Sergei Poljanski
d91a72f603
Add /admin/users to create, edit, disable and delete accounts with the per-area permission grid. New users get a one-time invite link (48 h) by email; the admin also sees it once, so an account without email can still be onboarded. Forgotten passwords get a 1 h reset link with the same answer for unknown accounts. Only token hashes are stored. Guards against escalation and lockout: a user manager can only grant flags they hold and cannot touch flags they lack; only superusers change superuser accounts; nobody can disable or delete themselves; the last active superuser stays. Logins, user changes, and bingo and invoice actions are recorded in an audit log at /admin/audit. Read timestamps as UTC: they are all written with Time.now.utc, and on a UTC+4 host a fresh 1 h token read back as already expired. Assisted-by: Claude:opus-5
25 lines
648 B
Ruby
25 lines
648 B
Ruby
require 'sequel'
|
|
|
|
module DB
|
|
module_function
|
|
|
|
def connect!
|
|
# Every timestamp is written as Time.now.utc; read them back as UTC too
|
|
# (otherwise a host in UTC+4 sees a fresh 1 h token as already expired).
|
|
Sequel.default_timezone = :utc
|
|
@connection ||= Sequel.connect(
|
|
ENV.fetch('DATABASE_URL'),
|
|
max_connections: 5,
|
|
logger: ($env == 'development' ? $logger : nil)
|
|
)
|
|
end
|
|
|
|
def connection
|
|
@connection or raise 'DB not connected — call DB.connect! first'
|
|
end
|
|
|
|
def migrate!
|
|
Sequel.extension :migration
|
|
Sequel::Migrator.run(connection, File.join($root, 'db', 'migrations'))
|
|
end
|
|
end
|