Merge branch 'main' into gsocmodule_C_week_3

PRAteek-singHWY · web-flow · commit 5e95496895d9 · 2026-07-08T15:46:32.000+05:30
diff --git a/.env.example b/.env.example
@@ -31,6 +31,16 @@ INSECURE_REQUESTS=false
 
 CRE_ENABLE_HEALTH=false
 
+# Expose MyOpenCRE in the UI (GET /api/capabilities → myopencre).
+# Off by default so production can roll out independently of import auth.
+
+CRE_ENABLE_MYOPENCRE=false
+
+# Expose Login/Logout in the UI (GET /api/capabilities → login).
+# Off by default until auth routes + User model land; enable on staging first.
+
+CRE_ENABLE_LOGIN=false
+
 # Embeddings
 
 NO_GEN_EMBEDDINGS=false
diff --git a/Makefile b/Makefile
@@ -85,7 +85,7 @@ install-python:
 install-typescript:
 	yarn add webpack && cd application/frontend && yarn build
 
-install: install-typescript install-python
+install: install-typescript install-python migrate-upgrade
 
 docker-dev:
 	docker build -f Dockerfile-dev -t opencre-dev:$(shell git rev-parse HEAD) .
diff --git a/README.md b/README.md
@@ -289,7 +289,7 @@ Then edit `.env` and provide values appropriate for your environment.
 * Google Auth: `GOOGLE_CLIENT_ID`, `GOOGLE_CLIENT_SECRET`, `GOOGLE_SECRET_JSON`, `LOGIN_ALLOWED_DOMAINS`
 * GCP: `GCP_NATIVE`
 * Spreadsheet Auth: `OpenCRE_gspread_Auth`
-* Feature flags: `CRE_ENABLE_HEALTH` (enable the `GET /rest/v1/health` deploy/uptime probe; off by default, returns 404 when unset)
+* Feature flags: `CRE_ENABLE_HEALTH` (enable the `GET /rest/v1/health` deploy/uptime probe; off by default, returns 404 when unset), `CRE_ENABLE_MYOPENCRE` (expose MyOpenCRE in `GET /api/capabilities`; off by default), `CRE_ENABLE_LOGIN` (expose Login/Logout UI via `capabilities.login`; off by default)
 
 See `.env.example` for full list and defaults.
 
diff --git a/application/feature_flags.py b/application/feature_flags.py
@@ -16,3 +16,13 @@ def is_cre_import_allowed() -> bool:
 
 def is_health_endpoint_enabled() -> bool:
     return os.getenv("CRE_ENABLE_HEALTH", "").strip().lower() in TRUE_VALUES
+
+
+def is_myopencre_enabled() -> bool:
+    """Return True when the MyOpenCRE feature is enabled via CRE_ENABLE_MYOPENCRE."""
+    return os.getenv("CRE_ENABLE_MYOPENCRE", "").strip().lower() in TRUE_VALUES
+
+
+def is_login_enabled() -> bool:
+    """Return True when auth UI / login is enabled via CRE_ENABLE_LOGIN."""
+    return os.getenv("CRE_ENABLE_LOGIN", "").strip().lower() in TRUE_VALUES
diff --git a/application/frontend/src/hooks/index.ts b/application/frontend/src/hooks/index.ts
@@ -1,3 +1,4 @@
 export { useEnvironment } from './useEnvironment';
 export { useLocationFromOutsideRoute } from './useLocationFromOutsideRoute';
 export { useCapabilities } from './useCapabilities';
+export { useUser } from './useUser';
diff --git a/application/frontend/src/hooks/useCapabilities.ts b/application/frontend/src/hooks/useCapabilities.ts
@@ -4,6 +4,12 @@ import { useEnvironment } from './useEnvironment';
 
 export type Capabilities = {
   myopencre: boolean;
+  login: boolean;
+};
+
+const DEFAULT_CAPABILITIES: Capabilities = {
+  myopencre: false,
+  login: false,
 };
 
 export const useCapabilities = () => {
@@ -16,8 +22,13 @@ export const useCapabilities = () => {
 
