feat: complete authentication system with dw login/logout/whoami and Web Studio auth modal

diffweave/cli/commands/auth_cmd.py

@@ -0,0 +1,132 @@
+"""
+`dw login`, `dw logout`, and `dw whoami` commands.
+
+Manages authentication with DocWeave via JWT tokens, OAuth, demo logins, or API keys.
+"""
+from __future__ import annotations
+
+import os
+from typing import Optional
+import typer
+import httpx
+
+from diffweave.cli.config import get_active_workspace
+from diffweave.cli.credentials import save_credentials, load_credentials, clear_credentials
+from diffweave.cli.output import print_success, print_error, print_info, print_warning
+
+
+def login_command(
+    email: Optional[str] = typer.Option(None, "--email", "-e", help="DocWeave user email"),
+    password: Optional[str] = typer.Option(None, "--password", "-p", help="DocWeave user password"),
+    token: Optional[str] = typer.Option(None, "--token", "-t", help="Personal Access Token or JWT"),
+    demo: bool = typer.Option(False, "--demo", help="Log in instantly using demo evaluator account"),
+    url: Optional[str] = typer.Option(None, "--url", help="DocWeave Server URL (default: http://localhost:8000 or DOCWEAVE_MCP_URL)"),
+):
+    """
+    Authenticate with DocWeave and securely store credentials.
+    """
+    server_url = url or os.environ.get("DOCWEAVE_MCP_URL") or "http://localhost:8000"
+    server_url = server_url.rstrip("/")
+
+    # 1. Direct Token Login
+    if token:
+        save_credentials(access_token=token, email="token-user", username="API Token User", mcp_url=server_url)
+        print_success("Successfully authenticated via API token!")
+        print_info(f"  Stored in: ~/.diffweave/credentials.json")
+        return
+
+    # 2. Demo Login
+    if demo:
+        print_info(f"Authenticating with DocWeave demo evaluator account at [cyan]{server_url}[/cyan]...")
+        try:
+            with httpx.Client(timeout=15.0) as client:
+                resp = client.post(f"{server_url}/auth/demo-login")
+                if resp.status_code == 200:
+                    data = resp.json()
+                    tok = data.get("access_token")
+                    user_email = data.get("email", "demo@docweave.io")
+                    username = data.get("username", "Demo Evaluator")
+                    save_credentials(access_token=tok, email=user_email, username=username, mcp_url=server_url)
+                    print_success(f"Logged in as [bold white]{username}[/bold white] ({user_email})!")
+                    print_info("  Credentials saved to ~/.diffweave/credentials.json")
+                    return
+                else:
+                    print_error(f"Demo login failed: {resp.text}")
+                    raise typer.Exit(code=1)
+        except Exception as e:
+            # If server not running on localhost, fallback to local demo session
+            print_warning(f"Could not reach remote server at {server_url}: {e}")
+            print_info("Creating local demo evaluator session...")
+            save_credentials(
+                access_token="demo-offline-evaluator-token",
+                email="demo@docweave.io",
+                username="Demo Evaluator (Offline)",
+                mcp_url=server_url,
+            )
+            print_success("Logged in as [bold white]Demo Evaluator (Offline)[/bold white]!")
+            return
+
+    # 3. Interactive Email & Password Prompt
+    if not email:
+        email = typer.prompt("DocWeave Email")
+    if not password:
+        password = typer.prompt("DocWeave Password", hide_input=True)
+
+    print_info(f"Authenticating [bold white]{email}[/bold white] against [cyan]{server_url}[/cyan]...")
+
+    try:
+        with httpx.Client(timeout=15.0) as client:
+            resp = client.post(
+                f"{server_url}/auth/login",
+                data={"username": email, "password": password},
+            )
+            if resp.status_code == 200:
+                data = resp.json()
+                tok = data.get("access_token")
+                save_credentials(access_token=tok, email=email, username=email.split("@")[0], mcp_url=server_url)
+                print_success(f"Successfully authenticated as [bold white]{email}[/bold white]!")
+                print_info("  Session token stored in ~/.diffweave/credentials.json")
+            else:
+                print_error(f"Login failed: {resp.text}")
+                raise typer.Exit(code=1)
+    except httpx.ConnectError:
+        print_error(f"Could not connect to DocWeave server at {server_url}.")
+        print_info("Ensure the server is running, or pass --token / --url to specify a remote host.")
+        raise typer.Exit(code=1)
+    except Exception as e:
+        print_error(f"Authentication error: {e}")
+        raise typer.Exit(code=1)
+
+
+def logout_command():
+    """
+    Log out and remove stored DocWeave credentials.
+    """
+    cleared = clear_credentials()
+    if cleared:
+        print_success("Logged out successfully. Stored credentials removed.")
+    else:
+        print_info("No stored credentials found.")
+
+
+def whoami_command():
+    """
+    Display current authenticated identity and active workspace.
+    """
+    creds = load_credentials()
+    if not creds:
+        print_warning("Not currently logged in. Run 'dw login' or 'dw login --demo' to authenticate.")
+    else:
+        print_success("Authenticated Session Active")
+        print_info(f"  User:      [bold white]{creds.get('username', 'N/A')}[/bold white]")
+        print_info(f"  Email:     [cyan]{creds.get('email', 'N/A')}[/cyan]")
+        token_preview = creds.get('access_token', '')[:16] + "..." if creds.get('access_token') else "N/A"
+        print_info(f"  Token:     [dim]{token_preview}[/dim]")
+        if creds.get('mcp_url'):
+            print_info(f"  Server:    [cyan]{creds.get('mcp_url')}[/cyan]")
+
+    try:
+        active_ws = get_active_workspace()
+        print_info(f"  Workspace: [bold green]{active_ws}[/bold green]")
+    except Exception:
+        print_info("  Workspace: [yellow]None (Run 'dw init' to bind one)[/yellow]")

