3 commits

Author	SHA1	Message	Date
Daniel	3c04d662f6	feat: the password door is gone; One Sign In is the only way in ... POST /api/auth/login answers 410 for everyone, administrators included. The sign-in screen never draws an email or a password: it is the provider's button, or a sentence saying sign-in is not configured. The admin CLI no longer resets passwords. The e2e harness mints its sessions inside the container instead of signing in with a password. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016fZGJNyDvERbMgS2Uc2msP	2026-09-15 04:14:04 +02:00
Daniel	29ff7e435c	feat: One Sign In is the only door; the SSO-only switch is gone ... With OIDC on, every password route is shut except /api/auth/login for administrators — the way back in if the provider is down, reached from an "Administrator sign-in" link. The disable-local-auth setting, the registration CLI command and the docs that described them are removed; accounts, roles and invitations live in authentik. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016fZGJNyDvERbMgS2Uc2msP	2026-09-15 03:33:53 +02:00
ifedan-ed	ac8e7bb890	v3.0.0: Auth, admin panel, security fixes, per-tab model selector ... - Add authMiddleware to all AI/transcribe routes (were unauthenticated) - Add full admin panel: user management, registration toggle, stats - Fix XSS in email verification (escape user.name in HTML) - Fix missing APP_URL fallback in password reset email - Add per-tab model selector (respects OpenRouter/Bedrock/Azure lists) - Fix transcribeAudio to send Authorization header - Fix labs input: textarea instead of single-line input - Add structured logging: audit_log, api_log, access_log tables - Add admin CLI (admin-cli.js) for Docker exec management - Fix duplicate var duration declaration in ai.js catch block - Fix RETURNING check case-sensitivity in database.js	2026-03-21 19:25:51 -04:00