ceccd18387
The feature was removed; the docs still described it as live. Worst of it was api-reference.md, which documented nine /api/learning endpoints and fourteen /api/admin/learning CMS endpoints — routes that answer 404 — plus POST /api/user/webdav-path, whose column was dropped by migration. Anyone reading them was reading fiction. Checked against the running system rather than assumed: no learning table exists, users.webdav_learning_path is gone, generated_image_links is gone, and no route mounts /api/learning or /api/admin/learning. Two things that look like Learning Hub and are not, so they stay: - learningRetrieval.js is live — My Resources uses it. Its settings keep the learning.* names because renaming them would orphan whatever an administrator has already set. retrieval-tuning.md now says so instead of listing the rows under two different feature names. - the moderator role is still assignable. It gated the CMS and now grants nothing; authentication.md says that rather than implying powers it does not have. moderatorMiddleware has no callers left, which is worth removing on its own. auth-admin-learning.md is now auth-admin.md. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU
47 lines
1.5 KiB
Markdown
47 lines
1.5 KiB
Markdown
# Auth And Admin Logic
|
|
|
|
This doc summarizes the current auth/admin responsibilities. The
|
|
source of truth is `server.js`, `src/routes/*.js`, and the focused top-level
|
|
docs.
|
|
|
|
## Auth
|
|
|
|
- Local auth uses argon2id for new password hashes and bcrypt fallback/rehash
|
|
for legacy rows.
|
|
- Web sessions use the `ped_auth` httpOnly cookie.
|
|
- Mobile sessions use secure token storage and `Authorization: Bearer`.
|
|
- `user_sessions` is the authoritative session registry.
|
|
- OIDC uses Authorization Code + PKCE through `src/routes/oidc.js`.
|
|
- 2FA uses TOTP plus one-time backup codes.
|
|
|
|
See [`../authentication.md`](../authentication.md) for details.
|
|
|
|
## Admin Panel
|
|
|
|
Admin routes live under `/api/admin` and require admin middleware unless the
|
|
specific route is explicitly public (for example public config reads used by the
|
|
login screen). Admin responsibilities include:
|
|
|
|
- user management and role changes
|
|
- settings and feature flags
|
|
- model allowlist/defaults/custom models
|
|
- prompt overrides
|
|
- SMTP/OIDC/security settings
|
|
- health/log views
|
|
- milestone management
|
|
- admin docs browser
|
|
|
|
## Security Rules
|
|
|
|
- Never expose raw secrets in admin health/config responses.
|
|
- Keep OIDC issuer validation and SSRF protections intact.
|
|
- Keep login, password reset, 2FA, and session endpoints rate-limited.
|
|
- Treat uploaded files as untrusted input and keep the file-type checks.
|
|
- Sanitize any rendered user content.
|
|
|
|
## Change Checklist
|
|
|
|
1. Check the relevant route and frontend module together.
|
|
2. Preserve role middleware order.
|
|
3. Run `node --check` on touched JS files.
|
|
4. Run `npm test`.
|