     fetch(`${baseUrl}/api/capabilities`)
       .then((res) => res.json())
-      .then(setCapabilities)
-      .catch(() => setCapabilities({ myopencre: false }))
+      .then((data: Partial<Capabilities>) =>
+        setCapabilities({
+          myopencre: Boolean(data?.myopencre),
+          login: Boolean(data?.login),
+        })
+      )
+      .catch(() => setCapabilities(DEFAULT_CAPABILITIES))
       .finally(() => setLoading(false));
   }, [apiUrl]);
 
diff --git a/application/frontend/src/hooks/useUser.ts b/application/frontend/src/hooks/useUser.ts
@@ -0,0 +1,62 @@
+import { useEffect, useState } from 'react';
+
+import { useEnvironment } from './useEnvironment';
+
+export type UserState = {
+  user: string | null;
+  isLoggedIn: boolean;
+  loading: boolean;
+};
+
+export const useUser = () => {
+  const { apiUrl } = useEnvironment();
+  const [user, setUser] = useState<string | null>(null);
+  const [loading, setLoading] = useState(true);
+
+  useEffect(() => {
+    let active = true;
+    fetch(`${apiUrl}/user`, { method: 'GET' })
+      .then((res) => {
+        if (res.status === 200) {
+          return res.text();
+        }
+        if (res.status === 401) {
+          return null; // the normal anonymous case — not logged in
+        }
+        // Unexpected status (e.g. 5xx): a real failure, not a clean anonymous state.
+        throw new Error(`Unexpected /user status: ${res.status}`);
+      })
+      .then((value) => {
+        if (active) {
+          setUser(value && value.trim() !== '' ? value : null);
+        }
+      })
+      .catch((err) => {
+        // Network error or unexpected status. Degrade to anonymous so public
+        // pages stay accessible (never block or redirect), but log the failure
+        // instead of silently masking it as a normal logged-out state.
+        if (active) {
+          setUser(null);
+        }
+        console.error('useUser: could not resolve /user login state', err);
+      })
+      .finally(() => {
+        if (active) {
+          setLoading(false);
+        }
+      });
+    return () => {
+      active = false;
+    };
+  }, [apiUrl]);
+
+  const login = () => {
+    window.location.href = `${apiUrl}/login`;
+  };
+
+  const logout = () => {
+    window.location.href = `${apiUrl}/logout`;
+  };
+
+  return { user, isLoggedIn: user !== null, loading, login, logout };
+};
diff --git a/application/frontend/src/routes.tsx b/application/frontend/src/routes.tsx
@@ -37,6 +37,7 @@ export interface IRoute {
 }
 export interface Capabilities {
   myopencre: boolean;
+  login: boolean;
 }
 export const ROUTES = (capabilities: Capabilities): IRoute[] => [
   ...(capabilities.myopencre
diff --git a/application/frontend/src/scaffolding/Header/Header.tsx b/application/frontend/src/scaffolding/Header/Header.tsx
@@ -1,6 +1,6 @@
 import './header.scss';
 
-import { Menu, Search } from 'lucide-react';
+import { LogOut, Menu, Search, User, X } from 'lucide-react';
 import React, { useEffect, useState } from 'react';
 import { Link, useHistory } from 'react-router-dom';
 import { NavLink } from 'react-router-dom';
@@ -9,6 +9,7 @@ import { Button } from 'semantic-ui-react';
 import { ClearFilterButton } from '../../components/FilterButton/FilterButton';
 import { Capabilities } from '../../hooks/useCapabilities';
 import { useLocationFromOutsideRoute } from '../../hooks/useLocationFromOutsideRoute';
+import { useUser } from '../../hooks/useUser';
 import { SearchBar } from '../../pages/Search/components/SearchBar';
 import { ROUTES } from '../../routes';
 
@@ -26,6 +27,8 @@ export const Header = ({ capabilities }: HeaderProps) => {
   };
   const { showFilter } = useLocationFromOutsideRoute(routes);
 
