Server auth (Argon2id), gallery modules, refactor for code sharing
Server (modeler-server):
- auth.rs: add username + password authentication via Argon2id. Adds
Argon2/PasswordHash/PasswordHasher/PasswordVerifier deps, password
hashing helpers, password-based login endpoint, and set-password CLI
subcommand. Existing API-key auth flow preserved.
- admin.rs: expand admin routes/endpoints (--admin flag, set-password,
user management)
- db.rs: schema/migration updates to support password auth columns
- error.rs: new ApiError variants for the auth flow
- scenes.rs / assemblies.rs / sync.rs: metadata column plumbing already
covered by Wave 0-2, plus incidental fixes
- Cargo.toml: add argon2, tower, png, http, hyper, base64 deps; expand
tower-http features; dev-dependency for tower::util
- README.md: document username + password auth path, --admin/--username/
--password flags, set-password subcommand
- server/src/config.rs: removed (config integrated into main.rs)
- New modules: gallery.rs (pure logic, 446 lines), middleware.rs
(request_id, metrics, gallery_visibility_gate, 415 lines),
rate_limit.rs (login throttling, 59 lines), static_files.rs
(classify/mime_for/StaticDirService, 343 lines)
Client (modeler):
- src/app/gizmo_controller.rs: extract build_axis_gizmo helper, share
arrow-mesh code with modeler_geom
- src/csg/eval/builders.rs: remove unused add/scale helpers
- src/csg/eval/mod.rs: drop evaluate_tessellate_and_registry_preview
(superseded by the new evaluate_tessellate_mesh_only path)
- src/csg/mod.rs: add smart reparent that routes through modifier sources
(Pattern/Extrude/EdgeBlend) and auto-wraps the source in a Union
Operation when needed; remove dead nodes_mut and reparent helpers
- src/csg/pick.rs: drop arrow_transform (moved to modeler_geom)
- src/ui/cloud_settings.rs: rename auth_display_name to display_name
- src/ui/properties.rs: collapse render_add_child_candidates modifier
branching into the new smart reparent path
These changes ride on top of c31c503 (Waves 0-5) and close out the
auth/credential rework tracked under #57 and #58.
Server auth (Argon2id), gallery modules, refactor for code sharing
Server (modeler-server):
- auth.rs: add username + password authentication via Argon2id. Adds
Argon2/PasswordHash/PasswordHasher/PasswordVerifier deps, password
hashing helpers, password-based login endpoint, and set-password CLI
subcommand. Existing API-key auth flow preserved.
- admin.rs: expand admin routes/endpoints (--admin flag, set-password,
user management)
- db.rs: schema/migration updates to support password auth columns
- error.rs: new ApiError variants for the auth flow
- scenes.rs / assemblies.rs / sync.rs: metadata column plumbing already
covered by Wave 0-2, plus incidental fixes
- Cargo.toml: add argon2, tower, png, http, hyper, base64 deps; expand
tower-http features; dev-dependency for tower::util
- README.md: document username + password auth path, --admin/--username/
--password flags, set-password subcommand
- server/src/config.rs: removed (config integrated into main.rs)
- New modules: gallery.rs (pure logic, 446 lines), middleware.rs
(request_id, metrics, gallery_visibility_gate, 415 lines),
rate_limit.rs (login throttling, 59 lines), static_files.rs
(classify/mime_for/StaticDirService, 343 lines)
Client (modeler):
- src/app/gizmo_controller.rs: extract build_axis_gizmo helper, share
arrow-mesh code with modeler_geom
- src/csg/eval/builders.rs: remove unused add/scale helpers
- src/csg/eval/mod.rs: drop evaluate_tessellate_and_registry_preview
(superseded by the new evaluate_tessellate_mesh_only path)
- src/csg/mod.rs: add smart reparent that routes through modifier sources
(Pattern/Extrude/EdgeBlend) and auto-wraps the source in a Union
Operation when needed; remove dead nodes_mut and reparent helpers
- src/csg/pick.rs: drop arrow_transform (moved to modeler_geom)
- src/ui/cloud_settings.rs: rename auth_display_name to display_name
- src/ui/properties.rs: collapse render_add_child_candidates modifier
branching into the new smart reparent path
These changes ride on top of c31c503 (Waves 0-5) and close out the
auth/credential rework tracked under #57 and #58.