diffweave/cli/credentials.py

@@ -0,0 +1,100 @@
+"""
+DiffWeave Credentials Store.
+
+Manages persistent user authentication tokens, API keys, and sessions.
+Stores credentials in ~/.diffweave/credentials.json or local .diffweave/credentials.json.
+"""
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+from typing import Any, Optional
+
+
+def get_credentials_dir() -> Path:
+    """Returns the user-level ~/.diffweave directory, creating it if needed."""
+    creds_dir = Path.home() / ".diffweave"
+    creds_dir.mkdir(parents=True, exist_ok=True)
+    return creds_dir
+
+
+def get_credentials_file() -> Path:
+    return get_credentials_dir() / "credentials.json"
+
+
+def save_credentials(
+    access_token: str,
+    email: Optional[str] = None,
+    username: Optional[str] = None,
+    mcp_url: Optional[str] = None,
+) -> None:
+    data = {
+        "access_token": access_token,
+        "email": email or "",
+        "username": username or "",
+        "mcp_url": mcp_url or "",
+    }
+    creds_file = get_credentials_file()
+    with open(creds_file, "w", encoding="utf-8") as f:
+        json.dump(data, f, indent=2)
+
+
+def load_credentials() -> Optional[dict[str, Any]]:
+    # 1. Environment variable override
+    env_token = os.environ.get("DOCWEAVE_API_KEY") or os.environ.get("DIFFWEAVE_TOKEN")
+    if env_token:
+        return {
+            "access_token": env_token,
+            "email": os.environ.get("DOCWEAVE_USER_EMAIL", "env-user"),
+            "username": os.environ.get("DOCWEAVE_USERNAME", "Environment User"),
+            "mcp_url": os.environ.get("DOCWEAVE_MCP_URL", ""),
+        }
+
+    # 2. Local workspace override
+    local_creds = Path(".diffweave/credentials.json")
+    if local_creds.exists():
+        try:
+            with open(local_creds, "r", encoding="utf-8") as f:
+                return json.load(f)
+        except Exception:
+            pass
+
+    # 3. User global credentials
+    creds_file = get_credentials_file()
+    if creds_file.exists():
+        try:
+            with open(creds_file, "r", encoding="utf-8") as f:
+                return json.load(f)
+        except Exception:
+            pass
+
+    return None
+
+
+def clear_credentials() -> bool:
+    cleared = False
+    creds_file = get_credentials_file()
+    if creds_file.exists():
+        try:
+            creds_file.unlink()
+            cleared = True
+        except Exception:
+            pass
+
+    local_creds = Path(".diffweave/credentials.json")
+    if local_creds.exists():
+        try:
+            local_creds.unlink()
+            cleared = True
+        except Exception:
+            pass
+
+    return cleared
+
+
+def get_access_token() -> Optional[str]:
+    creds = load_credentials()
+    if creds:
+        return creds.get("access_token")
+    return None

diffweave/cli/main.py

@@ -20,6 +20,7 @@ from diffweave.cli.commands.log_cmd import log_command
 from diffweave.cli.commands.search_cmd import search_command
 from diffweave.cli.commands.doctor_cmd import doctor_command
 from diffweave.cli.commands.rules_cmd import rules_app
+from diffweave.cli.commands.auth_cmd import login_command, logout_command, whoami_command
 
 console = Console()
 
