simple-module-site-lock 0.0.30__py3-none-any.whl

simple_module_site_lock-0.0.30.dist-info/METADATA

@@ -0,0 +1,148 @@
+Metadata-Version: 2.4
+Name: simple_module_site_lock
+Version: 0.0.30
+Summary: Optional site-wide password gate (staging / pre-launch) for simple_module apps
+Project-URL: Homepage, https://github.com/antosubash/simple_module_python
+Project-URL: Repository, https://github.com/antosubash/simple_module_python
+Project-URL: Issues, https://github.com/antosubash/simple_module_python/issues
+Author-email: Anto Subash <antosubash@live.com>
+License-Expression: MIT
+Keywords: gate,password,simple-module,staging
+Classifier: Development Status :: 3 - Alpha
+Classifier: Framework :: FastAPI
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Internet :: WWW/HTTP
+Classifier: Typing :: Typed
+Requires-Python: >=3.12
+Requires-Dist: simple-module-auth==0.0.30
+Requires-Dist: simple-module-core==0.0.30
+Requires-Dist: simple-module-hosting==0.0.30
+Requires-Dist: simple-module-settings==0.0.30
+Description-Content-Type: text/markdown
+
+# simple_module_site_lock
+
+Optional site-wide password gate for `simple_module` apps — a staging /
+pre-launch door. When enabled, every visitor must enter one shared password
+before they can see anything: not the landing page, not the API, not even
+that a login form exists.
+
+**Off by default.** Installing this module changes nothing until an operator
+turns it on.
+
+## Install
+
+Add the package to your host and re-sync — discovery picks it up from the
+`simple_module` entry point, no host code changes:
+
+```toml
+# host/pyproject.toml
+dependencies = ["simple_module_site_lock"]
+```
+
+```bash
+uv sync --all-packages
+```
+
+Or scaffold a new app with it selected: `smpy new --modules site_lock`.
+
+## Usage
+
+1. Sign in as an admin and open **Settings → Modules → SiteLock**.
+2. Set `password` (and optionally `message`), tick `enabled`, and **Save**.
+   Saving with a blank password is refused — the error appears on the
+   `enabled` field and nothing is persisted.
+3. Anyone without the password now gets the gate page at `/__unlock` on every
+   URL. They enter the password once and are returned to where they were
+   heading.
+4. To lift the gate, untick `enabled` and save. To rotate the password, set a
+   new one — every already-unlocked visitor is logged back out of the gate.
+
+Keep your own session alive while you do this: an admin with a live session
+skips the gate, which is what lets you undo a mistake (see
+[Admin bypass](#admin-bypass-and-the-lockout-you-can-still-cause) below).
+
+## How it works
+
+The module installs a single middleware that runs *before* `AuthMiddleware`.
+That ordering is the whole point — an anonymous visitor gets the gate rather
+than a redirect to the login page, so a locked site never reveals that it has
+one.
+
+It achieves that ordering by declaring `depends_on=["Settings", "Auth"]`:
+modules are installed in topological order and Starlette's `add_middleware`
+is LIFO, so sorting after `Auth` makes this middleware wrap outermost.
+
+Unlock state lives in the signed session cookie. The stored marker is a
+fingerprint of the current password, so **rotating the password immediately
+invalidates every unlocked session**.
+
+## Enabling it
+
+Settings → Site Lock:
+
+| Field | Default | Meaning |
+|---|---|---|
+| `enabled` | `false` | Master switch |
+| `password` | `""` | The shared password. Masked in the admin UI |
+| `message` | `""` | Optional line shown on the gate page |
+
+Changes apply immediately — no restart. Enabling with a blank password is
+rejected by a validator, so you cannot accidentally gate the site behind the
+empty string.
+
+## What stays reachable when locked
+
+- `/health` — always. Gating it would fail Kubernetes liveness/readiness
+  probes and get the pod killed.
+- `/__unlock` — the gate page itself.
+
+Everything else is gated. Requests under `/api/`, and any request carrying an
+`Authorization` header, get `403 {"detail": "Site is locked"}` rather than a
+redirect — a `401` would invite an auth flow that cannot succeed while the
+site is locked. Browser requests get a `302` to the gate.
+
+That includes the login API itself, so while the gate is on there is no
+programmatic way in: CI smoke tests, uptime monitors, mobile clients and
+webhook senders all get `403` no matter what credentials they hold. Only a
+browser that has passed the gate (or an admin holding a live session) can
+reach anything. Pause those integrations before enabling the gate, or point
+uptime checks at `/health`, which stays open.
+
+## Admin bypass, and the lockout you can still cause
+
+A user who already holds a session with the `admin` role skips the gate.
+This is the intended escape hatch: if you enable the gate and mistype the
+password, you are still holding the session that lets you go straight back to
+Settings and fix it.
+
+**It only rescues a live session.** If no admin is currently signed in and the
+password has been forgotten, there is no in-app recovery. Clear the override
+directly in the database:
+
+```sql
+DELETE FROM settings_setting
+ WHERE scope = 'system' AND key = 'site_lock.enabled';
+```
+
+Then restart the app (or save any setting) so the module re-hydrates.
+
+## Brute-force protection
+
+The unlock endpoint tracks failures per client IP in memory: 10 failures
+within 5 minutes trigger a 15-minute cooldown returning `429`. These
+thresholds are module constants, not settings — they are the only defence on
+a single shared secret, so they are not an operator-tunable surface.
+
+The limiter is process-local, which is adequate for the single-process
+staging deployments this module targets.
+
+## What this is not
+
+This is not user authentication or authorisation — that is what the `auth`,
+`users`, and `permissions` modules are for. The site lock is one shared
+secret in front of everything, with no notion of identity.

