Polish KarlDNS production UI and docs

router_dyndns/routers/management_shared.py

@@ -7,6 +7,7 @@ from starlette.concurrency import run_in_threadpool
 from ..ddns_models import DdnsSettings
 from ..ddns_security import (
     DASHBOARD_UNLOCK_COOKIE,
+    dashboard_cookie_signing_secret,
     dashboard_csrf_token,
     sign_dashboard_unlock_cookie,
     verify_dashboard_unlock_cookie,
@@ -30,7 +31,7 @@ async def get_active_management_account_async(store: DdnsStore, management_slug:
     return await run_in_threadpool(get_active_management_account, store, management_slug)
 
 
-def has_management_access(request: Request, management_slug: str, account: ManagementAccount) -> bool:
+def has_management_access(request: Request, settings: DdnsSettings, management_slug: str, account: ManagementAccount) -> bool:
     password_hash = account.get("dashboard_password_hash")
     if not password_hash:
         return True
@@ -38,6 +39,7 @@ def has_management_access(request: Request, management_slug: str, account: Manag
         str(account["hostname"]),
         management_slug,
         str(password_hash),
+        dashboard_cookie_signing_secret(settings),
         request.cookies.get(DASHBOARD_UNLOCK_COOKIE),
     )
 
@@ -100,11 +102,18 @@ def set_unlock_cookie(
     max_age_seconds: int,
 ) -> None:
     password_hash = account.get("dashboard_password_hash")
-    if not password_hash:
+    signing_secret = dashboard_cookie_signing_secret(settings)
+    if not password_hash or not signing_secret:
         return
     response.set_cookie(
         DASHBOARD_UNLOCK_COOKIE,
-        sign_dashboard_unlock_cookie(str(account["hostname"]), management_slug, str(password_hash), max_age_seconds),
+        sign_dashboard_unlock_cookie(
+            str(account["hostname"]),
+            management_slug,
+            str(password_hash),
+            signing_secret,
+            max_age_seconds,
+        ),
         max_age=max_age_seconds,
         path=f"/m/{management_slug}",
         httponly=True,