stemtrace 0.3.6__tar.gz → 0.3.7__tar.gz

{stemtrace-0.3.6 → stemtrace-0.3.7}/.bumpversion.toml

@@ -1,5 +1,5 @@
 [tool.bumpversion]
-current_version = "0.3.6"
+current_version = "0.3.7"
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<patch>\\d+)"
 serialize = ["{major}.{minor}.{patch}"]
 commit = true
@@ -24,6 +24,21 @@ filename = "src/stemtrace/server/ui/frontend/package.json"
 search = '"version": "{current_version}"'
 replace = '"version": "{new_version}"'
 
+# Frontend package-lock.json: root version and the root package entry
+[[tool.bumpversion.files]]
+filename = "src/stemtrace/server/ui/frontend/package-lock.json"
+search = """"name": "stemtrace-ui",
+  "version": "{current_version}\""""
+replace = """"name": "stemtrace-ui",
+  "version": "{new_version}\""""
+
+[[tool.bumpversion.files]]
+filename = "src/stemtrace/server/ui/frontend/package-lock.json"
+search = """"name": "stemtrace-ui",
+      "version": "{current_version}\""""
+replace = """"name": "stemtrace-ui",
+      "version": "{new_version}\""""
+
 # uv.lock - keep workspace lockfile in sync (uv stores the local project version)
 [[tool.bumpversion.files]]
 filename = "uv.lock"

{stemtrace-0.3.6 → stemtrace-0.3.7}/.dockerignore

@@ -2,9 +2,9 @@
 .git
 .gitignore
 
-# Python
-__pycache__
-*.py[cod]
+# Python (patterns without **/ only match at the context root)
+**/__pycache__
+**/*.py[cod]
 *$py.class
 *.so
 .Python
@@ -37,13 +37,23 @@ ENV/
 
 # Testing
 .pytest_cache/
+.mypy_cache/
+.ruff_cache/
 .coverage
 htmlcov/
 .tox/
 .nox/
 
 # Node (rebuilt in container)
-node_modules/
+**/node_modules/
+
+# Frontend build output and test artifacts (the UI is built in the
+# frontend stage; a local dist/ would be merged into the image's copy)
+src/stemtrace/server/ui/frontend/dist/
+src/stemtrace/server/ui/frontend/test-results/
+src/stemtrace/server/ui/frontend/playwright-report/
+src/stemtrace/server/ui/frontend/.tanstack/
+src/stemtrace/server/ui/frontend/tsconfig.tsbuildinfo
 
 # Documentation
 docs/_build/
@@ -53,9 +63,10 @@ docs/_build/
 .env.local
 *.log
 
-# Cursor/Editor
+# Cursor/Editor/agent tooling
 .cursor/
 .context/
+.claude/
 
 # Keep these (they're built in Dockerfile)
 !src/stemtrace/server/ui/frontend/package*.json

{stemtrace-0.3.6 → stemtrace-0.3.7}/.github/dependabot.yml

@@ -7,6 +7,10 @@ updates:
       interval: weekly
     commit-message:
       prefix: "chore(deps)"
+    ignore:
+      # Dependabot's uv updater fails on the build backend; updated by the
+      # weekly maintenance routine
+      - dependency-name: "hatchling"
 
   - package-ecosystem: npm
     directory: /src/stemtrace/server/ui/frontend
@@ -14,6 +18,10 @@ updates:
       interval: weekly
     commit-message:
       prefix: "chore(deps)"
+    ignore:
+      # Pinned to ^22: types must match the Node 22 runtime used in CI and Docker
+      - dependency-name: "@types/node"
+        update-types: ["version-update:semver-major"]
 
   - package-ecosystem: github-actions
     directory: /
@@ -29,3 +37,10 @@ updates:
       interval: weekly
     commit-message:
       prefix: "chore(deps)"
+    ignore:
+      # The shipped Python runtime is deliberate: stay on 3.12.x patch updates
+      - dependency-name: "python"
+        update-types: ["version-update:semver-major", "version-update:semver-minor"]
+      # UI is built with Node 22 LTS: allow minor/patch updates only
+      - dependency-name: "node"
+        update-types: ["version-update:semver-major"]

