danvics/pediatric-ai-scribe-v3
1
0
Fork 0
Code Issues Pull requests Projects Releases 16 Packages Wiki Activity Actions
pediatric-ai-scribe-v3/docs/logic/auth-admin-learning.md
Daniel a505244b97
Some checks failed
Forgejo Android APK / Root app tests (push) Successful in 47s
Details
Forgejo Docker Build / Root app tests (push) Successful in 45s
Details
Forgejo Android APK / Build signed APK (push) Successful in 2m8s
Details
Forgejo Docker Build / Build Docker image (push) Successful in 10s
Details
Forgejo Docker Build / Deploy to the host (push) Failing after 0s
Details
refactor: remove the embedding settings, whose only consumer is gone 
Embeddings existed here for Learning Hub semantic search — the card said
so itself. Learning Hub was removed, and nothing took its place: the
clinical corpus is embedded by the indexing service, not by this app.
What was left was a settings page that configured a model, tested it,
reported its dimensions, and fed nothing.

src/utils/embeddings.js had exactly one importer, src/routes/adminConfig
.js, which used it for the three routes this deletes. Outside those, the
only mentions of embedding in the server were a comment and a settings
prefix.

Gone: the module, its three admin routes, the dimension probe, the
Discover & test kind and its two panels, the admin.js block behind them,
the embeddings. prefix from both the writable-settings allowlist and the
lockdown list (it can no longer be written at all, so locking it says
nothing), and docs/embeddings-setup.md, which documented Learning Hub
search end to end.

'embedding' stays in NON_CHAT_MODES — that is the filter keeping
embedding models out of the chat-model list, and the gateway still
serves them.

Docs still describe nine /api/learning endpoints that no longer exist,
left from the Learning Hub removal. Not touched here; that is its own
subject.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU
2026-09-12 21:47:09 +02:00

1.7 KiB
Raw Blame History

Auth, Admin, And Learning Hub Logic

This doc summarizes the current auth/admin/Learning Hub responsibilities. The source of truth is server.js, src/routes/*.js, and the focused top-level docs.

Auth

  • Local auth uses argon2id for new password hashes and bcrypt fallback/rehash for legacy rows.
  • Web sessions use the ped_auth httpOnly cookie.
  • Mobile sessions use secure token storage and Authorization: Bearer.
  • user_sessions is the authoritative session registry.
  • OIDC uses Authorization Code + PKCE through src/routes/oidc.js.
  • 2FA uses TOTP plus one-time backup codes.

See ../authentication.md for details.

Admin Panel

Admin routes live under /api/admin and require admin middleware unless the specific route is explicitly public (for example public config reads used by the login screen). Admin responsibilities include:

  • user management and role changes
  • settings and feature flags
  • model allowlist/defaults/custom models
  • prompt overrides
  • SMTP/OIDC/security settings
  • health/log views
  • milestone management
  • admin docs browser

Learning Hub

Learning Hub has two surfaces:

  • learner/user-facing routes under /api/learning
  • moderator/admin CMS routes under /api/admin/learning

Security Rules

  • Never expose raw secrets in admin health/config responses.
  • Keep OIDC issuer validation and SSRF protections intact.
  • Keep login, password reset, 2FA, and session endpoints rate-limited.
  • Treat Learning Hub uploads as untrusted input and keep file-type checks.
  • Sanitize rendered Learning Hub content.

Change Checklist

  1. Check the relevant route and frontend module together.
  2. Preserve role middleware order.
  3. Run node --check on touched JS files.
  4. Run npm test.