Add token-based auth for WebDAV/NTLM and API access

- Add Token model with CRUD endpoints (/api/tokens, /auth/tokens)
- Support Basic auth with token:<secret> for built-in users
- Implement full NTLMv2 handshake for Windows WebDAV clients
- Add SSO token auth via check_permissions() proxy
- Hydrate request auth context from session or Authorization header
- Persist session cookie after successful Authorization-based login
- Add secure flag to session cookies based on request scheme
- Add frontend UserTokensModal for creating/revoking tokens
- Fix devserver to run workspace source via python -m cista
- Add tests for token CRUD and file auth (Basic, NTLM, session)
- Remove proactive WWW-Authenticate advertisement

cista/app.py

@@ -40,54 +40,13 @@ app.router.ALLOWED_METHODS = (
 )
 
 configure_main_logging()
-# Register either SSO proxy or built-in auth routes based on PASKIA_BACKEND_URL
-if sso.paskia_enabled():
-    app.blueprint(sso.bp)  # SSO proxy for /auth/* routes
-else:
-    app.blueprint(auth.bp)  # Built-in auth routes
-app.blueprint(preview.bp)
-app.blueprint(bp)
-app.blueprint(fileserver.bp)
-app.exception(Exception)(handle_sanic_exception)
-
-
-setproctitle("cista-main")
-
-
-@app.before_server_start
-async def main_start(app):
-    config.load_config()
-    setproctitle(f"cista {config.config.path.name}")
-    app.ctx.threadexec = ThreadPoolExecutor(
-        max_workers=4, thread_name_prefix="cista-worker"
-    )
-    # Larger pool for long-running but low-memory zip operations
-    app.ctx.zipexec = ThreadPoolExecutor(max_workers=32, thread_name_prefix="cista-zip")
-    await start_preview_workers()
-    watching.start(app)
-
-
-# Sanic sometimes fails to execute after_server_stop, so we do it before instead (potentially interrupting handlers)
-@app.before_server_stop
-async def main_stop(app):
-    watching.stop(app)
-    await shutdown_preview_workers()
-    app.ctx.threadexec.shutdown()
-    app.ctx.zipexec.shutdown(cancel_futures=True)
-    await sso.close_client()
-    logger.debug("Cista worker threads all finished")
 
 
 @app.on_request
 async def use_session(req):
     req.ctx._log_start = time.perf_counter()
-    req.ctx.session = session.get(req)
-    try:
-        req.ctx.username = req.ctx.session["username"]  # type: ignore
-        req.ctx.user = config.config.users[req.ctx.username]
-    except (AttributeError, KeyError, TypeError):
-        req.ctx.username = None
-        req.ctx.user = None
+    req.ctx._auth_flow = ["session: start"]
+    auth.hydrate_request_auth_context(req, source="app.on_request")
     # CSRF protection
     if req.method == "GET" and req.headers.upgrade != "websocket":
         return  # Ordinary GET requests are fine
@@ -129,6 +88,56 @@ async def forward_sso_cookies(req, res):
             res.headers.add("set-cookie", cookie)
 
 
+@app.on_response
+async def persist_auth_session(req, res):
+    """Persist a session cookie after successful Authorization-based auth."""
+    username = getattr(req.ctx, "_create_session_username", None)
+    if not username or res.status >= 400:
+        return
+    existing = getattr(req.ctx, "session", None)
+    if isinstance(existing, dict) and existing.get("username") == username:
+        return
+    session.create(res, username, secure=req.scheme == "https")
+
+
+# Register either SSO proxy or built-in auth routes based on PASKIA_BACKEND_URL
+if sso.paskia_enabled():
+    app.blueprint(sso.bp)  # SSO proxy for /auth/* routes
+else:
+    app.blueprint(auth.bp)  # Built-in auth routes
+app.blueprint(preview.bp)
+app.blueprint(bp)
+app.blueprint(fileserver.bp)
+app.exception(Exception)(handle_sanic_exception)
+
+
+setproctitle("cista-main")
+
+
+@app.before_server_start
+async def main_start(app):
+    config.load_config()
+    setproctitle(f"cista {config.config.path.name}")
+    app.ctx.threadexec = ThreadPoolExecutor(
+        max_workers=4, thread_name_prefix="cista-worker"
+    )
+    # Larger pool for long-running but low-memory zip operations
+    app.ctx.zipexec = ThreadPoolExecutor(max_workers=32, thread_name_prefix="cista-zip")
+    await start_preview_workers()
+    watching.start(app)
+
+
+# Sanic sometimes fails to execute after_server_stop, so we do it before instead (potentially interrupting handlers)
+@app.before_server_stop
+async def main_stop(app):
+    watching.stop(app)
+    await shutdown_preview_workers()
+    app.ctx.threadexec.shutdown()
+    app.ctx.zipexec.shutdown(cancel_futures=True)
+    await sso.close_client()
+    logger.debug("Cista worker threads all finished")
+
+
 www = {}