Repository navigation
feat: serve the admin console from FastAPI and Django - #4
Merged
Merged
Conversation
Proxies the Seamless admin dashboard from the auth API at /console, as the Express and Fastify adapters do: Adapter.console in the core, console_router for FastAPI and console_urlpatterns for Django. GET and HEAD only, nothing forwarded but the method and path, no path that can leave the console subtree, and redirects followed only within it.
Bccorb
force-pushed
the
feat/console-proxy
branch
from
October 8, 2026 19:19
b592bc8 to
907d3ee
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the admin console proxy, the counterpart of the Express and Fastify ones. It lets a Python API serve the Seamless admin dashboard at
/consoleon its own origin.seamless initdefaults to the console served by the API, so the FastAPI API template (fells-code/seamless-templates#112) needs this.Adapter.console(method, path, query), blocking and thread-safe likehandle.app.include_router(console_router(auth))serves/consoleand/console/....path("console/", include(console_urlpatterns)). The view is CSRF-exempt because it serves GET and HEAD only and answers anything else 405 itself.Behaviour matches the Node proxies, fells-code/seamless-auth-go#3 and fells-code/seamless-auth-rust#4:
GETandHEADonly./or\\, and malformed escapes answer 400.Checked against a real auth API serving the dashboard (the verify stack):
/console,/console/and its hashed JS (1.3 MB) and CSS assets come through byte for byte, HEAD has no body, and a traversal is refused. I ran the same check against the Go and Rust proxies.159 tests pass on Python 3.11, 3.12 and 3.14, and ruff and mypy strict are clean.