danvics/pediatric-ai-scribe-v3
1
0
Fork 0
Code Issues Pull requests Projects Releases 16 Packages Wiki Activity Actions

docs: accounts in the README, and the sign-in code path is verified end to end
Some checks failed
Forgejo Android APK / Root app tests (push) Successful in 47s
Details
Forgejo Docker Build / Root app tests (push) Successful in 47s
Details
Forgejo Android APK / Build signed APK (push) Successful in 2m4s
Details
Forgejo Docker Build / Build Docker image (push) Successful in 11s
Details
Forgejo Docker Build / Deploy to the host (push) Failing after 0s
Details

Browse source 
The README's feature list never mentioned accounts at all. It now says how
somebody signs in — password or an emailed code, side by side — that passwords
are argon2id with bcrypt rows rehashed on next sign-in, and that registration can
be open, closed or invite-only with codes that are revocable while live and
deletable only once spent.

The browser-STT note now says why the Web Speech gate exists rather than only
that it exists: Chrome and Edge send that audio to Google, so it is off unless a
user turns it on.

And the one thing that could not be demonstrated before now can. With SMTP
configured, a real send returns true, and driving the sign-in screen in a browser
— request a code, type it — returns 200 from /login-code/verify and enters the
app. docs/authentication.md records that.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU
This commit is contained in:
Daniel 2026-09-11 22:02:25 +02:00
parent 154b896d5b
commit f7e0277552
2 changed files with 8 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
README.md
View file

@ -49,7 +49,9 @@ The app runs as an authenticated Express/Postgres service with a browser fronten
### Admin And Security
- Local auth, role-based access, TOTP 2FA, OIDC/SSO, email verification, and optional Turnstile.
- Sign in with a password or a six-digit code emailed to you — offered side by side, because a code depends on mail arriving and a password does not.
- Role-based access, TOTP 2FA, OIDC/SSO, email verification, and optional Turnstile. Passwords are argon2id, with bcrypt rows rehashed on their next sign-in.
- Registration can be open, closed, or invite-only with generated codes. A code can be revoked while live, and deleted only once it is spent.
- Admin panel for users, settings, prompts, models, logs, and Learning Hub content.
- Audit, API, access, and client-error logs with redaction hardening.
- OpenBao secret loading support at container startup.
@ -59,7 +61,7 @@ The app runs as an authenticated Express/Postgres service with a browser fronten
Browser Whisper has been removed from the runtime. The app should not ship browser Whisper workers, browser-local Whisper model downloads, Transformers.js browser STT, or Browser Whisper setup docs.
Speech-to-text is handled server-side through configured providers such as Google/Gemini, AWS Transcribe, LiteLLM, or OpenAI Whisper. Browser-native Web Speech remains gated behind an explicit user setting when present in the browser.
Speech-to-text is handled server-side through configured providers such as Google/Gemini, AWS Transcribe, LiteLLM, or OpenAI Whisper. Browser-native Web Speech remains gated behind an explicit user setting when present in the browser — it is off unless a user turns it on, because Chrome and Edge send that audio to Google.
## Quick Start

4
docs/authentication.md
View file

@ -158,6 +158,10 @@ would make low digits slightly likelier.
`loginCodes.sweep()` clears codes more than a day past expiry. It is fire and
forget: housekeeping never fails a request.
Verified end to end against the running server with SMTP configured: a code is
requested from the sign-in screen, the mail is sent, and typing the code returns
200 from `/login-code/verify` and enters the app.
### Frontend note
`public/js/authFetch.js` keeps an allowlist of `/api` paths callable with no