Grotti 2.2.0: Auth, API-Tokens, MCP und Doku-Trennung.

web/templates/setup.html

@@ -0,0 +1,65 @@
+<!DOCTYPE html>
+<html lang="de">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="csrf" content="{{ csrf }}">
+<title>Setup · Grotti</title>
+<link rel="icon" type="image/png" sizes="32x32" href="{{ url_for('static', filename='brand/favicon-32.png') }}">
+<link rel="stylesheet" href="{{ url_for('static', filename='grotti.css') }}?v=40">
+</head>
+<body class="auth-body">
+<main class="auth-card">
+  <h1 class="auth-brand"><img src="{{ url_for('static', filename='brand/logo.png') }}" alt="" width="40" height="40" decoding="async"> Grotti einrichten</h1>
+  <p class="tiny">Lege den ersten Administrator an. Danach ist Login Pflicht.</p>
+  <form id="setup-form" class="stack">
+    <div class="field">
+      <label for="username">Admin-Benutzer</label>
+      <input id="username" name="username" autocomplete="username" required autofocus minlength="2">
+    </div>
+    <div class="field">
+      <label for="password">Passwort</label>
+      <input id="password" name="password" type="password" autocomplete="new-password" required minlength="8">
+    </div>
+    <div class="field">
+      <label for="password2">Passwort wiederholen</label>
+      <input id="password2" name="password2" type="password" autocomplete="new-password" required minlength="8">
+    </div>
+    <button type="submit">Admin anlegen</button>
+    <p class="msg" id="note" hidden></p>
+  </form>
+</main>
+<script>
+document.getElementById("setup-form").addEventListener("submit", async (event) => {
+  event.preventDefault();
+  const note = document.getElementById("note");
+  note.hidden = true;
+  const password = document.getElementById("password").value;
+  if (password !== document.getElementById("password2").value) {
+    note.hidden = false;
+    note.textContent = "Passwörter stimmen nicht überein.";
+    note.className = "msg";
+    return;
+  }
+  try {
+    const response = await fetch("/api/v1/auth/setup", {
+      method: "POST",
+      credentials: "same-origin",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        username: document.getElementById("username").value,
+        password,
+      }),
+    });
+    const payload = await response.json().catch(() => ({}));
+    if (!response.ok) throw new Error(payload.error || response.statusText);
+    location.href = "/";
+  } catch (error) {
+    note.hidden = false;
+    note.textContent = error.message || String(error);
+    note.className = "msg";
+  }
+});
+</script>
+</body>
+</html>