Phase 3-5: GitHub OAuth, Admin panel, Auto-sync, WASM HTTP, Integration tests
Phase 3:
- GitHub OAuth on server (login/callback with state-param CSRF)
- Bulk sync endpoints (pull manifest since timestamp, batch upsert)
- Client OAuth flow (native local TCP listener + browser, WASM URL callback)
- WASM HTTP path (fetch-based async HTTP in platform.rs)
- LoginWithGitHub action wired in toolbar cloud menu
Phase 4:
- is_admin column on users table + --admin CLI flag
- Admin middleware + user management endpoints (list/delete users, stats)
- HTML admin dashboard (GET /admin) with JS-fetched data
- 6 integration tests for admin endpoints
Phase 5:
- Auto-sync timer (tick() per frame) with configurable interval
- Exponential backoff retry (1s up to 5min)
- Cloud Settings panel (server URL, auto-sync toggle, interval slider, status)
- Cloud Login window (replaces menu_button that closed on text field focus)
- Save Assembly / Save Scene to Cloud buttons in toolbar menu
- Cloud settings persisted across restarts via egui insert_persisted
- login_api_key / login_server_url input buffers stored in CloudManager
Client:
- SyncCompleted/SyncFailed variants in CloudOpResult
- notify_sync_result() for retry state management
- 22 integration tests: health, oauth, auth, sync, assemblies, admin
Server auth (Argon2id), gallery modules, refactor for code sharing
Server (modeler-server):
- auth.rs: add username + password authentication via Argon2id. Adds
Argon2/PasswordHash/PasswordHasher/PasswordVerifier deps, password
hashing helpers, password-based login endpoint, and set-password CLI
subcommand. Existing API-key auth flow preserved.
- admin.rs: expand admin routes/endpoints (--admin flag, set-password,
user management)
- db.rs: schema/migration updates to support password auth columns
- error.rs: new ApiError variants for the auth flow
- scenes.rs / assemblies.rs / sync.rs: metadata column plumbing already
covered by Wave 0-2, plus incidental fixes
- Cargo.toml: add argon2, tower, png, http, hyper, base64 deps; expand
tower-http features; dev-dependency for tower::util
- README.md: document username + password auth path, --admin/--username/
--password flags, set-password subcommand
- server/src/config.rs: removed (config integrated into main.rs)
- New modules: gallery.rs (pure logic, 446 lines), middleware.rs
(request_id, metrics, gallery_visibility_gate, 415 lines),
rate_limit.rs (login throttling, 59 lines), static_files.rs
(classify/mime_for/StaticDirService, 343 lines)
Client (modeler):
- src/app/gizmo_controller.rs: extract build_axis_gizmo helper, share
arrow-mesh code with modeler_geom
- src/csg/eval/builders.rs: remove unused add/scale helpers
- src/csg/eval/mod.rs: drop evaluate_tessellate_and_registry_preview
(superseded by the new evaluate_tessellate_mesh_only path)
- src/csg/mod.rs: add smart reparent that routes through modifier sources
(Pattern/Extrude/EdgeBlend) and auto-wraps the source in a Union
Operation when needed; remove dead nodes_mut and reparent helpers
- src/csg/pick.rs: drop arrow_transform (moved to modeler_geom)
- src/ui/cloud_settings.rs: rename auth_display_name to display_name
- src/ui/properties.rs: collapse render_add_child_candidates modifier
branching into the new smart reparent path
These changes ride on top of c31c503 (Waves 0-5) and close out the
auth/credential rework tracked under #57 and #58.
Add New Scene menu item
- New Scene button at top of File menu (src/ui/menu_bar.rs)
- Confirmation dialog if unsaved changes (Save/Don't Save/Cancel)
- do_new_scene() resets tree, undo, selection, gizmo, extrude,
clipboard, assemblies, cloud scene name, file path, etc.
- Guide, assembly library, and dock state are preserved
Also: server now injects __MODELER_SRV__ into index.html at serve
time so the WASM frontend knows the server URL without guessing.
Revision history: snapshot capture, preview/restore, GC
- revisions table in db.rs with PRIMARY KEY (user_id, kind, name, version)
- capture() function with retry loop for concurrent MAX(version) races
- GC keeps newest 50 revisions per document (single DELETE with subquery)
- Capture hooks before every overwrite (sync.rs x2, assemblies.rs, scenes.rs)
- GET /api/documents/{kind}/{name}/revisions (paginated list)
- GET /api/documents/{kind}/{name}/revisions/{version} (full snapshot)
- POST /api/documents/{kind}/{name}/restore (captures current, writes restored)
- Client: fetch_revisions, fetch_revision_data, restore_revision cloud methods
- Preview mode: saves CSG tree before loading revision, restores on exit
- Auto-sync disabled during preview mode
- Revision history UI in Document Properties tab (collapsible section)
- 4 unit tests + 11 integration tests, all 494 passing