@agenticmail/enterprise 0.3.2 → 0.4.0

package/dashboards/django/templates/users.html

@@ -0,0 +1,34 @@
+{% extends "layout.html" %}
+{% block content %}
+<h2 class="t">Users</h2>
+<p class="desc">Manage team members</p>
+<div class="card" style="margin-bottom:16px">
+<div class="ct">Create User</div>
+<form method="POST" style="display:grid;grid-template-columns:1fr 1fr;gap:10px">
+<div class="fg"><label class="fl">Name</label><input class="input" name="name" required></div>
+<div class="fg"><label class="fl">Email</label><input class="input" type="email" name="email" required></div>
+<div class="fg"><label class="fl">Role</label><select class="input" name="role"><option>member</option><option>admin</option><option>owner</option></select></div>
+<div class="fg"><label class="fl">Password</label><input class="input" type="password" name="password" required minlength="8"></div>
+<div><button class="btn btn-p" type="submit">Create</button></div>
+</form>
+</div>
+<div class="card">
+{% if users %}
+<table>
+<thead><tr><th>Name</th><th>Email</th><th>Role</th><th>Last Login</th></tr></thead>
+<tbody>
+{% for u in users %}
+<tr>
+<td style="font-weight:600">{{ u.name }}</td>
+<td style="color:var(--dim)">{{ u.email }}</td>
+<td>{{ u.role_badge|safe }}</td>
+<td style="color:var(--muted);font-size:12px">{{ u.lastLoginAt|default:"Never" }}</td>
+</tr>
+{% endfor %}
+</tbody>
+</table>
+{% else %}
+<div class="empty">&#x1f465; No users yet</div>
+{% endif %}
+</div>
+{% endblock %}

package/dashboards/django/templates/vault.html

@@ -0,0 +1,46 @@
+{% extends "layout.html" %}
+{% block content %}
+<h2 class="t">Vault</h2>
+<p class="desc">Manage secrets and credentials</p>
+<div class="card" style="margin-bottom:16px">
+<div class="ct">Add Secret</div>
+<form method="POST" style="display:flex;gap:10px;align-items:end;flex-wrap:wrap">
+<input type="hidden" name="_action" value="add">
+<div class="fg" style="flex:1;margin:0"><label class="fl">Name</label><input class="input" name="name" required placeholder="e.g. OPENAI_API_KEY"></div>
+<div class="fg" style="flex:1;margin:0"><label class="fl">Value</label><input class="input" type="password" name="value" required placeholder="Secret value"></div>
+<div class="fg" style="margin:0"><label class="fl">Category</label><select class="input" name="category"><option value="api_key">API Key</option><option value="deploy">Deploy</option><option value="cloud_storage">Cloud Storage</option><option value="skill_credential">Skill Credential</option><option value="custom" selected>Custom</option></select></div>
+<button class="btn btn-p" type="submit">Add</button>
+</form>
+</div>
+<div class="card">
+{% if secrets %}
+<table>
+<thead><tr><th>Name</th><th>Category</th><th>Created By</th><th>Created</th><th></th></tr></thead>
+<tbody>
+{% for s in secrets %}
+<tr>
+<td style="font-weight:600;font-family:monospace">{{ s.name }}</td>
+<td>{{ s.category_badge|safe }}</td>
+<td style="color:var(--muted);font-size:12px">{{ s.createdBy|default:s.created_by|default:"-" }}</td>
+<td style="color:var(--muted);font-size:12px">{{ s.createdAt|default:s.created_at|default:"-" }}</td>
+<td>
+<form method="POST" style="display:inline">
+<input type="hidden" name="_action" value="rotate">
+<input type="hidden" name="secret_id" value="{{ s.id }}">
+<button class="btn btn-sm btn-p" type="submit">Rotate</button>
+</form>
+<form method="POST" style="display:inline">
+<input type="hidden" name="_action" value="delete">
+<input type="hidden" name="secret_id" value="{{ s.id }}">
+<button class="btn btn-sm btn-d" type="submit">Delete</button>
+</form>
+</td>
+</tr>
+{% endfor %}
+</tbody>
+</table>
+{% else %}
+<div class="empty">&#x1f512; No secrets stored</div>
+{% endif %}
+</div>
+{% endblock %}

