Remove login gates, make app fully open-source

Strip MUCHE member login, invitation codes, OTP/SMTP, password hashing,
and fuzzy name matching. Everyone can now use the app freely with just
a display name. Admin dashboard remains protected behind PREFERO_ADMIN_PASSWORD.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/auth.py

@@ -1,132 +1,15 @@
 """Authentication module for 分析侠 Prefero.
 
-Supports two methods:
-  1. MUCHE Member login (name fuzzy-match + password)
-  2. Invitation code (instant, checked against env var)
-
-MUCHE team members are stored as a whitelist.
-First login: match name + set password to claim account.
-Subsequent logins: match name + enter password.
-Fuzzy matching allows minor name variations (e.g. "John" matches "Jonathan").
-
-Toggle with PREFERO_AUTH_ENABLED env var ("true" to enable).
+Open access — no login required. Users pick a display name for community features.
+Admin access is controlled separately via PREFERO_ADMIN_PASSWORD env var.
 """
 
 from __future__ import annotations
 
-import hashlib
-import os
 import re
-from difflib import SequenceMatcher
 
 import streamlit as st
 
-# ---------------------------------------------------------------------------
-# Configuration helpers
-# ---------------------------------------------------------------------------
-
-def _auth_enabled() -> bool:
-    return os.environ.get("PREFERO_AUTH_ENABLED", "").lower() == "true"
-
-
-def _get_invitation_codes() -> list[str]:
-    raw = os.environ.get("PREFERO_INVITATION_CODES", "")
-    if not raw.strip():
-        return []
-    return [c.strip().upper() for c in raw.split(",") if c.strip()]
-
-
-# ---------------------------------------------------------------------------
-# MUCHE team whitelist
-# ---------------------------------------------------------------------------
-
-MUCHE_MEMBERS: list[str] = [
-    # Director
-    "Henry Cutler",
-    # Academics
-    "Mona Aghdaee",
-    "Anam Bilgrami",
-    "Jonas Fooken",
-    "Yuanyuan Gu",
-    "Martin Hoyle",
-    "Varinder Jeet",
-    "Ali Furkan Kalay",
-    "Alicia Norman",
-    "Bonny Parkinson",
-    "Smriti Raichand",
-    "Rezwanul Rana",
-    "Rajan Sharma",
-    "Shari Stathis",
-    "Dandan Yu",
-    # Operations
-    "Ashley Soytemiz",
-    # Honorary & Visiting
-    "Marco Bertoni",
-    "David Cullen",
-    "Nils Gutacker",
-    "Rowena Jacobs",
-    "Elizabeth-Ann Schroeder",
-    "Kompal Sinha",
-    "Neil Soderlund",
-    "Apostolos Tsiachristas",
-    # Graduate research students
-    "Meimei Chen",
-    "Han Cheng",
-    "Kadek Darmawan",
-    "Shan Jiang",
-    "Maggie Lee",
-    "Noura Saba",
-    "Saranjit Singh",
-    "Zachery Tirrell",
-    "Hengzhe Zhao",
-]
-
-
-def _normalize(name: str) -> str:
-    """Lowercase, strip, collapse whitespace, remove hyphens."""
-    return re.sub(r"[\s\-]+", " ", name.strip().lower())
-
-
-def _fuzzy_match(input_name: str, threshold: float = 0.75) -> str | None:
-    """Find the best fuzzy match from MUCHE_MEMBERS.
-
-    Returns the canonical name if similarity >= threshold, else None.
-    Tries full name match first, then first-name-only match.
-    """
-    norm_input = _normalize(input_name)
-    if not norm_input:
-        return None
-
-    best_name: str | None = None
-    best_score: float = 0.0
-
-    for member in MUCHE_MEMBERS:
-        norm_member = _normalize(member)
-        score = SequenceMatcher(None, norm_input, norm_member).ratio()
-        if score > best_score:
-            best_score = score
-            best_name = member
-
-        first_name = norm_member.split()[0]
-        score_first = SequenceMatcher(None, norm_input, first_name).ratio()
-        if score_first > best_score:
-            best_score = score_first
-            best_name = member
-
-    if best_score >= threshold:
-        return best_name
-    return None
-
-
-def _hash_password(password: str) -> str:
-    """Simple SHA-256 hash for password storage."""
-    return hashlib.sha256(password.encode()).hexdigest()
-
-
-# ---------------------------------------------------------------------------
-# Auth gate UI
-# ---------------------------------------------------------------------------
-
 _SLOWBRO_IMG = (
     "https://raw.githubusercontent.com/PokeAPI/sprites/master/sprites"
     "/pokemon/other/official-artwork/80.png"
@@ -134,16 +17,19 @@ _SLOWBRO_IMG = (
 
