feat: make demo-mode login banner overridable via DEMO_BANNER_HTML

Add DEMO_BANNER_HTML env var that replaces the built-in demo banner with
custom HTML when set. Empty (default) keeps the existing banner. Documented
in .env.example and deployment.md.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: SushantGautam

.env.example

@@ -38,6 +38,9 @@ SEED_ON_BOOT=true
 DEMO_MODE=false
 DEMO_USERNAME=admin
 DEMO_PASSWORD=change-me
+# Optional: override the demo-mode login banner with custom HTML.
+# When empty, the built-in banner is shown. Trusted operator content only.
+#DEMO_BANNER_HTML=<div class="mb-4 …">Your custom banner</div>
 
 # --- PostgreSQL ---------------------------------------------------------------
 # In Docker Compose the web/worker containers reach Postgres at host `postgres`

config/settings.py

@@ -323,6 +323,9 @@ def _csrf_trusted_origins() -> list[str]:
 DEMO_MODE = env_bool("DEMO_MODE", False)
 DEMO_USERNAME = os.environ.get("DEMO_USERNAME", "studio")
 DEMO_PASSWORD = os.environ.get("DEMO_PASSWORD", "localdevpass123")
+# Optional: override the demo-mode login banner with custom HTML (trusted
+# operator content only). When empty, the built-in banner is shown.
+DEMO_BANNER_HTML = os.environ.get("DEMO_BANNER_HTML", "")
 
 # Framing policy:
 # - Demo mode (HF Spaces / public demos): allow cross-origin framing so the

docs/deployment.md

@@ -186,6 +186,7 @@ override them when you deliberately need to.
 | `WORKER_POOL` | Worker label (`cpu` by default). |
 | `BOOTSTRAP_USERNAME`, `BOOTSTRAP_EMAIL`, `BOOTSTRAP_PASSWORD`, `BOOTSTRAP_PROJECT_NAME` | First admin user and workspace. |
 | `DEMO_MODE`, `DEMO_USERNAME`, `DEMO_PASSWORD` | Prefilled demo login and the HF iframe cookie/CSRF policy. |
+| `DEMO_BANNER_HTML` | Optional custom HTML for the demo-mode login banner. Empty = built-in banner. Trusted operator content only. |
 | `WORKOS_CLIENT_ID`, `WORKOS_API_KEY` | Optional passwordless email sign-in. |
 | `SIMPLEAUDIT_GRAVATAR` | `true` = show Gravatar avatars (the browser sends the MD5 hash of the user's email to gravatar.com). Default off: the user's initial is shown. |
 | `SENTRY_DSN`, `SENTRY_ENVIRONMENT` | Optional error tracking. |

infra/ui.py

@@ -336,6 +336,7 @@ def get_context_data(self, **kw):
             kw["demo_mode"] = True
             kw["demo_username"] = settings.DEMO_USERNAME
             kw["demo_password"] = settings.DEMO_PASSWORD
+            kw["demo_banner_html"] = getattr(settings, "DEMO_BANNER_HTML", "")
         kw["workos_enabled"] = getattr(settings, "WORKOS_ENABLED", False)
         kw["registration_enabled"] = registration_enabled()
         # The login page is what unauthenticated visitors land on when they

templates/auth/login.html

@@ -30,6 +30,9 @@
 
     <!-- Demo mode banner -->
     {% if demo_mode %}
+    {% if demo_banner_html %}
+    {{ demo_banner_html|safe }}
+    {% else %}
     <div class="mb-4 flex items-start gap-3 rounded-xl border border-accent/30 bg-accent/10 px-4 py-3">
       <svg class="mt-0.5 w-5 h-5 shrink-0 text-accent" fill="none" stroke="currentColor" stroke-width="2" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" d="M13 16h-1v-4h-1m1-4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z"/></svg>
       <div class="text-sm text-gray-300">
@@ -44,6 +47,7 @@
       </div>
     </div>
     {% endif %}
+    {% endif %}
 
     <!-- Secondary: username/password (always available) -->
     <form method="post" class="bg-surface-raised rounded-2xl border border-gray-800 p-8 space-y-5 shadow-xl">