danvics/pediatric-ai-scribe-v3
1
0
Fork 0
Code Issues Pull requests Projects Releases 16 Packages Wiki Activity Actions
pediatric-ai-scribe-v3/docs/logic/auth-admin.md
Daniel ceccd18387
Some checks failed
Forgejo Docker Build / Root app tests (push) Successful in 47s
Details
Forgejo Docker Build / Build Docker image (push) Successful in 22s
Details
Forgejo Docker Build / Deploy to the host (push) Failing after 1s
Details
docs: take the Learning Hub out of the docs 
The feature was removed; the docs still described it as live. Worst of
it was api-reference.md, which documented nine /api/learning endpoints
and fourteen /api/admin/learning CMS endpoints — routes that answer 404
— plus POST /api/user/webdav-path, whose column was dropped by
migration. Anyone reading them was reading fiction.

Checked against the running system rather than assumed: no learning
table exists, users.webdav_learning_path is gone, generated_image_links
is gone, and no route mounts /api/learning or /api/admin/learning.

Two things that look like Learning Hub and are not, so they stay:

- learningRetrieval.js is live — My Resources uses it. Its settings keep
  the learning.* names because renaming them would orphan whatever an
  administrator has already set. retrieval-tuning.md now says so instead
  of listing the rows under two different feature names.
- the moderator role is still assignable. It gated the CMS and now
  grants nothing; authentication.md says that rather than implying
  powers it does not have. moderatorMiddleware has no callers left,
  which is worth removing on its own.

auth-admin-learning.md is now auth-admin.md.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU
2026-09-12 22:24:29 +02:00

1.5 KiB
Raw Blame History

Auth And Admin Logic

This doc summarizes the current auth/admin responsibilities. The source of truth is server.js, src/routes/*.js, and the focused top-level docs.

Auth

  • Local auth uses argon2id for new password hashes and bcrypt fallback/rehash for legacy rows.
  • Web sessions use the ped_auth httpOnly cookie.
  • Mobile sessions use secure token storage and Authorization: Bearer.
  • user_sessions is the authoritative session registry.
  • OIDC uses Authorization Code + PKCE through src/routes/oidc.js.
  • 2FA uses TOTP plus one-time backup codes.

See ../authentication.md for details.

Admin Panel

Admin routes live under /api/admin and require admin middleware unless the specific route is explicitly public (for example public config reads used by the login screen). Admin responsibilities include:

  • user management and role changes
  • settings and feature flags
  • model allowlist/defaults/custom models
  • prompt overrides
  • SMTP/OIDC/security settings
  • health/log views
  • milestone management
  • admin docs browser

Security Rules

  • Never expose raw secrets in admin health/config responses.
  • Keep OIDC issuer validation and SSRF protections intact.
  • Keep login, password reset, 2FA, and session endpoints rate-limited.
  • Treat uploaded files as untrusted input and keep the file-type checks.
  • Sanitize any rendered user content.

Change Checklist

  1. Check the relevant route and frontend module together.
  2. Preserve role middleware order.
  3. Run node --check on touched JS files.
  4. Run npm test.