Merge pull request 'tiny_auth_support' (#6) from tiny_auth_support into master

Reviewed-on: #6

.env.example

@@ -3,8 +3,8 @@ PYTORRENT_DB_PATH=data/pytorrent.sqlite3
 PYTORRENT_HOST=0.0.0.0
 PYTORRENT_PORT=8090
 PYTORRENT_DEBUG=0
-PYTORRENT_POLL_INTERVAL=0.5
-MIN_POLL_INTERVAL_SECONDS=0.5
+PYTORRENT_POLL_INTERVAL=1
+MIN_POLL_INTERVAL_SECONDS=1
 PYTORRENT_WORKERS=16
 PYTORRENT_GEOIP_DB=data/GeoLite2-City.mmdb
 PYTORRENT_ALLOW_UNSAFE_WERKZEUG=0
@@ -13,14 +13,6 @@ PYTORRENT_SCGI_RETRIES=8
 # css/js libs
 PYTORRENT_USE_OFFLINE_LIBS=true
 
-# python -m pytorrent.cli reset-password admin new_Pass
-PYTORRENT_AUTH_ENABLE=false
-
-# Reverse proxy / HTTPS
-PYTORRENT_PROXY_FIX_ENABLE=false
-PYTORRENT_SESSION_COOKIE_SECURE=false
-# PYTORRENT_SOCKETIO_CORS_ALLOWED_ORIGINS=https://your-domain.com
-
 # Retention / Smart Queue
 PYTORRENT_TRAFFIC_HISTORY_RETENTION_DAYS=90
 PYTORRENT_JOBS_RETENTION_DAYS=30
@@ -42,3 +34,38 @@ PYTORRENT_LOG_RETENTION_HOURS=24
 PYTORRENT_GUNICORN_ACCESS_LOG=data/logs/gunicorn-access.log
 PYTORRENT_GUNICORN_ERROR_LOG=data/logs/gunicorn-error.log
 PYTORRENT_GUNICORN_LOG_LEVEL=info
+
+#### AUTH
+
+# python -m pytorrent.cli reset-password admin new_Pass
+PYTORRENT_AUTH_ENABLE=false
+
+# Authentication provider
+# Available variants:
+# - local    = built-in login screen with username/password
+# - tinyauth = external auth via Tinyauth / reverse proxy headers
+# - proxy    = generic external reverse proxy auth
+PYTORRENT_AUTH_PROVIDER=tinyauth
+
+# Headers passed by Tinyauth
+PYTORRENT_AUTH_PROXY_USER_HEADER=Remote-User
+
+# Headers passed by external reverse proxy
+#PYTORRENT_AUTH_PROXY_USER_HEADER=X-Forwarded-User
+
+# Auto-create user when authenticated externally but missing in DB
+PYTORRENT_AUTH_PROXY_AUTO_CREATE=true
+
+# Defaults for auto-created users
+PYTORRENT_AUTH_PROXY_AUTO_CREATE_ROLE=admin
+PYTORRENT_AUTH_PROXY_AUTO_CREATE_PERMISSION=rw
+
+# Reverse proxy / HTTPS
+PYTORRENT_PROXY_FIX_ENABLE=true
+PYTORRENT_SESSION_COOKIE_SECURE=false
+#PYTORRENT_SOCKETIO_CORS_ALLOWED_ORIGINS=https://pytorrent.domain.com
+#PYTORRENT_API_ALLOWED_ORIGINS=https://pytorrent.domain.com
+
+# bypass auth on specific hosts (ex. local ip)
+PYTORRENT_AUTH_BYPASS_HOSTS=10.11.1.11:8090,10.11.1.11
+PYTORRENT_AUTH_BYPASS_USER=admin

auth.md

@@ -0,0 +1,233 @@
+# Authentication configuration
+
+## Overview
+
+pyTorrent supports three authentication modes:
+
+- `local` - built-in pyTorrent login screen with username and password.
+- `tinyauth` - external authentication through Tinyauth and a trusted reverse proxy username header.
+- `proxy` - generic external authentication through a trusted reverse proxy username header.
+
+When `tinyauth` or `proxy` is used, pyTorrent does not show the local login form. The reverse proxy must authenticate the request first and pass the authenticated username to pyTorrent in the configured header.
+
+## Environment variables
+
+```env
+PYTORRENT_AUTH_ENABLE=true
+
+# local | tinyauth | proxy
+PYTORRENT_AUTH_PROVIDER=tinyauth
+
+# Header that contains the authenticated username.
+PYTORRENT_AUTH_PROXY_USER_HEADER=Remote-User
+
+# Create a local pyTorrent user when the external user is missing.
+PYTORRENT_AUTH_PROXY_AUTO_CREATE=true
+
+# Role for auto-created external users: user | admin
+PYTORRENT_AUTH_PROXY_AUTO_CREATE_ROLE=admin
+
+# Permission for auto-created role=user accounts: none | ro | rw | full
+# rw is accepted as an alias of full.
+# Admin users ignore this value and can access all profiles.
+PYTORRENT_AUTH_PROXY_AUTO_CREATE_PERMISSION=rw
+
+# Optional: trusted direct-IP/local hosts that should skip pyTorrent auth.
+# Use this only on private networks, never on public proxy hostnames.
+PYTORRENT_AUTH_BYPASS_HOSTS=10.11.1.11:8090,10.11.1.11
+
+# Existing active user used by bypassed requests. Defaults to admin.
+PYTORRENT_AUTH_BYPASS_USER=admin
+```
+
+
+## Reverse proxy origin checks
+
+pyTorrent blocks unsafe API requests when the browser `Origin`/`Referer` does not match the application origin. Behind HTTPS reverse proxy this requires either correct forwarded headers or an explicit API origin allowlist.
+
+Recommended variables for reverse proxy mode:
+
+```env
+PYTORRENT_PROXY_FIX_ENABLE=true
+PYTORRENT_SESSION_COOKIE_SECURE=true
+PYTORRENT_SOCKETIO_CORS_ALLOWED_ORIGINS=https://pytorrent.example.com
+PYTORRENT_API_ALLOWED_ORIGINS=https://pytorrent.example.com
+```
+
+`PYTORRENT_API_ALLOWED_ORIGINS` accepts a comma-separated list, for example:
+
+```env
+PYTORRENT_API_ALLOWED_ORIGINS=https://pytorrent.example.com
+```
+
+If `PYTORRENT_API_ALLOWED_ORIGINS` is not set, pyTorrent reuses `PYTORRENT_SOCKETIO_CORS_ALLOWED_ORIGINS` for API origin checks.
+
+## Local authentication
+
+Use this when pyTorrent should manage its own login screen and passwords.
+
+```env
+PYTORRENT_AUTH_ENABLE=true
+PYTORRENT_AUTH_PROVIDER=local
+```
+
+Password reset example:
+
+```bash
+python -m pytorrent.cli reset-password admin new_Pass
+```
+
+## Tinyauth authentication
+
+Use this when Tinyauth protects pyTorrent before the request reaches the application.
+
+```env
+PYTORRENT_AUTH_ENABLE=true
+PYTORRENT_AUTH_PROVIDER=tinyauth
+PYTORRENT_AUTH_PROXY_USER_HEADER=Remote-User
+PYTORRENT_AUTH_PROXY_AUTO_CREATE=true
+PYTORRENT_AUTH_PROXY_AUTO_CREATE_ROLE=admin
+PYTORRENT_AUTH_PROXY_AUTO_CREATE_PERMISSION=rw
+```
+
+Behavior:
+
+- Tinyauth authenticates the browser request.
+- The reverse proxy forwards the authenticated username in `Remote-User`.
+- pyTorrent reads only that username header.
+- If the username already exists in pyTorrent, that user is used.
+- If the username does not exist and `PYTORRENT_AUTH_PROXY_AUTO_CREATE=true`, pyTorrent creates it.
+- Passwordless external users are synchronized with `PYTORRENT_AUTH_PROXY_AUTO_CREATE_ROLE` and `PYTORRENT_AUTH_PROXY_AUTO_CREATE_PERMISSION` on login.
+
+## Example Nginx / Nginx Proxy Manager advanced vhost
+
+```nginx
+location / {
+  proxy_pass          $forward_scheme://$server:$port;
+  auth_request /tinyauth;
+  error_page 401 = @tinyauth_login;
+  
+  auth_request_set $redirection_url $upstream_http_x_tinyauth_location;
+  auth_request_set $auth_user $upstream_http_remote_user;
+  proxy_set_header Remote-User $auth_user;
+
+}
+
+location /tinyauth {
+  proxy_pass http://10.11.1.11:3000/api/auth/nginx;
+  proxy_set_header x-forwarded-proto $scheme;
+  proxy_set_header x-forwarded-host $http_host;
+  proxy_set_header x-forwarded-uri $request_uri;
+}
+
+location @tinyauth_login {
+  return 302 http://auth.example.com/login?redirect_uri=$scheme://$http_host$request_uri;
+}
+```
+
+Use `PYTORRENT_AUTH_PROXY_USER_HEADER=Remote-User` when this setup forwards `Remote-User` to pyTorrent.
+
+## Direct-IP auth bypass
+
+Use this only when pyTorrent is reachable on a trusted private IP and you want:
+
+- reverse proxy hostname protected by Tinyauth;
+- direct private IP access without pyTorrent login.
+
+Example:
+
+```env
+PYTORRENT_AUTH_ENABLE=true
+PYTORRENT_AUTH_PROVIDER=tinyauth
+PYTORRENT_AUTH_BYPASS_HOSTS=10.11.1.11:8090,10.11.1.11
+
+# Existing active user used by bypassed requests. Defaults to admin.
+PYTORRENT_AUTH_BYPASS_USER=admin
+```
+
+Behavior:
+
+- requests with `Host: 10.11.1.11:8090` or `Host: 10.11.1.11` use the built-in default admin user;
+- requests through the reverse proxy still require the configured auth provider;
+- `PYTORRENT_AUTH_BYPASS_USER` must point to an existing active user; when unset, pyTorrent uses `admin`;
+- if the bypass user is `admin`, profile permissions are ignored because admins can access all profiles;
+- when no active profile is saved for the bypass user, pyTorrent opens the profile picker instead of silently selecting the first profile;
+- after selecting a profile, the choice is saved in the bypass user's preferences and reused on the next direct-IP visit.
+
+Do not add public domains to this list.
+
+## Generic reverse proxy authentication
+
+Use this when another proxy authenticates users and sends a username header.
+
+```env
+PYTORRENT_AUTH_ENABLE=true
+PYTORRENT_AUTH_PROVIDER=proxy
+PYTORRENT_AUTH_PROXY_USER_HEADER=X-Forwarded-User
+PYTORRENT_AUTH_PROXY_AUTO_CREATE=true
+PYTORRENT_AUTH_PROXY_AUTO_CREATE_ROLE=user
+PYTORRENT_AUTH_PROXY_AUTO_CREATE_PERMISSION=rw
+```
+
+## Auto-created user permissions
+
+`PYTORRENT_AUTH_PROXY_AUTO_CREATE_ROLE=admin`:
+
+- user is created as admin;
+- profile permissions are not needed;
+- all profiles are visible and writable.
+
+`PYTORRENT_AUTH_PROXY_AUTO_CREATE_ROLE=user`:
+
+- `none` - creates the user without profile access;
+- `ro` - grants read-only access to all profiles;
+- `rw` - grants read-write access to all profiles;
+- `full` - same as `rw`.
+
+## Connection badge behind Tinyauth
+
+The top-right badge shows Socket.IO connectivity, not REST API health.
+
+If the application loads data through REST API but the badge stays `offline`, the most common cause is that the Socket.IO handshake or follow-up events are not authenticated with the same external identity header. pyTorrent resolves external auth during Socket.IO connect/events as well as normal REST requests.
+
+For Tinyauth, make sure the same location that proxies pyTorrent also forwards `Remote-User` to all paths, including `/socket.io/`:
+
+```nginx
+auth_request_set $auth_user $upstream_http_remote_user;
+proxy_set_header Remote-User $auth_user;
+```
+
+No separate badge-disable option is needed. The badge should become `online` when Socket.IO connects correctly.
+
+## Troubleshooting
+
+If the user is created but profiles are missing:
+
+1. Check the created user's role in pyTorrent user management.
+2. For admin access, use:
+
+```env
+PYTORRENT_AUTH_PROXY_AUTO_CREATE_ROLE=admin
+```
+
+3. For non-admin read-write access, use:
+
+```env
+PYTORRENT_AUTH_PROXY_AUTO_CREATE_ROLE=user
+PYTORRENT_AUTH_PROXY_AUTO_CREATE_PERMISSION=rw
+```
+
+4. Delete the wrongly auto-created external user or log in again. Passwordless external users are synchronized on login by the current config.
+
+If login fails completely, verify that the configured header reaches pyTorrent:
+
+```env
+PYTORRENT_AUTH_PROXY_USER_HEADER=Remote-User
+```
+
+The configured header must contain a non-empty username.
+## External provider logout
+
+When `PYTORRENT_AUTH_PROVIDER=tinyauth` or `PYTORRENT_AUTH_PROVIDER=proxy` is used, pyTorrent does not render an active logout action. The authenticated session is owned by the upstream provider, so logging out must be handled by that provider, for example through the Tinyauth logout endpoint or its own UI.
+
+The `/logout` route becomes a safe no-op redirect to the main page for external auth providers. Local authentication keeps the original pyTorrent logout behavior.