simple_module_site_lock-0.0.30.dist-info/RECORD

@@ -0,0 +1,14 @@
+site_lock/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+site_lock/constants.py,sha256=WMB-tV3zX--wIFIXqrx1RIlGUIKQtxA7uEyxCNlzNZs,908
+site_lock/middleware.py,sha256=lTfmhJ_OFujjUCErbeJT9KCAH4AlHYvDmhA3nuBtUJ8,6295
+site_lock/module.py,sha256=2ogUpEb4rcfVTZmSQdBg2157lefMnbw-nozc0OzOVPA,1500
+site_lock/page.py,sha256=rQLPhgp7YNXDX2dcCldDSjxsDyLe7_b4_9OazieL7Vg,1672
+site_lock/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+site_lock/rate_limit.py,sha256=IuFvZ1BcBBW1uJ0dfvIgZPdN8miza7YIhlB0Q0BLvvE,1860
+site_lock/settings.py,sha256=kCGyrqOy_6xh895SV52PwWpMvZaGXyEW2P-mEzO2Z6k,2300
+site_lock/state.py,sha256=iVir-NL6d2v2SvZhecWHYVoMRcH24nfUrK-dlSsvS_A,950
+site_lock/templates/unlock.html,sha256=cg1WxGCtVyK9DKg3xsVDvX6KXE8R40NXAcDA79cSCAc,2494
+simple_module_site_lock-0.0.30.dist-info/METADATA,sha256=3qu7YiaK8g1Wz7SVDCjRvJcvBA2JVnPIstf8y8xljy0,5925
+simple_module_site_lock-0.0.30.dist-info/WHEEL,sha256=lCkmxWfQsSc9CfIClYeavTdQeEX2toPqufh9gI35EQA,87
+simple_module_site_lock-0.0.30.dist-info/entry_points.txt,sha256=WlObRbz5zuypwJ5TzAnDq_wPIcR0yj2FQLzm6aNNnnw,60
+simple_module_site_lock-0.0.30.dist-info/RECORD,,

simple_module_site_lock-0.0.30.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.31.0
+Root-Is-Purelib: true
+Tag: py3-none-any

simple_module_site_lock-0.0.30.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[simple_module]
+site_lock = site_lock.module:SiteLockModule

site_lock/constants.py

@@ -0,0 +1,28 @@
+"""Every literal the site_lock module depends on."""
+
+from __future__ import annotations
+
+MODULE_NAME = "SiteLock"
+MODULE_PACKAGE = "site_lock"
+
+# Dependencies — names must match the other modules' ``ModuleMeta.name``.
+MODULE_SETTINGS = "Settings"
+MODULE_AUTH = "Auth"
+
+# The gate endpoint. Double-underscore prefix keeps it clear of app routes.
+UNLOCK_PATH = "/__unlock"
+SESSION_KEY = "site_lock"
+
+# Never gated: Kubernetes liveness/readiness probes must always succeed.
+HEALTH_PREFIX = "/health"
+API_PREFIX = "/api/"
+
+# Duplicated rather than imported from ``users`` — site_lock must also work
+# under the ``keycloak`` provider, which has no dependency on ``users``.
+ADMIN_ROLE = "admin"
+
+# Brute-force limits. Deliberately NOT settings fields: they are the only
+# defence on a single shared secret and are not an operator-tunable surface.
+MAX_FAILURES = 10
+WINDOW_SECONDS = 300
+COOLDOWN_SECONDS = 900

