From f7e02775521b564ad3fbddba1c5892ef88eef6b0 Mon Sep 17 00:00:00 2001 From: Daniel Date: Fri, 11 Sep 2026 22:02:25 +0200 Subject: [PATCH] docs: accounts in the README, and the sign-in code path is verified end to end MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The README's feature list never mentioned accounts at all. It now says how somebody signs in — password or an emailed code, side by side — that passwords are argon2id with bcrypt rows rehashed on next sign-in, and that registration can be open, closed or invite-only with codes that are revocable while live and deletable only once spent. The browser-STT note now says why the Web Speech gate exists rather than only that it exists: Chrome and Edge send that audio to Google, so it is off unless a user turns it on. And the one thing that could not be demonstrated before now can. With SMTP configured, a real send returns true, and driving the sign-in screen in a browser — request a code, type it — returns 200 from /login-code/verify and enters the app. docs/authentication.md records that. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU --- README.md | 6 ++++-- docs/authentication.md | 4 ++++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 1f4af880..55738d64 100644 --- a/README.md +++ b/README.md @@ -49,7 +49,9 @@ The app runs as an authenticated Express/Postgres service with a browser fronten ### Admin And Security -- Local auth, role-based access, TOTP 2FA, OIDC/SSO, email verification, and optional Turnstile. +- Sign in with a password or a six-digit code emailed to you — offered side by side, because a code depends on mail arriving and a password does not. +- Role-based access, TOTP 2FA, OIDC/SSO, email verification, and optional Turnstile. Passwords are argon2id, with bcrypt rows rehashed on their next sign-in. +- Registration can be open, closed, or invite-only with generated codes. A code can be revoked while live, and deleted only once it is spent. - Admin panel for users, settings, prompts, models, logs, and Learning Hub content. - Audit, API, access, and client-error logs with redaction hardening. - OpenBao secret loading support at container startup. @@ -59,7 +61,7 @@ The app runs as an authenticated Express/Postgres service with a browser fronten Browser Whisper has been removed from the runtime. The app should not ship browser Whisper workers, browser-local Whisper model downloads, Transformers.js browser STT, or Browser Whisper setup docs. -Speech-to-text is handled server-side through configured providers such as Google/Gemini, AWS Transcribe, LiteLLM, or OpenAI Whisper. Browser-native Web Speech remains gated behind an explicit user setting when present in the browser. +Speech-to-text is handled server-side through configured providers such as Google/Gemini, AWS Transcribe, LiteLLM, or OpenAI Whisper. Browser-native Web Speech remains gated behind an explicit user setting when present in the browser — it is off unless a user turns it on, because Chrome and Edge send that audio to Google. ## Quick Start diff --git a/docs/authentication.md b/docs/authentication.md index c03262b3..631029ad 100644 --- a/docs/authentication.md +++ b/docs/authentication.md @@ -158,6 +158,10 @@ would make low digits slightly likelier. `loginCodes.sweep()` clears codes more than a day past expiry. It is fire and forget: housekeeping never fails a request. +Verified end to end against the running server with SMTP configured: a code is +requested from the sign-in screen, the mail is sent, and typing the code returns +200 from `/login-code/verify` and enters the app. + ### Frontend note `public/js/authFetch.js` keeps an allowlist of `/api` paths callable with no