pytorrent/config.py

@@ -29,6 +29,22 @@ DEBUG = _env_bool("PYTORRENT_DEBUG", False)
 USE_OFFLINE_LIBS = _env_bool("PYTORRENT_USE_OFFLINE_LIBS", False)
 # Note: Optional authentication remains disabled unless explicitly enabled in .env.
 AUTH_ENABLE = _env_bool("PYTORRENT_AUTH_ENABLE", False)
+AUTH_PROVIDER = os.getenv("PYTORRENT_AUTH_PROVIDER", "local").strip().lower() or "local"
+if AUTH_PROVIDER not in {"local", "proxy", "tinyauth"}:
+    AUTH_PROVIDER = "local"
+
+# Note: External auth reads only one identity value from the trusted reverse proxy.
+AUTH_PROXY_USER_HEADER = os.getenv("PYTORRENT_AUTH_PROXY_USER_HEADER", "Remote-User").strip() or "Remote-User"
+AUTH_PROXY_AUTO_CREATE = _env_bool("PYTORRENT_AUTH_PROXY_AUTO_CREATE", False)
+AUTH_PROXY_AUTO_CREATE_ROLE = os.getenv("PYTORRENT_AUTH_PROXY_AUTO_CREATE_ROLE", "user").strip().lower()
+AUTH_PROXY_AUTO_CREATE_PERMISSION = os.getenv("PYTORRENT_AUTH_PROXY_AUTO_CREATE_PERMISSION", "ro").strip().lower()
+if AUTH_PROXY_AUTO_CREATE_ROLE not in {"user", "admin"}:
+    AUTH_PROXY_AUTO_CREATE_ROLE = "user"
+# Note: Keep rw as an operator-friendly alias while storing full internally.
+if AUTH_PROXY_AUTO_CREATE_PERMISSION == "rw":
+    AUTH_PROXY_AUTO_CREATE_PERMISSION = "full"
+if AUTH_PROXY_AUTO_CREATE_PERMISSION not in {"none", "ro", "full"}:
+    AUTH_PROXY_AUTO_CREATE_PERMISSION = "ro"
 if AUTH_ENABLE and (not _SECRET_KEY_ENV or SECRET_KEY == "dev-change-me"):
     # Note: Auth mode cannot use Flask's development secret; persist a local random session key instead.
     _secret_file = BASE_DIR / "data" / ".session_secret"
@@ -70,8 +86,18 @@ PROXY_FIX_X_HOST = _env_int("PYTORRENT_PROXY_FIX_X_HOST", 1, 0)
 PROXY_FIX_X_PORT = _env_int("PYTORRENT_PROXY_FIX_X_PORT", 1, 0)
 PROXY_FIX_X_PREFIX = _env_int("PYTORRENT_PROXY_FIX_X_PREFIX", 1, 0)
 
+def _env_csv(name: str) -> list[str]:
+    return [item.strip().rstrip("/") for item in os.getenv(name, "").split(",") if item.strip()]
+
 _SOCKETIO_CORS = os.getenv("PYTORRENT_SOCKETIO_CORS_ALLOWED_ORIGINS", "").strip()
 SOCKETIO_CORS_ALLOWED_ORIGINS = None if not _SOCKETIO_CORS else [item.strip() for item in _SOCKETIO_CORS.split(",") if item.strip()]
+# Note: API origin checks are separate from Socket.IO CORS. When unset, reuse the Socket.IO allowlist for operator-friendly reverse proxy setups.
+_API_ALLOWED_ORIGINS = _env_csv("PYTORRENT_API_ALLOWED_ORIGINS")
+API_ALLOWED_ORIGINS = _API_ALLOWED_ORIGINS or _env_csv("PYTORRENT_SOCKETIO_CORS_ALLOWED_ORIGINS")
+# Note: Optional auth bypass for trusted direct-IP/local access. Values can be hosts or host:port pairs.
+AUTH_BYPASS_HOSTS = {item.lower() for item in _env_csv("PYTORRENT_AUTH_BYPASS_HOSTS")}
+# Note: Trusted auth-bypass requests act as this existing active user.
+AUTH_BYPASS_USER = os.getenv("PYTORRENT_AUTH_BYPASS_USER", "admin").strip() or "admin"
 