site_lock/middleware.py

@@ -0,0 +1,177 @@
+"""Site-wide password gate.
+
+Runs outermost among module middleware — the module sorts after ``Auth``, and
+Starlette's ``add_middleware`` is LIFO — so this executes *before*
+``AuthMiddleware``. That ordering is the whole point: an anonymous visitor
+sees the gate instead of being redirected to the login page, so a locked site
+never reveals that a login form exists.
+
+``SessionMiddleware`` sits outside this one, so ``scope["session"]`` is
+readable here and writes are persisted on the way out.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import logging
+import secrets
+from urllib.parse import quote
+
+from starlette.requests import Request
+from starlette.responses import (
+    HTMLResponse,
+    JSONResponse,
+    RedirectResponse,
+    Response,
+)
+from starlette.types import ASGIApp, Receive, Scope, Send
+
+from site_lock import constants as c
+from site_lock.page import render_unlock_page, safe_next
+
+logger = logging.getLogger(__name__)
+
+_NO_STORE = {"Cache-Control": "no-store"}
+_ERR_WRONG = "Incorrect password."
+_ERR_THROTTLED = "Too many attempts. Try again later."
+
+
+def password_fingerprint(password: str) -> str:
+    """Short digest of the active password, stored in the session.
+
+    Comparing this on each request is what makes a password rotation
+    invalidate every previously-unlocked session.
+    """
+    return hashlib.sha256(password.encode("utf-8")).hexdigest()[:16]
+
+
+class SiteLockMiddleware:
+    """Gate every request behind a single shared password."""
+
+    def __init__(self, app: ASGIApp) -> None:
+        self.app = app
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
+        if scope["type"] != "http":
+            await self.app(scope, receive, send)
+            return
+
+        state = scope["app"].state.site_lock
+        settings = state.settings
+
+        # Default-off fast path: one attribute read, no Request construction.
+        if not settings.enabled:
+            await self.app(scope, receive, send)
+            return
+
+        path: str = scope["path"]
+
+        # Kubernetes probes must never be gated, or the pod gets killed.
+        if path.startswith(c.HEALTH_PREFIX):
+            await self.app(scope, receive, send)
+            return
+
+        fingerprint = password_fingerprint(settings.password)
+        session = scope.get("session")
+
+        if path == c.UNLOCK_PATH:
+            response = await self._unlock(scope, receive, state, fingerprint, session)
+            await response(scope, receive, send)
+            return
+
+        if session is not None and session.get(c.SESSION_KEY) == fingerprint:
+            await self.app(scope, receive, send)
+            return
+
+        if await self._is_admin(scope):
+            # Stamp the marker so the provider lookup costs once per session
+            # rather than once per request.
+            if session is not None:
+                session[c.SESSION_KEY] = fingerprint
+            await self.app(scope, receive, send)
+            return
+
+        await self._gate(scope, receive, send, path)
+
+    async def _gate(self, scope: Scope, receive: Receive, send: Send, path: str) -> None:
+        has_auth_header = any(k == b"authorization" for k, _ in scope.get("headers", ()))
+        if path.startswith(c.API_PREFIX) or has_auth_header:
+            # 403 rather than 401: a 401 would invite an auth flow that cannot
+            # succeed while the site is locked.
+            response: Response = JSONResponse(
+                {"detail": "Site is locked"}, status_code=403, headers=_NO_STORE
+            )
+        else:
+            target = f"{c.UNLOCK_PATH}?next={quote(safe_next(path), safe='/')}"
+            response = RedirectResponse(target, status_code=302, headers=_NO_STORE)
+        await response(scope, receive, send)
+
+    async def _unlock(
+        self,
+        scope: Scope,
+        receive: Receive,
+        state,
+        fingerprint: str,
+        session,
+    ) -> Response:
+        method: str = scope.get("method", "GET")
+        settings = state.settings
+        request = Request(scope, receive)
+
+        if method == "GET":
+            return HTMLResponse(
+                render_unlock_page(
+                    message=settings.message,
+                    next_url=request.query_params.get("next", "/"),
+                ),
+                headers=_NO_STORE,
+            )
+        if method != "POST":
+            return Response(status_code=405, headers=_NO_STORE)
+
+        client = scope.get("client")
+        key = client[0] if client else "unknown"
+        if state.limiter.is_blocked(key):
+            return self._page(settings, _ERR_THROTTLED, "/", status=429)
+
+        form = await request.form()
+        supplied = str(form.get("password", ""))
+        target = safe_next(str(form.get("next", "/")))
+
+        if secrets.compare_digest(supplied, settings.password):
+            state.limiter.reset(key)
+            if session is not None:
+                session[c.SESSION_KEY] = fingerprint
+            return RedirectResponse(target, status_code=303, headers=_NO_STORE)
+
+        state.limiter.record_failure(key)
+        return self._page(settings, _ERR_WRONG, target, status=401)
+
+    @staticmethod
+    def _page(settings, error: str, next_url: str, *, status: int) -> HTMLResponse:
+        return HTMLResponse(
+            render_unlock_page(message=settings.message, error=error, next_url=next_url),
+            status_code=status,
+            headers=_NO_STORE,
+        )
+
+    @staticmethod
+    async def _is_admin(scope: Scope) -> bool:
+        """True when the caller already holds a session for an admin user.
+
+        This is the documented lockout escape hatch: an admin who enables the
+        gate and mistypes the password keeps access to the settings screen.
+        """
+        auth_state = getattr(scope["app"].state, "auth", None)
+        provider = getattr(auth_state, "auth_provider", None)
+        if provider is None:
+            return False
+        try:
+            user = await provider.resolve_user(Request(scope))
+        except Exception:
+            logger.exception("Site lock admin bypass failed; treating as anonymous")
+            return False
+        return user is not None and c.ADMIN_ROLE in getattr(user, "roles", ())
+
+
+__all__ = ["SiteLockMiddleware", "password_fingerprint"]

