owain
0e4bc7b444
PocketID OIDC already auto-provisioned users keyed by pocketid_sub, and the data layer was already fully user-scoped. This adds the missing pieces for running real multi-user: - auth.py callback: link by email to an existing un-linked account (so the admin keeps their data when first signing in by passkey), collision-safe username generation, and request the `groups` scope. - Group gating: optional pocketid_allowed_group (admin-config or POCKETID_ALLOWED_GROUP env); users lacking the group are rejected at the callback and redirected to /login?auth_error=not_authorized. - New admin users API (app/api/users.py): list users, promote/demote admin (guards against demoting/locking out the last admin or yourself), and delete a user with ordered bulk deletes of all their data + on-disk files. - ProfilePage: allowed-group field; LoginPage: rejected-login message; Layout: admin-only Users nav; new UsersPage. Resync milevault_export to current source (it had drifted many features behind — missing garmin_sync, npm-ci Dockerfile and @polyline-codec that broke its own CI) and add POCKETID_ALLOWED_GROUP to .env.example. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
27 lines
515 B
Plaintext
27 lines
515 B
Plaintext
fastapi==0.111.0
|
|
uvicorn[standard]==0.30.0
|
|
sqlalchemy[asyncio]==2.0.30
|
|
asyncpg==0.29.0
|
|
alembic==1.13.1
|
|
pydantic==2.7.1
|
|
pydantic-settings==2.2.1
|
|
python-jose[cryptography]==3.3.0
|
|
passlib==1.7.4
|
|
bcrypt==4.0.1
|
|
python-multipart==0.0.9
|
|
httpx==0.27.0
|
|
redis[hiredis]==5.0.4
|
|
celery[redis]==5.4.0
|
|
garmin-fit-sdk==21.195.0
|
|
gpxpy==1.6.2
|
|
numpy==1.26.4
|
|
scipy==1.13.0
|
|
geopy==2.4.1
|
|
polyline==2.0.2
|
|
Pillow==10.3.0
|
|
aiofiles==23.2.1
|
|
python-dateutil==2.9.0
|
|
pytz==2024.1
|
|
psycopg2-binary==2.9.9
|
|
garminconnect==0.2.24
|
|
cryptography==42.0.8 |