{stemtrace-0.3.6 → stemtrace-0.3.7}/.github/workflows/ci.yml

@@ -135,7 +135,7 @@ jobs:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Set up Node.js
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
           cache: "npm"
@@ -170,7 +170,7 @@ jobs:
           enable-cache: true
 
       - name: Set up Node.js
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
           cache: "npm"

{stemtrace-0.3.6 → stemtrace-0.3.7}/.github/workflows/e2e.yml

@@ -153,7 +153,7 @@ jobs:
           sleep 5
 
       - name: Set up Node.js
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
           cache: "npm"

{stemtrace-0.3.6 → stemtrace-0.3.7}/.github/workflows/release.yml

@@ -56,7 +56,7 @@ jobs:
           python-version: "3.12"
 
       - name: Set up Node.js
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
           cache: "npm"
@@ -112,7 +112,7 @@ jobs:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

{stemtrace-0.3.6 → stemtrace-0.3.7}/.pre-commit-config.yaml

@@ -11,13 +11,15 @@ repos:
       - id: debug-statements
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.14.0
+    rev: v0.16.10
     hooks:
       # Linter (auto-fix enabled)
-      - id: ruff
+      - id: ruff-check
         args: [--fix]
-      # Formatter
+      # Formatter (Python only: the hook also formats Markdown code blocks,
+      # which would undo the hand-aligned comments in the README examples)
       - id: ruff-format
+        types_or: [python, pyi]
 
