Feat/backend api security and minor fixes

[cardosofede]

Is necessary to run the broker via Docker, and this version of the Backend-API via source or docker: https://github.com/hummingbot/backend-api/pull/37

In this PR we should test the following things (is necessary to do a fresh install of the environment):

1. Auth system: change in CONFIG.py AUTH_SYSTEM_ENABLED to True by default (so you don't need to set up an env variable or set the env variable, as you want) -- > line 20 of the image. Test that the login is working well for admin abc that is the default.

2. Backend API security: as you can see lines 24 and 25 were added to introduce two new env variables. By default, the user and pass are (admin, admin) for Backend API. If you run the Dashboard you should be able to use it without problems. The next thing will be:

   • Changing the config in the backend api and run it again (check the .env file and change the username)
   • Changing the default from admin to something else In the last two scenarios, the dashboard should not work.

[rapcmia]

PR update:

• Fresh install dashboard and backend-api on source ✅
• AUTH_SYSTEM_ENABLED is still set to false by default, change from false to true to test. Auth enabled ✅
• Login using default credentials ok
• After login, check bot orchestration page
  • It seems related to issue on set_environment.sh
  • Change to set admin/admin worked ✅
  • if backend_api_username and password does not match to set .env file, user cannot access ✅
• If auth disabled and backendapi credentials does not match:
  • user can access dashboard without login ✅
  • user can’t access pages that require backendapi ✅

[rapcmia]

Attached recording of XEMM Controller accessible when unauthorized:

https://github.com/user-attachments/assets/d1845fb8-f097-4bc4-9ceb-cc5d217a13fc

[nikspz]

0c9238a

Docker backend-api-PR37 + dashboard PR188

1. Cloned PR188 and set AUTH_SYSTEM_ENABLED True
2. manually built docker image with docker build -t hummingbot/dashboard:development -f Dockerfile .
3. cloned backend-api-PR37 and manually built docker image with docker build -t hummingbot/backend-api:development -f Dockerfile .
4. cloned deploy repo and use setup_dev.sh to run dashboard

Actual: Reviewed not asked for authentication

[notion-workspace[bot]]

Feat/backend api security and minor fixes #188