 
 def auth_gate() -> bool:
-    """Show auth UI. Returns True if authenticated, False otherwise."""
-    if not _auth_enabled():
-        return True
+    """Always returns True — open access, no login required."""
+    st.session_state["authenticated"] = True
+    return True
 
-    if st.session_state.get("authenticated"):
+
+def username_gate() -> bool:
+    """Prompt the user to choose a display name if they haven't yet."""
+    if st.session_state.get("username"):
         return True
 
     try:
         st.set_page_config(
-            page_title="分析侠 Prefero - Sign In",
+            page_title="分析侠 Prefero - Welcome",
             page_icon="🧮",
             layout="centered",
         )
@@ -153,189 +39,6 @@ def auth_gate() -> bool:
     from utils import language_banner
     language_banner()
 
-    st.markdown(
-        "<div style='text-align:center;'>"
-        f"<img src='{_SLOWBRO_IMG}' width='120' />"
-        "</div>",
-        unsafe_allow_html=True,
-    )
-    st.markdown(
-        "<h2 style='text-align:center; margin-bottom:0;'>分析侠 Prefero</h2>",
-        unsafe_allow_html=True,
-    )
-    st.markdown(
-        "<p style='text-align:center; color:gray;'>Sign In</p>",
-        unsafe_allow_html=True,
-    )
-
-    # ── Concurrent login conflict resolution ─────────────────────
-    _conflict_user = st.session_state.get("_auth_conflict_user")
-    if _conflict_user:
-        _conflict_id = st.session_state.get("_auth_conflict_id", 0)
-        _conflict_source = st.session_state.get("_auth_conflict_source", "")
-
-        st.warning(
-            f"**{_conflict_user}** is currently logged in from another session. "
-            "Do you want to kick them off and log in here?"
-        )
-
-        _kick_col, _cancel_col = st.columns(2)
-        with _kick_col:
-            if st.button("Yes, log in here", type="primary", key="_auth_kick_btn", use_container_width=True):
-                from session_queue import force_evict_username, register_username
-                force_evict_username(_conflict_user)
-                st.session_state["authenticated"] = True
-                st.session_state["username"] = _conflict_user
-                st.session_state["user_id"] = _conflict_id
-                register_username(_conflict_user)
-                from community_db import log_activity
-                log_activity(_conflict_user, "login", f"{_conflict_source} (kicked previous session)")
-                # Clean up conflict state
-                st.session_state.pop("_auth_conflict_user", None)
-                st.session_state.pop("_auth_conflict_id", None)
-                st.session_state.pop("_auth_conflict_source", None)
-                st.rerun()
-        with _cancel_col:
-            if st.button("Cancel", key="_auth_cancel_kick_btn", use_container_width=True):
-                st.session_state.pop("_auth_conflict_user", None)
-                st.session_state.pop("_auth_conflict_id", None)
-                st.session_state.pop("_auth_conflict_source", None)
-                st.rerun()
-
-        return False
-
-    tab_member, tab_invite = st.tabs(["MUCHE Member", "Invitation Code"])
-
-    # ── Tab 1: MUCHE Member (name + password) ─────────────────────
-    with tab_member:
-        st.caption("Enter your name as it appears on the MUCHE website.")
-
-        name_input = st.text_input(
-            "Your name",
-            key="_auth_member_name",
-            placeholder="e.g. Jordan McAllister",
-        )
-
-        matched_name = None
-        if name_input and name_input.strip():
-            matched_name = _fuzzy_match(name_input)
-
-        if matched_name:
-            st.success(f"Matched: **{matched_name}**")
-
-            from community_db import init_db, get_user_by_name
-            init_db()
-            existing = get_user_by_name(matched_name)
-
-            if existing and existing.email:
-                # Returning user — enter password
-                pw_input = st.text_input(
-                    "Password",
-                    key="_auth_member_pw",
-                    type="password",
-                )
-                if st.button("Sign In", key="_auth_member_login_btn", use_container_width=True):
-                    if not pw_input:
-                        st.error("Please enter your password.")
-                    elif _hash_password(pw_input) == existing.email:
-                        from session_queue import is_username_active, register_username
-                        if is_username_active(existing.username):
-                            st.session_state["_auth_conflict_user"] = existing.username
-                            st.session_state["_auth_conflict_id"] = existing.id
-                            st.session_state["_auth_conflict_source"] = "MUCHE member"
