feat(api): add capabilities.login gated by CRE_ENABLE_LOGIN

Expose login alongside myopencre on GET /api/capabilities so auth UI
(#943) can roll out behind an env flag; defaults remain off on prod.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: northdpole

.env.example

@@ -31,6 +31,16 @@ INSECURE_REQUESTS=false
 
 CRE_ENABLE_HEALTH=false
 
+# Expose MyOpenCRE in the UI (GET /api/capabilities → myopencre).
+# Off by default so production can roll out independently of import auth.
+
+CRE_ENABLE_MYOPENCRE=false
+
+# Expose Login/Logout in the UI (GET /api/capabilities → login).
+# Off by default until auth routes + User model land; enable on staging first.
+
+CRE_ENABLE_LOGIN=false
+
 # Embeddings
 
 NO_GEN_EMBEDDINGS=false

README.md

@@ -289,7 +289,7 @@ Then edit `.env` and provide values appropriate for your environment.
 * Google Auth: `GOOGLE_CLIENT_ID`, `GOOGLE_CLIENT_SECRET`, `GOOGLE_SECRET_JSON`, `LOGIN_ALLOWED_DOMAINS`
 * GCP: `GCP_NATIVE`
 * Spreadsheet Auth: `OpenCRE_gspread_Auth`
-* Feature flags: `CRE_ENABLE_HEALTH` (enable the `GET /rest/v1/health` deploy/uptime probe; off by default, returns 404 when unset)
+* Feature flags: `CRE_ENABLE_HEALTH` (enable the `GET /rest/v1/health` deploy/uptime probe; off by default, returns 404 when unset), `CRE_ENABLE_MYOPENCRE` (expose MyOpenCRE in `GET /api/capabilities`; off by default), `CRE_ENABLE_LOGIN` (expose Login/Logout UI via `capabilities.login`; off by default)
 
 See `.env.example` for full list and defaults.
 

application/feature_flags.py

@@ -21,3 +21,8 @@ def is_health_endpoint_enabled() -> bool:
 def is_myopencre_enabled() -> bool:
     """Return True when the MyOpenCRE feature is enabled via CRE_ENABLE_MYOPENCRE."""
     return os.getenv("CRE_ENABLE_MYOPENCRE", "").strip().lower() in TRUE_VALUES
+
+
+def is_login_enabled() -> bool:
+    """Return True when auth UI / login is enabled via CRE_ENABLE_LOGIN."""
+    return os.getenv("CRE_ENABLE_LOGIN", "").strip().lower() in TRUE_VALUES

application/frontend/src/hooks/useCapabilities.ts

@@ -4,6 +4,12 @@ import { useEnvironment } from './useEnvironment';
 
 export type Capabilities = {
   myopencre: boolean;
+  login: boolean;
+};
+
+const DEFAULT_CAPABILITIES: Capabilities = {
+  myopencre: false,
+  login: false,
 };
 
 export const useCapabilities = () => {
@@ -16,8 +22,13 @@ export const useCapabilities = () => {
 
     fetch(`${baseUrl}/api/capabilities`)
       .then((res) => res.json())
-      .then(setCapabilities)
-      .catch(() => setCapabilities({ myopencre: false }))
+      .then((data: Partial<Capabilities>) =>
+        setCapabilities({
+          myopencre: Boolean(data?.myopencre),
+          login: Boolean(data?.login),
+        })
+      )
+      .catch(() => setCapabilities(DEFAULT_CAPABILITIES))
       .finally(() => setLoading(false));
   }, [apiUrl]);
 

application/frontend/src/routes.tsx

@@ -37,6 +37,7 @@ export interface IRoute {
 }
 export interface Capabilities {
   myopencre: boolean;
+  login: boolean;
 }
 export const ROUTES = (capabilities: Capabilities): IRoute[] => [
   ...(capabilities.myopencre

application/tests/web_main_test.py

@@ -1526,16 +1526,19 @@ def test_health_db_unreachable_returns_503(self) -> None:
         finally:
             os.environ.pop("CRE_ENABLE_HEALTH", None)
 
-    def test_capabilities_endpoint_returns_myopencre_key(self) -> None:
-        """GET /api/capabilities returns 200 with a boolean myopencre key."""
+    def test_capabilities_endpoint_returns_capability_keys(self) -> None:
+        """GET /api/capabilities returns 200 with boolean myopencre and login keys."""
         with patch.dict(os.environ, {}, clear=False):
             os.environ.pop("CRE_ENABLE_MYOPENCRE", None)
+            os.environ.pop("CRE_ENABLE_LOGIN", None)
             with self.app.test_client() as client:
                 response = client.get("/api/capabilities")
                 self.assertEqual(200, response.status_code)
                 body = json.loads(response.data.decode())
                 self.assertIn("myopencre", body)
+                self.assertIn("login", body)
                 self.assertIsInstance(body["myopencre"], bool)
+                self.assertIsInstance(body["login"], bool)
 
     def test_capabilities_myopencre_false_by_default(self) -> None:
         """myopencre is False when CRE_ENABLE_MYOPENCRE is unset."""
@@ -1555,3 +1558,22 @@ def test_capabilities_myopencre_true_when_flag_set(self) -> None:
                 self.assertEqual(200, response.status_code)
                 body = json.loads(response.data.decode())
                 self.assertTrue(body["myopencre"])
+
+    def test_capabilities_login_false_by_default(self) -> None:
+        """login is False when CRE_ENABLE_LOGIN is unset."""
+        with patch.dict(os.environ, {}, clear=False):
+            os.environ.pop("CRE_ENABLE_LOGIN", None)
+            with self.app.test_client() as client:
+                response = client.get("/api/capabilities")
+                self.assertEqual(200, response.status_code)
+                body = json.loads(response.data.decode())
+                self.assertFalse(body["login"])
+
+    def test_capabilities_login_true_when_flag_set(self) -> None:
+        """login is True when CRE_ENABLE_LOGIN is set to a truthy value."""
+        with patch.dict(os.environ, {"CRE_ENABLE_LOGIN": "1"}, clear=False):
+            with self.app.test_client() as client:
+                response = client.get("/api/capabilities")
+                self.assertEqual(200, response.status_code)
+                body = json.loads(response.data.decode())
+                self.assertTrue(body["login"])

application/web/web_main.py

@@ -25,6 +25,7 @@
 from application.feature_flags import (
     is_cre_import_allowed,
     is_health_endpoint_enabled,
+    is_login_enabled,
     is_myopencre_enabled,
 )
 
@@ -1202,8 +1203,13 @@ def get_config() -> Any:
 
 @app.route("/api/capabilities", methods=["GET"])
 def get_capabilities() -> Any:
-    """Expose frontend feature capabilities, e.g. whether MyOpenCRE is enabled."""
-    return jsonify({"myopencre": is_myopencre_enabled()})
+    """Expose frontend feature capabilities (MyOpenCRE, login UI)."""
+    return jsonify(
+        {
+            "myopencre": is_myopencre_enabled(),
+            "login": is_login_enabled(),
+        }
+    )
 
 
 @app.route("/admin/imports/rerun", methods=["POST"])