package/dashboards/django/utils/api.py

@@ -0,0 +1,20 @@
+"""
+HTTP client for AgenticMail API communication.
+"""
+
+import os
+import requests as http_client
+
+API_URL = os.getenv('AGENTICMAIL_URL', 'http://localhost:3000')
+
+
+def api_request(method, path, body=None, token=None):
+    """Make an HTTP request to the AgenticMail API."""
+    headers = {'Content-Type': 'application/json'}
+    if token:
+        headers['Authorization'] = f'Bearer {token}'
+    try:
+        r = http_client.request(method, f'{API_URL}{path}', headers=headers, json=body, timeout=10)
+        return r.json()
+    except Exception as e:
+        return {'error': str(e)}

package/dashboards/django/utils/helpers.py

@@ -0,0 +1,39 @@
+"""
+Shared template helpers: badges, status formatting, and page context.
+"""
+
+from django.utils.html import escape
+
+
+def badge(text, badge_type=None):
+    """Generate a badge HTML span. Auto-detects type from text if not provided."""
+    cls_map = {
+        'active': 'b-a',
+        'owner': 'b-w',
+        'admin': 'b-p',
+        'member': 'b-r',
+        'viewer': 'b-r',
+        'archived': 'b-r',
+        'suspended': 'b-r',
+        'revoked': 'b-r',
+    }
+    if badge_type:
+        cls = badge_type
+    else:
+        cls = cls_map.get(text.lower() if text else '', 'b-r')
+    return f'<span class="badge {cls}">{escape(text)}</span>'
+
+
+def status_badge(status):
+    """Generate a badge for a status string."""
+    return badge(status)
+
+
+def page_context(request, title, page_name):
+    """Build common template context for authenticated pages."""
+    return {
+        'page_title': title,
+        'page_name': page_name,
+        'user': request.session.get('user', {}),
+        'flash_msg': request.session.pop('flash', None),
+    }

package/dashboards/django/views/__init__.py

@@ -0,0 +1,38 @@
+"""
+View imports for URL routing.
+"""
+
+from views.auth import login_view, logout_view
+from views.dashboard import dashboard_view
+from views.agents import agents_view, agent_detail_view, provider_models_view
+from views.users import users_view
+from views.api_keys import api_keys_view
+from views.audit import audit_view
+from views.settings_view import settings_view
+from views.dlp import dlp_view
+from views.guardrails import guardrails_view
+from views.journal import journal_view
+from views.messages import messages_view
+from views.compliance import compliance_view
+from views.vault import vault_view
+from views.skills import skills_view
+
+__all__ = [
+    'login_view',
+    'logout_view',
+    'dashboard_view',
+    'agents_view',
+    'agent_detail_view',
+    'provider_models_view',
+    'users_view',
+    'api_keys_view',
+    'audit_view',
+    'settings_view',
+    'dlp_view',
+    'guardrails_view',
+    'journal_view',
+    'messages_view',
+    'compliance_view',
+    'vault_view',
+    'skills_view',
+]