   # Local hooks use project environment (uv) for proper dependency access
   - repo: local

{stemtrace-0.3.6 → stemtrace-0.3.7}/CHANGELOG.md

@@ -7,6 +7,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.3.7] - 2026-10-10
+
+### Changed
+- Docker: the image's `HEALTHCHECK` now calls the new `<prefix>/api/health/live` endpoint instead of `/stemtrace/api/health`, which returns 401 under form login (so containers with login enabled reported unhealthy). The liveness endpoint needs no session and checks only that the process is serving: it always answers 200, with an informational `{"status": "ok"}`, or `{"status": "degraded"}` by the same rule as `/api/health` (the event consumer stopped unexpectedly or can't read from the broker; a consumer stopped on purpose or whose event source finished is not degraded).
+- Docker image: updated the locked runtime dependencies `fastapi` 0.141.1 → 0.142.2 (which now pulls in `opentelemetry-api` 1.45.1; stemtrace doesn't configure tracing, so it stays a no-op), `pydantic` 2.12.5 → 2.13.5 (`pydantic-core` 2.41.5 → 2.46.5), `celery` 5.6.0 → 5.6.3, `typer` 0.21.0 → 0.27.3, `typing-extensions` 4.15.0 → 4.16.0 and `websockets` 15.0.1 → 16.1.1 (used by uvicorn's WebSocket support). Only the lockfile changed: the package's dependency ranges are the same, so pip installs are unaffected. With typer 0.27, `--help` shows option types as `<str>`/`<int>` instead of `TEXT`/`INTEGER`.
+- Docker image: building the image from a local checkout no longer copies the frontend's `node_modules/`, `dist/` or test artifacts into the build context, so stale local UI assets can't end up in the image.
+- UI: updated `@tanstack/react-query` 5.94.5 → 5.104.1 in the bundled frontend.
+
+### Fixed
+- Form login: clear warnings and an in-app explanation when sessions are rejected because workers/replicas don't share `STEMTRACE_LOGIN_SECRET`. Without an explicit secret each process signs cookies with its own random secret, so under `uvicorn --workers N`, gunicorn or several replicas a cookie issued by one process is rejected by the others (random 401s, unstyled UI, login loops). stemtrace now logs a startup warning when form login runs without a secret (mentioning `WEB_CONCURRENCY` > 1 or gunicorn when detected). In that mode, when a well-formed, unexpired session cookie fails signature verification and the issue time it carries (`iat`, now included in the signed session payload; unverified in this case and used only to classify the rejection, never to grant access) is after the process started (so it most likely came from a sibling worker or replica), it also logs a rate-limited warning (also for rejected WebSocket handshakes) and returns `"reason": "session_secret_mismatch"` in API 401 responses, and HTML routes redirect to the login page with `reason=session_mismatch`, which shows an explanation. Cookies from before a restart, and any badly signed cookie when a secret is configured, get a plain 401 / login redirect.
+- Form login: the static UI bundle under `/assets/` (the public open-source JS/CSS build, no data) is now served without a session, so the UI always loads and is styled instead of rendering a blank or unstyled page when a bundle request is rejected. The UI routes, API and WebSocket stay protected, and paths containing `.` or `..` segments (including percent-encoded variants), or an encoded `?` or `#` (`%3F`, `%23`), are rejected with 404 before any exemption applies. Exemptions are decided on the decoded path that routing matches, so e.g. `/api/health/live%3Fx` can't pass as the liveness probe. Paths under `assets/` that aren't real bundle files return 404 instead of the app shell.
+- UI: the Logout control is now a button in the header instead of a floating overlay injected by the server, which covered the connection status. On narrow screens the header wraps onto extra rows instead of overflowing, and the status tooltip stays inside the viewport.
+- UI: a 401 from the API (missing or expired session) now redirects to the login page with `next` set to the current page, instead of showing "Failed to load ..." errors. A 401 with `reason: "session_secret_mismatch"` shows an explanation instead, since signing in again wouldn't help. Redirects happen at most once per page and not again within a few seconds of the last one, which prevents redirect loops. The WebSocket reconnect now backs off exponentially (3s up to 60s) instead of retrying every 3s forever.
+- Task state no longer regresses when events arrive out of order. The sender-side `PENDING` event (from `task_sent`, which fires after publish) could reach the stream after the worker's `STARTED`/`SUCCESS`, and the task showed as `PENDING` again. Node state now comes from the most advanced event, and the result is the same for every arrival order. A terminal state (`SUCCESS`/`FAILURE`/`REVOKED`/`REJECTED`) always beats a non-terminal one, and between terminals the later one wins. Among other states, a newer attempt (higher `retries`) wins, then lifecycle order (`PENDING` < `RECEIVED` < `STARTED`/`RETRY`), with `STARTED` vs `RETRY` in the same attempt decided by time (a redelivered run after a connection-loss retry shows as `STARTED`). A task's events are kept in lifecycle order: the first attempt's `PENDING` then `RECEIVED` first (even when stamped after the task was received or finished), then everything else by timestamp, with a fixed order for identical timestamps. `first_seen`, `last_updated`, `duration_ms`, date filters, sorting and eviction follow that order instead of arrival order. Node aliases from task arguments (`node_alias_from_arguments`) are read from the first event that carries arguments, so a leading `RECEIVED` (which has none) no longer hides them. Task lists, task details and graphs are read from a single snapshot taken under the store lock, so a concurrent event can't make a response mix old and new data (e.g. a `?state=STARTED` filter returning a task that just finished). Naive event timestamps are treated as UTC. Exact duplicate events are ignored and not re-broadcast over the WebSocket.
+- UI: the task timeline and event history follow the same order as the API. They used to sort by retry count first, so a failure raised in the worker main process (hard time limit, lost worker), which Celery reports with `retries=0`, appeared before later attempts and produced negative durations. A late-stamped `PENDING` is shown first, with its time clamped to the first run.
+- The signal handler no longer raises `TypeError` when Celery cancels a running task (lost broker connection, cold shutdown): Celery sends `task_retry` without a `reason` on that path. The `RETRY` event is now created, with the exception text "cancelled by Celery". During a broker outage it still can't be delivered if stemtrace publishes through that same broker.
+
 ## [0.3.6] - 2026-10-10
 
 ### Security

{stemtrace-0.3.6 → stemtrace-0.3.7}/Dockerfile

@@ -60,9 +60,10 @@ ENV PORT="8000"
 
