rays
5e95557cbb
- Settings > Manage users: add an account (password, or none for proxy
sign-in), toggle admin, remove. Backed by GET/POST /api/users and
PATCH/DELETE /api/users/{id}, 403 for non-admins. The only admin
cannot be demoted or removed.
- GET /api/logs is admin-only and the Log button is hidden for others;
the log names every account, feed and failed sign-in.
- Feeds inside an OPML list those with unread items first, in the
sidebar folder and on the subscription's page.
- Deploying is now buildx --push to 192.168.1.130:5000 and recreating
the ipodderx service of the Arcane project content; CLAUDE.md and the
README's Docker section say so.
- Tests: Playwright for user admin, the last-admin guard, 403s for a
non-admin and the unread ordering (new Aardvark Radio fixture); a unit
test for last_admin; the smoke test drives usersModal.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0173mGu6rK18Ne7UGTwAaVJV
88 lines
3.8 KiB
Markdown
88 lines
3.8 KiB
Markdown
# Accounts, and what several people share
|
|
|
|
ipx serves any number of people from one copy of the data. The rule that decides everything else:
|
|
**there is one file on disk per enclosure URL.** Two people subscribed to the same show cost one
|
|
fetch, one parse and one file.
|
|
|
|
## What is yours, what is everyone's
|
|
|
|
| Yours alone | The same for everyone |
|
|
|---|---|
|
|
| Read, starred, playback position | The feed's URL |
|
|
| Which feeds you see at all | Its download folder |
|
|
| Keywords, auto-download, explicit, per-scan cap | When it is scanned |
|
|
| | The file on disk |
|
|
|
|
The right-hand column describes the feed and the file rather than a preference — two people wanting
|
|
different folders would mean two copies. Those three are **admin-only**, and the API returns `403`
|
|
for anyone else rather than merely hiding the controls.
|
|
|
|
## How the scanner merges everyone's wants
|
|
|
|
One fetch serves every subscriber, so the policy is a union:
|
|
|
|
* an item is downloaded if **anyone** wants it — one person's keyword set matching is enough, and
|
|
one person with no keywords removes the filter for that feed entirely
|
|
* auto-download is on if **anyone** has it on
|
|
* the per-scan cap is the **largest** anyone asked for
|
|
|
|
So "auto-download off" means *I don't cause downloads*, not *I never see them*. If someone else's
|
|
subscription pulls an item, you see it listed as downloaded and can play it, because the enclosure
|
|
is shared.
|
|
|
|
## Deleting
|
|
|
|
Deleting a file deletes everyone's copy. A feed with other subscribers labels the button **Delete
|
|
for everyone** and names them in the confirmation, and the server has the last word: if anyone else
|
|
has starred the item or not played it yet, `DELETE /api/enclosures/{id}` answers `409` with the
|
|
reason, and only `?force=true` goes through.
|
|
|
|
Retention follows the same rule: starred by anyone keeps a file, and it counts as read only once
|
|
every subscriber has read it.
|
|
|
|
## Signing in
|
|
|
|
Three ways, tried in order of how specific the claim is:
|
|
|
|
1. **A proxy header** naming the user — Cloudflare Zero Trust or Authentik. Honoured only from an
|
|
address in `trusted_proxies`. See [sso.md](sso.md).
|
|
2. **A session cookie** from signing in at `/login`. Argon2id hashes, sessions in the database,
|
|
idle timeout `session_days`.
|
|
3. **The shared `[web] token`**, which signs in as the admin — this is what the Docker healthcheck
|
|
and any scripts use.
|
|
|
|
A database with no accounts creates **admin / ipodderx** on the next daemon start and says so in
|
|
the log. Change it:
|
|
|
|
```sh
|
|
echo -n 'a good password' | ipx user passwd admin
|
|
```
|
|
|
|
## Adding someone
|
|
|
|
```sh
|
|
echo -n 'their password' | ipx user add sam
|
|
```
|
|
|
|
They sign in at `/login` and start with **no feeds**: subscriptions are per person. Adding a feed
|
|
someone else already has costs nothing — no second fetch, no second copy — it just appears on their
|
|
list with their own read state. Unsubscribing removes it from their list alone; only when the last
|
|
subscriber leaves does the feed stop being scanned, and even then its files and history stay, so
|
|
re-subscribing does not pull the back catalogue again.
|
|
|
|
An admin can do the same from **Settings → Manage users…**: add someone (with a password, or none
|
|
for someone the proxy signs in), tick or untick Admin, or remove an account. Removing one takes its
|
|
subscriptions and read state with it; downloaded files stay. The only admin cannot be demoted or
|
|
removed there, so there is always someone who can manage the rest.
|
|
|
|
## Admin
|
|
|
|
The first account is an admin. An admin can change global settings (scanning interval, quota,
|
|
retention, media types, download folder), a feed's URL, folder and schedule, and who has an account
|
|
and who else is an admin, and read the log, which names everyone's feeds and sign-ins. Everyone else
|
|
gets the Settings and Log buttons hidden and a `403` if they ask anyway.
|
|
|
|
```sh
|
|
ipx user list # the admin column says who
|
|
```
|