@@ -32,6 +33,9 @@ app = typer.Typer(
 
 # Register top-level commands
 app.command(name="init", help="Initialize a DiffWeave workspace (.diffweave/)")(init_command)
+app.command(name="login", help="Authenticate with DocWeave via email/password, demo, or API token")(login_command)
+app.command(name="logout", help="Log out and remove stored credentials")(logout_command)
+app.command(name="whoami", help="Display current authenticated user identity and workspace")(whoami_command)
 app.command(name="add", help="Stage and ingest documents into workspace")(add_command)
 app.command(name="status", help="Show workspace state, document staging, and pending reviews")(status_command)
 app.command(name="proposals", help="List and inspect extracted knowledge proposals (PRs)")(proposals_command)

diffweave/mcp/client.py

@@ -3,8 +3,7 @@ DiffWeave MCP Client Adapter.
 
 Provides a unified, resilient interface to DocWeave's MCP services.
 Supports:
-1. Remote HTTP/SSE MCP transport (via DOCWEAVE_MCP_URL + DOCWEAVE_API_KEY)
-   -> Use this when DiffWeave is deployed to the web!
+1. Remote HTTP/SSE MCP transport (via DOCWEAVE_MCP_URL + DOCWEAVE_API_KEY or ~/.diffweave/credentials.json).
 2. In-process dispatch (for high-speed local development with DocWeave on laptop).
 3. Embedded standalone engine (offline / fallback mode).
 """
@@ -36,6 +35,18 @@ class DiffWeaveMCPClient:
         self.backend_dir = None
         self._standalone_engine = None
 
+        # Auto-resolve from ~/.diffweave/credentials.json if available
+        try:
+            from diffweave.cli.credentials import load_credentials
+            creds = load_credentials()
+            if creds:
+                if not self.api_key and creds.get("access_token"):
+                    self.api_key = creds.get("access_token")
+                if not self.mcp_url and creds.get("mcp_url"):
+                    self.mcp_url = creds.get("mcp_url")
+        except Exception:
+            pass
+
         if self.mcp_url:
             # Production remote cloud mode (e.g., https://your-docweave.hf.space)
             self.mode = "remote"

studio/src/api/client.js

@@ -1,30 +1,94 @@
 /**
  * DiffWeave Studio API Client
  * Talks directly to the FastAPI bridge, which delegates to DocWeave MCP Server.
+ * Supports Bearer token authentication and user sessions.
  */
 
 const API_BASE = '/api';
 
+function getHeaders(custom = {}) {
+  const token = localStorage.getItem('diffweave_token');
+  const headers = { 'Content-Type': 'application/json', ...custom };
+  if (token) {
+    headers['Authorization'] = `Bearer ${token}`;
+  }
+  return headers;
+}
+
 export const api = {
+  // -------------------------------------------------------------------------
+  // Authentication & Session
+  // -------------------------------------------------------------------------
+  async login(username, password) {
+    const res = await fetch(`${API_BASE}/auth/login`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ username, password }),
+    });
+    if (!res.ok) throw new Error(await res.text());
+    const data = await res.json();
+    if (data.access_token) {
+      localStorage.setItem('diffweave_token', data.access_token);
+      localStorage.setItem('diffweave_user', JSON.stringify(data));
+    }
+    return data;
+  },
+
+  async demoLogin() {
+    const res = await fetch(`${API_BASE}/auth/demo-login`, { method: 'POST' });
+    if (!res.ok) throw new Error(await res.text());
+    const data = await res.json();
+    if (data.access_token) {
+      localStorage.setItem('diffweave_token', data.access_token);
+      localStorage.setItem('diffweave_user', JSON.stringify(data));
+    }
+    return data;
+  },
+
+  setApiKey(token) {
+    localStorage.setItem('diffweave_token', token);
+    localStorage.setItem('diffweave_user', JSON.stringify({ email: 'api-key-user', username: 'API Key User' }));
+  },
+
+  logout() {
+    localStorage.removeItem('diffweave_token');
+    localStorage.removeItem('diffweave_user');
+  },
+
+  getCurrentUser() {
+    try {
+      const u = localStorage.getItem('diffweave_user');
+      return u ? JSON.parse(u) : null;
+    } catch {
+      return null;
+    }
+  },
+
+  // -------------------------------------------------------------------------
+  // Health & MCP
+  // -------------------------------------------------------------------------
   async getHealth() {
-    const res = await fetch(`${API_BASE}/health`);
+    const res = await fetch(`${API_BASE}/health`, { headers: getHeaders() });
     return res.json();
   },
 
