mirror of
https://github.com/computerim/impactflow-discovery.git
synced 2026-08-27 07:40:37 +00:00
Joel Salmon
33674f92f4
Close the remaining Phase 1 DoD gaps and reconcile the browser flow with the auth layer. Goals (5 -> 7 prompts): - Add near-term (6-12mo) and long-term (3-5yr) goal prompts; collect raw text on the conversation and store AI-articulated goal summaries on the profile. Extractor articulates the person's own stated goals (mirror, not compass) and never fabricates. Alembic 003 adds the four columns. Cookie-based browser sessions (fixes frontend<->auth desync): - OAuth callback now sets httpOnly session cookies and redirects into the app instead of returning JSON. get_current_user gains a cookie fallback (X-API-Key -> Bearer -> cookie). refresh/logout read the refresh cookie and set/clear cookies. New shared auth.js (authedFetch) sends cookies and silently refreshes on 401. Static pages drop the bogus user_id and call the correct /me endpoints. Profile editing (read/edit/affirm): - PATCH /discovery/profile/me edits the prose (Ikigai summaries, overlap narrative, goals); owner-scoped, partial update, 409 when locked. Edit mode in profile.html with Save/Cancel. Also: bump default model to claude-sonnet-4-6, align ports to 8011 (OAuth redirect, CORS), add COOKIE_SECURE/POST_LOGIN_REDIRECT config, and refresh the README to match the shipped behavior. Tests: 33 passing (added cookie-auth, profile-edit, goal-extraction cases; factored a shared app_client fixture into conftest.py). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
37 lines
1.4 KiB
Bash
37 lines
1.4 KiB
Bash
ANTHROPIC_API_KEY=your_anthropic_api_key_here
|
|
DATABASE_URL=sqlite+aiosqlite:///./data/discovery.db
|
|
HOST_BIND_IP=0.0.0.0
|
|
HOST_PORT=8011
|
|
|
|
# Optional: override the Anthropic model used for extraction
|
|
ANTHROPIC_MODEL=claude-sonnet-4-6
|
|
|
|
# Google OAuth (web client type). Register the redirect URI below as an
|
|
# authorized redirect URI in the Google Cloud Console for this client.
|
|
GOOGLE_CLIENT_ID=xxxx.apps.googleusercontent.com
|
|
GOOGLE_CLIENT_SECRET=GOCSPX-xxxx
|
|
OAUTH_REDIRECT_URI=http://localhost:8011/api/auth/callback
|
|
|
|
# Random 64-char URL-safe strings. Generate with:
|
|
# python -c "import secrets; print(secrets.token_urlsafe(48))"
|
|
JWT_SECRET=generate-a-random-64-char-string
|
|
IMPACTFLOW_API_KEY=generate-another-random-64-char-string
|
|
|
|
# JWT lifetimes (minutes / days).
|
|
JWT_ACCESS_MINUTES=15
|
|
JWT_REFRESH_DAYS=7
|
|
|
|
# Browser session cookies. COOKIE_SECURE must be true in production (HTTPS);
|
|
# set it false ONLY for local http://localhost dev, where Secure cookies are
|
|
# never sent. POST_LOGIN_REDIRECT is where the OAuth callback lands the
|
|
# browser after setting the session cookies.
|
|
COOKIE_SECURE=false
|
|
POST_LOGIN_REDIRECT=/static/discovery.html
|
|
|
|
# Comma-separated allow-list of browser origins for CORS.
|
|
CORS_ALLOWED_ORIGINS=http://localhost:8011,http://100.103.206.4:8011
|
|
|
|
# Optional comma-separated email-domain allow-list (e.g. "computerim.com").
|
|
# Empty means any verified Google email is accepted.
|
|
ALLOWED_EMAIL_DOMAINS=
|