hotel-manage-stack/auth
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions
36 commits 1 branch 0 tags 334 KiB
Commit graph

36 commits

This branch
This branch
All branches
Author SHA1 Message Date
jtricerolph
da0f97c47c Workforce: fetch locations individually by ID instead of list endpoint 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-07 13:14:11 +00:00
jtricerolph
788628485b Add per-app session timeout: max_session_hours column on apps, enforced in /verify 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-07 12:57:13 +00:00
jtricerolph
3fae52c36b Workforce: filter departments by configured location_id 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-07 12:52:34 +00:00
jtricerolph
9ea567955d Workforce: fetch locations to resolve location names on departments 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-07 12:48:43 +00:00
jtricerolph
5d6a9ea3cd Workforce: bearer token only, strip OAuth, pass location fields from departments 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-07 12:42:47 +00:00
jtricerolph
75d373c2c5 Use Workforce bearer token directly if configured, skip OAuth 
If a bearer_token is stored in settings, getWorkforceToken() returns it
immediately without doing an OAuth password grant. Validation accepts
either bearer_token or email+password.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-07 12:34:56 +00:00
jtricerolph
8d6fd71800 Add reports app registration and capabilities 
Registers reports app (LXC 122, /reports, BarChart2, #1d4ed8, Management
category) with two capabilities: view (run reports) and export (CSV download).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-06 12:58:35 +00:00
jtricerolph
2f0c9a1b34 Remove view_bookability + view_competitor_rates from forecasting caps 
These features have moved to the Rate Monitor app.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-05 12:14:30 +00:00
jtricerolph
a4ea1c141e Add Rate Monitor app registration and 6 capabilities 
Renames 'Rate Scraper' → 'Rate Monitor', seeds view_own_rates,
view_competitors, view_direct_rates, rate_analysis, manage_scraper,
manage_hotels caps for the rates app (LXC 115).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-05 12:06:54 +00:00
jtricerolph
42c1a33c4b Auth seed: include name in ON CONFLICT DO UPDATE so renames take effect on restart 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-04 13:23:15 +00:00
jtricerolph
edbaeeda08 Rename housekeeping category to Hotel, HK Planner to Rota Check 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-04 13:19:39 +00:00
jtricerolph
a03b065c43 Auth: assignable-users endpoint + maintenance app seed row 
GET /api/auth/users?app=<slug> — non-admin user list for task allocation
(requester must have access to the app; returns active users with access,
minimal fields). Seed row for the maintenance app (LXC 121).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-03 21:29:08 +00:00
jtricerolph
608ed4ce19 Auth: refresh JWT on verify so permission changes take effect without re-login 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-02 21:07:09 +00:00
jtricerolph
6e5009b57f Expand cashup caps: history, cash_summary, safe_count 
Splits the old 'reports' cap into reports + cash_summary,
'floats' into floats + safe_count, and adds a new 'history' cap.
Existing installs get the three new caps added to the Staff role
via an additive per-cap seed so admin-managed configs are unaffected.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-02 14:36:06 +00:00
jtricerolph
b5d494a691 Seed hk-planner capabilities: planner + settings 
Staff role gets planner by default; settings is admin/explicit-grant only.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-02 14:29:58 +00:00
jtricerolph
c7f7079b99 Add per-app granular capabilities (RBAC beyond app access) 
Schema:
- app_capabilities: capabilities each app exposes (<app>:<slug>)
- role_capabilities / user_capabilities: grants via roles and direct
- Seed cashup caps (count, finalise, reports, floats, settings)
- Non-breaking migration: default Staff role gets all cashup caps
  except settings (previously only is_admin reached settings)

Resolution:
- getUserCapabilities(): admins get all; others get union of
  role + direct grants, as "<app>:<cap>" strings
- caps[] added to JWT payload (login + register)
- /verify returns live capabilities for the requested app (bare slugs)

Admin API:
- GET /admin/capabilities catalogue
- grant/revoke capability on roles and users
- roles/users GET responses now include their capabilities

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-02 14:19:08 +00:00
jtricerolph
fdbc4df29c Seed hk-planner app (10.10.10.118) 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-02 13:59:02 +00:00
jtricerolph
1ae1019ea5 Workforce OAuth: try platform scope for full access 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-02 01:11:27 +00:00
jtricerolph
1c16f0ae9b Workforce OAuth: remove scope restriction to get all permitted scopes 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-02 01:08:31 +00:00
jtricerolph
31213a3523 Fix Workforce pagination: use page_size param (not per_page) 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-02 01:05:11 +00:00
jtricerolph
1bab3d273f Workforce OAuth: use department scope for departments endpoint 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-02 01:03:12 +00:00
jtricerolph
875835bb7c Use me+department scopes and improve OAuth error messages 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-02 00:57:01 +00:00
jtricerolph
f3dcfa37c6 Request department and staff scopes for Workforce OAuth token 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-02 00:55:17 +00:00
jtricerolph
da657ab6c7 Log Workforce departments error to aid debugging 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-02 00:53:53 +00:00
jtricerolph
6742204546 Remove OAuth scope restriction and improve API error messages 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-02 00:41:37 +00:00
jtricerolph
1eba56345f Fix Workforce OAuth: use form-encoded body and correct scope 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-02 00:35:55 +00:00
jtricerolph
42be29b2ce Add SETTINGS_URL/SECRET to compose, fix sync email-change and rate-limit bugs 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-02 00:23:59 +00:00
jtricerolph
f08d53d702 Add internal registry endpoint, self-registration, and workforce sync 
- Register internalRoutes at /api/auth/internal (used by management)
- Add registerRoutes for staff self-registration flow
- Add workforce sync job (runs on schedule, fails gracefully if unconfigured)
- Add email.js for registration/invite emails

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-01 20:35:44 +00:00
jtricerolph
2d89fd9227 Fix cashup app seed: correct host to 10.10.10.117 and port to 3083 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-01 20:23:06 +00:00
jtricerolph
7fd1ed8381 Add app category grouping support 
Add category column to apps table with migration, update seed with category
values for existing apps, and include category in auth queries ordered by
category then name.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-01 18:26:01 +00:00
jtricerolph
a0edbec92b Switch app icons to Lucide names, update existing rows on conflict 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-01 18:09:55 +00:00
jtricerolph
cd21697af3 Admins implicitly see all active apps (fixes empty portal for admin) 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-01 14:59:51 +00:00
jtricerolph
b7589b702a Cookie: Secure only over HTTPS (works on LAN HTTP); healthcheck 127.0.0.1 2026-07-01 14:42:28 +00:00
jtricerolph
e194e736d0 Docker-in-LXC: security_opt apparmor=unconfined 2026-07-01 13:28:50 +00:00
jtricerolph
4dfdb7c3e7 ip-check: add 'auto' self public-IP mode + matcher list 2026-07-01 12:57:57 +00:00
jtricerolph
372e71c8f5 Initial commit: auth 2026-07-01 12:09:54 +00:00