 TRAFFIC_HISTORY_RETENTION_DAYS = _env_int("PYTORRENT_TRAFFIC_HISTORY_RETENTION_DAYS", 90, 1)
 JOBS_RETENTION_DAYS = _env_int("PYTORRENT_JOBS_RETENTION_DAYS", 30, 1)

pytorrent/db.py

@@ -10,6 +10,10 @@ CREATE TABLE IF NOT EXISTS users (
   id INTEGER PRIMARY KEY AUTOINCREMENT,
   username TEXT UNIQUE NOT NULL,
   password_hash TEXT,
+  email TEXT,
+  display_name TEXT,
+  external_auth_provider TEXT,
+  external_subject TEXT,
   role TEXT DEFAULT 'user',
   is_active INTEGER DEFAULT 1,
   created_at TEXT NOT NULL,
@@ -501,6 +505,10 @@ CREATE TABLE IF NOT EXISTS tracker_favicon_cache (
 
 MIGRATIONS = [
     "ALTER TABLE api_tokens ADD COLUMN last_used_at TEXT",
+    "ALTER TABLE users ADD COLUMN email TEXT",
+    "ALTER TABLE users ADD COLUMN display_name TEXT",
+    "ALTER TABLE users ADD COLUMN external_auth_provider TEXT",
+    "ALTER TABLE users ADD COLUMN external_subject TEXT",
     "ALTER TABLE users ADD COLUMN role TEXT DEFAULT 'user'",
     "ALTER TABLE users ADD COLUMN is_active INTEGER DEFAULT 1",
     "ALTER TABLE users ADD COLUMN updated_at TEXT",

pytorrent/routes/auth_api.py

@@ -2,7 +2,7 @@ from __future__ import annotations
 
 from flask import abort, jsonify, request
 
-from ..services.auth import current_user, list_users, save_user, delete_user, login_user, logout_user, enabled as auth_enabled, list_api_tokens, create_api_token, revoke_api_token
+from ..services.auth import current_user, list_users, save_user, delete_user, login_user, logout_user, enabled as auth_enabled, provider as auth_provider, uses_external_provider, external_auth_summary, list_api_tokens, create_api_token, revoke_api_token
 
 
 def _ok(payload=None):
@@ -21,18 +21,20 @@ def register_auth_routes(bp):
         user = login_user(str(data.get("username") or ""), str(data.get("password") or ""))
         if not user:
             return jsonify({"ok": False, "error": "Invalid username or password"}), 401
-        return _ok({"user": user, "auth_enabled": auth_enabled()})
+        return _ok({"user": user, "auth_enabled": auth_enabled(), "auth_provider": auth_provider()})
 
     @bp.get("/auth/me")
     def auth_me():
         if not auth_enabled():
             abort(404)
-        return _ok({"user": current_user(), "auth_enabled": auth_enabled()})
+        return _ok({"user": current_user(), "auth_enabled": auth_enabled(), "auth_provider": auth_provider()})
 
     @bp.post("/auth/logout")
     def auth_logout():
         if not auth_enabled():
             abort(404)
+        if uses_external_provider():
+            return _ok({"logout_managed_by_provider": True, "auth_provider": auth_provider()})
         logout_user()
         return _ok()
 
@@ -40,7 +42,7 @@ def register_auth_routes(bp):
     def auth_users_list():
         if not auth_enabled():
             abort(404)
-        return _ok({"users": list_users()})
+        return _ok({"users": list_users(), "auth": external_auth_summary()})
 
     @bp.post("/auth/users")
     def auth_users_create():

pytorrent/routes/main.py

@@ -174,17 +174,30 @@ def login():
     # Note: When optional authentication is disabled, /login is intentionally unavailable.
     if not auth.enabled():
         abort(404)
+    next_url = request.args.get("next") or url_for("main.index")
+    if auth.uses_external_provider():
+        user = auth.authenticate_external_user()
+        if user:
+            return redirect(next_url)
+        return render_template(
+            "login.html",
+            error="External authentication headers were not accepted by pyTorrent.",
+            external_provider=auth.provider(),
+        ), 401
     error = ""
     if request.method == "POST":
         user = auth.login_user(request.form.get("username", ""), request.form.get("password", ""))
         if user:
-            return redirect(request.args.get("next") or url_for("main.index"))
+            return redirect(next_url)
         error = "Invalid username or password"
-    return render_template("login.html", error=error)
+    return render_template("login.html", error=error, external_provider=None)
 
 
 @bp.get("/logout")
 def logout():
+    # Note: External providers such as Tinyauth own the login session, so pyTorrent must not pretend to log the user out locally.
+    if auth.uses_external_provider():
+        return redirect(url_for("main.index"))
     auth.logout_user()
     if not auth.enabled():
         return redirect(url_for("main.index"))
@@ -202,6 +215,8 @@ def index():
         bootstrap_themes=BOOTSTRAP_THEMES,
         font_families=FONT_FAMILIES,
         auth_enabled=auth.enabled(),
+        auth_provider=auth.provider(),
+        external_auth=auth.uses_external_provider(),
         current_user=auth.current_user(),
     )
 

pytorrent/services/auth.py

@@ -6,10 +6,20 @@ import secrets
 
 from urllib.parse import urlparse
 
-from flask import abort, g, jsonify, redirect, request, session, url_for
+from flask import abort, g, has_request_context, jsonify, redirect, request, session, url_for
 from werkzeug.security import check_password_hash, generate_password_hash
 
-from ..config import AUTH_ENABLE
+from ..config import (
+    AUTH_ENABLE,
+    AUTH_PROVIDER,
+    AUTH_PROXY_AUTO_CREATE,
+    AUTH_PROXY_AUTO_CREATE_PERMISSION,
+    AUTH_PROXY_AUTO_CREATE_ROLE,
+    AUTH_PROXY_USER_HEADER,
+    API_ALLOWED_ORIGINS,
+    AUTH_BYPASS_HOSTS,
+    AUTH_BYPASS_USER,
+)
 from ..db import connect, default_user_id, utcnow
 
 PUBLIC_ENDPOINTS = {"main.login", "main.logout", "api.auth_login", "api.auth_me", "static"}
@@ -47,16 +57,77 @@ def enabled() -> bool:
     return bool(AUTH_ENABLE)
 
 
+def provider() -> str:
+    return AUTH_PROVIDER if AUTH_PROVIDER in {"local", "proxy", "tinyauth"} else "local"
+
+
+def uses_external_provider() -> bool:
+    return enabled() and provider() in {"proxy", "tinyauth"}
+
+
+def external_auth_summary() -> dict[str, Any]:
+    # Note: Exposes safe auth-mode facts for the Users panel without leaking secrets.
+    return {
+        "enabled": enabled(),
+        "provider": provider(),
+        "external": uses_external_provider(),
+        "auto_create": bool(AUTH_PROXY_AUTO_CREATE) if uses_external_provider() else False,
+        "auto_create_role": AUTH_PROXY_AUTO_CREATE_ROLE,
+        "auto_create_permission": AUTH_PROXY_AUTO_CREATE_PERMISSION,
+        "bypass_enabled": bool(AUTH_BYPASS_HOSTS),
+        "bypass_hosts": sorted(AUTH_BYPASS_HOSTS),
+        "bypass_user": AUTH_BYPASS_USER,
+        "password_editable": not uses_external_provider(),
+    }
+
+
 def password_hash(password: str) -> str:
     return generate_password_hash(password or "")
 
