marcandClaude Opus 5
68e184163e
This is a private instance, so anyone able to reach the login page could previously give themselves an account. The registration route is gone rather than hidden, and the login screen no longer hints that accounts can be made. Accounts now come from an admin under Account → Administration: create, delete, and reset a password. Appointing further admins is deliberately not offered — with one admin it is not needed, and it is the one power that turns a compromised account into a lost instance. The first admin comes from INKNOTE_ADMIN_USER / INKNOTE_ADMIN_PASSWORD, used only when the database has no users, or to choose whom to promote when an older database has users but no admin. Once an admin exists both are ignored, so leaving them in .env cannot reset anything. Two things that would otherwise have been quietly wrong: - a deleted user's token stayed valid until it expired, because tokens are signed rather than stored and there was no session to revoke. authMiddleware now checks the account still exists, so an open tab stops working the moment the account is deleted. - deleting an account takes its notes, notebooks, drawings and version history with it via ON DELETE CASCADE. Verified: no orphaned rows in notes, notebooks, sync_log, attachments or note_versions. Deletion asks for the username to be typed back, since it destroys data that version history cannot bring back. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
35 lines
1.2 KiB
Bash
35 lines
1.2 KiB
Bash
# Copy to ../.env next to docker-compose.yml and fill in.
|
|
# Back this file up together with the database: without ENCRYPTION_KEY the
|
|
# stored notes cannot be read again.
|
|
|
|
# Signs session tokens. Changing it logs everyone out.
|
|
# openssl rand -hex 32
|
|
JWT_SECRET=
|
|
|
|
# Encrypts note bodies at rest. LOSING THIS MEANS LOSING THE NOTES.
|
|
# Must be exactly 32 bytes as hex.
|
|
# openssl rand -hex 32
|
|
ENCRYPTION_KEY=
|
|
|
|
# The first administrator.
|
|
#
|
|
# There is no public sign-up — accounts are created by an admin inside the app
|
|
# under Account → Administration. These two settle who the first one is:
|
|
#
|
|
# empty database → the account is created from both values
|
|
# existing users, → INKNOTE_ADMIN_USER names which of them becomes admin.
|
|
# no admin yet Without it, the oldest account is promoted.
|
|
# an admin exists → both are ignored entirely
|
|
#
|
|
# So they can never reset an existing password or take rights away; the worst
|
|
# they can do on a running instance is nothing.
|
|
INKNOTE_ADMIN_USER=
|
|
INKNOTE_ADMIN_PASSWORD=
|
|
|
|
# ── Optional ──
|
|
# PORT=4000
|
|
# ALLOWED_ORIGINS= # only if the UI is served from another host
|
|
# MAX_VERSIONS_PER_NOTE=50
|
|
# VERSION_RETENTION_DAYS=90
|
|
# VERSION_COALESCE_MINUTES=5
|