package/dashboards/django/views/agents.py

@@ -0,0 +1,343 @@
+"""
+Agents view: list, create, detail, and archive agents.
+"""
+
+import json
+import re
+
+from django.http import HttpResponse, HttpResponseRedirect
+from django.template.loader import render_to_string
+from django.utils.safestring import mark_safe
+
+from utils.api import api_request
+from utils.helpers import badge, page_context
+
+
+def _parse_comma_list(value):
+    """Parse a comma-separated string into a list, stripping whitespace."""
+    if not value:
+        return []
+    return [item.strip() for item in value.split(',') if item.strip()]
+
+
+def _resolve_agent_fields(agent):
+    """Resolve display name, email, and model from agent config following priority rules."""
+    config = agent.get('config') or {}
+    identity = config.get('identity') or {}
+
+    # Name: config.identity.name > config.name > config.displayName > agent.name
+    display_name = (
+        identity.get('name')
+        or config.get('name')
+        or config.get('displayName')
+        or agent.get('name', '')
+    )
+
+    # Email: config.identity.email > config.email > agent.email (never show raw UUIDs)
+    email = (
+        identity.get('email')
+        or config.get('email')
+        or agent.get('email', '')
+    )
+
+    # Filter out UUID emails
+    if email and re.match(r'^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$', email, re.IGNORECASE):
+        email = ''
+
+    # Avatar initial: first letter of resolved display name
+    avatar_initial = display_name[0].upper() if display_name else '?'
+
+    # Model: if dict, use modelId or provider; otherwise use as-is
+    model_raw = config.get('model', '')
+    if isinstance(model_raw, dict):
+        model = model_raw.get('modelId') or model_raw.get('provider') or ''
+    else:
+        model = model_raw
+
+    return display_name, email, avatar_initial, model
+
+
+def provider_models_view(request, provider_id):
+    """API proxy: fetch available models for a given provider."""
+    if not request.session.get('token'):
+        return HttpResponse('{"error":"unauthorized"}', content_type='application/json', status=401)
+    token = request.session['token']
+    data = api_request('GET', f'/api/providers/{provider_id}/models', token=token)
+    return HttpResponse(json.dumps(data), content_type='application/json')
+
+
+def agents_view(request):
+    """Handle agent listing, creation, and archival."""
+    if not request.session.get('token'):
+        return HttpResponseRedirect('/login')
+
+    token = request.session['token']
+    flash_msg = request.session.pop('flash', None)
+
+    if request.method == 'POST':
+        action = request.POST.get('_action')
+        if action == 'create':
+            body = {
+                'name': request.POST['name'],
+                'role': request.POST.get('role', 'assistant'),
+                'provider': request.POST.get('provider', 'anthropic'),
+                'model': request.POST.get('model') or None,
+                'persona': {
+                    'gender': request.POST.get('gender') or None,
+                    'dateOfBirth': request.POST.get('date_of_birth') or None,
+                    'maritalStatus': request.POST.get('marital_status') or None,
+                    'culturalBackground': request.POST.get('cultural_background') or None,
+                    'language': request.POST.get('language') or None,
+                    'traits': {
+                        'communication': request.POST.get('trait_communication', 'direct'),
+                        'detail': request.POST.get('trait_detail', 'detail-oriented'),
+                        'energy': request.POST.get('trait_energy', 'calm'),
+                        'humor': request.POST.get('humor') or 'warm',
+                        'formality': request.POST.get('formality') or 'adaptive',
+                        'empathy': request.POST.get('empathy') or 'moderate',
+                        'patience': request.POST.get('patience') or 'patient',
+                        'creativity': request.POST.get('creativity') or 'creative',
+                    },
+                },
+            }
+            if request.POST.get('soul_id'):
+                body['soul_id'] = request.POST['soul_id']
+            if request.POST.get('email'):
+                body['email'] = request.POST['email']
+            result = api_request('POST', '/api/agents', body=body, token=token)
+            request.session['flash'] = 'Agent created!' if 'id' in result else result.get('error', 'Failed')
+        elif action == 'archive':
+            agent_id = request.POST.get('agent_id')
+            api_request('POST', f'/api/agents/{agent_id}/archive', token=token)
+            request.session['flash'] = 'Agent archived'
+        return HttpResponseRedirect('/agents')
+
+    data = api_request('GET', '/api/agents', token=token)
+    agents = data.get('agents', [])
+
+    # Add badge HTML to each agent for template rendering