site_lock/module.py

@@ -0,0 +1,47 @@
+"""Site Lock module — optional site-wide password gate."""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from simple_module_core.module import ModuleBase, ModuleMeta
+
+from site_lock import constants as c
+
+if TYPE_CHECKING:
+    from fastapi import FastAPI
+
+
+class SiteLockModule(ModuleBase):
+    meta = ModuleMeta(
+        name=c.MODULE_NAME,
+        # ``Settings`` so register_module_settings can reach the module
+        # registry; ``Auth`` so this module sorts *after* auth and its
+        # middleware therefore wraps outermost, executing before
+        # AuthMiddleware. Both are load-bearing — see the module README.
+        depends_on=[c.MODULE_SETTINGS, c.MODULE_AUTH],
+    )
+
+    def register_settings(self, app: FastAPI) -> None:
+        import importlib
+
+        from site_lock.settings import SiteLockSettings
+        from site_lock.state import SiteLockState
+
+        # SM009 is AST-based: resolving via importlib matches the convention
+        # used by the other settings-backed modules.
+        register_module_settings = importlib.import_module(
+            "settings.registration"
+        ).register_module_settings
+
+        register_module_settings(
+            app,
+            c.MODULE_PACKAGE,
+            SiteLockSettings,
+            lambda s: SiteLockState(settings=s),
+        )
+
+    def register_middleware(self, app: FastAPI) -> None:
+        from site_lock.middleware import SiteLockMiddleware
+
+        app.add_middleware(SiteLockMiddleware)

site_lock/page.py

@@ -0,0 +1,55 @@
+"""Render the standalone unlock page.
+
+Kept out of ``middleware.py`` so the escaping and ``next``-sanitisation rules
+can be unit-tested without an ASGI harness, and so both files stay well under
+the 300-line cap.
+"""
+
+from __future__ import annotations
+
+import html
+import importlib.resources
+from string import Template
+
+_TEMPLATE = Template(
+    (importlib.resources.files(__package__) / "templates" / "unlock.html").read_text(
+        encoding="utf-8"
+    )
+)
+
+_DEFAULT_MESSAGE = "This site is not public yet. Enter the password to continue."
+_ERROR_BLOCK = '<p class="error" role="alert">{message}</p>'
+
+
+def safe_next(raw: str | None) -> str:
+    """Return ``raw`` if it is a same-site absolute path, else ``/``.
+
+    Rejects protocol-relative (``//host``) and backslash-prefixed (``/\\host``)
+    targets — browsers resolve both off-site — plus anything carrying CR/LF,
+    which could otherwise be smuggled into the redirect header. Without this
+    the gate would be an open redirect.
+    """
+    if not raw or not raw.startswith("/"):
+        return "/"
+    if raw.startswith(("//", "/\\")):
+        return "/"
+    if "\r" in raw or "\n" in raw:
+        return "/"
+    return raw
+
+
+def render_unlock_page(
+    *,
+    message: str = "",
+    error: str = "",
+    next_url: str = "/",
+) -> str:
+    """Render the gate page. Every interpolated value is HTML-escaped."""
+    return _TEMPLATE.safe_substitute(
+        message=html.escape(message or _DEFAULT_MESSAGE),
+        error=_ERROR_BLOCK.format(message=html.escape(error)) if error else "",
+        next_url=html.escape(safe_next(next_url), quote=True),
+    )
+
+
+__all__ = ["render_unlock_page", "safe_next"]

