owain
0e4bc7b444
PocketID OIDC already auto-provisioned users keyed by pocketid_sub, and the data layer was already fully user-scoped. This adds the missing pieces for running real multi-user: - auth.py callback: link by email to an existing un-linked account (so the admin keeps their data when first signing in by passkey), collision-safe username generation, and request the `groups` scope. - Group gating: optional pocketid_allowed_group (admin-config or POCKETID_ALLOWED_GROUP env); users lacking the group are rejected at the callback and redirected to /login?auth_error=not_authorized. - New admin users API (app/api/users.py): list users, promote/demote admin (guards against demoting/locking out the last admin or yourself), and delete a user with ordered bulk deletes of all their data + on-disk files. - ProfilePage: allowed-group field; LoginPage: rejected-login message; Layout: admin-only Users nav; new UsersPage. Resync milevault_export to current source (it had drifted many features behind — missing garmin_sync, npm-ci Dockerfile and @polyline-codec that broke its own CI) and add POCKETID_ALLOWED_GROUP to .env.example. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
35 lines
1.3 KiB
Python
35 lines
1.3 KiB
Python
from pydantic_settings import BaseSettings
|
|
from pydantic import Field
|
|
from typing import Optional
|
|
|
|
|
|
class Settings(BaseSettings):
|
|
# Database
|
|
database_url: str = Field(..., env="DATABASE_URL")
|
|
# Redis
|
|
redis_url: str = Field("redis://localhost:6379/0", env="REDIS_URL")
|
|
# Auth
|
|
secret_key: str = Field(..., env="SECRET_KEY")
|
|
algorithm: str = "HS256"
|
|
access_token_expire_minutes: int = 60 * 24 * 7 # 7 days
|
|
# Admin account
|
|
admin_username: str = Field("admin", env="ADMIN_USERNAME")
|
|
admin_password: Optional[str] = Field(None, env="ADMIN_PASSWORD")
|
|
# Base URL - used for OAuth callbacks
|
|
base_url: str = Field("https://milevault.jarrett.eu", env="BASE_URL")
|
|
# PocketID OIDC (optional)
|
|
pocketid_issuer: Optional[str] = Field(None, env="POCKETID_ISSUER")
|
|
pocketid_client_id: Optional[str] = Field(None, env="POCKETID_CLIENT_ID")
|
|
pocketid_client_secret: Optional[str] = Field(None, env="POCKETID_CLIENT_SECRET")
|
|
pocketid_allowed_group: Optional[str] = Field(None, env="POCKETID_ALLOWED_GROUP")
|
|
# Files
|
|
file_store_path: str = Field("/data/files", env="FILE_STORE_PATH")
|
|
# Environment
|
|
environment: str = Field("production", env="ENVIRONMENT")
|
|
|
|
class Config:
|
|
env_file = ".env"
|
|
case_sensitive = False
|
|
|
|
|
|
settings = Settings() |