+    for a in agents:
+        a['status_badge'] = badge(a.get('status', ''))
+
+    ctx = page_context(request, 'Agents', 'agents')
+    ctx['flash_msg'] = flash_msg
+    ctx['agents'] = agents
+
+    html = render_to_string('agents.html', ctx)
+    return HttpResponse(html)
+
+
+def agent_detail_view(request, agent_id):
+    """Show agent detail page, handle deploy/stop/restart actions."""
+    if not request.session.get('token'):
+        return HttpResponseRedirect('/login')
+
+    token = request.session['token']
+    flash_msg = request.session.pop('flash', None)
+
+    # Handle action POSTs
+    if request.method == 'POST':
+        action = request.POST.get('_action')
+        if action == 'deploy':
+            api_request('POST', f'/api/agents/{agent_id}/deploy', token=token)
+            request.session['flash'] = 'Agent deployed'
+        elif action == 'stop':
+            api_request('POST', f'/api/agents/{agent_id}/stop', token=token)
+            request.session['flash'] = 'Agent stopped'
+        elif action == 'restart':
+            api_request('POST', f'/api/agents/{agent_id}/restart', token=token)
+            request.session['flash'] = 'Agent restarted'
+        elif action == 'rollback_journal':
+            entry_id = request.POST.get('entry_id')
+            result = api_request('POST', f'/journal/{entry_id}/rollback', body={}, token=token)
+            if result.get('success'):
+                request.session['flash'] = 'Journal entry rolled back'
+            else:
+                request.session['flash'] = result.get('error', 'Rollback failed')
+        elif action == 'save_tool_security':
+            tool_sec = {
+                'security': {
+                    'pathSandbox': {
+                        'enabled': 'ps_enabled' in request.POST,
+                        'allowedDirs': _parse_comma_list(request.POST.get('ps_allowedDirs', '')),
+                        'blockedPatterns': _parse_comma_list(request.POST.get('ps_blockedPatterns', '')),
+                    },
+                    'ssrf': {
+                        'enabled': 'ssrf_enabled' in request.POST,
+                        'allowedHosts': _parse_comma_list(request.POST.get('ssrf_allowedHosts', '')),
+                        'blockedCidrs': _parse_comma_list(request.POST.get('ssrf_blockedCidrs', '')),
+                    },
+                    'commandSanitizer': {
+                        'enabled': 'cs_enabled' in request.POST,
+                        'mode': request.POST.get('cs_mode', 'blocklist'),
+                        'allowedCommands': _parse_comma_list(request.POST.get('cs_allowedCommands', '')),
+                        'blockedPatterns': _parse_comma_list(request.POST.get('cs_blockedPatterns', '')),
+                    },
+                },
+                'middleware': {
+                    'audit': {
+                        'enabled': 'audit_enabled' in request.POST,
+                        'redactKeys': _parse_comma_list(request.POST.get('audit_redactKeys', '')),
+                    },
+                    'rateLimit': {
+                        'enabled': 'rl_enabled' in request.POST,
+                        'overrides': {},
+                    },
+                    'circuitBreaker': {
+                        'enabled': 'cb_enabled' in request.POST,
+                    },
+                    'telemetry': {
+                        'enabled': 'tel_enabled' in request.POST,
+                    },
+                },
+            }
+            result = api_request('PATCH', f'/engine/agents/{agent_id}/tool-security', body={
+                'toolSecurity': tool_sec,
+                'updatedBy': 'dashboard',
+            }, token=token)
+            if 'error' in result:
+                request.session['flash'] = result.get('error', 'Failed to save tool security')
+            else:
+                request.session['flash'] = 'Agent tool security saved!'
+        elif action == 'reset_tool_security':
+            result = api_request('PATCH', f'/engine/agents/{agent_id}/tool-security', body={
+                'toolSecurity': {},
+                'updatedBy': 'dashboard',
+            }, token=token)
+            if 'error' in result:
+                request.session['flash'] = result.get('error', 'Failed to reset tool security')
+            else:
+                request.session['flash'] = 'Tool security reset to org defaults'
+        return HttpResponseRedirect(f'/agents/{agent_id}')
+
+    data = api_request('GET', f'/api/agents/{agent_id}', token=token)
+    agent = data.get('agent') or data
+
+    display_name, email, avatar_initial, model = _resolve_agent_fields(agent)
+
+    config = agent.get('config') or {}
+    persona = config.get('persona') or {}
+    traits = persona.get('traits') or {}
+    permissions = config.get('permissions') or agent.get('permissions') or {}
+
+    # Build traits list for template (handle both dict and list)
+    traits_items = []
+    if isinstance(traits, dict):