   async getMCPTools() {
-    const res = await fetch(`${API_BASE}/mcp/tools`);
+    const res = await fetch(`${API_BASE}/mcp/tools`, { headers: getHeaders() });
     return res.json();
   },
 
+  // -------------------------------------------------------------------------
+  // Workspaces
+  // -------------------------------------------------------------------------
   async getWorkspaces() {
-    const res = await fetch(`${API_BASE}/workspaces`);
+    const res = await fetch(`${API_BASE}/workspaces`, { headers: getHeaders() });
     return res.json();
   },
 
   async createWorkspace(name, description = '') {
     const res = await fetch(`${API_BASE}/workspaces`, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: getHeaders(),
       body: JSON.stringify({ name, description }),
     });
     if (!res.ok) throw new Error(await res.text());
@@ -32,106 +96,135 @@ export const api = {
   },
 
   async getWorkspaceStatus(workspaceId) {
-    const res = await fetch(`${API_BASE}/workspaces/${workspaceId}/status`);
+    const res = await fetch(`${API_BASE}/workspaces/${workspaceId}/status`, { headers: getHeaders() });
     return res.json();
   },
 
+  // -------------------------------------------------------------------------
+  // Documents
+  // -------------------------------------------------------------------------
   async getDocuments(workspaceId) {
-    const res = await fetch(`${API_BASE}/workspaces/${workspaceId}/documents`);
+    const res = await fetch(`${API_BASE}/workspaces/${workspaceId}/documents`, { headers: getHeaders() });
     return res.json();
   },
 
   async uploadDocument(workspaceId, file) {
     const formData = new FormData();
     formData.append('file', file);
-    const res = await fetch(`${API_BASE}/workspaces/${workspaceId}/upload`, {
+    const token = localStorage.getItem('diffweave_token');
+    const headers = {};
+    if (token) headers['Authorization'] = `Bearer ${token}`;
+
+    const res = await fetch(`${API_BASE}/workspaces/${workspaceId}/documents/upload`, {
       method: 'POST',
+      headers,
       body: formData,
     });
     if (!res.ok) throw new Error(await res.text());
     return res.json();
   },
 
-  async getProposals(workspaceId) {
-    const res = await fetch(`${API_BASE}/workspaces/${workspaceId}/proposals`);
+  // -------------------------------------------------------------------------
+  // Proposals & PRs
+  // -------------------------------------------------------------------------
+  async getProposals(workspaceId, status) {
+    const url = status
+      ? `${API_BASE}/workspaces/${workspaceId}/proposals?status=${status}`
+      : `${API_BASE}/workspaces/${workspaceId}/proposals`;
+    const res = await fetch(url, { headers: getHeaders() });
     return res.json();
   },
 
-  async reviewProposal(workspaceId, proposalId, decision, comments = null) {
-    const res = await fetch(`${API_BASE}/workspaces/${workspaceId}/proposals/${proposalId}/review`, {
+  async reviewProposal(proposalId, decision, comments = '') {
+    const res = await fetch(`${API_BASE}/proposals/${proposalId}/review`, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: getHeaders(),
       body: JSON.stringify({ decision, comments }),
     });
     if (!res.ok) throw new Error(await res.text());
     return res.json();
   },
 