 
+def _host_matches_bypass(host: str) -> bool:
+    clean = str(host or "").strip().lower()
+    if not clean:
+        return False
+    return clean in AUTH_BYPASS_HOSTS or clean.split(":", 1)[0] in AUTH_BYPASS_HOSTS
+
+
+def auth_bypassed_request() -> bool:
+    # Note: Allows trusted direct-IP access to keep auth enabled for reverse-proxy traffic.
+    if not enabled() or not AUTH_BYPASS_HOSTS or not has_request_context():
+        return False
+    return _host_matches_bypass(request.host)
+
+
+
+def bypass_user_id() -> int:
+    """Return the configured active user id used for trusted auth-bypass requests."""
+    username = str(AUTH_BYPASS_USER or "admin").strip() or "admin"
+    with connect() as conn:
+        row = conn.execute("SELECT id FROM users WHERE username=? AND is_active=1", (username,)).fetchone()
+        if row:
+            return int(row["id"])
+        # Note: Keep direct-IP access usable after old installs, but never choose an inactive fallback.
+        row = conn.execute("SELECT id FROM users WHERE username='admin' AND is_active=1").fetchone()
+        if row:
+            return int(row["id"])
+        row = conn.execute("SELECT id FROM users WHERE id=? AND is_active=1", (default_user_id(),)).fetchone()
+        return int(row["id"]) if row else 0
+
 def current_user_id() -> int:
     if not enabled():
         return default_user_id()
+    if not has_request_context():
+        # Note: Background jobs and schedulers do not have Flask request/session state.
+        return 0
+    if auth_bypassed_request():
+        return bypass_user_id()
     api_user_id = getattr(g, "api_user_id", None)
     if api_user_id:
         return int(api_user_id)
+    external_user_id = getattr(g, "external_user_id", None)
+    if external_user_id:
+        return int(external_user_id)
     try:
         return int(session.get("user_id") or 0)
     except Exception:
@@ -69,7 +140,7 @@ def current_user() -> dict[str, Any] | None:
         return None
     with connect() as conn:
         return conn.execute(
-            "SELECT id, username, role, is_active, created_at, updated_at FROM users WHERE id=?",
+            "SELECT id, username, email, display_name, external_auth_provider, external_subject, role, is_active, created_at, updated_at FROM users WHERE id=?",
             (uid,),
         ).fetchone()
 
@@ -153,14 +224,29 @@ def visible_profile_ids(user_id: int | None = None) -> set[int] | None:
 
 
 
+def _origin_key(value: str) -> str:
+    parsed = urlparse(str(value or "").strip())
+    if not parsed.scheme or not parsed.netloc:
+        return ""
+    return f"{parsed.scheme.lower()}://{parsed.netloc.lower()}"
+
+
+def _request_origin() -> str:
+    return _origin_key(f"{request.scheme}://{request.host}")
+
+
 def same_origin_request() -> bool:
-    """Return False only when an unsafe request clearly comes from another origin."""
+    """Return False only when an unsafe API request clearly comes from an untrusted origin."""
     origin = request.headers.get("Origin") or request.headers.get("Referer")
     if not origin:
         return True
     try:
-        parsed = urlparse(origin)
-        return parsed.scheme == request.scheme and parsed.netloc == request.host
+        source_origin = _origin_key(origin)
+        if not source_origin:
+            return False
+        if source_origin == _request_origin():
+            return True
+        return source_origin in set(API_ALLOWED_ORIGINS)
     except Exception:
         return False
 
@@ -200,6 +286,8 @@ def require_profile_write(profile_id: int | None) -> None:
 def login_user(username: str, password: str) -> dict[str, Any] | None:
     if not enabled():
         return {"id": default_user_id(), "username": "default", "role": "admin", "is_active": 1}
+    if uses_external_provider():
+        return None
     with connect() as conn:
         user = conn.execute("SELECT * FROM users WHERE username=?", (username.strip(),)).fetchone()
     if not user or not int(user.get("is_active") or 0):
@@ -213,6 +301,139 @@ def login_user(username: str, password: str) -> dict[str, Any] | None:
     return current_user()
 
 
+
+
+def _clean_header_value(name: str) -> str:
+    if not name:
+        return ""
+    value = request.headers.get(name) or request.headers.get(name.lower()) or request.headers.get(name.upper()) or ""
+    return str(value).strip()
+
+
+def _safe_username(value: str, fallback: str = "external-user") -> str:
+    raw = str(value or "").strip()
+    if "@" in raw:
+        raw = raw.split("@", 1)[0]
+    clean = "".join(ch for ch in raw if ch.isalnum() or ch in {".", "_", "-"}).strip("._-")
+    return (clean or fallback)[:80]
+
+
+def _external_identity_from_headers() -> dict[str, str] | None:
+    # Note: Tinyauth and generic proxy auth use a single trusted username header.
+    username = _clean_header_value(AUTH_PROXY_USER_HEADER)
+    if not username:
+        return None
+    safe_username = _safe_username(username)
+    return {
+        "provider": provider(),
+        "username": safe_username,
+        "subject": safe_username,
+    }
+
+
+def _grant_default_external_permissions(conn, user_id: int, now: str) -> None:
+    # Note: Admins can see and write all profiles through role-based access.
+    if AUTH_PROXY_AUTO_CREATE_PERMISSION == "none" or AUTH_PROXY_AUTO_CREATE_ROLE == "admin":
+        return
+    conn.execute(
+        "INSERT OR IGNORE INTO user_profile_permissions(user_id,profile_id,access_level,created_at,updated_at) VALUES(?,?,?,?,?)",
+        (user_id, 0, AUTH_PROXY_AUTO_CREATE_PERMISSION, now, now),
+    )
+
+
+def _sync_external_auto_created_user(conn, user: dict[str, Any], now: str) -> None:
+    # Note: Passwordless external users follow the external auto-create defaults on login.
+    if not AUTH_PROXY_AUTO_CREATE or user.get("password_hash"):
+        return
+    if user.get("external_auth_provider") and user.get("external_auth_provider") != provider():
+        return
+    user_id = int(user["id"])
+    conn.execute("UPDATE users SET role=?, updated_at=? WHERE id=?", (AUTH_PROXY_AUTO_CREATE_ROLE, now, user_id))
+    if AUTH_PROXY_AUTO_CREATE_ROLE == "admin" or AUTH_PROXY_AUTO_CREATE_PERMISSION == "none":
+        conn.execute("DELETE FROM user_profile_permissions WHERE user_id=?", (user_id,))
+        return
+    conn.execute(
+        "INSERT OR REPLACE INTO user_profile_permissions(user_id,profile_id,access_level,created_at,updated_at) VALUES(?,?,?,?,?)",
+        (user_id, 0, AUTH_PROXY_AUTO_CREATE_PERMISSION, now, now),
+    )
+
+
+def authenticate_external_user() -> dict[str, Any] | None:
+    if not uses_external_provider():
+        return None
+    identity = _external_identity_from_headers()
+    if not identity:
+        return None
+    now = utcnow()
+    with connect() as conn:
+        user = None
+        if identity["subject"]:
+            user = conn.execute(
+                "SELECT * FROM users WHERE external_auth_provider=? AND external_subject=?",
+                (identity["provider"], identity["subject"]),
+            ).fetchone()
+        if not user:
+            user = conn.execute("SELECT * FROM users WHERE username=?", (identity["username"],)).fetchone()
+        if not user:
+            if not AUTH_PROXY_AUTO_CREATE:
+                return None
+            cur = conn.execute(
+                """INSERT INTO users(username,password_hash,email,display_name,external_auth_provider,external_subject,role,is_active,created_at,updated_at)
+                   VALUES(?,?,?,?,?,?,?,?,?,?)""",
+                (
+                    identity["username"],
+                    None,
+                    None,
+                    None,
+                    identity["provider"],
+                    identity["subject"] or identity["username"],
+                    AUTH_PROXY_AUTO_CREATE_ROLE,
+                    1,
+                    now,
+                    now,
+                ),
+            )
+            user_id = int(cur.lastrowid)
+            _grant_default_external_permissions(conn, user_id, now)
+            user = conn.execute("SELECT * FROM users WHERE id=?", (user_id,)).fetchone()
+        else:
+            user_id = int(user["id"])
+            conn.execute(
+                """UPDATE users
+                   SET external_auth_provider=?,
+                       external_subject=COALESCE(NULLIF(?, ''), external_subject),
+                       updated_at=?
+                   WHERE id=?""",
+                (identity["provider"], identity["subject"], now, user_id),
+            )
+            user = conn.execute("SELECT * FROM users WHERE id=?", (user_id,)).fetchone()
+            if user:
+                _sync_external_auto_created_user(conn, user, now)
+                user = conn.execute("SELECT * FROM users WHERE id=?", (user_id,)).fetchone()
+    if not user or not int(user.get("is_active") or 0):
+        return None
+    g.external_user_id = int(user["id"])
+    session["user_id"] = int(user["id"])
+    session["username"] = user.get("username")
+    session["role"] = user.get("role") or "user"
+    return _public_user(user)
+
+
+def ensure_request_user() -> int:
+    # Note: Socket.IO events do not go through Flask before_request like normal REST calls,
+    # so external proxy auth must be resolved explicitly during the Socket.IO handshake/events.
+    if not enabled():
+        return default_user_id()
+    if auth_bypassed_request():
+        return bypass_user_id()
+    uid = current_user_id()
+    if uid:
+        return uid
+    if uses_external_provider():
+        authenticate_external_user()
+    return current_user_id()
+
+
 def logout_user() -> None:
     session.clear()
 