-                            st.rerun()
-                        else:
-                            st.session_state["authenticated"] = True
-                            st.session_state["username"] = existing.username
-                            st.session_state["user_id"] = existing.id
-                            register_username(existing.username)
-                            from community_db import log_activity
-                            log_activity(existing.username, "login", "MUCHE member")
-                            st.success(f"Welcome back, {existing.username}!")
-                            st.rerun()
-                    else:
-                        st.error("Incorrect password.")
-            else:
-                # First time — set password to claim account
-                st.info("First time? Set a password to claim your account.")
-                pw1 = st.text_input(
-                    "Choose a password",
-                    key="_auth_member_pw1",
-                    type="password",
-                )
-                pw2 = st.text_input(
-                    "Confirm password",
-                    key="_auth_member_pw2",
-                    type="password",
-                )
-                if st.button("Create Account", key="_auth_member_create_btn", use_container_width=True):
-                    if not pw1 or not pw2:
-                        st.error("Please fill in both password fields.")
-                    elif len(pw1) < 4:
-                        st.error("Password must be at least 4 characters.")
-                    elif pw1 != pw2:
-                        st.error("Passwords do not match.")
-                    else:
-                        try:
-                            from community_db import create_user, log_activity
-                            from session_queue import register_username
-                            user = create_user(matched_name, email=_hash_password(pw1))
-                            st.session_state["authenticated"] = True
-                            st.session_state["username"] = user.username
-                            st.session_state["user_id"] = user.id
-                            register_username(user.username)
-                            log_activity(user.username, "register", "MUCHE member")
-                            st.success(f"Account created! Welcome, {user.username}!")
-                            st.rerun()
-                        except ValueError as exc:
-                            st.error(str(exc))
-        elif name_input and name_input.strip():
-            st.warning(
-                "Name not found in the MUCHE team list. "
-                "Please check your spelling, or use an invitation code."
-            )
-
-    # ── Tab 2: Invitation Code ────────────────────────────────────
-    with tab_invite:
-        code_input = st.text_input(
-            "Enter your invitation code",
-            key="_auth_invite_input",
-            type="password",
-        )
-        if st.button("Enter", key="_auth_invite_btn", use_container_width=True):
-            valid_codes = _get_invitation_codes()
-            if not valid_codes:
-                st.error("No invitation codes are configured.")
-            elif code_input.strip().upper() in valid_codes:
-                st.session_state["authenticated"] = True
-                st.session_state["auth_email"] = ""
-                st.success("Access granted!")
-                st.rerun()
-            else:
-                st.error("Invalid invitation code.")
-
-    return False
-
-
-# ---------------------------------------------------------------------------
-# Username selection gate (shown after auth, before main app)
-# ---------------------------------------------------------------------------
-
-def username_gate() -> bool:
-    """Prompt the user to choose a display name if they haven't yet.
-
-    For MUCHE members, username is already set during auth_gate.
-    Only invitation code users see this screen.
-    """
-    if not _auth_enabled():
-        if not st.session_state.get("username"):
-            st.session_state["username"] = "Guest"
-            st.session_state["user_id"] = 0
-        return True
-
-    if st.session_state.get("username"):
-        return True
-
     st.markdown(
         "<div style='text-align:center;'>"
         f"<img src='{_SLOWBRO_IMG}' width='100' />"
@@ -343,44 +46,12 @@ def username_gate() -> bool:
         unsafe_allow_html=True,
     )
     st.markdown(
-        "<h3 style='text-align:center;'>Choose your display name</h3>",
+        "<h3 style='text-align:center;'>Welcome to 分析侠 Prefero</h3>"
+        "<p style='text-align:center; color:gray;'>"
+        "Choose a display name to get started</p>",
         unsafe_allow_html=True,
     )
 