 EXPOSE 8000
 
-# Health check (CLI server mounts API at /stemtrace prefix)
+# Health check (CLI server mounts API at /stemtrace prefix). The liveness
+# endpoint needs no login session and answers 200 while the process serves.
 HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
-    CMD python -c "import httpx; httpx.get('http://localhost:8000/stemtrace/api/health').raise_for_status()"
+    CMD python -c "import httpx; httpx.get('http://localhost:8000/stemtrace/api/health/live').raise_for_status()"
 
 # Default command: run server
 ENTRYPOINT ["stemtrace"]

{stemtrace-0.3.6 → stemtrace-0.3.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: stemtrace
-Version: 0.3.6
+Version: 0.3.7
 Summary: A lightweight Celery task flow visualizer
 Project-URL: Homepage, https://github.com/iansokolskyi/stemtrace
 Project-URL: Documentation, https://github.com/iansokolskyi/stemtrace#readme
@@ -59,7 +59,7 @@ Description-Content-Type: text/markdown
 
 **Zero-infrastructure Celery task flow visualizer**
 
-[![PyPI version](https://img.shields.io/badge/pypi-v0.3.6-darklime)](https://pypi.org/project/stemtrace)
+[![PyPI version](https://img.shields.io/badge/pypi-v0.3.7-darklime)](https://pypi.org/project/stemtrace)
 [![Python](https://img.shields.io/pypi/pyversions/stemtrace.svg)](https://pypi.org/project/stemtrace/)
 [![CI](https://github.com/iansokolskyi/stemtrace/actions/workflows/ci.yml/badge.svg)](https://github.com/iansokolskyi/stemtrace/actions/workflows/ci.yml)
 [![codecov](https://codecov.io/gh/iansokolskyi/stemtrace/graph/badge.svg)](https://codecov.io/gh/iansokolskyi/stemtrace)
@@ -443,6 +443,10 @@ stemtrace server \
     --login-secret change-me
 ```
 
+Set `--login-secret` (or `STEMTRACE_LOGIN_SECRET`) to a long random value, and use the same
+value on every replica. Without it, each process generates its own random secret, so sessions
+only work within a single process and are lost on restart.
+
 #### High-Scale Production Setup
 
 Note: `stemtrace server` includes an embedded consumer today (single-process). A multi-process deployment mode is planned.
@@ -512,7 +516,19 @@ stemtrace.init_app(
 )
 ```
 
-This serves a sign-in page at `/stemtrace/login` and protects everything under `/stemtrace`.
+This serves a sign-in page at `/stemtrace/login` and protects the UI, API and WebSocket under
+`/stemtrace`. The static JS/CSS bundle under `/stemtrace/assets/` is the public UI build and is
+served without a session. So is `/stemtrace/api/health/live`, a liveness probe for load
+balancers and container health checks: it always answers 200 while the process is serving,
+with only `{"status": "ok"}`, or `{"status": "degraded"}` when the embedded consumer stopped
+unexpectedly or can't read from the broker (the same rule as `/stemtrace/api/health`).
+
+For any multi-process deployment (`uvicorn --workers N`, gunicorn, or several replicas behind
+a load balancer), set `login_secret` (or the `STEMTRACE_LOGIN_SECRET` env var) to the same long
+random value everywhere, e.g. `python -c "import secrets; print(secrets.token_urlsafe(32))"`.
+Without it, each process signs sessions with its own random secret, and users get logged out
+at random. stemtrace logs a warning at startup in that case, and the login page and UI explain
+the problem when a session signed by another process is rejected.
 