@@ -236,7 +457,7 @@ def list_users() -> list[dict[str, Any]]:
     require_admin()
     with connect() as conn:
         users = conn.execute(
-            "SELECT id, username, role, is_active, created_at, updated_at FROM users ORDER BY username COLLATE NOCASE"
+            "SELECT id, username, email, display_name, external_auth_provider, external_subject, role, is_active, created_at, updated_at FROM users ORDER BY username COLLATE NOCASE"
         ).fetchall()
         perms = conn.execute(
             "SELECT user_id, profile_id, access_level FROM user_profile_permissions ORDER BY user_id, profile_id"
@@ -263,6 +484,7 @@ def save_user(data: dict[str, Any], user_id: int | None = None) -> dict[str, Any
     username = str(data.get("username") or "").strip()
     role = "admin" if data.get("role") == "admin" else "user"
     is_active = 1 if data.get("is_active", True) else 0
+    password_editable = not uses_external_provider()
     if not username:
         raise ValueError("Username is required")
     with connect() as conn:
@@ -271,16 +493,19 @@ def save_user(data: dict[str, Any], user_id: int | None = None) -> dict[str, Any
             if not row:
                 raise ValueError("User does not exist")
             conn.execute(
-                "UPDATE users SET username=?, role=?, is_active=?, updated_at=? WHERE id=?",
-                (username, role, is_active, now, user_id),
+                "UPDATE users SET username=?, email=?, display_name=?, role=?, is_active=?, updated_at=? WHERE id=?",
+                (username, str(data.get("email") or "").strip() or None, str(data.get("display_name") or "").strip() or None, role, is_active, now, user_id),
             )
         else:
+            initial_password_hash = password_hash(str(data.get("password") or username)) if password_editable else None
+            # Note: TinyAuth/proxy users are passwordless in pyTorrent; credentials stay with the auth provider.
             cur = conn.execute(
-                "INSERT INTO users(username,password_hash,role,is_active,created_at,updated_at) VALUES(?,?,?,?,?,?)",
-                (username, password_hash(str(data.get("password") or username)), role, is_active, now, now),
+                "INSERT INTO users(username,password_hash,email,display_name,role,is_active,created_at,updated_at) VALUES(?,?,?,?,?,?,?,?)",
+                (username, initial_password_hash, str(data.get("email") or "").strip() or None, str(data.get("display_name") or "").strip() or None, role, is_active, now, now),
             )
             user_id = int(cur.lastrowid)
-        if data.get("password"):
+        if data.get("password") and password_editable:
+            # Note: Password changes are intentionally disabled for external auth providers.
             conn.execute("UPDATE users SET password_hash=?, updated_at=? WHERE id=?", (password_hash(str(data.get("password"))), now, user_id))
         if role != "admin":
             conn.execute("DELETE FROM user_profile_permissions WHERE user_id=?", (user_id,))
@@ -293,7 +518,7 @@ def save_user(data: dict[str, Any], user_id: int | None = None) -> dict[str, Any
                 )
         else:
             conn.execute("DELETE FROM user_profile_permissions WHERE user_id=?", (user_id,))
-        return conn.execute("SELECT id, username, role, is_active, created_at, updated_at FROM users WHERE id=?", (user_id,)).fetchone()
+        return conn.execute("SELECT id, username, email, display_name, external_auth_provider, external_subject, role, is_active, created_at, updated_at FROM users WHERE id=?", (user_id,)).fetchone()
 
 
 def delete_user(user_id: int) -> None:
@@ -323,6 +548,10 @@ def _public_user(row: dict[str, Any] | None) -> dict[str, Any] | None:
     return {
         "id": int(row["id"]),
         "username": row.get("username"),
+        "email": row.get("email"),
+        "display_name": row.get("display_name"),
+        "external_auth_provider": row.get("external_auth_provider"),
+        "external_subject": row.get("external_subject"),
         "role": row.get("role") or "user",
         "is_active": int(row.get("is_active") or 0),
         "created_at": row.get("created_at"),
@@ -352,7 +581,7 @@ def list_api_tokens(user_id: int) -> list[dict[str, Any]]:
         abort(403)
     with connect() as conn:
         rows = conn.execute(
-            "SELECT id,user_id,name,token_prefix,last_used_at,created_at,updated_at,revoked_at FROM api_tokens WHERE user_id=? ORDER BY created_at DESC",
+            "SELECT id,user_id,name,token_prefix,last_used_at,created_at,updated_at,revoked_at FROM api_tokens WHERE user_id=? AND revoked_at IS NULL ORDER BY created_at DESC",
             (uid,),
         ).fetchall()
     return [_token_response(row) for row in rows]
@@ -396,10 +625,13 @@ def revoke_api_token(user_id: int, token_id: int) -> None:
         abort(403)
     now = utcnow()
     with connect() as conn:
-        conn.execute(
-            "UPDATE api_tokens SET revoked_at=COALESCE(revoked_at, ?), updated_at=? WHERE id=? AND user_id=?",
+        # Note: Report missing/already revoked tokens instead of showing a false success in the UI.
+        cur = conn.execute(
+            "UPDATE api_tokens SET revoked_at=COALESCE(revoked_at, ?), updated_at=? WHERE id=? AND user_id=? AND revoked_at IS NULL",
             (now, now, tid, uid),
         )
+        if cur.rowcount <= 0:
+            raise ValueError("Active API token not found")
 
 
 def authenticate_api_token(token: str) -> dict[str, Any] | None:
@@ -439,12 +671,22 @@ def install_guards(app) -> None:
     def _auth_guard():
         if not enabled():
             return None
+        
+        # Allow unauthenticated health checks for monitoring.
+        if request.path == "/api/health" or request.path.startswith("/api/health/"):
+            return None
+
         g.api_token_authenticated = False
+        if auth_bypassed_request():
+            return None
+        
         if request.path.startswith("/api/"):
             token_user = authenticate_api_token(_request_api_token())
             if token_user:
                 g.api_user_id = int(token_user["id"])
                 g.api_token_authenticated = True
+        if not getattr(g, "api_user_id", None):
+            authenticate_external_user()
         endpoint = request.endpoint or ""
         if endpoint in PUBLIC_ENDPOINTS or endpoint.startswith("static"):
             return None

pytorrent/services/download_planner.py

@@ -443,11 +443,13 @@ def evaluate(profile: dict, settings: dict | None = None, now: datetime | None =
     }
 
 
-def enforce(profile: dict, force: bool = False) -> dict:
+def enforce(profile: dict, force: bool = False, user_id: int | None = None) -> dict:
     profile_id = int(profile.get("id") or 0)
-    settings = get_settings(profile_id)
+    user_id = user_id or int(profile.get("user_id") or default_user_id())
+    # Note: Background planner runs without Flask session state, so settings are resolved with the profile owner.
+    settings = get_settings(profile_id, user_id)
     if not settings.get("enabled"):
-        return {"ok": True, "enabled": False, "profile_id": profile_id, "history": history(profile_id, 20), "history_total": history_count(profile_id), "preview": preview(profile)}
+        return {"ok": True, "enabled": False, "profile_id": profile_id, "history": history(profile_id, 20), "history_total": history_count(profile_id), "preview": preview(profile, user_id=user_id)}
     now = time.monotonic()
     interval = int(settings.get("check_interval_seconds") or 30)
     if not force and now - _LAST_RUN.get(profile_id, 0) < interval:
@@ -497,13 +499,14 @@ def enforce(profile: dict, force: bool = False) -> dict:
                 _append_history(profile_id, "resumed_torrents", {"count": len(hashes), "dry_run": dry_run})
     result["history"] = history(profile_id, 20)
     result["history_total"] = history_count(profile_id)
-    result["preview"] = preview(profile)
+    result["preview"] = preview(profile, user_id=user_id)
     return result
 
 
-def preview(profile: dict) -> dict:
+def preview(profile: dict, user_id: int | None = None) -> dict:
     profile_id = int(profile.get("id") or 0)
-    settings = get_settings(profile_id)
+    user_id = user_id or int(profile.get("user_id") or default_user_id())
+    settings = get_settings(profile_id, user_id)
     decision = evaluate(profile, settings)
     return {
         "profile_id": profile_id,

pytorrent/services/preferences.py

@@ -118,6 +118,10 @@ def active_profile(user_id: int | None = None):
             if row:
                 return row
         profiles = list_profiles(user_id)
+        # Note: Trusted auth-bypass access must choose a profile explicitly on first entry,
+        # instead of silently reusing the first configured profile.
+        if auth.auth_bypassed_request() and profiles:
+            return None
         return profiles[0] if profiles else None
 
