Security & Environment Standards

Authentication Model

The app uses passwordless magic-link authentication — no passwords, no flask-login, no WTForms. A time-limited token is emailed; clicking it creates an authenticated session.

# app.py globals
magic_links    = {}   # {token: {'email': str, 'expires': datetime}}
active_sessions = {}  # {email: session_id} — one session per user enforced

MAGIC_LINK_EXPIRY_MINUTES = 15

def send_magic_link_email(email, magic_token, base_url) -> bool:
    # Send link via SMTP; falls back to stdout in dev (no SMTP config).
    ...

The @login_required decorator (defined in app.py) checks session['authenticated'] and active_sessions.