuthSettings = Field(default_factory=AuthSettings)
 
     @field_validator("timezone")
     @classmethod
@@ -321,6 +348,7 @@ SECRET_FIELDS = frozenset(
         "session_cookie",
         "bot_token",
         "webhook_url",
+        "password_hash",
     }
 )