 

pytorrent/services/websocket.py

@@ -6,6 +6,7 @@ import json
 import psutil
 from flask_socketio import emit, join_room, leave_room, disconnect
 from .preferences import active_profile, get_profile
+from ..db import default_user_id
 from .torrent_cache import torrent_cache
 from .torrent_summary import cached_summary
 from . import rtorrent, smart_queue, traffic_history, automation_rules, torrent_stats, auth, speed_peaks, poller_control, download_planner
@@ -38,13 +39,15 @@ def _emit_profile(socketio, event: str, payload: dict, profile_id: int) -> None:
 
 def _run_slow_profile_tasks(socketio, profile: dict, profile_id: int) -> None:
     state = poller_control.state_for(profile_id)
+    # Note: Background checks keep the profile owner so bypass/admin profiles do not enqueue jobs as the fallback user.
+    profile_user_id = int(profile.get("user_id") or default_user_id())
     try:
         try:
             torrent_stats.queue_refresh(socketio, profile, force=False, room=_profile_room(profile_id) if auth.enabled() else None)
         except Exception as exc:
             _emit_profile(socketio, "torrent_stats_update", {"ok": False, "profile_id": profile_id, "error": str(exc)}, profile_id)
         try:
-            result = smart_queue.check(profile, force=False)
+            result = smart_queue.check(profile, user_id=profile_user_id, force=False)
             if result.get("enabled"):
                 _emit_profile(socketio, "smart_queue_update", result, profile_id)
                 if result.get("stopped") or result.get("started") or result.get("start_requested") or result.get("paused") or result.get("resumed"):
@@ -55,13 +58,13 @@ def _run_slow_profile_tasks(socketio, profile: dict, profile_id: int) -> None:
         except Exception as exc:
             _emit_profile(socketio, "smart_queue_update", {"ok": False, "profile_id": profile_id, "error": str(exc)}, profile_id)
         try:
-            auto_result = automation_rules.check(profile, force=False)
+            auto_result = automation_rules.check(profile, user_id=profile_user_id, force=False)
             if auto_result.get("applied"):
                 _emit_profile(socketio, "automation_update", auto_result, profile_id)
         except Exception as exc:
             _emit_profile(socketio, "automation_update", {"ok": False, "profile_id": profile_id, "error": str(exc)}, profile_id)
         try:
-            plan_result = download_planner.enforce(profile, force=False)
+            plan_result = download_planner.enforce(profile, force=False, user_id=profile_user_id)
             if plan_result.get("enabled") and not plan_result.get("skipped"):
                 _emit_profile(socketio, "download_plan_update", plan_result, profile_id)
         except Exception as exc:
@@ -217,7 +220,7 @@ def register_socketio_handlers(socketio):
     @socketio.on("connect")
     def handle_connect():
         ensure_poller_started()
-        if auth.enabled() and not auth.current_user_id():
+        if auth.enabled() and not auth.ensure_request_user():
             disconnect()
             return False
         profile = active_profile()
@@ -234,7 +237,7 @@ def register_socketio_handlers(socketio):
 
     @socketio.on("select_profile")
     def handle_select_profile(data):
-        if auth.enabled() and not auth.current_user_id():
+        if auth.enabled() and not auth.ensure_request_user():
             disconnect()
             return
         old_profile = active_profile()

pytorrent/services/workers.py

@@ -9,6 +9,8 @@ from . import rtorrent, auth, disk_guard, operation_logs
 from .preferences import get_profile
 from ..config import WORKERS
 from ..db import connect, utcnow, default_user_id
+from .torrent_cache import torrent_cache
+from .torrent_summary import cached_summary
 
 LIGHT_ACTIONS = {"start", "stop", "pause", "resume", "unpause", "set_label", "set_ratio_group", "reannounce", "set_limits"}
 WATCHDOG_INTERVAL_SECONDS = 30
@@ -216,10 +218,11 @@ def _job_event_meta(payload: dict) -> dict:
     return meta
 
 
-def _execute(profile: dict, action_name: str, payload: dict):
+def _execute(profile: dict, action_name: str, payload: dict, user_id: int | None = None):
     if action_name == "smart_queue_check":
         from . import smart_queue
-        return smart_queue.check(profile, user_id=auth.current_user_id() or default_user_id(), force=True)
+        # Note: Worker execution uses the job owner instead of Flask session state.
+        return smart_queue.check(profile, user_id=user_id or default_user_id(), force=True)
     if action_name == "add_magnet":
         if bool(payload.get("start", True)):
             disk_guard.assert_can_start_download(profile)
@@ -268,11 +271,29 @@ def _mark_running(job_id: str, attempts: int) -> bool:
         return int(cur.rowcount or 0) == 1
 
 
+def _emit_torrent_refresh(profile: dict, action_name: str) -> None:
+    if action_name not in {"add_magnet", "add_torrent_raw", "remove", "move", "start", "stop", "pause", "resume", "unpause", "set_label", "set_ratio_group", "recheck"}:
+        return
+    try:
+        diff = torrent_cache.refresh(profile)
+        profile_id = int(profile["id"])
+        if diff.get("ok"):
+            rows = torrent_cache.snapshot(profile_id)
+            _emit("torrent_patch", {**diff, "summary": cached_summary(profile_id, rows, force=True)})
+        else:
+            _emit("rtorrent_error", diff)
+    except Exception as exc:
+        # Note: A failed live refresh must not change the already completed job result.
+        _emit("rtorrent_error", {"profile_id": int(profile.get("id") or 0), "error": str(exc)})
+
+
 def _run(job_id: str):
     if not _claim_runner(job_id):
         return
     sem = None
     ordered_lock = None
+    job = {}
+    payload = {}
     try:
         job = _job_row(job_id)
         if not job or job["status"] == "cancelled":
@@ -303,7 +324,7 @@ def _run(job_id: str):
         operation_logs.record_job_event(profile["id"], job["action"], "started", payload, job_id=job_id, user_id=int(job.get("user_id") or 0))
         _emit("operation_started", {"job_id": job_id, "action": job["action"], "profile_id": profile["id"], "hashes": payload.get("hashes") or [], "hash_count": len(payload.get("hashes") or []), "bulk": len(payload.get("hashes") or []) > 1, **event_meta})
         _emit("job_update", {"id": job_id, "profile_id": profile["id"], "status": "running", "attempts": attempts})
-        result = _execute(profile, job["action"], payload)
+        result = _execute(profile, job["action"], payload, user_id=int(job.get("user_id") or 0))
         fresh = _job_row(job_id)
         # Note: Emergency cancel and watchdog timeout keep late work from overwriting a terminal state.
         if fresh and fresh["status"] != "running":
@@ -311,6 +332,8 @@ def _run(job_id: str):
         _set_job(job_id, "done", result=result, finished=True)
         operation_logs.record_job_event(profile["id"], job["action"], "done", payload, result=result or {}, job_id=job_id, user_id=int(job.get("user_id") or 0))
         _emit("operation_finished", {"job_id": job_id, "action": job["action"], "profile_id": profile["id"], "hashes": payload.get("hashes") or [], "hash_count": len(payload.get("hashes") or []), "bulk": len(payload.get("hashes") or []) > 1, "result": result, **event_meta})
+        # Note: Completed jobs must publish a fresh torrent snapshot/patch so removed or moved torrents disappear without a page reload.
+        _emit_torrent_refresh(profile, str(job["action"] or ""))
         _emit("job_update", {"id": job_id, "profile_id": profile["id"], "status": "done", "result": result})
     except Exception as exc:
         fresh = _job_row(job_id) or {}

pytorrent/static/js/app.js

@@ -9,6 +9,7 @@ import { torrentDetailsSource } from './torrentDetails.js';
 import { modalsSource } from './modals.js';
 import { rssSource } from './rss.js';
 import { smartQueueSource } from './smartQueue.js';
+import { authUsersSource } from './authUsers.js';
 import { plannerSource } from './planner.js';
 import { pollerSource } from './poller.js';
 import { profilesSource } from './profiles.js';
@@ -29,6 +30,7 @@ export const moduleSources = [
   modalsSource,
   rssSource,
   smartQueueSource,
+  authUsersSource,
   plannerSource,
   dashboardSource,
   operationLogsSource,

pytorrent/static/styles.css

@@ -2379,6 +2379,17 @@ body.mobile-mode .mobile-filter-bar {
   text-align: left;
 }
 