+        traits_items = list(traits.items())
+    elif isinstance(traits, list):
+        traits_items = [(t, None) for t in traits]
+
+    # Build permissions list for template
+    permissions_items = []
+    if isinstance(permissions, dict):
+        permissions_items = list(permissions.items())
+
+    # Personal detail rows
+    personal_details = []
+    if persona.get('gender'):
+        personal_details.append(('Gender', persona['gender']))
+    if persona.get('dateOfBirth'):
+        personal_details.append(('Date of Birth', persona['dateOfBirth']))
+    if persona.get('maritalStatus'):
+        personal_details.append(('Marital Status', persona['maritalStatus']))
+    if persona.get('culturalBackground'):
+        personal_details.append(('Cultural Background', persona['culturalBackground']))
+    if persona.get('language'):
+        personal_details.append(('Language', persona['language']))
+
+    status_text = agent.get('state') or agent.get('status') or 'unknown'
+    role_text = agent.get('role') or config.get('role') or ''
+    description = config.get('description') or agent.get('description') or persona.get('description') or ''
+    created = agent.get('createdAt') or agent.get('created_at') or ''
+    agent_id_val = agent.get('id') or agent.get('agentId') or agent_id
+
+    # Fetch activity data (events, tool calls, journal) — each wrapped in try/except
+    events = []
+    try:
+        ev_data = api_request('GET', f'/activity/events?agentId={agent_id}&limit=50', token=token)
+        events = ev_data.get('events', [])
+    except Exception:
+        pass
+
+    tool_calls = []
+    try:
+        tc_data = api_request('GET', f'/activity/tool-calls?agentId={agent_id}&limit=50', token=token)
+        tool_calls = tc_data.get('toolCalls', [])
+    except Exception:
+        pass
+
+    journal_entries = []
+    try:
+        j_data = api_request('GET', f'/journal?agentId={agent_id}&orgId=default&limit=50', token=token)
+        journal_entries = j_data.get('entries', [])
+    except Exception:
+        pass
+
+    # Fetch tool security data
+    tool_security = {}
+    org_defaults = {}
+    agent_overrides = {}
+    try:
+        ts_data = api_request('GET', f'/engine/agents/{agent_id}/tool-security', token=token)
+        tool_security = ts_data.get('toolSecurity') or {}
+        org_defaults = ts_data.get('orgDefaults') or {}
+        agent_overrides = ts_data.get('agentOverrides') or {}
+    except Exception:
+        pass
+
+    # Pre-extract nested tool security values for Django template
+    ts_sec = tool_security.get('security') or {}
+    ts_mw = tool_security.get('middleware') or {}
+    ts_ps = ts_sec.get('pathSandbox') or {}
+    ts_ssrf = ts_sec.get('ssrf') or {}
+    ts_cs = ts_sec.get('commandSanitizer') or {}
+    ts_audit = ts_mw.get('audit') or {}
+    ts_rl = ts_mw.get('rateLimit') or {}
+    ts_cb = ts_mw.get('circuitBreaker') or {}
+    ts_tel = ts_mw.get('telemetry') or {}
+
+    has_overrides = bool(agent_overrides.get('security') or agent_overrides.get('middleware'))
+
+    ctx = page_context(request, display_name, 'agents')
+    ctx['flash_msg'] = flash_msg
+    ctx['agent'] = agent
+    ctx['agent_id'] = agent_id_val
+    ctx['display_name'] = display_name
+    ctx['email'] = email
+    ctx['avatar_initial'] = avatar_initial
+    ctx['model'] = model or '-'
+    ctx['status_text'] = status_text
+    ctx['status_badge_html'] = badge(status_text)
+    ctx['role_text'] = role_text
+    ctx['role_badge_html'] = badge(role_text) if role_text else ''
+    ctx['description'] = description
+    ctx['traits_items'] = traits_items
+    ctx['permissions_items'] = permissions_items
+    ctx['profile'] = permissions
+    ctx['personal_details'] = personal_details
+    ctx['created'] = created
+    ctx['events'] = events
+    ctx['tool_calls'] = tool_calls
+    ctx['journal_entries'] = journal_entries
+    ctx['events_json'] = mark_safe(json.dumps(events))
+    ctx['tool_calls_json'] = mark_safe(json.dumps(tool_calls))
+    ctx['journal_entries_json'] = mark_safe(json.dumps(journal_entries))
+    ctx['ts_ps'] = ts_ps
+    ctx['ts_ssrf'] = ts_ssrf
+    ctx['ts_cs'] = ts_cs
+    ctx['ts_audit'] = ts_audit
+    ctx['ts_rl'] = ts_rl
+    ctx['ts_cb'] = ts_cb
+    ctx['ts_tel'] = ts_tel
+    ctx['ts_has_overrides'] = has_overrides
+    ctx['ts_ps_allowedDirs'] = ', '.join(ts_ps.get('allowedDirs') or [])
+    ctx['ts_ps_blockedPatterns'] = ', '.join(ts_ps.get('blockedPatterns') or [])
+    ctx['ts_ssrf_allowedHosts'] = ', '.join(ts_ssrf.get('allowedHosts') or [])
+    ctx['ts_ssrf_blockedCidrs'] = ', '.join(ts_ssrf.get('blockedCidrs') or [])
+    ctx['ts_cs_allowedCommands'] = ', '.join(ts_cs.get('allowedCommands') or [])
+    ctx['ts_cs_blockedPatterns'] = ', '.join(ts_cs.get('blockedPatterns') or [])
+    ctx['ts_cs_mode'] = ts_cs.get('mode') or 'blocklist'
+    ctx['ts_audit_redactKeys'] = ', '.join(ts_audit.get('redactKeys') or [])
+
+    html = render_to_string('agent_detail.html', ctx)
+    return HttpResponse(html)

