Reviewing the upload queue is now a per-user flag (reviews_uploads), not part
of the admin role: several people can hold it, a moderator can have it, and an
admin may not. Only admins grant or revoke it; existing admins keep it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- appearance settings get "collapse search" (off keeps the field always open)
and separate switches for the activity and mood pickers on the home page;
stored in ui_prefs (search_collapse, home_activities, home_moods)
- Collection and Admin headers in the sidebar fold their items; the state is
remembered in the browser, a folded Admin shows the review queue badge;
icon-only and phone layouts always show every item
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- settings get a search position (left, center by default, right); the top bar
is three zones and the suggestions open towards the free space
- buttons, chips, tabs, menu items and the home screen controls are not
text-selectable, so clicks and double clicks no longer highlight labels
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- /admin/users: list with search, role filter and cursor pages; create
with a one-time temporary password; rename, change role, block;
reset password; delete
- every change is checked against the role policy, a forbidden field
rejects the whole patch; the last active admin is locked in the
transaction and cannot be demoted, blocked or deleted
- role change and blocking revoke access tokens at once; blocking and
password reset also end all sessions
- /admin/audit: newest-first journal with actor names
- path and query parameter errors are problem+json now
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- users, refresh_tokens and audit_log schema (migration 00002)
- argon2id passwords with rehash on login, password policy, lockout
with exponential back-off and a per-IP rate limit in Redis
- Ed25519 JWT access tokens with kid-based key rotation; rotating
refresh tokens with reuse detection (cookie for web, body for Android)
- bootstrap admin on first start; must_change_credentials and
must_change_password gate every other endpoint
- /auth/login, /auth/refresh, /auth/logout(-all), /me, /me/password,
/me/bootstrap-credentials, /me/sessions; server-info reports
bootstrap_required
- role policy from docs/auth-and-roles.md with table tests
- problem+json errors with field errors; ru/en translations of the codes
- install.sh and update.sh generate JWT_PRIVATE_KEY
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
mrleo1nid
