Sergei Poljanski
9bf40690e5
The admin was one shared HTTP Basic login: no way to give someone partial access, revoke one person, or tell who changed what. Add a users table and a session login form. Passwords are scrypt hashes from Ruby's OpenSSL, so no native gem is needed. Sessions carry a per-user version that is bumped on password change, which logs that user out everywhere. ADMIN_USER/ADMIN_PASSWORD now bootstrap the first superuser on an empty table and afterwards only work while no active superuser exists, as a recovery path that re-creates one. Until per-area permissions land, non-superusers only reach the dashboard and their own password page. Assisted-by: Claude:opus-5 |
||
|---|---|---|
| .. | ||
| admin_auth_test.rb | ||
| app_test.rb | ||
| bingo_test.rb | ||
| crypto_test.rb | ||
| fmt_test.rb | ||
| invoice_test.rb | ||
| rate_limit_test.rb | ||
| test_helper.rb | ||