5 Commits

Include renames

Author	SHA1	Message	Date
mrleo1nidandClaude Opus 5.5	74da457362	feat(auth): make upload review a separate grant instead of an admin privilege ... Reviewing the upload queue is now a per-user flag (reviews_uploads), not part of the admin role: several people can hold it, a moderator can have it, and an admin may not. Only admins grant or revoke it; existing admins keep it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-21 10:07:05 +03:00
mrleo1nidandClaude Opus 5.5	b27b915b63	feat(web): settings to keep the search open and hide home pickers; collapsible menu sections ... - appearance settings get "collapse search" (off keeps the field always open) and separate switches for the activity and mood pickers on the home page; stored in ui_prefs (search_collapse, home_activities, home_moods) - Collection and Admin headers in the sidebar fold their items; the state is remembered in the browser, a folded Admin shows the review queue badge; icon-only and phone layouts always show every item Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-21 08:26:48 +03:00
mrleo1nidandClaude Opus 5.5	860072e542	feat(web): choose where the search sits, and controls no longer select text ... - settings get a search position (left, center by default, right); the top bar is three zones and the suggestions open towards the free space - buttons, chips, tabs, menu items and the home screen controls are not text-selectable, so clicks and double clicks no longer highlight labels Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-21 00:11:06 +03:00
mrleo1nidandClaude Opus 5.5	f075863f15	feat(api): user management and audit log for admins (M1) ... - /admin/users: list with search, role filter and cursor pages; create with a one-time temporary password; rename, change role, block; reset password; delete - every change is checked against the role policy, a forbidden field rejects the whole patch; the last active admin is locked in the transaction and cannot be demoted, blocked or deleted - role change and blocking revoke access tokens at once; blocking and password reset also end all sessions - /admin/audit: newest-first journal with actor names - path and query parameter errors are problem+json now Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-20 06:18:02 +03:00
mrleo1nidandClaude Opus 5.5	ed4a492dba	feat(api): sign-in, refresh rotation and bootstrap admin (M1) ... - users, refresh_tokens and audit_log schema (migration 00002) - argon2id passwords with rehash on login, password policy, lockout with exponential back-off and a per-IP rate limit in Redis - Ed25519 JWT access tokens with kid-based key rotation; rotating refresh tokens with reuse detection (cookie for web, body for Android) - bootstrap admin on first start; must_change_credentials and must_change_password gate every other endpoint - /auth/login, /auth/refresh, /auth/logout(-all), /me, /me/password, /me/bootstrap-credentials, /me/sessions; server-info reports bootstrap_required - role policy from docs/auth-and-roles.md with table tests - problem+json errors with field errors; ru/en translations of the codes - install.sh and update.sh generate JWT_PRIVATE_KEY Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-20 06:12:25 +03:00