-    # ── Concurrent login conflict resolution ─────────────────────
-    _conflict_user = st.session_state.get("_auth_conflict_user")
-    if _conflict_user:
-        _conflict_id = st.session_state.get("_auth_conflict_id", 0)
-        _conflict_source = st.session_state.get("_auth_conflict_source", "")
-
-        st.warning(
-            f"**{_conflict_user}** is currently logged in from another session. "
-            "Do you want to kick them off and log in here?"
-        )
-
-        _kick_col, _cancel_col = st.columns(2)
-        with _kick_col:
-            if st.button("Yes, log in here", type="primary", key="_ugate_kick_btn", use_container_width=True):
-                from session_queue import force_evict_username, register_username
-                force_evict_username(_conflict_user)
-                st.session_state["username"] = _conflict_user
-                st.session_state["user_id"] = _conflict_id
-                register_username(_conflict_user)
-                from community_db import log_activity
-                log_activity(_conflict_user, "login", f"{_conflict_source} (kicked previous session)")
-                st.session_state.pop("_auth_conflict_user", None)
-                st.session_state.pop("_auth_conflict_id", None)
-                st.session_state.pop("_auth_conflict_source", None)
-                st.rerun()
-        with _cancel_col:
-            if st.button("Cancel", key="_ugate_cancel_kick_btn", use_container_width=True):
-                st.session_state.pop("_auth_conflict_user", None)
-                st.session_state.pop("_auth_conflict_id", None)
-                st.session_state.pop("_auth_conflict_source", None)
-                st.rerun()
-
-        return False
-
     name_input = st.text_input(
         "Username",
         key="_auth_username_input",
@@ -399,29 +70,22 @@ def username_gate() -> bool:
         else:
             try:
                 from community_db import init_db, create_user, get_user_by_name, log_activity
-                from session_queue import is_username_active, register_username
+                from session_queue import register_username
 
                 init_db()
                 existing = get_user_by_name(name)
                 if existing:
-                    if is_username_active(existing.username):
-                        st.session_state["_auth_conflict_user"] = existing.username
-                        st.session_state["_auth_conflict_id"] = existing.id
-                        st.session_state["_auth_conflict_source"] = "Returning user"
-                        st.rerun()
-                    else:
-                        st.session_state["username"] = existing.username
-                        st.session_state["user_id"] = existing.id
-                        register_username(existing.username)
-                        log_activity(existing.username, "login", "Returning user")
-                        st.success(f"Welcome back, {existing.username}!")
-                        st.rerun()
+                    st.session_state["username"] = existing.username
+                    st.session_state["user_id"] = existing.id
+                    register_username(existing.username)
+                    log_activity(existing.username, "login", "Returning user")
+                    st.rerun()
                 else:
                     user = create_user(name, email="")
                     st.session_state["username"] = user.username
                     st.session_state["user_id"] = user.id
                     register_username(user.username)
-                    st.success(f"Welcome, {user.username}!")
+                    log_activity(user.username, "register", "New user")
                     st.rerun()
             except Exception as exc:
                 st.error(f"Error: {exc}")

app/pages/8_🔒_Admin.py

@@ -427,12 +427,8 @@ with c3:
 
 st.header("Space Configuration")
 
-auth_enabled = os.environ.get("PREFERO_AUTH_ENABLED", "false")
 queue_enabled = os.environ.get("PREFERO_QUEUE_ENABLED", "false")
 