site_lock/rate_limit.py

@@ -0,0 +1,58 @@
+"""In-memory per-IP attempt limiter for the unlock endpoint.
+
+Deliberately process-local: it mirrors the existing ``users``
+``LoginRateLimiter`` and is adequate for the single-process staging
+deployments this module targets. ``users``' version is not reused because
+importing it would couple ``site_lock`` to the ``users`` module, and the
+site lock must also work under the ``keycloak`` provider.
+"""
+
+from __future__ import annotations
+
+import time
+from dataclasses import dataclass, field
+
+
+@dataclass
+class _Bucket:
+    failures: list[float] = field(default_factory=list)
+    blocked_until: float = 0.0
+
+
+class AttemptLimiter:
+    """Track failed unlock attempts per client key and impose a cooldown."""
+
+    def __init__(
+        self,
+        *,
+        max_failures: int,
+        window_seconds: int,
+        cooldown_seconds: int,
+    ) -> None:
+        self._max = max_failures
+        self._window = window_seconds
+        self._cooldown = cooldown_seconds
+        self._buckets: dict[str, _Bucket] = {}
+
+    @staticmethod
+    def _now(now: float | None) -> float:
+        return time.monotonic() if now is None else now
+
+    def is_blocked(self, key: str, *, now: float | None = None) -> bool:
+        bucket = self._buckets.get(key)
+        return bucket is not None and bucket.blocked_until > self._now(now)
+
+    def record_failure(self, key: str, *, now: float | None = None) -> None:
+        moment = self._now(now)
+        bucket = self._buckets.setdefault(key, _Bucket())
+        bucket.failures = [t for t in bucket.failures if moment - t < self._window]
+        bucket.failures.append(moment)
+        if len(bucket.failures) >= self._max:
+            bucket.blocked_until = moment + self._cooldown
+            bucket.failures.clear()
+
+    def reset(self, key: str) -> None:
+        self._buckets.pop(key, None)
+
+
+__all__ = ["AttemptLimiter"]

site_lock/settings.py

@@ -0,0 +1,56 @@
+"""Site Lock module settings — DB-backed via ``register_module_settings``.
+
+The field is named ``password`` so the settings admin UI masks it
+automatically (``settings._module_settings.is_secret_field``).
+"""
+
+from __future__ import annotations
+
+from pydantic import model_validator
+from pydantic_core import InitErrorDetails, PydanticCustomError
+from pydantic_core import ValidationError as CoreValidationError
+from pydantic_settings import BaseSettings, SettingsConfigDict
+
+_BLANK_PASSWORD_MSG = "password must be set before enabling the site lock"
+
+
+class SiteLockSettings(BaseSettings):
+    """Site-wide shared-password gate configuration."""
+
+    model_config = SettingsConfigDict(extra="ignore")
+
+    enabled: bool = False
+    password: str = ""
+    message: str = ""
+
+    @model_validator(mode="after")
+    def _password_required_when_enabled(self) -> SiteLockSettings:
+        """Refuse to gate the site behind an empty password.
+
+        Without this, flipping ``enabled`` on before setting a password would
+        lock every visitor out from behind a secret that is the empty string.
+        Raising here makes ``apply_changes_and_reload`` reject the change so
+        the settings screen shows a validation error instead.
+
+        The error is deliberately pinned to ``enabled`` rather than raised as a
+        bare ``ValueError``. A plain raise from a model validator carries
+        ``loc=[]``, and the shared settings form only renders errors it can
+        attach to a field (``ModuleForm.onSave`` keys them by ``loc[-1]``).
+        With an empty ``loc`` the 422 was silently swallowed: the admin saw the
+        toggle stay on, no error, and had every reason to believe the site was
+        locked when it was still wide open.
+        """
+        if self.enabled and not self.password.strip():
+            raise CoreValidationError.from_exception_data(
+                title=type(self).__name__,
+                line_errors=[
+                    InitErrorDetails(
+                        type=PydanticCustomError(
+                            "site_lock_password_required", _BLANK_PASSWORD_MSG
+                        ),
+                        loc=("enabled",),
+                        input=self.enabled,
+                    )
+                ],
+            )
+        return self