 #### Built-in Auth Helpers (Basic / API key)
 

{stemtrace-0.3.6 → stemtrace-0.3.7}/README.md

@@ -4,7 +4,7 @@
 
 **Zero-infrastructure Celery task flow visualizer**
 
-[![PyPI version](https://img.shields.io/badge/pypi-v0.3.6-darklime)](https://pypi.org/project/stemtrace)
+[![PyPI version](https://img.shields.io/badge/pypi-v0.3.7-darklime)](https://pypi.org/project/stemtrace)
 [![Python](https://img.shields.io/pypi/pyversions/stemtrace.svg)](https://pypi.org/project/stemtrace/)
 [![CI](https://github.com/iansokolskyi/stemtrace/actions/workflows/ci.yml/badge.svg)](https://github.com/iansokolskyi/stemtrace/actions/workflows/ci.yml)
 [![codecov](https://codecov.io/gh/iansokolskyi/stemtrace/graph/badge.svg)](https://codecov.io/gh/iansokolskyi/stemtrace)
@@ -388,6 +388,10 @@ stemtrace server \
     --login-secret change-me
 ```
 
+Set `--login-secret` (or `STEMTRACE_LOGIN_SECRET`) to a long random value, and use the same
+value on every replica. Without it, each process generates its own random secret, so sessions
+only work within a single process and are lost on restart.
+
 #### High-Scale Production Setup
 
 Note: `stemtrace server` includes an embedded consumer today (single-process). A multi-process deployment mode is planned.
@@ -457,7 +461,19 @@ stemtrace.init_app(
 )
 ```
 
-This serves a sign-in page at `/stemtrace/login` and protects everything under `/stemtrace`.
+This serves a sign-in page at `/stemtrace/login` and protects the UI, API and WebSocket under
+`/stemtrace`. The static JS/CSS bundle under `/stemtrace/assets/` is the public UI build and is
+served without a session. So is `/stemtrace/api/health/live`, a liveness probe for load
+balancers and container health checks: it always answers 200 while the process is serving,
+with only `{"status": "ok"}`, or `{"status": "degraded"}` when the embedded consumer stopped
+unexpectedly or can't read from the broker (the same rule as `/stemtrace/api/health`).
+
+For any multi-process deployment (`uvicorn --workers N`, gunicorn, or several replicas behind
+a load balancer), set `login_secret` (or the `STEMTRACE_LOGIN_SECRET` env var) to the same long
+random value everywhere, e.g. `python -c "import secrets; print(secrets.token_urlsafe(32))"`.
+Without it, each process signs sessions with its own random secret, and users get logged out
+at random. stemtrace logs a warning at startup in that case, and the login page and UI explain
+the problem when a session signed by another process is rejected.
 
 #### Built-in Auth Helpers (Basic / API key)
 

{stemtrace-0.3.6 → stemtrace-0.3.7}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "stemtrace"
-version = "0.3.6"
+version = "0.3.7"
 description = "A lightweight Celery task flow visualizer"
 readme = "README.md"
 license = { text = "MIT" }
@@ -115,10 +115,6 @@ ignore_missing_imports = true
 module = "kombu.*"
 ignore_missing_imports = true
 
-[[tool.mypy.overrides]]
-module = "amqp.*"
-ignore_missing_imports = true
-
 # =============================================================================
 # ruff
 # =============================================================================
@@ -204,6 +200,6 @@ exclude_lines = [
     "if TYPE_CHECKING:",
     "raise NotImplementedError",
     "@abstractmethod",
-    "\\.\\.\\.",  # Protocol method stubs
+    "^\\s*\\.\\.\\.\\s*$",  # Protocol method stubs (a bare `...` body line)
     "class.*Protocol.*:",
 ]

{stemtrace-0.3.6 → stemtrace-0.3.7}/src/stemtrace/__init__.py

@@ -16,9 +16,6 @@ Usage:
 """
 
 import os
-import secrets
-import urllib.parse
-from collections.abc import Awaitable, Callable
 from typing import TYPE_CHECKING, Any
 
 from stemtrace.core.events import TaskEvent, TaskState
@@ -36,14 +33,15 @@ from stemtrace.server.fastapi import (
     require_api_key,
     require_basic_auth,
 )
-from stemtrace.server.fastapi.form_auth import FormAuthConfig, is_authenticated_cookie
+from stemtrace.server.fastapi.form_auth import FormAuthConfig, resolve_session_secret
+from stemtrace.server.fastapi.form_auth_middleware import create_form_auth_middleware
 from stemtrace.server.fastapi.login_routes import create_login_router
 
 if TYPE_CHECKING:
     from celery import Celery
     from fastapi import FastAPI
 
