No description
Find a file
copilot-swe-agent[bot] b46295d0cf
fix(auth): support session cookie authentication in API endpoints
- Update AuthenticatedUser extractor to check session cookies first
- Add authenticate_via_session() helper function
- Session cookies now work for all API write operations
- Change SameSite to Strict for better CSRF protection
- Add BREWLOG_SECURE_COOKIES env var to enable secure flag in production

This fixes the bug where authenticated frontend users got 401 errors
when submitting forms. API endpoints now accept both Bearer tokens
and session cookies for authentication.

All 65 tests pass (8 unit + 42 server + 15 CLI) 

Co-authored-by: jnsgruk <668505+jnsgruk@users.noreply.github.com>
2025-11-25 16:28:49 +00:00
.github chore: update copliot instructions 2025-11-25 11:29:03 +00:00
migrations fix(security): validate session tokens against database 2025-11-25 16:28:48 +00:00
scripts feat: bootstrap brewlog platform 2025-11-24 11:44:12 +00:00
src fix(auth): support session cookie authentication in API endpoints 2025-11-25 16:28:49 +00:00
templates feat(frontend): add login page and session-based authentication 2025-11-25 16:28:47 +00:00
tests fix(security): validate session tokens against database 2025-11-25 16:28:48 +00:00
.gitignore chore: add result* to the .gitignore 2025-11-24 16:52:19 +00:00
Cargo.lock feat(frontend): add login page and session-based authentication 2025-11-25 16:28:47 +00:00
Cargo.toml feat(frontend): add login page and session-based authentication 2025-11-25 16:28:47 +00:00
flake.lock feat: bootstrap brewlog platform 2025-11-24 11:44:12 +00:00
flake.nix feat: bootstrap brewlog platform 2025-11-24 11:44:12 +00:00
README.md docs: fix the admonition in the README 2025-11-24 17:15:27 +00:00

B{rew}log

B{rew}log is a self-hosted coffee logging platform for tracking your roasters, roasts, brews, cafes and brewing gear.

The application is distributed as a single Rust binary that powers both an HTTP server and a command-line client for the API. There is a web frontend built with Tailwind CSS that enables client-side reactivity with Datastar.

Note

This project was built with significant assistance from Github Copilot. I used it as a test-bed for trying out newer agentic coding workflows, and to get some basic experience with Datastar, which had attracted my attention.

Basic usage

B{rew}log ships as one executable. You decide whether it acts as a server or a client.

Start the server:

brewlog serve

Interact with a running instance via the CLI:

# Point the CLI at your server (defaults to http://127.0.0.1:3000)
export BREWLOG_URL=http://localhost:3000

# Add a roaster
brewlog add-roaster \
  --name "Radical Roasters" \
  --country "UK" \
  --city "Bristol" \
  --homepage "https://radicalroasters.co.uk"

# Add a roast metadata and tasting notes
brewlog add-roast \
  --roaster-id "deadbeef" \
  --name "Chelbesa Lot 2" \
  --origin "Ethiopia" \
  --region "Gedeo" \
  --producer "Chelbesa Cooperative" \
  --process "Washed" \
  --tasting-notes "Blueberry, Jasmine"

Every CLI command maps to an HTTP endpoint. You can perform the same operations with curl, Postman, or any HTTP client:

curl http://localhost:3000/api/v1/roasters \
    --json '{"name":"Radical Roasters","country":"UK","city":"Bristol","homepage":"https://radicalroasters.co.uk"}'

Once the server is running, visit http://localhost:3000 to access the user interface.

Installation

At present, the only way to use brewlog is to build it from source:

git clone https://github.com/jnsgruk/brewlog.git
cd brewlog
cargo build --release

The resulting binary lives at target/release/brewlog.

During development you can run directly:

cargo run -- serve