-invite_codes_raw = os.environ.get("PREFERO_INVITATION_CODES", "")
-invite_count = len([c for c in invite_codes_raw.split(",") if c.strip()]) if invite_codes_raw.strip() else 0
-
 admin_users_display = os.environ.get("PREFERO_ADMIN_USERS", "(not set)")
 
 smtp_configured = bool(os.environ.get("SMTP_USER")) and bool(os.environ.get("SMTP_PASS"))
@@ -440,10 +436,9 @@ smtp_configured = bool(os.environ.get("SMTP_USER")) and bool(os.environ.get("SMT
 cfg_col1, cfg_col2 = st.columns(2)
 
 with cfg_col1:
-    st.metric("Auth enabled", auth_enabled)
+    st.metric("Access mode", "Open (no login)")
     st.metric("Queue enabled", queue_enabled)
     st.metric("SMTP configured", "Yes" if smtp_configured else "No")
 
 with cfg_col2:
-    st.metric("Invitation codes", str(invite_count))
     st.metric("Admin users", admin_users_display)

app/utils.py

@@ -35,12 +35,7 @@ _SESSION_DEFAULTS: dict[str, object] = {
 
 
 def require_auth() -> None:
-    """Block the page if the user has not authenticated.
-
-    When auth is disabled via PREFERO_AUTH_ENABLED, this is a no-op.
-    Otherwise it shows the auth gate and stops execution until the
-    user successfully authenticates.
-    """
+    """Run the auth gate. Currently a no-op (open access)."""
     if not auth_gate():
         st.stop()
 
@@ -56,7 +51,7 @@ def require_queue_slot() -> None:
 
 
 def _check_session_timeout() -> None:
-    """If the session was evicted due to inactivity, clear auth and redirect.
+    """If the session was evicted due to inactivity, clear state and redirect.
 
     Skips the check when estimation is actively running (the user is waiting
     for Slowbro to finish, not actually idle).
@@ -69,22 +64,22 @@ def _check_session_timeout() -> None:
     if st.session_state.get("_estimation_running"):
         return
 
-    if not st.session_state.get("authenticated"):
-        return  # not logged in → nothing to expire
+    if not st.session_state.get("username"):
+        return  # no username set → nothing to expire
 
     # Only check if user was previously admitted to the queue.
-    # Without this, freshly authenticated users who haven't entered
-    # the queue yet would be incorrectly treated as evicted.
+    # Without this, fresh users who haven't entered the queue yet
+    # would be incorrectly treated as evicted.
     if not st.session_state.get("_queue_admitted"):
         return
 
     if not is_session_active():
-        # Session was evicted — clear auth state
-        for key in ("authenticated", "auth_email", "username", "user_id"):
+        # Session was evicted — clear state so user re-enters
+        for key in ("username", "user_id"):
             st.session_state[key] = _SESSION_DEFAULTS.get(key, "")
         st.session_state.pop("_queue_session_id", None)
         st.session_state.pop("_queue_admitted", None)
-        st.warning("Your session expired due to inactivity. Please sign in again.")
+        st.warning("Your session expired due to inactivity. Please choose a username to continue.")
         st.stop()
 
 

scripts/test_new_modules.py

@@ -2,7 +2,7 @@
 """Comprehensive tests for newly created/modified modules in 分析侠 Prefero.
 
 Tested modules:
-  1. app/auth.py          — Authentication (OTP, invitation codes, rate limiting)
+  1. app/auth.py          — Authentication (open access, username gate)
   2. app/session_queue.py — Concurrent user queue
   3. app/waiting_facts.py — Cultural facts list
   4. app/pages/1_Data.py  — _generate_template_excel()
@@ -57,242 +57,33 @@ def _reset_session_state():
 # ══════════════════════════════════════════════════════════════════
 
 class TestAuth(unittest.TestCase):
-    """Tests for the authentication module."""
+    """Tests for the authentication module (open access)."""
 
