type
Screen Set
title
Session & dashboard
description
Public auth routes, the session-scoped password change, the health probe, and the role-dispatching dashboard.
tags
screens, auth, dashboard, session
status
stable
stale_after
Fri Apr 30 2027 02:00:00 GMT+0200 (Central European Summer Time)
generated
techwriter/mimo-v2.6-flash · Sat Oct 31 2026 11:02:38 GMT+0100 (Central European Standard Time)
sources
main → cmd/server/main.go; auth → internal/interfaces/http/auth_handler.go; dash → internal/interfaces/http/dashboard_handler.go

Session & dashboard

Everything outside the RBAC catalogue: login, logout, the password change, the health probe and the dashboard (which dispatches on role code, not on a gate).

Method Path Gate Handler
GET /health public JSON {status, version} — the swarm/Docker healthcheck target
GET /auth/login public login page (mints the CSRF cookie)
POST /auth/login public + CSRF login; in-memory rate limiter keys failed attempts per client+account and applies a growing lockout
POST /auth/logout public + CSRF clears the session
GET /auth/change-password authenticated + CSRF change-password page
POST /auth/change-password authenticated + CSRF change own password (bcrypt), invalidates the user's permission cache
GET / authenticated (no resource gate) dashboard: teacher → own classes, parent → own children, otherwise school-wide metrics

Every other route sits behind AuthMiddleware → CSRFMiddleware → RequireSetup → Require(resource, action); this group is the only surface that does not.

Rendered from simple-lms/screens/session.md · OKF bundle · regenerate with npm run render