site_lock/state.py

@@ -0,0 +1,34 @@
+"""Module-owned state attached to ``app.state.site_lock``."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+
+from site_lock import constants as c
+from site_lock.rate_limit import AttemptLimiter
+from site_lock.settings import SiteLockSettings
+
+
+def _default_limiter() -> AttemptLimiter:
+    return AttemptLimiter(
+        max_failures=c.MAX_FAILURES,
+        window_seconds=c.WINDOW_SECONDS,
+        cooldown_seconds=c.COOLDOWN_SECONDS,
+    )
+
+
+@dataclass
+class SiteLockState:
+    """Per-app site-lock state.
+
+    ``settings`` is reassigned in place by ``settings.reload`` on a hot
+    reload, so this dataclass must stay mutable. ``limiter`` survives those
+    reloads, which is what keeps an in-flight brute-force cooldown from being
+    cleared by an unrelated settings save.
+    """
+
+    settings: SiteLockSettings
+    limiter: AttemptLimiter = field(default_factory=_default_limiter)
+
+
+__all__ = ["SiteLockState"]

site_lock/templates/unlock.html

@@ -0,0 +1,64 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex, nofollow">
+<title>Protected</title>
+<style>
+  :root { color-scheme: light dark; }
+  * { box-sizing: border-box; }
+  body {
+    margin: 0; min-height: 100vh;
+    display: flex; align-items: center; justify-content: center;
+    font-family: ui-sans-serif, system-ui, -apple-system, "Segoe UI", sans-serif;
+    background: #f7f7f8; color: #18181b; padding: 1.5rem;
+  }
+  .card {
+    width: 100%; max-width: 22rem; background: #fff;
+    border: 1px solid #e4e4e7; border-radius: 0.75rem;
+    padding: 2rem; box-shadow: 0 1px 3px rgba(0,0,0,.06);
+  }
+  h1 { margin: 0 0 .25rem; font-size: 1.125rem; font-weight: 600; }
+  p { margin: 0 0 1.25rem; font-size: .875rem; color: #52525b; line-height: 1.5; }
+  label { display: block; font-size: .8125rem; font-weight: 500; margin-bottom: .375rem; }
+  input {
+    width: 100%; padding: .5rem .75rem; font-size: .875rem;
+    border: 1px solid #d4d4d8; border-radius: .5rem; background: #fff; color: inherit;
+  }
+  input:focus { outline: 2px solid #6366f1; outline-offset: 1px; border-color: transparent; }
+  button {
+    width: 100%; margin-top: 1rem; padding: .5rem .75rem;
+    font-size: .875rem; font-weight: 500; color: #fff; background: #18181b;
+    border: 0; border-radius: .5rem; cursor: pointer;
+  }
+  button:hover { background: #27272a; }
+  .error {
+    margin: 0 0 1rem; padding: .5rem .75rem; font-size: .8125rem;
+    color: #991b1b; background: #fef2f2; border: 1px solid #fecaca; border-radius: .5rem;
+  }
+  @media (prefers-color-scheme: dark) {
+    body { background: #09090b; color: #fafafa; }
+    .card { background: #18181b; border-color: #27272a; box-shadow: none; }
+    p { color: #a1a1aa; }
+    input { background: #09090b; border-color: #3f3f46; }
+    button { background: #fafafa; color: #18181b; }
+    button:hover { background: #e4e4e7; }
+    .error { color: #fca5a5; background: #7f1d1d33; border-color: #7f1d1d; }
+  }
+</style>
+</head>
+<body>
+  <main class="card">
+    <h1>Protected</h1>
+    <p>$message</p>
+    $error
+    <form method="post" action="/__unlock">
+      <input type="hidden" name="next" value="$next_url">
+      <label for="password">Password</label>
+      <input id="password" name="password" type="password" autocomplete="current-password" autofocus required>
+      <button type="submit">Continue</button>
+    </form>
+  </main>
+</body>
+</html>