1f4794a706
- Introduce `USE_ANONYMOUS_AUTH_SESSIONS` to make guest access an opt-in feature. - Transition root-level pages into `(app)` and `(public)` route groups for improved access control. - Adopt Figtree as the primary typeface and implement a pre-render theme initialization script. - Decouple audiobook chapter processing into a standalone API route and harden resource ownership logic. - Replace the legacy footer with a unified layout and add skeleton loading states for document lists. - Update environment documentation and test suites to align with the revised routing and auth flows. BREAKING CHANGE: The audiobook generation API has been restructured, moving specific chapter logic to `/api/audiobook/chapter`.
1.8 KiB
1.8 KiB
| title |
|---|
| Auth |
This page covers application-level configuration for provider access and authentication.
Auth behavior
- Auth is enabled only when both
BASE_URLandAUTH_SECRETare set. - Remove either value to disable auth.
- Keep
AUTH_TRUSTED_ORIGINSempty to trust onlyBASE_URL. - Anonymous auth sessions are disabled by default.
- Set
USE_ANONYMOUS_AUTH_SESSIONS=trueto enable anonymous session flows.
Route behavior
/is a public landing/onboarding page and remains indexable./appis the protected app home (document list and uploader UI).- If auth is enabled and a valid session exists (including anonymous), visiting
/redirects to/app. - Protected app routes continue to require auth; when anonymous sessions are disabled and no session exists, users are redirected to
/signin.
Related docs
- For auth environment variables: Environment Variables
- For TTS character limits and quota behavior: TTS Rate Limiting
- For provider-specific guidance: TTS Providers
- For storage/S3/SeaweedFS behavior: Object / Blob Storage
- For database mode: Database
- For migration behavior and commands: Migrations
Sync notes
Auth enabled
- Settings and reading progress are saved to the server.
- Updates are not instant push-based sync; they use normal client polling/refresh behavior.
- If two devices change the same item around the same time, the newest update wins.
Auth disabled
- Settings and reading progress stay local in the browser (Dexie/IndexedDB).
- This avoids no-auth cross-browser conflicts, but there is no cross-device sync.
Claim modal note
- You may still see old anonymous settings/progress available to claim from older deployments.