-__version__ = "0.3.6"
+__version__ = "0.3.7"
 __all__ = [
     "ConfigurationError",
     "StemtraceConfig",
@@ -178,7 +176,10 @@ def init_app(
         login_password: Enable built-in form login if set (password for login_username).
         login_secret: Secret used to sign session cookies. If not provided, uses
             STEMTRACE_LOGIN_SECRET env var. If still missing, a random secret is
-            generated (sessions invalidated on app restart).
+            generated per process and a warning is logged: sessions then only
+            work within one process (and are invalidated on restart), so set the
+            same long random value on every worker/replica of a multi-process
+            deployment.
         login_ttl_seconds: Session TTL in seconds (default: 24 hours).
         node_alias_from_arguments: Derive graph node display name from task arguments.
             Digit string for args[index], string for kwargs[key], or None (default).
@@ -208,10 +209,8 @@ def init_app(
     effective_login_username = login_username or os.getenv("STEMTRACE_LOGIN_USERNAME")
     effective_login_password = login_password or os.getenv("STEMTRACE_LOGIN_PASSWORD")
     if effective_login_username and effective_login_password:
-        effective_secret = (
-            login_secret
-            or os.getenv("STEMTRACE_LOGIN_SECRET")
-            or secrets.token_urlsafe(32)
+        effective_secret, secret_is_generated = resolve_session_secret(
+            login_secret or os.getenv("STEMTRACE_LOGIN_SECRET")
         )
         form_auth_config = FormAuthConfig(
             username=effective_login_username,
@@ -220,6 +219,7 @@ def init_app(
             ttl_seconds=login_ttl_seconds,
             cookie_name="stemtrace_session",
             cookie_path=mount_prefix,
+            secret_is_generated=secret_is_generated,
         )
 
         _install_stemtrace_form_auth(
@@ -256,51 +256,23 @@ def _install_stemtrace_form_auth(
     The login router must be added before stemtrace UI's SPA catch-all route,
     otherwise `/login` would be handled by the SPA fallback.
     """
-    from fastapi import Request
-    from fastapi.responses import JSONResponse, RedirectResponse
-    from starlette.responses import Response
-
     login_router = create_login_router(
         form_auth_config,
         default_next_path=f"{mount_prefix}/",
     )
     app.include_router(login_router, prefix=mount_prefix)
 
-    login_path = f"{mount_prefix}/login"
-    logout_path = f"{mount_prefix}/logout"
-
-    @app.middleware("http")
-    async def _stemtrace_form_auth_middleware(
-        request: Request,
-        call_next: Callable[[Request], Awaitable[Response]],
-    ) -> Response:
-        path = request.url.path
-        if not path.startswith(mount_prefix):
-            return await call_next(request)
-
-        # Allow login/logout without auth.
-        if path in (login_path, logout_path):
-            return await call_next(request)
-
-        cookie_value = request.cookies.get(form_auth_config.cookie_name)
-        if is_authenticated_cookie(
-            cookie_value,
-            secret=form_auth_config.secret,
-            expected_username=form_auth_config.username,
-        ):
-            return await call_next(request)
-
-        # Not authenticated.
-        if path.startswith(f"{mount_prefix}/api"):
-            return JSONResponse({"detail": "Authentication required"}, status_code=401)
-        if path.startswith(f"{mount_prefix}/assets"):
-            return JSONResponse({"detail": "Authentication required"}, status_code=401)
-
-        next_target = path
-        if request.url.query:
-            next_target = f"{path}?{request.url.query}"
-        next_qs = urllib.parse.urlencode({"next": next_target})
-        return RedirectResponse(url=f"{login_path}?{next_qs}", status_code=303)
+    app.middleware("http")(
+        create_form_auth_middleware(
+            form_auth_config,
+            login_path=f"{mount_prefix}/login",
+            logout_path=f"{mount_prefix}/logout",
+            api_prefix=f"{mount_prefix}/api",
+            assets_prefix=f"{mount_prefix}/assets",
+            protected_prefix=mount_prefix,
+            public_paths=(f"{mount_prefix}/api/health/live",),
+        )
+    )
 
 
 def _reset() -> None: