Sergei Poljanski
9bf40690e5
The admin was one shared HTTP Basic login: no way to give someone partial access, revoke one person, or tell who changed what. Add a users table and a session login form. Passwords are scrypt hashes from Ruby's OpenSSL, so no native gem is needed. Sessions carry a per-user version that is bumped on password change, which logs that user out everywhere. ADMIN_USER/ADMIN_PASSWORD now bootstrap the first superuser on an empty table and afterwards only work while no active superuser exists, as a recovery path that re-creates one. Until per-area permissions land, non-superusers only reach the dashboard and their own password page. Assisted-by: Claude:opus-5 |
||
|---|---|---|
| .. | ||
| 001_invoices.rb | ||
| 002_invoice_ltc.rb | ||
| 003_invoice_crypto.rb | ||
| 004_bingo.rb | ||
| 005_bingo_photo_variants.rb | ||
| 006_bingo_mw_type.rb | ||
| 007_users.rb | ||