Gabriel Vidal 39a12ca498 feat(users): guests, a built-in login and a caller on every request ...

users.json holds guests (per-project grants view/chat/ship, models,
monthly budget, notification channels); auth.json holds one-time login
links and browser sessions (sha256 of the tokens only). Login is a
magic link mailed over SMTP (SMTP_* env), or copied from the owner's
user admin. The gate now resolves a Caller: a guest session cookie
decides the request outright and may only reach GUEST_ROUTES (default
deny, same-origin for writes); on GUEST_HOSTS nothing is ever the owner;
every existing path (Authelia via Traefik, loopback, token, read-only
key) is the owner exactly as before.

Routes: /api/auth/{request-link,login,logout}, /api/me (GET/PUT prefs),
/api/users CRUD + login-link + revoke, /api/conversation-share.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-11 15:24:24 +02:00

17 KiB

Raw Permalink Blame History

View Raw