+  const { user, isLoggedIn, loading: userLoading, login, logout } = useUser();
+
   const [isMobileMenuOpen, setIsMobileMenuOpen] = useState(false);
   useEffect(() => {
     const mediaQuery = window.matchMedia('(min-width: 768px)');
@@ -100,28 +103,24 @@ export const Header = ({ capabilities }: HeaderProps) => {
             </div>
 
             <div className="navbar__actions">
-              {/* Left these divs so that we can add auth functionality directly here. */}
-              {/* <div className="navbar__desktop-auth">
-                <Link
-                  to={{
-                    pathname: '/auth',
-                    state: { mode: 'login' },
-                  }}
-                  className="btn btn--ghost"
-                >
-                  Log In
-                </Link>
-
-                <Link
-                  to={{
-                    pathname: '/auth',
-                    state: { mode: 'signup' },
-                  }}
-                  className="btn btn--primary"
-                >
-                  Sign Up
-                </Link>
-              </div> */}
+              {capabilities.login && !userLoading && (
+                <div className="navbar__desktop-auth">
+                  {isLoggedIn ? (
+                    <div className="user-info">
+                      <div className="user-details">
+                        <User className="icon" />
+                        <span>{user}</span>
+                      </div>
+                      <Button onClick={logout}>
+                        <LogOut className="icon" />
+                        Logout
+                      </Button>
+                    </div>
+                  ) : (
+                    <Button onClick={login} content="Login" />
+                  )}
+                </div>
+              )}
 
               <button className="navbar__mobile-menu-toggle" onClick={() => setIsMobileMenuOpen(true)}>
                 <Menu className="icon" />
@@ -135,6 +134,13 @@ export const Header = ({ capabilities }: HeaderProps) => {
       <div className={`navbar__overlay ${isMobileMenuOpen ? 'is-open' : ''}`} onClick={closeMobileMenu}></div>
 
       <div className={`navbar__mobile-menu ${isMobileMenuOpen ? 'is-open' : ''}`}>
+        <button
+          className="navbar__mobile-menu-close"
+          onClick={closeMobileMenu}
+          aria-label="Close mobile menu"
+        >
+          <X className="mobile-close-icon" />
+        </button>
         <div className="mobile-search-container">
           <SearchBar />
         </div>
@@ -210,31 +216,37 @@ export const Header = ({ capabilities }: HeaderProps) => {
           )}
         </div>
 
-        <div className="mobile-auth">
-          {/* <div className="auth-buttons">
-            <Link
-              to={{
-                pathname: '/auth',
-                state: { mode: 'login' },
-              }}
-              className="btn btn--ghost"
-              onClick={closeMobileMenu}
-            >
-              Log In
-            </Link>
-
-            <Link
-              to={{
-                pathname: '/auth',
-                state: { mode: 'signup' },
-              }}
-              className="btn btn--primary"
-              onClick={closeMobileMenu}
-            >
-              Sign Up
-            </Link>
-          </div> */}
-        </div>
+        {capabilities.login && !userLoading && (
+          <div className="mobile-auth">
+            {isLoggedIn ? (
+              <div className="user-info">
+                <div className="user-details">
+                  <User className="icon" />
+                  <span>{user}</span>
+                </div>
+                <Button
+                  onClick={() => {
+                    closeMobileMenu();
+                    logout();
+                  }}
+                >
+                  <LogOut className="icon" />
+                  Logout
+                </Button>
+              </div>
+            ) : (
+              <div className="auth-buttons">
+                <Button
+                  onClick={() => {
+                    closeMobileMenu();
+                    login();
+                  }}
+                  content="Login"
+                />
+              </div>
+            )}
+          </div>
+        )}
       </div>
     </>
   );
diff --git a/application/frontend/src/scaffolding/Header/header.scss b/application/frontend/src/scaffolding/Header/header.scss
@@ -345,3 +345,22 @@
   border: 0;
 }
 