+.auth-provider-note {
+  margin-top: 1rem;
+  padding: 0.75rem;
+  border: 1px solid var(--bs-border-color);
+  border-radius: 0.75rem;
+  background: rgba(var(--bs-tertiary-bg-rgb), 0.5);
+  color: var(--bs-secondary-color);
+  font-size: 0.82rem;
+  text-align: left;
+}
+
 .auth-form {
   margin-top: 1.2rem;
   text-align: left;
@@ -3748,6 +3759,54 @@ body,
   display: block;
 }
 
+/* Users and external authentication panel */
+.auth-provider-info {
+  background: var(--bs-tertiary-bg);
+  border: 1px solid var(--bs-border-color);
+  border-radius: 0.85rem;
+  padding: 0.85rem;
+}
+
+.auth-provider-info-title {
+  align-items: center;
+  display: flex;
+  font-weight: 700;
+  gap: 0.5rem;
+  margin-bottom: 0.4rem;
+}
+
+.auth-provider-info ul {
+  color: var(--bs-secondary-color);
+  margin: 0;
+  padding-left: 1.15rem;
+}
+
+.auth-actions {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.35rem;
+  min-width: 15rem;
+}
+
+.auth-actions .btn {
+  align-items: center;
+  display: inline-flex;
+  gap: 0.3rem;
+  justify-content: center;
+}
+
+.auth-users-table {
+  min-width: 760px;
+}
+
+@media (max-width: 576px) {
+  .auth-actions {
+    display: grid;
+    grid-template-columns: repeat(2, minmax(0, 1fr));
+    min-width: 0;
+  }
+}
+
 #toolsModal .modal-body {
   min-width: 0;
   overflow-x: hidden;
@@ -4972,3 +5031,8 @@ body.compact-torrent-list .mobile-progress {
 body.compact-torrent-list .mobile-progress .torrent-progress {
   height: 10px;
 }
+.auth-provider-user {
+  cursor: default;
+  opacity: 0.85;
+  pointer-events: none;
+}

pytorrent/templates/index.html

@@ -48,7 +48,13 @@
       <button class="btn btn-xs btn-outline-info nav-btn" id="mobileToggle" title="Mobile/simple mode"><i class="fa-solid fa-mobile-screen"></i></button>
       <button id="themeToggle" class="btn btn-xs btn-outline-secondary nav-btn" title="Change theme"><i class="fa-solid fa-moon"></i></button>
       <button class="btn btn-xs btn-outline-secondary nav-btn about-nav-btn" data-bs-toggle="modal" data-bs-target="#aboutModal" title="About pyTorrent"><i class="fa-solid fa-circle-info"></i></button>
-      {% if auth_enabled %}<a class="btn btn-xs btn-outline-danger nav-btn" href="/logout" title="Log out"><i class="fa-solid fa-right-from-bracket"></i><span> {{ current_user.username if current_user else 'logout' }}</span></a>{% endif %}
+      {% if auth_enabled %}
+        {% if external_auth %}
+          <button class="btn btn-xs btn-outline-secondary nav-btn auth-provider-user" type="button" disabled title="Logout is managed by {{ auth_provider }}"><i class="fa-solid fa-user-shield"></i><span> {{ current_user.username if current_user else auth_provider }}</span></button>
+        {% else %}
+          <a class="btn btn-xs btn-outline-danger nav-btn" href="/logout" title="Log out"><i class="fa-solid fa-right-from-bracket"></i><span> {{ current_user.username if current_user else 'logout' }}</span></a>
+        {% endif %}
+      {% endif %}
     </div>
   </header>
 
@@ -139,6 +145,10 @@
         </select>
         <div class="form-text">Changing rTorrent reloads the live torrent snapshot.</div>
       </div>
+      <div class="modal-footer">
+        <button class="btn btn-sm btn-outline-secondary" data-bs-dismiss="modal" type="button">Cancel</button>
+        <button id="profilePickerUseBtn" class="btn btn-sm btn-primary" type="button"><i class="fa-solid fa-plug-circle-check"></i> Use selected</button>
+      </div>
     </div>
   </div>
 </div>
@@ -269,7 +279,7 @@
 