     def setUp(self):
         _reset_session_state()
-        # Clean env vars that auth.py reads
-        for var in ("PREFERO_AUTH_ENABLED", "PREFERO_INVITATION_CODES",
-                     "SMTP_USER", "SMTP_PASS", "SMTP_HOST", "SMTP_PORT"):
-            os.environ.pop(var, None)
-
-    def tearDown(self):
-        for var in ("PREFERO_AUTH_ENABLED", "PREFERO_INVITATION_CODES",
-                     "SMTP_USER", "SMTP_PASS", "SMTP_HOST", "SMTP_PORT"):
-            os.environ.pop(var, None)
-
-    # ── _generate_otp ─────────────────────────────────────────────
-
-    def test_generate_otp_returns_6_digit_string(self):
-        from auth import _generate_otp
-        otp = _generate_otp()
-        self.assertIsInstance(otp, str)
-        self.assertEqual(len(otp), 6)
-        self.assertTrue(otp.isdigit(), f"OTP '{otp}' is not all digits")
-
-    def test_generate_otp_multiple_calls_vary(self):
-        """Multiple calls should (very likely) produce different OTPs."""
-        from auth import _generate_otp
-        otps = {_generate_otp() for _ in range(50)}
-        # With 10^6 possibilities and 50 draws, collisions are extremely rare
-        self.assertGreater(len(otps), 1, "50 OTP calls all returned the same value")
-
-    # ── _get_invitation_codes ─────────────────────────────────────
-
-    def test_invitation_codes_empty_when_unset(self):
-        from auth import _get_invitation_codes
-        self.assertEqual(_get_invitation_codes(), [])
-
-    def test_invitation_codes_empty_string(self):
-        from auth import _get_invitation_codes
-        os.environ["PREFERO_INVITATION_CODES"] = ""
-        self.assertEqual(_get_invitation_codes(), [])
-
-    def test_invitation_codes_whitespace_only(self):
-        from auth import _get_invitation_codes
-        os.environ["PREFERO_INVITATION_CODES"] = "   "
-        self.assertEqual(_get_invitation_codes(), [])
-
-    def test_invitation_codes_single(self):
-        from auth import _get_invitation_codes
-        os.environ["PREFERO_INVITATION_CODES"] = "abc123"
-        self.assertEqual(_get_invitation_codes(), ["ABC123"])
-
-    def test_invitation_codes_multiple_with_spaces(self):
-        from auth import _get_invitation_codes
-        os.environ["PREFERO_INVITATION_CODES"] = " code1 , code2 , CODE3 "
-        self.assertEqual(_get_invitation_codes(), ["CODE1", "CODE2", "CODE3"])
-
-    def test_invitation_codes_case_insensitive_upper(self):
-        """Codes are stored upper-cased for case-insensitive matching."""
-        from auth import _get_invitation_codes
-        os.environ["PREFERO_INVITATION_CODES"] = "HelloWorld"
-        codes = _get_invitation_codes()
-        self.assertIn("HELLOWORLD", codes)
-
-    def test_invitation_codes_skip_empty_segments(self):
-        from auth import _get_invitation_codes
-        os.environ["PREFERO_INVITATION_CODES"] = "a,,b, ,c"
-        codes = _get_invitation_codes()
-        self.assertEqual(codes, ["A", "B", "C"])
-
-    # ── _auth_enabled ─────────────────────────────────────────────
-
-    def test_auth_enabled_false_when_unset(self):
-        from auth import _auth_enabled
-        self.assertFalse(_auth_enabled())
-
-    def test_auth_enabled_false_when_empty(self):
-        from auth import _auth_enabled
-        os.environ["PREFERO_AUTH_ENABLED"] = ""
-        self.assertFalse(_auth_enabled())
-
-    def test_auth_enabled_false_when_random_string(self):
-        from auth import _auth_enabled
-        os.environ["PREFERO_AUTH_ENABLED"] = "yes"
-        self.assertFalse(_auth_enabled())
-
-    def test_auth_enabled_true(self):
-        from auth import _auth_enabled
-        os.environ["PREFERO_AUTH_ENABLED"] = "true"
-        self.assertTrue(_auth_enabled())
-
-    def test_auth_enabled_true_case_insensitive(self):
-        from auth import _auth_enabled
-        os.environ["PREFERO_AUTH_ENABLED"] = "TRUE"
-        self.assertTrue(_auth_enabled())
-
-    def test_auth_enabled_true_mixed_case(self):
-        from auth import _auth_enabled
-        os.environ["PREFERO_AUTH_ENABLED"] = "True"
-        self.assertTrue(_auth_enabled())
-
-    # ── _smtp_configured ──────────────────────────────────────────
-
-    def test_smtp_not_configured_when_unset(self):
-        from auth import _smtp_configured
-        self.assertFalse(_smtp_configured())
-
-    def test_smtp_not_configured_with_only_user(self):
-        from auth import _smtp_configured
-        os.environ["SMTP_USER"] = "user@example.com"
-        self.assertFalse(_smtp_configured())
-
-    def test_smtp_not_configured_with_only_pass(self):
-        from auth import _smtp_configured
-        os.environ["SMTP_PASS"] = "secret"
-        self.assertFalse(_smtp_configured())
-
-    def test_smtp_configured_with_both(self):
-        from auth import _smtp_configured
-        os.environ["SMTP_USER"] = "user@example.com"
-        os.environ["SMTP_PASS"] = "secret"
