rays
d7fac2d0e7
- Security: feeds from Patreon, Supercast, Supporting Cast, Glow and Memberful are never listed in Popular or the Directory. A Supercast feed keeps its key in the URL's path, which the query check missed, so it was being listed. - Adding a feed queues a scan of it, and an OPML import that added feeds scans what is due, so items show without pressing Scan. - A file deleted to save space, or by hand, looks as if it was never downloaded: no "reaped" chip, just the Download button. The retention summary says "deleted". - The feed header keeps its title and stats to one line each and wraps its buttons; a single feed's table drops the Feed column. - Tests: adding a feed shows its item without Scan; a deleted file shows no "reaped"; paid-feed hosts and acast public ids in the unit test. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016HdTEWQNrzyFULijigkmMn
98 lines
4.5 KiB
Markdown
98 lines
4.5 KiB
Markdown
# Accounts, and what several people share
|
|
|
|
ipx serves any number of people from one copy of the data. The rule that decides everything else:
|
|
**there is one file on disk per enclosure URL.** Two people subscribed to the same show cost one
|
|
fetch, one parse and one file.
|
|
|
|
## What is yours, what is everyone's
|
|
|
|
| Yours alone | The same for everyone |
|
|
|---|---|
|
|
| Read, starred, playback position | The feed's URL |
|
|
| Which feeds you see at all | Its download folder |
|
|
| Keywords, auto-download, explicit, per-scan cap | When it is scanned |
|
|
| | The file on disk |
|
|
|
|
The right-hand column describes the feed and the file rather than a preference — two people wanting
|
|
different folders would mean two copies. Those three are **admin-only**, and the API returns `403`
|
|
for anyone else rather than merely hiding the controls.
|
|
|
|
## How the scanner merges everyone's wants
|
|
|
|
One fetch serves every subscriber, so the policy is a union:
|
|
|
|
* an item is downloaded if **anyone** wants it — one person's keyword set matching is enough, and
|
|
one person with no keywords removes the filter for that feed entirely
|
|
* auto-download is on if **anyone** has it on
|
|
* the per-scan cap is the **largest** anyone asked for
|
|
|
|
So "auto-download off" means *I don't cause downloads*, not *I never see them*. If someone else's
|
|
subscription pulls an item, you see it listed as downloaded and can play it, because the enclosure
|
|
is shared.
|
|
|
|
## Deleting
|
|
|
|
Deleting a file deletes everyone's copy. A feed with other subscribers labels the button **Delete
|
|
for everyone** and names them in the confirmation, and the server has the last word: if anyone else
|
|
has starred the item or not played it yet, `DELETE /api/enclosures/{id}` answers `409` with the
|
|
reason, and only `?force=true` goes through.
|
|
|
|
Retention follows the same rule: starred by anyone keeps a file, and it counts as read only once
|
|
every subscriber has read it.
|
|
|
|
## Signing in
|
|
|
|
Three ways, tried in order of how specific the claim is:
|
|
|
|
1. **A proxy header** naming the user — Cloudflare Zero Trust or Authentik. Honoured only from an
|
|
address in `trusted_proxies`. See [sso.md](sso.md).
|
|
2. **A session cookie** from signing in at `/login`. Argon2id hashes, sessions in the database,
|
|
idle timeout `session_days`.
|
|
3. **The shared `[web] token`**, which signs in as the admin — this is what the Docker healthcheck
|
|
and any scripts use.
|
|
|
|
A database with no accounts creates **admin / ipodderx** on the next daemon start and says so in
|
|
the log. Change it:
|
|
|
|
```sh
|
|
echo -n 'a good password' | ipx user passwd admin
|
|
```
|
|
|
|
## Adding someone
|
|
|
|
```sh
|
|
echo -n 'their password' | ipx user add sam
|
|
```
|
|
|
|
They sign in at `/login` and start with **no feeds**: subscriptions are per person. Adding a feed
|
|
someone else already has costs nothing — no second fetch, no second copy — it just appears on their
|
|
list with their own read state. Unsubscribing removes it from their list alone; only when the last
|
|
subscriber leaves does the feed stop being scanned, and even then its files and history stay, so
|
|
re-subscribing does not pull the back catalogue again.
|
|
|
|
**Popular** and **Directory** sit at the top of the feed list, above your own feeds. Popular, also
|
|
shown in the Add feed dialog, lists the ten feeds with the most subscribers on this server, you
|
|
included. Directory lists every one of them A to Z. Your own feeds are marked Subscribed.
|
|
It shows a title, artwork and a count, never a URL or who reads it. Feeds from an
|
|
OPML subscription are left out, since they come with the OPML. So is anything that looks private: a
|
|
login configured for the feed, credentials in its URL, or a key such as `auth=` or `token=` in the
|
|
query, or a feed from a paid-feed service such as Patreon or Supercast, which put the key in the
|
|
path. Those are someone's paid subscriptions, and listing them would let anyone here read what they
|
|
pay for.
|
|
|
|
An admin can do the same from **Settings → Manage users…**: add someone (with a password, or none
|
|
for someone the proxy signs in), tick or untick Admin, or remove an account. Removing one takes its
|
|
subscriptions and read state with it; downloaded files stay. The only admin cannot be demoted or
|
|
removed there, so there is always someone who can manage the rest.
|
|
|
|
## Admin
|
|
|
|
The first account is an admin. An admin can change global settings (scanning interval, quota,
|
|
retention, media types, download folder), a feed's URL, folder and schedule, and who has an account
|
|
and who else is an admin, and read the log, which names everyone's feeds and sign-ins. Everyone else
|
|
gets the Settings and Log buttons hidden and a `403` if they ask anyway.
|
|
|
|
```sh
|
|
ipx user list # the admin column says who
|
|
```
|