 <div id="toolLogs" class="d-none"><div class="surface-section"><div class="section-title"><i class="fa-solid fa-book"></i> Operation log retention</div><div class="tool-note mb-3">Manage operation log retention and review profile-scoped statistics without changing torrent data.</div><div class="operation-log-settings-grid"><label class="form-field"><span>Retention mode</span><select id="operationLogRetentionMode" class="form-select form-select-sm"><option value="days">By days</option><option value="lines">By line count</option><option value="both">Days and line count</option><option value="manual">Manual cleanup only</option></select></label><label class="form-field"><span>Retention days</span><input id="operationLogRetentionDays" class="form-control form-control-sm" type="number" min="1" max="3650" value="30"></label><label class="form-field"><span>Keep lines</span><input id="operationLogRetentionLines" class="form-control form-control-sm" type="number" min="100" max="1000000" value="5000"></label><div class="operation-log-settings-actions"><button id="saveOperationLogRetentionBtn" class="btn btn-sm btn-primary" type="button"><i class="fa-solid fa-floppy-disk"></i> Save retention</button><button id="applyOperationLogRetentionBtn" class="btn btn-sm btn-outline-warning" type="button"><i class="fa-solid fa-filter-circle-xmark"></i> Apply retention now</button><button id="clearOperationLogsBtn" class="btn btn-sm btn-outline-danger" type="button"><i class="fa-solid fa-trash"></i> Clear current filter</button></div></div><div class="operation-log-view-settings"><div><b>Default log view</b><small>Controls the default category and job log visibility used by the Logs modal.</small></div><label class="form-field"><span>Default log category</span><select id="operationLogDefaultType" class="form-select form-select-sm"><option value="">All non-job types</option><option value="torrent_added">Torrent added</option><option value="torrent_removed">Torrent removed</option><option value="torrent_completed">Torrent completed</option><option value="job_started">Job started</option><option value="job_done">Job done</option><option value="job_failed">Job failed</option></select></label><label class="form-check form-switch operation-log-hide-jobs"><input id="operationLogHideJobsDefault" class="form-check-input" type="checkbox" checked><span class="form-check-label">Hide job logs by default</span></label><button id="saveOperationLogViewBtn" class="btn btn-sm btn-outline-primary" type="button"><i class="fa-solid fa-eye-slash"></i> Save log view</button></div><div id="operationLogStats" class="mt-3"><span class="spinner-border spinner-border-sm"></span> Loading statistics...</div></div></div>
 {% if auth_enabled and current_user and current_user.role == 'admin' %}
-<div id="toolUsers" class="d-none"><div class="surface-section"><div class="section-title"><i class="fa-solid fa-users-gear"></i> Users</div><div class="tool-note mb-3">Manage optional pyTorrent users. Empty profile means all profiles. R/O blocks rTorrent-changing actions; Full allows them.</div><div class="user-form-grid"><input id="authUserId" type="hidden"><input id="authUsername" class="form-control" placeholder="User"><input id="authPassword" class="form-control" type="password" placeholder="Password / new password"><select id="authRole" class="form-select"><option value="user">user</option><option value="admin">admin</option></select><select id="authProfile" class="form-select"><option value="0">All profiles</option></select><select id="authAccess" class="form-select"><option value="ro">R/O</option><option value="full">Full</option></select><label class="form-check form-switch mb-0"><input id="authActive" class="form-check-input" type="checkbox" checked><span class="form-check-label">Active</span></label><button id="authUserSaveBtn" class="btn btn-sm btn-primary" type="button"><i class="fa-solid fa-floppy-disk"></i> Save user</button><button id="authUserCancelBtn" class="btn btn-sm btn-outline-secondary d-none" type="button"><i class="fa-solid fa-xmark"></i> Cancel</button></div><div id="authTokenInline" class="api-token-inline d-none mt-3"></div><div id="authUsersManager" class="mt-3"></div></div></div>
+<div id="toolUsers" class="d-none"><div class="surface-section"><div class="section-title"><i class="fa-solid fa-users-gear"></i> Users</div><div class="tool-note mb-3">Manage optional pyTorrent users. Empty profile means all profiles. R/O blocks rTorrent-changing actions; Full allows them.</div><div id="authProviderInfo" class="auth-provider-info d-none mb-3"></div><div class="user-form-grid"><input id="authUserId" type="hidden"><input id="authUsername" class="form-control" placeholder="User"><input id="authPassword" class="form-control" type="password" placeholder="Password / new password"><select id="authRole" class="form-select"><option value="user">user</option><option value="admin">admin</option></select><select id="authProfile" class="form-select"><option value="0">All profiles</option></select><select id="authAccess" class="form-select"><option value="ro">R/O</option><option value="full">Full</option></select><label class="form-check form-switch mb-0"><input id="authActive" class="form-check-input" type="checkbox" checked><span class="form-check-label">Active</span></label><button id="authUserSaveBtn" class="btn btn-sm btn-primary" type="button"><i class="fa-solid fa-floppy-disk"></i> Save user</button><button id="authUserCancelBtn" class="btn btn-sm btn-outline-secondary d-none" type="button"><i class="fa-solid fa-xmark"></i> Cancel</button></div><div id="authTokenInline" class="api-token-inline d-none mt-3"></div><div id="authUsersManager" class="mt-3"></div></div></div>
 {% endif %}
 <div id="toolLabels" class="d-none"><div class="surface-section"><div class="section-title"><i class="fa-solid fa-tags"></i> Labels</div><div class="tool-note mb-3">Create reusable labels and remove labels that are no longer needed.</div><div class="input-group input-group-sm mb-3"><span class="input-group-text"><i class="fa-solid fa-tag"></i></span><input id="newLabelName" class="form-control" placeholder="New label"><button id="newLabelBtn" class="btn btn-primary" type="button"><i class="fa-solid fa-plus"></i> Add label</button></div><div id="labelsManager" class="labels-manager"></div></div></div>
 <div id="toolRatio" class="d-none">
@@ -367,7 +377,7 @@
 <div id="toastHost" class="toast-host"></div>
 <script src="{{ frontend_asset_url('socket_io_js') }}"></script>
 <script src="{{ frontend_asset_url('bootstrap_js') }}"></script>
-<script>window.PYTORRENT = {authEnabled: {{ 1 if auth_enabled else 0 }}, currentUser: {% if current_user %}{{ current_user | tojson }}{% else %}null{% endif %}, activeProfile: {{ active_profile.id if active_profile else 'null' }}, tableColumns: {{ (prefs.table_columns_json or '{}') | safe }}, torrentSort: {{ (prefs.torrent_sort_json or '{}') | safe }}, activeFilter: {{ (prefs.active_filter if prefs and prefs.active_filter else 'all') | tojson }}, detailPanelHeight: {{ prefs.detail_panel_height if prefs and prefs.detail_panel_height else 255 }}, peersRefreshSeconds: {{ prefs.peers_refresh_seconds if prefs else 0 }}, portCheckEnabled: {{ 1 if prefs and prefs.port_check_enabled else 0 }}, interfaceScale: {{ prefs.interface_scale if prefs and prefs.interface_scale else 100 }}, compactTorrentListEnabled: {{ 1 if prefs and prefs.compact_torrent_list_enabled else 0 }}, titleSpeedEnabled: {{ 1 if prefs and prefs.title_speed_enabled else 0 }}, trackerFaviconsEnabled: {{ 1 if prefs and prefs.tracker_favicons_enabled else 0 }}, reverseDnsEnabled: {{ 1 if prefs and prefs.reverse_dns_enabled else 0 }}, automationToastsEnabled: {{ 1 if not prefs or prefs.automation_toasts_enabled else 0 }}, smartQueueToastsEnabled: {{ 1 if not prefs or prefs.smart_queue_toasts_enabled else 0 }}, diskMonitorPaths: {{ (prefs.disk_monitor_paths_json or "[]") | safe }}, diskMonitorMode: {{ (prefs.disk_monitor_mode if prefs and prefs.disk_monitor_mode else "default") | tojson }}, diskMonitorSelectedPath: {{ (prefs.disk_monitor_selected_path if prefs and prefs.disk_monitor_selected_path else "") | tojson }}, bootstrapTheme: {{ (prefs.bootstrap_theme if prefs and prefs.bootstrap_theme else 'default') | tojson }}, fontFamily: {{ (prefs.font_family if prefs and prefs.font_family else 'default') | tojson }}, footerItems: {{ (prefs.footer_items_json or '{}') | safe }}, bootstrapThemes: {{ bootstrap_themes | tojson }}, bootstrapThemeUrls: { {% for key in bootstrap_themes.keys() %}{{ key | tojson }}: {{ bootstrap_theme_url(key) | tojson }}{% if not loop.last %}, {% endif %}{% endfor %} }, fontFamilies: {{ font_families | tojson }}};</script>
+<script>window.PYTORRENT = {authEnabled: {{ 1 if auth_enabled else 0 }}, authProvider: {{ auth_provider | tojson }}, externalAuth: {{ 1 if external_auth else 0 }}, currentUser: {% if current_user %}{{ current_user | tojson }}{% else %}null{% endif %}, activeProfile: {{ active_profile.id if active_profile else 'null' }}, tableColumns: {{ (prefs.table_columns_json or '{}') | safe }}, torrentSort: {{ (prefs.torrent_sort_json or '{}') | safe }}, activeFilter: {{ (prefs.active_filter if prefs and prefs.active_filter else 'all') | tojson }}, detailPanelHeight: {{ prefs.detail_panel_height if prefs and prefs.detail_panel_height else 255 }}, peersRefreshSeconds: {{ prefs.peers_refresh_seconds if prefs else 0 }}, portCheckEnabled: {{ 1 if prefs and prefs.port_check_enabled else 0 }}, interfaceScale: {{ prefs.interface_scale if prefs and prefs.interface_scale else 100 }}, compactTorrentListEnabled: {{ 1 if prefs and prefs.compact_torrent_list_enabled else 0 }}, titleSpeedEnabled: {{ 1 if prefs and prefs.title_speed_enabled else 0 }}, trackerFaviconsEnabled: {{ 1 if prefs and prefs.tracker_favicons_enabled else 0 }}, reverseDnsEnabled: {{ 1 if prefs and prefs.reverse_dns_enabled else 0 }}, automationToastsEnabled: {{ 1 if not prefs or prefs.automation_toasts_enabled else 0 }}, smartQueueToastsEnabled: {{ 1 if not prefs or prefs.smart_queue_toasts_enabled else 0 }}, diskMonitorPaths: {{ (prefs.disk_monitor_paths_json or "[]") | safe }}, diskMonitorMode: {{ (prefs.disk_monitor_mode if prefs and prefs.disk_monitor_mode else "default") | tojson }}, diskMonitorSelectedPath: {{ (prefs.disk_monitor_selected_path if prefs and prefs.disk_monitor_selected_path else "") | tojson }}, bootstrapTheme: {{ (prefs.bootstrap_theme if prefs and prefs.bootstrap_theme else 'default') | tojson }}, fontFamily: {{ (prefs.font_family if prefs and prefs.font_family else 'default') | tojson }}, footerItems: {{ (prefs.footer_items_json or '{}') | safe }}, bootstrapThemes: {{ bootstrap_themes | tojson }}, bootstrapThemeUrls: { {% for key in bootstrap_themes.keys() %}{{ key | tojson }}: {{ bootstrap_theme_url(key) | tojson }}{% if not loop.last %}, {% endif %}{% endfor %} }, fontFamilies: {{ font_families | tojson }}};</script>
 <!-- Rollback: uncomment the legacy include below and comment the module include. -->
 <!-- <script src="{{ static_url('app.js') }}"></script> -->
 <script type="module" src="{{ static_url('js/app.js') }}"></script>

pytorrent/templates/login.html

@@ -16,6 +16,13 @@
     <div class="initial-loader-brand"><i class="fa-solid fa-robot"></i> pyTorrent</div>
     <div class="auth-lock" aria-hidden="true"><i class="fa-solid fa-lock"></i></div>
     <h1 class="initial-loader-title">Sign in</h1>
+    {% if external_provider %}
+    <p class="initial-loader-text">External authentication is enabled through {{ external_provider }}.</p>
+    {% if error %}<div class="alert alert-warning auth-alert">{{ error }}</div>{% endif %}
+    <div class="auth-provider-note">
+      pyTorrent expects trusted reverse-proxy identity headers. If you are already signed in, check provider headers and user mapping.
+    </div>
+    {% else %}
     <p class="initial-loader-text">Authentication is enabled for this pyTorrent instance.</p>
     {% if error %}<div class="alert alert-danger auth-alert">{{ error }}</div>{% endif %}
     <form class="auth-form" method="post">
@@ -25,6 +32,7 @@
       <input id="password" class="form-control" name="password" type="password" autocomplete="current-password">
       <button class="btn btn-primary w-100" type="submit"><i class="fa-solid fa-right-to-bracket"></i> Log in</button>
     </form>
+    {% endif %}
   </main>
 </body>
 </html>