-        self.assertTrue(_smtp_configured())
-
-    def test_smtp_not_configured_with_empty_user(self):
-        from auth import _smtp_configured
-        os.environ["SMTP_USER"] = ""
-        os.environ["SMTP_PASS"] = "secret"
-        self.assertFalse(_smtp_configured())
-
-    # ── _check_rate_limit & _record_otp_attempt ───────────────────
-
-    def test_rate_limit_allows_first_attempt(self):
-        from auth import _check_rate_limit
-        self.assertTrue(_check_rate_limit("test@example.com"))
-
-    def test_rate_limit_allows_up_to_three(self):
-        from auth import _check_rate_limit, _record_otp_attempt
-        email = "ratelimit@example.com"
-        _record_otp_attempt(email)
-        self.assertTrue(_check_rate_limit(email))
-        _record_otp_attempt(email)
-        self.assertTrue(_check_rate_limit(email))
-        _record_otp_attempt(email)
-        # Now at 3 attempts — should be blocked
-        self.assertFalse(_check_rate_limit(email))
-
-    def test_rate_limit_different_emails_independent(self):
-        from auth import _check_rate_limit, _record_otp_attempt
-        for _ in range(3):
-            _record_otp_attempt("a@example.com")
-        self.assertFalse(_check_rate_limit("a@example.com"))
-        # Different email should still be allowed
-        self.assertTrue(_check_rate_limit("b@example.com"))
-
-    def test_rate_limit_old_attempts_expire(self):
-        """Attempts older than 10 minutes should not count."""
-        from auth import _check_rate_limit, _record_otp_attempt
-        email = "expire@example.com"
-        # Manually set old timestamps
-        old_time = time.time() - 11 * 60  # 11 minutes ago
-        _mock_session_state["_otp_attempts"] = {email: [old_time, old_time, old_time]}
-        self.assertTrue(_check_rate_limit(email))
-
-    def test_record_otp_creates_key_if_missing(self):
-        from auth import _record_otp_attempt
-        self.assertNotIn("_otp_attempts", _mock_session_state)
-        _record_otp_attempt("new@example.com")
-        self.assertIn("_otp_attempts", _mock_session_state)
-        self.assertEqual(len(_mock_session_state["_otp_attempts"]["new@example.com"]), 1)
-
-    # ── _send_otp_email (mocked) ──────────────────────────────────
-
-    def test_send_otp_email_constructs_message(self):
-        from auth import _send_otp_email
-        import base64
-        os.environ["SMTP_USER"] = "sender@example.com"
-        os.environ["SMTP_PASS"] = "pass123"
-        os.environ["SMTP_HOST"] = "smtp.example.com"
-        os.environ["SMTP_PORT"] = "587"
-
-        with patch("auth.smtplib.SMTP") as mock_smtp_class:
-            mock_server = MagicMock()
-            mock_smtp_class.return_value.__enter__ = MagicMock(return_value=mock_server)
-            mock_smtp_class.return_value.__exit__ = MagicMock(return_value=False)
-
-            _send_otp_email("recipient@example.com", "123456")
-
-            # Verify SMTP was initialized with correct host/port
-            mock_smtp_class.assert_called_once_with("smtp.example.com", 587, timeout=15)
-            # Verify the sendmail call happened
-            mock_server.starttls.assert_called_once()
-            mock_server.login.assert_called_once_with("sender@example.com", "pass123")
-            mock_server.sendmail.assert_called_once()
-            call_args = mock_server.sendmail.call_args
-            self.assertEqual(call_args[0][0], "sender@example.com")
-            self.assertEqual(call_args[0][1], ["recipient@example.com"])
-            # Verify the MIME headers
-            msg_string = call_args[0][2]
-            self.assertIn("Subject: Your Prefero Login Code", msg_string)
-            self.assertIn("From: sender@example.com", msg_string)
-            self.assertIn("To: recipient@example.com", msg_string)
-            # The body is base64-encoded (MIMEText with utf-8 charset)
-            # Decode and verify the OTP code is in the body
-            from email import message_from_string
-            parsed = message_from_string(msg_string)
-            body = parsed.get_payload(decode=True).decode("utf-8")
-            self.assertIn("123456", body)
-            self.assertIn("Prefero", body)
-            self.assertIn("verification code", body)
-
-    def test_send_otp_email_default_host_and_port(self):
-        from auth import _send_otp_email
-        os.environ["SMTP_USER"] = "u@example.com"
-        os.environ["SMTP_PASS"] = "p"
-        # Don't set SMTP_HOST or SMTP_PORT — should use defaults
-
-        with patch("auth.smtplib.SMTP") as mock_smtp_class:
-            mock_server = MagicMock()
-            mock_smtp_class.return_value.__enter__ = MagicMock(return_value=mock_server)
-            mock_smtp_class.return_value.__exit__ = MagicMock(return_value=False)
-
-            _send_otp_email("r@example.com", "999999")
-
-            mock_smtp_class.assert_called_once_with("smtp.gmail.com", 587, timeout=15)
 
