feature(web): Added web auth for the deer flow by WillemJiang · Pull Request #843 · bytedance/deer-flow

WillemJiang · 2026-02-01T14:21:12Z

This pull request introduces a comprehensive user authentication and management system to the backend, along with supporting changes to environment configuration, testing, and internationalization. The most significant updates are the addition of JWT-based authentication, new user/admin endpoints, environment variable documentation, and supporting utilities for secure password handling and CSRF protection.

Backend: User Authentication & Management

Implemented JWT-based authentication, CSRF token generation, and user role checks via new middleware in src/server/middleware/auth.py. This includes functions for token creation, verification, CSRF protection, and admin/user role enforcement.
Added user management endpoints to src/server/app.py for login, logout, password change, and admin-only user CRUD operations, all protected by the new authentication system. [1] [2]
Integrated authentication checks into sensitive endpoints, such as requiring admin for /api/mcp/server/metadata and user authentication for /api/chat/stream. [1] [2]
Added bcrypt as a dependency for secure password hashing in pyproject.toml.

Environment Configuration

Updated .env.example with documentation and placeholders for JWT_SECRET_KEY, initial admin credentials, and notes on secure key requirements. [1] [2]

Testing Support

Modified tests/unit/server/test_app.py to override authentication dependencies with mock users, enabling tests for endpoints that now require authentication. [1] [2] [3]

Internationalization & Frontend

Extended English and Chinese translation files with authentication and admin-related UI strings, such as login, logout, and configuration messages. [1] [2] [3] [4]
Adjusted frontend test configuration and dependencies for improved environment mocking and TypeScript support. [1] [2] [3]

Backend: Authentication & User Management

Added JWT-based authentication middleware, CSRF token utilities, and admin/user role enforcement in src/server/middleware/auth.py.
Introduced user login, logout, password change, and admin user CRUD endpoints in src/server/app.py, all protected by authentication and role checks. [1] [2]
Integrated authentication requirements into sensitive endpoints, such as /api/chat/stream and /api/mcp/server/metadata. [1] [2]
Added bcrypt dependency for secure password hashing in pyproject.toml.

Environment Configuration

Documented and added placeholders for JWT_SECRET_KEY and initial admin credentials in .env.example, including security requirements. [1] [2]

Testing & Internationalization

Updated backend tests to support authentication by overriding dependencies with mock users in tests/unit/server/test_app.py. [1] [2] [3]
Added authentication and admin UI strings to English and Chinese translation files. [1] [2] [3] [4]
Improved frontend test config and TypeScript support. [1] [2] [3]

Fixed the "Object is possibly 'undefined'" error in parseToken function by adding null safety check for parts[1] when parsing JWT tokens. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>

Replaced logical OR (||) with nullish coalescing operator (??) for safer null checking when parsing JWT tokens in auth utils. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>

Copilot

Pull request overview

This pull request introduces a comprehensive JWT-based authentication and user management system to DeerFlow. The implementation adds login/logout functionality, password management, admin-only user CRUD operations, and role-based access control across both backend and frontend.

Changes:

Added JWT-based authentication with user/admin roles and password hashing using bcrypt
Implemented user management endpoints (login, logout, password change, user CRUD) with role-based authorization
Integrated authentication middleware for frontend with protected routes and auth context
Added comprehensive test coverage for authentication flows and user management

Reviewed changes

Copilot reviewed 41 out of 43 changed files in this pull request and generated 24 comments.

Show a summary per file

File	Description
src/server/middleware/auth.py	New authentication middleware with JWT token generation/verification and role-based access control
src/config/users.py	User management system with bcrypt password hashing and YAML-based persistence
src/server/app.py	Added authentication endpoints and integrated auth dependencies into existing endpoints
web/src/core/auth/*	Frontend authentication utilities, context provider, and server-side helpers
web/src/middleware.ts	Next.js middleware for route protection and role-based access
web/src/app/admin/*	Admin pages for user management and system configuration
web/src/app/login/page.tsx	Login page component
tests/*	Comprehensive test coverage for authentication and user management
pyproject.toml	Added bcrypt dependency
.env.example	Added JWT and admin credential configuration

