Sergei Poljanski
d91a72f603
Add /admin/users to create, edit, disable and delete accounts with the per-area permission grid. New users get a one-time invite link (48 h) by email; the admin also sees it once, so an account without email can still be onboarded. Forgotten passwords get a 1 h reset link with the same answer for unknown accounts. Only token hashes are stored. Guards against escalation and lockout: a user manager can only grant flags they hold and cannot touch flags they lack; only superusers change superuser accounts; nobody can disable or delete themselves; the last active superuser stays. Logins, user changes, and bingo and invoice actions are recorded in an audit log at /admin/audit. Read timestamps as UTC: they are all written with Time.now.utc, and on a UTC+4 host a fresh 1 h token read back as already expired. Assisted-by: Claude:opus-5 |
||
|---|---|---|
| .. | ||
| 001_invoices.rb | ||
| 002_invoice_ltc.rb | ||
| 003_invoice_crypto.rb | ||
| 004_bingo.rb | ||
| 005_bingo_photo_variants.rb | ||
| 006_bingo_mw_type.rb | ||
| 007_users.rb | ||
| 008_user_tokens_audit.rb | ||