panel.io.admin_auth module#

Access control for the admin panel, shared by the Tornado and ASGI servers.

Two independent checks apply. config.admin_users restricts the admin panel to users authenticated by the server’s auth provider, while config.admin_password requires a password entered on the admin panel’s own login page and therefore also works without server authentication.

class panel.io.admin_auth.AdminAccess(allowed: bool, login: bool = False, error: str | None = None)[source]#

Bases: NamedTuple

Outcome of checking a request against the admin access configuration.

allowed: bool#: Alias for field number 0

error: str | None#: Alias for field number 2

login: bool#: Alias for field number 1

panel.io.admin_auth.admin_cookie(token: str | None, secure: bool = False) → str[source]#: The Set-Cookie header value storing token, or clearing the cookie if it is None. The path is left to the browser, which scopes the cookie to the admin endpoint the login page is served under.

panel.io.admin_auth.admin_document_url(login_path: str) → str[source]#: The URL of the admin document relative to its login page at login_path. It omits the trailing slash, under which the document’s relative resource URLs would not resolve.

panel.io.admin_auth.check_admin_access(user: str | None, token: str | None) → AdminAccess[source]#

Checks whether a request may access the admin panel.

Parameters:

user: str | None: The user authenticated by the server’s auth provider.
token: str | None: The value of the admin cookie.

panel.io.admin_auth.mark_admin_application(app: Application) → Application[source]#: Marks an application as the admin panel, the servers enforce the admin access configuration on its routes.

panel.io.admin_auth.relative_endpoint(path: str, endpoint: str) → str[source]#: The URL of an admin endpoint relative to the admin document at path, which keeps redirects working behind proxies that rewrite the prefix.