+.navbar__mobile-menu-close {
+  display: flex;
+  margin-left: auto;
+  margin-bottom: 1rem;
+  background: transparent;
+  border: none;
+  cursor: pointer;
+  padding: 0.5rem;
+
+  .mobile-close-icon {
+    color: #ffffff;
+    width: 28px;
+    height: 28px;
+  }
+
+  &:hover {
+    opacity: 0.7;
+  }
+}
diff --git a/application/tests/web_main_test.py b/application/tests/web_main_test.py
@@ -1525,3 +1525,55 @@ def test_health_db_unreachable_returns_503(self) -> None:
                     self.assertFalse(body["db_reachable"])
         finally:
             os.environ.pop("CRE_ENABLE_HEALTH", None)
+
+    def test_capabilities_endpoint_returns_capability_keys(self) -> None:
+        """GET /api/capabilities returns 200 with boolean myopencre and login keys."""
+        with patch.dict(os.environ, {}, clear=False):
+            os.environ.pop("CRE_ENABLE_MYOPENCRE", None)
+            os.environ.pop("CRE_ENABLE_LOGIN", None)
+            with self.app.test_client() as client:
+                response = client.get("/api/capabilities")
+                self.assertEqual(200, response.status_code)
+                body = json.loads(response.data.decode())
+                self.assertIn("myopencre", body)
+                self.assertIn("login", body)
+                self.assertIsInstance(body["myopencre"], bool)
+                self.assertIsInstance(body["login"], bool)
+
+    def test_capabilities_myopencre_false_by_default(self) -> None:
+        """myopencre is False when CRE_ENABLE_MYOPENCRE is unset."""
+        with patch.dict(os.environ, {}, clear=False):
+            os.environ.pop("CRE_ENABLE_MYOPENCRE", None)
+            with self.app.test_client() as client:
+                response = client.get("/api/capabilities")
+                self.assertEqual(200, response.status_code)
+                body = json.loads(response.data.decode())
+                self.assertFalse(body["myopencre"])
+
+    def test_capabilities_myopencre_true_when_flag_set(self) -> None:
+        """myopencre is True when CRE_ENABLE_MYOPENCRE is set to a truthy value."""
+        with patch.dict(os.environ, {"CRE_ENABLE_MYOPENCRE": "1"}, clear=False):
+            with self.app.test_client() as client:
+                response = client.get("/api/capabilities")
+                self.assertEqual(200, response.status_code)
+                body = json.loads(response.data.decode())
+                self.assertTrue(body["myopencre"])
+
+    def test_capabilities_login_false_by_default(self) -> None:
+        """login is False when CRE_ENABLE_LOGIN is unset."""
+        with patch.dict(os.environ, {}, clear=False):
+            os.environ.pop("CRE_ENABLE_LOGIN", None)
+            with self.app.test_client() as client:
+                response = client.get("/api/capabilities")
+                self.assertEqual(200, response.status_code)
+                body = json.loads(response.data.decode())
+                self.assertFalse(body["login"])
+
+    def test_capabilities_login_true_when_flag_set(self) -> None:
+        """login is True when CRE_ENABLE_LOGIN is set to a truthy value."""
+        with patch.dict(os.environ, {"CRE_ENABLE_LOGIN": "1"}, clear=False):
+            with self.app.test_client() as client:
+                response = client.get("/api/capabilities")
+                self.assertEqual(200, response.status_code)
+                body = json.loads(response.data.decode())
+                self.assertTrue(body["login"])
diff --git a/application/web/web_main.py b/application/web/web_main.py
diff --git a/docs/rfc/user-auth-myopencre.md b/docs/rfc/user-auth-myopencre.md

Original file line number	Diff line number	Diff line change
`@@ -37,6 +37,7 @@ export interface IRoute {`
`37`	`37`	`}`
`38`	`38`	`export interface Capabilities {`
`39`	`39`	`myopencre: boolean;`
	`40`	`+ login: boolean;`
`40`	`41`	`}`
`41`	`42`	`export const ROUTES = (capabilities: Capabilities): IRoute[] => [`
`42`	`43`	`...(capabilities.myopencre`