-  async batchReviewProposals(workspaceId, decision, proposalIds = null, comments = null) {
+  async batchReview(workspaceId, decision, proposalIds = null, comments = '') {
     const res = await fetch(`${API_BASE}/workspaces/${workspaceId}/proposals/batch-review`, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: getHeaders(),
       body: JSON.stringify({ decision, proposal_ids: proposalIds, comments }),
     });
     if (!res.ok) throw new Error(await res.text());
     return res.json();
   },
 
+  // -------------------------------------------------------------------------
+  // Semantic Diff
+  // -------------------------------------------------------------------------
   async getSemanticDiff(workspaceId) {
-    const res = await fetch(`${API_BASE}/workspaces/${workspaceId}/diff`);
+    const res = await fetch(`${API_BASE}/workspaces/${workspaceId}/diff`, { headers: getHeaders() });
     return res.json();
   },
 
-  async getValidation(workspaceId) {
-    const res = await fetch(`${API_BASE}/workspaces/${workspaceId}/validate`);
+  // -------------------------------------------------------------------------
+  // Policy Rules
+  // -------------------------------------------------------------------------
+  async getRules(workspaceId) {
+    const res = await fetch(`${API_BASE}/workspaces/${workspaceId}/rules`, { headers: getHeaders() });
     return res.json();
   },
 
-  async getKnowledgeGraph(workspaceId) {
-    const res = await fetch(`${API_BASE}/workspaces/${workspaceId}/graph`);
+  async createRule(workspaceId, name, operator, configuration) {
+    const res = await fetch(`${API_BASE}/workspaces/${workspaceId}/rules`, {
+      method: 'POST',
+      headers: getHeaders(),
+      body: JSON.stringify({ name, operator, configuration }),
+    });
+    if (!res.ok) throw new Error(await res.text());
     return res.json();
   },
 
-  async getKnowledge(workspaceId, type = null, status = null) {
-    const params = new URLSearchParams();
-    if (type) params.append('type', type);
-    if (status) params.append('status', status);
-    const res = await fetch(`${API_BASE}/workspaces/${workspaceId}/knowledge?${params.toString()}`);
+  async deleteRule(ruleId) {
+    const res = await fetch(`${API_BASE}/rules/${ruleId}`, {
+      method: 'DELETE',
+      headers: getHeaders(),
+    });
     return res.json();
   },
 
-  async searchKnowledge(workspaceId, query) {
-    const res = await fetch(`${API_BASE}/workspaces/${workspaceId}/search?q=${encodeURIComponent(query)}`);
+  async validateProposals(workspaceId) {
+    const res = await fetch(`${API_BASE}/workspaces/${workspaceId}/validate`, { headers: getHeaders() });
     return res.json();
   },
 
-  async getRules(workspaceId) {
-    const res = await fetch(`${API_BASE}/workspaces/${workspaceId}/rules`);
+  // -------------------------------------------------------------------------
+  // Knowledge Register & Graph
+  // -------------------------------------------------------------------------
+  async getKnowledgeItems(workspaceId) {
+    const res = await fetch(`${API_BASE}/workspaces/${workspaceId}/knowledge`, { headers: getHeaders() });
     return res.json();
   },
 
-  async createRule(workspaceId, name, operator, configuration) {
-    const res = await fetch(`${API_BASE}/workspaces/${workspaceId}/rules`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ name, operator, configuration }),
-    });
-    if (!res.ok) throw new Error(await res.text());
+  async searchKnowledge(workspaceId, query) {
+    const res = await fetch(
+      `${API_BASE}/workspaces/${workspaceId}/knowledge/search?q=${encodeURIComponent(query)}`,
+      { headers: getHeaders() }
+    );
     return res.json();
   },
 
-  async enableRule(ruleId) {
-    const res = await fetch(`${API_BASE}/rules/${ruleId}/enable`, { method: 'POST' });
+  async getKnowledgeGraph(workspaceId) {
+    const res = await fetch(`${API_BASE}/workspaces/${workspaceId}/graph`, { headers: getHeaders() });
     return res.json();
   },
 
-  async disableRule(ruleId) {
-    const res = await fetch(`${API_BASE}/rules/${ruleId}/disable`, { method: 'POST' });
+  // -------------------------------------------------------------------------
+  // Audit Trail & Metrics
+  // -------------------------------------------------------------------------
+  async getActivityFeed(workspaceId) {
+    const res = await fetch(`${API_BASE}/workspaces/${workspaceId}/activity`, { headers: getHeaders() });
     return res.json();
   },
 