package/dashboards/django/views/api_keys.py

@@ -0,0 +1,47 @@
+"""
+API Keys view: list, create, and revoke API keys.
+"""
+
+from django.http import HttpResponse, HttpResponseRedirect
+from django.template.loader import render_to_string
+
+from utils.api import api_request
+from utils.helpers import badge, page_context
+
+
+def api_keys_view(request):
+    """Handle API key listing, creation, and revocation."""
+    if not request.session.get('token'):
+        return HttpResponseRedirect('/login')
+
+    token = request.session['token']
+    flash_msg = request.session.pop('flash', None)
+
+    if request.method == 'POST':
+        action = request.POST.get('_action')
+        if action == 'create':
+            result = api_request('POST', '/api/api-keys', body={'name': request.POST['name']}, token=token)
+            if 'plaintext' in result:
+                request.session['flash'] = f"Key created: {result['plaintext']} — SAVE THIS NOW!"
+            else:
+                request.session['flash'] = result.get('error', 'Failed')
+        elif action == 'revoke':
+            key_id = request.POST.get('key_id')
+            api_request('DELETE', f'/api/api-keys/{key_id}', token=token)
+            request.session['flash'] = 'Key revoked'
+        return HttpResponseRedirect('/api-keys')
+
+    data = api_request('GET', '/api/api-keys', token=token)
+    keys = data.get('keys', [])
+
+    # Add badge HTML and status to each key for template rendering
+    for k in keys:
+        status = 'revoked' if k.get('revoked') else 'active'
+        k['status_badge'] = badge(status)
+
+    ctx = page_context(request, 'API Keys', 'keys')
+    ctx['flash_msg'] = flash_msg
+    ctx['keys'] = keys
+
+    html = render_to_string('api_keys.html', ctx)
+    return HttpResponse(html)

package/dashboards/django/views/audit.py

@@ -0,0 +1,35 @@
+"""
+Audit log view: paginated event listing.
+"""
+
+from django.http import HttpResponse, HttpResponseRedirect
+from django.template.loader import render_to_string
+
+from utils.api import api_request
+from utils.helpers import page_context
+
+
+def audit_view(request):
+    """Display paginated audit events."""
+    if not request.session.get('token'):
+        return HttpResponseRedirect('/login')
+
+    token = request.session['token']
+    page_num = max(0, int(request.GET.get('p', 0)))
+    data = api_request('GET', f'/api/audit?limit=25&offset={page_num * 25}', token=token)
+    events = data.get('events', [])
+    total = data.get('total', 0)
+
+    ctx = page_context(request, 'Audit Log', 'audit')
+    ctx['events'] = events
+    ctx['total'] = total
+    # Pagination context
+    ctx['page_num'] = page_num
+    ctx['prev_page'] = page_num - 1
+    ctx['current_page'] = page_num + 1
+    ctx['next_page'] = page_num + 1
+    ctx['has_next'] = (page_num + 1) * 25 < total
+    ctx['base_url'] = '/audit'
+
+    html = render_to_string('audit.html', ctx)
+    return HttpResponse(html)

package/dashboards/django/views/auth.py

@@ -0,0 +1,34 @@
+"""
+Authentication views: login and logout.
+"""
+
+from django.http import HttpResponse, HttpResponseRedirect
+from django.template.loader import render_to_string
+
+from utils.api import api_request, API_URL
+
+
+def login_view(request):
+    """Handle login form display and submission."""
+    error = None
+    if request.method == 'POST':
+        email = request.POST.get('email', '')
+        password = request.POST.get('password', '')
+        data = api_request('POST', '/auth/login', body={'email': email, 'password': password})
+        if 'token' in data:
+            request.session['token'] = data['token']
+            request.session['user'] = data['user']
+            return HttpResponseRedirect('/')
+        error = data.get('error', 'Login failed')
+
+    html = render_to_string('login.html', {
+        'error': error,
+        'api_url': API_URL,
+    })
+    return HttpResponse(html)
+
+
+def logout_view(request):
+    """Flush session and redirect to login."""
+    request.session.flush()
+    return HttpResponseRedirect('/login')