Files not reviewed (1)

web/pnpm-lock.yaml: Language not supported

Copilot · 2026-02-02T14:10:32Z

web/src/core/auth/utils.ts

+
+  try {
+    localStorage.setItem(AUTH_CONFIG.CSRF_TOKEN_KEY, token);
+    document.cookie = `${AUTH_CONFIG.CSRF_TOKEN_KEY}=${token}; path=/; max-age=${AUTH_CONFIG.DEFAULT_TTL / 1000}; SameSite=Strict; Secure`;


Security: The Secure flag should be conditional based on the environment. Setting secure=True for cookies in development (HTTP) will prevent them from working. Consider using environment-based configuration to set this flag appropriately.

src/server/app.py

Copilot · 2026-02-02T14:10:33Z

web/src/core/auth/utils.ts

+    }
+
+    // Decode payload (base64url)
+    const payload = JSON.parse(atob((parts[1] ?? '').replace(/-/g, '+').replace(/_/g, '/')));


Base64 decoding error handling: The JWT payload decoding on line 111 uses optional chaining on parts[1] which is good, but the fallback empty string '' will cause atob() to decode successfully but produce unexpected results. If parts[1] is undefined/null, the try-catch will handle it, but it's clearer to check explicitly before decoding.

src/server/app.py

tests/unit/server/test_user_endpoints.py

tests/unit/config/test_users.py

xunliu · 2026-02-03T07:37:53Z

src/config/users.py

+        with open(USERS_FILE, 'w', encoding='utf-8') as f:
+            yaml.dump(data, f, default_flow_style=False, allow_unicode=True)
+
+        _users_cache = users


hi @WillemJiang
I think we need to add a file write lock to prevent concurrent conflicts.

good suggest!

xunliu · 2026-02-05T01:21:52Z

LGTM

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

WillemJiang and others added 16 commits January 31, 2026 21:45

feat: the init code of web auth function

1b055b4

Fixed the build errors and lint errors

46cf7d8

Added user menu to the chat page for login out

a764526

fix the test error of test_app

2bf6846

refactoring the authentication parts

ee5627d

fix the test error on CI box

cffc9c4

Fixed the lint error of web frontend

b5f6e97

fix: use nullish coalescing operator in JWT parsing

a538226

Replaced logical OR (||) with nullish coalescing operator (??) for safer null checking when parsing JWT tokens in auth utils. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>

feat(web): harden admin auth and config access

c5a008f

fix the lint error of frontend

bd2ea59

fix the test error of web-auth feature

0a6febc

Fixed the unit test errors

e4b43b6

Added the user management for the web-auth

9e0339a

Add the unit tests for the user management

1b54b70

fixed the errors of command ' make lint-frontend'

50d2402

WillemJiang requested a review from Copilot February 2, 2026 13:57

Merge branch 'main' into web-auth-new

d205942

Copilot started reviewing on behalf of WillemJiang February 2, 2026 13:57 View session

Copilot AI reviewed Feb 2, 2026

View reviewed changes

xunliu reviewed Feb 3, 2026

View reviewed changes

WillemJiang and others added 5 commits February 6, 2026 15:35

Merge branch 'main' into web-auth-new

a45c3cd

Merge branch 'main' into web-auth-new

b361d36

Apply suggestions from code review

c57f2c5

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

updated the code as code review suggested

252e51d

Added the logout implementation

58f758d

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feature(web): Added web auth for the deer flow#843

feature(web): Added web auth for the deer flow#843
WillemJiang wants to merge 22 commits intobytedance:main-1.xfrom
WillemJiang:web-auth-new

WillemJiang commented Feb 1, 2026

Copilot AI left a comment

Copilot AI Feb 2, 2026

Uh oh!

Copilot AI Feb 2, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

xunliu Feb 3, 2026

WillemJiang Feb 3, 2026

xunliu commented Feb 5, 2026

Labels

3 participants

Conversation

WillemJiang commented Feb 1, 2026

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Copilot AI Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

xunliu Feb 3, 2026

Choose a reason for hiding this comment

WillemJiang Feb 3, 2026

Choose a reason for hiding this comment

xunliu commented Feb 5, 2026

Labels

3 participants