-  async getActivity(workspaceId, limit = 50) {
-    const res = await fetch(`${API_BASE}/workspaces/${workspaceId}/activity?limit=${limit}`);
+  async getWorkflows(workspaceId) {
+    const res = await fetch(`${API_BASE}/workspaces/${workspaceId}/workflows`, { headers: getHeaders() });
     return res.json();
   },
 };

studio/src/components/Navbar.jsx

@@ -1,4 +1,5 @@
-import React, { useState } from 'react';
+import React, { useState, useEffect } from 'react';
+import { api } from '../api/client';
 
 export default function Navbar({
   workspaces,
@@ -13,6 +14,20 @@ export default function Navbar({
   const [newWsName, setNewWsName] = useState('');
   const [newWsDesc, setNewWsDesc] = useState('');
 
+  // Auth Modal State
+  const [showAuthModal, setShowAuthModal] = useState(false);
+  const [currentUser, setCurrentUser] = useState(null);
+  const [authMode, setAuthMode] = useState('demo'); // 'demo' | 'login' | 'apikey'
+  const [loginEmail, setLoginEmail] = useState('');
+  const [loginPassword, setLoginPassword] = useState('');
+  const [customApiKey, setCustomApiKey] = useState('');
+  const [authLoading, setAuthLoading] = useState(false);
+  const [authError, setAuthError] = useState('');
+
+  useEffect(() => {
+    setCurrentUser(api.getCurrentUser());
+  }, []);
+
   const handleCreate = async (e) => {
     e.preventDefault();
     if (!newWsName.trim()) return;
@@ -22,6 +37,51 @@ export default function Navbar({
     setShowNewModal(false);
   };
 
+  const handleDemoLogin = async () => {
+    setAuthLoading(true);
+    setAuthError('');
+    try {
+      const user = await api.demoLogin();
+      setCurrentUser(user);
+      setShowAuthModal(false);
+    } catch (err) {
+      // Fallback local demo user
+      api.setApiKey('demo-evaluator-token');
+      setCurrentUser({ username: 'Demo Evaluator', email: 'demo@docweave.io' });
+      setShowAuthModal(false);
+    } finally {
+      setAuthLoading(false);
+    }
+  };
+
+  const handleEmailLogin = async (e) => {
+    e.preventDefault();
+    setAuthLoading(true);
+    setAuthError('');
+    try {
+      const user = await api.login(loginEmail, loginPassword);
+      setCurrentUser(user);
+      setShowAuthModal(false);
+    } catch (err) {
+      setAuthError('Authentication failed: ' + (err.message || 'Invalid credentials'));
+    } finally {
+      setAuthLoading(false);
+    }
+  };
+
+  const handleSaveApiKey = (e) => {
+    e.preventDefault();
+    if (!customApiKey.trim()) return;
+    api.setApiKey(customApiKey.trim());
+    setCurrentUser({ username: 'API Key User', email: 'pat@docweave.io' });
+    setShowAuthModal(false);
+  };
+
+  const handleLogout = () => {
+    api.logout();
+    setCurrentUser(null);
+  };
+
   const pendingCount = stats?.pending_proposals || 0;
 
   return (
@@ -31,7 +91,7 @@ export default function Navbar({
           {/* Logo & Workspace Selector */}
           <div className="flex items-center space-x-6">
             <div className="flex items-center space-x-2">
-              <span className="text-xl text-emerald-400 font-bold tracking-tight">◈ DiffWeave</span>
+              <span className="text-xl text-emerald-400 font-bold tracking-tight">🧶 DiffWeave</span>
               <span className="text-xs px-2 py-0.5 rounded bg-emerald-500/10 text-emerald-400 border border-emerald-500/20 font-mono">
                 Studio
               </span>
@@ -94,16 +154,155 @@ export default function Navbar({
             })}
           </nav>
 
