gtiandClaude Opus 5.5
64d3fc56e2
Collaborators logged into GTI Gerenciador open GTI Fiscal without a second password. The panel signs a 60 s JWT (Ed25519; the Hub holds only the public key); the Hub checks signature, iss/aud/exp/nbf, maximum lifetime, nonce against a one-time state cookie set when the flow starts at GET /login (login-CSRF protection) and a single-use jti (sso_used_assertions). Collaborators are provisioned in admin_users with auth_source=GTI_GERENCIADOR and no password; a CHECK constraint makes a passwordless local account or a federated account with a password impossible (migration 0021). Sessions last FEDERATED_SESSION_SECONDS (1 h) and are renewed silently through the panel. The local admin stays as break-glass at /login/local, audited. Logout ends only the Hub session. Every SSO success/rejection (stable reason code), logout and local login is audited with the real client IP, never the token. verify_password now fails closed on a missing hash instead of raising. Visual identity: gti-theme.css is a verbatim copy of the panel's design system (tokens, sidebar, light/dark theme) plus its tema.js, sidebar.js and logo; control-panel.css keeps only Hub components, all colours from the panel tokens. Page structure and features unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
20 lines
465 B
TOML
20 lines
465 B
TOML
[project]
|
|
name = "gti-fiscal-hub"
|
|
version = "1.0.0rc1"
|
|
requires-python = ">=3.10"
|
|
dependencies = [
|
|
"fastapi>=0.115,<1",
|
|
"jinja2>=3.1,<4",
|
|
"uvicorn[standard]>=0.30,<1",
|
|
"sqlalchemy>=2.0,<3",
|
|
"psycopg[binary]>=3.2,<4",
|
|
"alembic>=1.13,<2",
|
|
"httpx>=0.27,<1",
|
|
"openpyxl>=3.1,<4",
|
|
"pypdf>=4.0,<6",
|
|
"pdfplumber>=0.11,<1",
|
|
# SSO from GTI Gerenciador (central/app/sso.py): Ed25519-signed JWT assertions.
|
|
"pyjwt>=2.14,<3",
|
|
"cryptography>=50,<51",
|
|
]
|