gtiandClaude Opus 5.5
64d3fc56e2
Collaborators logged into GTI Gerenciador open GTI Fiscal without a second password. The panel signs a 60 s JWT (Ed25519; the Hub holds only the public key); the Hub checks signature, iss/aud/exp/nbf, maximum lifetime, nonce against a one-time state cookie set when the flow starts at GET /login (login-CSRF protection) and a single-use jti (sso_used_assertions). Collaborators are provisioned in admin_users with auth_source=GTI_GERENCIADOR and no password; a CHECK constraint makes a passwordless local account or a federated account with a password impossible (migration 0021). Sessions last FEDERATED_SESSION_SECONDS (1 h) and are renewed silently through the panel. The local admin stays as break-glass at /login/local, audited. Logout ends only the Hub session. Every SSO success/rejection (stable reason code), logout and local login is audited with the real client IP, never the token. verify_password now fails closed on a missing hash instead of raising. Visual identity: gti-theme.css is a verbatim copy of the panel's design system (tokens, sidebar, light/dark theme) plus its tema.js, sidebar.js and logo; control-panel.css keeps only Hub components, all colours from the panel tokens. Page structure and features unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
31 lines
1.4 KiB
HTML
31 lines
1.4 KiB
HTML
<!doctype html>
|
|
<html lang="pt-BR" data-tema="escuro">
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<meta name="viewport" content="width=device-width,initial-scale=1">
|
|
<title>Não foi possível entrar | GTI Fiscal</title>
|
|
<link rel="icon" type="image/png" href="/static/logo-gti-256x256.png">
|
|
<link rel="stylesheet" href="/static/gti-theme.css">
|
|
<link rel="stylesheet" href="/static/control-panel.css">
|
|
</head>
|
|
<body class="login-page">
|
|
<div class="cartao login-card">
|
|
<img src="/static/logo-gti-256x256.png" alt="GTI Grupo" class="login-logo">
|
|
<h1>Não foi possível entrar no GTI Fiscal</h1>
|
|
{% set messages = {
|
|
"EXPIRED": "O acesso demorou demais para ser concluído.",
|
|
"STATE_MISMATCH": "O acesso foi iniciado em outra aba ou já foi usado.",
|
|
"REPLAY": "Este acesso já foi utilizado.",
|
|
"DISABLED_IN_FISCAL": "Seu usuário está desativado no GTI Fiscal.",
|
|
"SSO_DISABLED": "O acesso pelo Painel de Clientes não está configurado."
|
|
} %}
|
|
<p class="login-subtitle">{{ messages.get(reason, "A identificação enviada pelo Painel de Clientes não foi aceita.") }}</p>
|
|
<div class="login-actions">
|
|
<a class="botao" href="/login">Tentar novamente</a>
|
|
{% if panel_home %}<a class="botao" href="{{ panel_home }}">Voltar ao Painel de Clientes</a>{% endif %}
|
|
</div>
|
|
<p class="muted" style="margin-top:16px;font-size:.78rem">Código: {{ reason }}</p>
|
|
</div>
|
|
</body>
|
|
</html>
|