-          {/* MCP Status Indicator */}
+          {/* Right Status Controls */}
           <div className="flex items-center space-x-3">
+            {/* MCP Status Indicator */}
             <div className="flex items-center space-x-2 px-2.5 py-1 rounded-full bg-emerald-950/40 border border-emerald-500/30 text-emerald-400 text-xs font-mono">
               <span className="w-2 h-2 rounded-full bg-emerald-400 pulse-glow"></span>
               <span>MCP: 29 Tools</span>
             </div>
+
+            {/* Auth / User Control */}
+            {currentUser ? (
+              <div className="flex items-center space-x-2 bg-slate-900 border border-slate-700 px-2.5 py-1 rounded-lg text-xs">
+                <div className="w-5 h-5 rounded-full bg-emerald-600 text-white flex items-center justify-center font-bold text-[10px]">
+                  {currentUser.username ? currentUser.username[0].toUpperCase() : 'U'}
+                </div>
+                <span className="text-slate-200 font-medium max-w-[100px] truncate">{currentUser.username}</span>
+                <button
+                  onClick={handleLogout}
+                  className="text-slate-500 hover:text-red-400 text-xs ml-1"
+                  title="Log out"
+                >
+                  ✕
+                </button>
+              </div>
+            ) : (
+              <button
+                onClick={() => setShowAuthModal(true)}
+                className="px-3 py-1 text-xs font-medium rounded-lg bg-emerald-600 hover:bg-emerald-500 text-white transition shadow-sm"
+              >
+                Sign In / API Key
+              </button>
+            )}
           </div>
         </div>
       </div>
 
