owain
0e4bc7b444
PocketID OIDC already auto-provisioned users keyed by pocketid_sub, and the data layer was already fully user-scoped. This adds the missing pieces for running real multi-user: - auth.py callback: link by email to an existing un-linked account (so the admin keeps their data when first signing in by passkey), collision-safe username generation, and request the `groups` scope. - Group gating: optional pocketid_allowed_group (admin-config or POCKETID_ALLOWED_GROUP env); users lacking the group are rejected at the callback and redirected to /login?auth_error=not_authorized. - New admin users API (app/api/users.py): list users, promote/demote admin (guards against demoting/locking out the last admin or yourself), and delete a user with ordered bulk deletes of all their data + on-disk files. - ProfilePage: allowed-group field; LoginPage: rejected-login message; Layout: admin-only Users nav; new UsersPage. Resync milevault_export to current source (it had drifted many features behind — missing garmin_sync, npm-ci Dockerfile and @polyline-codec that broke its own CI) and add POCKETID_ALLOWED_GROUP to .env.example. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
37 lines
1.3 KiB
Bash
37 lines
1.3 KiB
Bash
# FitTracker configuration
|
|
# Copy this file to .env and edit, OR just run: bash install.sh
|
|
# install.sh auto-generates all secrets for you.
|
|
|
|
# ── Required ──────────────────────────────────────────────────────────────────
|
|
|
|
# Login for the web interface
|
|
ADMIN_USERNAME=admin
|
|
ADMIN_PASSWORD=changeme
|
|
|
|
# Security: generate with: openssl rand -hex 32
|
|
SECRET_KEY=changeme_run_openssl_rand_hex_32
|
|
|
|
# Database password
|
|
DB_PASSWORD=changeme
|
|
DB_USER=fittracker
|
|
|
|
# Redis password
|
|
REDIS_PASSWORD=changeme
|
|
|
|
# ── Optional ──────────────────────────────────────────────────────────────────
|
|
|
|
# Port to expose (default: 80)
|
|
HTTP_PORT=80
|
|
|
|
# Mapbox token for satellite map tiles — free at mapbox.com
|
|
# Leave blank to use OpenStreetMap (CartoDB dark tiles, no key needed)
|
|
VITE_MAPBOX_TOKEN=
|
|
|
|
# PocketID passkey authentication — leave blank to use local auth only
|
|
# See: https://github.com/pocket-id/pocket-id
|
|
POCKETID_ISSUER=
|
|
POCKETID_CLIENT_ID=
|
|
POCKETID_CLIENT_SECRET=
|
|
# Restrict sign-in to members of this PocketID group (leave blank to allow all)
|
|
POCKETID_ALLOWED_GROUP=
|