     # ── auth_gate ─────────────────────────────────────────────────
 
-    def test_auth_gate_returns_true_when_disabled(self):
+    def test_auth_gate_always_returns_true(self):
         from auth import auth_gate
-        # PREFERO_AUTH_ENABLED not set → disabled
         self.assertTrue(auth_gate())
 
-    def test_auth_gate_returns_true_when_already_authenticated(self):
+    def test_auth_gate_sets_authenticated_flag(self):
         from auth import auth_gate
-        os.environ["PREFERO_AUTH_ENABLED"] = "true"
-        _mock_session_state["authenticated"] = True
-        self.assertTrue(auth_gate())
+        auth_gate()
+        self.assertTrue(_mock_session_state.get("authenticated"))
+
+    # ── username_gate ─────────────────────────────────────────────
+
+    def test_username_gate_returns_true_when_username_set(self):
+        from auth import username_gate
+        _mock_session_state["username"] = "TestUser"
+        self.assertTrue(username_gate())
+
+    def test_username_gate_returns_false_when_no_username(self):
+        from auth import username_gate
+        result = username_gate()
+        self.assertFalse(result)
 
 
 # ══════════════════════════════════════════════════════════════════
@@ -913,7 +704,6 @@ class TestUtils(unittest.TestCase):
 
     def setUp(self):
         _reset_session_state()
-        os.environ.pop("PREFERO_AUTH_ENABLED", None)
         os.environ.pop("PREFERO_QUEUE_ENABLED", None)
 
     # ── Imports ───────────────────────────────────────────────────
@@ -997,6 +787,9 @@ class TestUtils(unittest.TestCase):
         for key, default_val in _SESSION_DEFAULTS.items():
             self.assertIn(key, _mock_session_state,
                           f"Key '{key}' not found in session state after init")
+            # auth_gate() sets authenticated=True during init, so skip that check
+            if key == "authenticated":
+                continue
             self.assertEqual(_mock_session_state[key], default_val)
 
     def test_init_session_state_does_not_overwrite_existing(self):