+      {/* Auth / API Key Modal */}
+      {showAuthModal && (
+        <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/70 backdrop-blur-sm">
+          <div className="bg-[#101726] border border-slate-700 p-6 rounded-xl w-full max-w-md shadow-2xl">
+            <div className="flex justify-between items-center mb-4">
+              <h3 className="text-lg font-semibold text-white">Connect DocWeave Account</h3>
+              <button onClick={() => setShowAuthModal(false)} className="text-slate-400 hover:text-white">✕</button>
+            </div>
+
+            {/* Tabs */}
+            <div className="flex border-b border-slate-800 mb-4 text-xs font-medium">
+              <button
+                onClick={() => setAuthMode('demo')}
+                className={`pb-2 px-3 ${authMode === 'demo' ? 'border-b-2 border-emerald-400 text-emerald-400' : 'text-slate-400'}`}
+              >
+                ⚡ 1-Click Demo
+              </button>
+              <button
+                onClick={() => setAuthMode('login')}
+                className={`pb-2 px-3 ${authMode === 'login' ? 'border-b-2 border-emerald-400 text-emerald-400' : 'text-slate-400'}`}
+              >
+                Email Login
+              </button>
+              <button
+                onClick={() => setAuthMode('apikey')}
+                className={`pb-2 px-3 ${authMode === 'apikey' ? 'border-b-2 border-emerald-400 text-emerald-400' : 'text-slate-400'}`}
+              >
+                API Key / PAT
+              </button>
+            </div>
+
+            {authError && (
+              <div className="p-2 mb-3 rounded bg-red-950/50 border border-red-500/30 text-red-300 text-xs">
+                {authError}
+              </div>
+            )}
+
+            {authMode === 'demo' && (
+              <div>
+                <p className="text-xs text-slate-300 mb-4 leading-relaxed">
+                  Log in immediately as an evaluator demo user. No registration or email verification required.
+                </p>
+                <button
+                  onClick={handleDemoLogin}
+                  disabled={authLoading}
+                  className="w-full py-2 px-4 rounded-lg bg-emerald-600 hover:bg-emerald-500 text-white font-medium text-sm transition"
+                >
+                  {authLoading ? 'Authenticating...' : 'Enter as Demo Evaluator'}
+                </button>
+              </div>
+            )}
+
+            {authMode === 'login' && (
+              <form onSubmit={handleEmailLogin} className="space-y-3">
+                <div>
+                  <label className="block text-xs font-medium text-slate-400 mb-1">Email</label>
+                  <input
+                    type="email"
+                    required
+                    placeholder="user@docweave.io"
+                    value={loginEmail}
+                    onChange={(e) => setLoginEmail(e.target.value)}
+                    className="w-full bg-[#161F32] border border-slate-700 rounded-lg px-3 py-2 text-sm text-slate-200 focus:outline-none focus:ring-1 focus:ring-emerald-500"
+                  />
+                </div>
+                <div>
+                  <label className="block text-xs font-medium text-slate-400 mb-1">Password</label>
+                  <input
+                    type="password"
+                    required
+                    placeholder="••••••••"
+                    value={loginPassword}
+                    onChange={(e) => setLoginPassword(e.target.value)}
+                    className="w-full bg-[#161F32] border border-slate-700 rounded-lg px-3 py-2 text-sm text-slate-200 focus:outline-none focus:ring-1 focus:ring-emerald-500"
+                  />
+                </div>
+                <button
+                  type="submit"
+                  disabled={authLoading}
+                  className="w-full py-2 px-4 rounded-lg bg-emerald-600 hover:bg-emerald-500 text-white font-medium text-sm transition mt-2"
+                >
+                  {authLoading ? 'Signing In...' : 'Sign In'}
+                </button>
+              </form>
+            )}
+
+            {authMode === 'apikey' && (
+              <form onSubmit={handleSaveApiKey} className="space-y-3">
+                <div>
+                  <label className="block text-xs font-medium text-slate-400 mb-1">Personal Access Token (PAT) / JWT</label>
+                  <input
+                    type="text"
+                    required
+                    placeholder="eyJhbGciOiJIUzI1NiIsInR5cCI6Ik..."
+                    value={customApiKey}
+                    onChange={(e) => setCustomApiKey(e.target.value)}
+                    className="w-full bg-[#161F32] border border-slate-700 rounded-lg px-3 py-2 text-xs font-mono text-slate-200 focus:outline-none focus:ring-1 focus:ring-emerald-500"
+                  />
+                </div>
+                <p className="text-[11px] text-slate-400 leading-normal">
+                  Paste a JWT bearer token or API key generated from DocWeave to authenticate all requests from this Studio.
+                </p>
+                <button
+                  type="submit"
+                  className="w-full py-2 px-4 rounded-lg bg-emerald-600 hover:bg-emerald-500 text-white font-medium text-sm transition mt-2"
+                >
+                  Save & Connect API Key
+                </button>
+              </form>
+            )}
+          </div>
+        </div>
+      )}
+
       {/* New Workspace Modal */}
       {showNewModal && (
         <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/60 backdrop-blur-sm">
@@ -118,30 +317,30 @@ export default function Navbar({
                   placeholder="e.g. Clinical Research Protocols"
                   value={newWsName}
                   onChange={(e) => setNewWsName(e.target.value)}
-                  className="w-full bg-[#162032] border border-slate-700 rounded-lg px-3 py-2 text-sm text-white focus:outline-none focus:border-emerald-500"
+                  className="w-full bg-[#161F32] border border-slate-700 rounded-lg px-3 py-2 text-sm text-slate-200 focus:outline-none focus:ring-1 focus:ring-emerald-500"
                 />
               </div>
               <div className="mb-6">
-                <label className="block text-xs font-medium text-slate-400 mb-1">Description (Optional)</label>
+                <label className="block text-xs font-medium text-slate-400 mb-1">Description (optional)</label>
                 <textarea
-                  rows="2"
-                  placeholder="Workspace purpose or project notes"
+                  placeholder="Clinical documentation & knowledge validation..."
                   value={newWsDesc}
                   onChange={(e) => setNewWsDesc(e.target.value)}
-                  className="w-full bg-[#162032] border border-slate-700 rounded-lg px-3 py-2 text-sm text-white focus:outline-none focus:border-emerald-500"
-                />
+                  rows="3"
+                  className="w-full bg-[#161F32] border border-slate-700 rounded-lg px-3 py-2 text-sm text-slate-200 focus:outline-none focus:ring-1 focus:ring-emerald-500"
+                ></textarea>
               </div>
               <div className="flex justify-end space-x-3">
                 <button
                   type="button"
                   onClick={() => setShowNewModal(false)}
-                  className="px-4 py-2 text-xs font-medium text-slate-400 hover:text-white rounded-lg bg-slate-800"
+                  className="px-4 py-2 text-sm text-slate-400 hover:text-white transition"
                 >
                   Cancel
                 </button>
                 <button
                   type="submit"
-                  className="px-4 py-2 text-xs font-medium text-black bg-emerald-400 hover:bg-emerald-300 rounded-lg font-semibold"
+                  className="px-4 py-2 bg-emerald-600 hover:bg-emerald-500 text-white text-sm font-medium rounded-lg transition"
                 >
                   Create Workspace
                 </button>