mirror of
https://github.com/esengine/DeepSeek-Reasonix.git
synced 2026-11-07 10:45:59 -10:00
YHH
1858974dc7
The crash dashboard ran its own account system — a separate D1 users/ sessions table with its own password login — which fragmented identity from id.reasonix.io. Make it consume the shared identity instead: it resolves the .reasonix.io rxid cookie via id.reasonix.io/me (Bearer) and keeps only a per-dashboard role in a new `access` table. Existing roles migrate by email (migrate-access.sql); ADMIN_EMAILS force-promotes the owner so a missed migration can't lock them out. Sign-in redirects to the shared login; sign-out revokes the shared session. Also: accounts /auth/logout accepts a Bearer token (so crash can revoke server-side), and the site login honours a next to any *.reasonix.io.
18 lines
813 B
SQL
18 lines
813 B
SQL
-- Unify dashboard auth onto id.reasonix.io: dashboard access is now a per-email
|
|
-- role, not a local password/session. Identity is resolved from the shared
|
|
-- account service; this table only records who may view the dashboard.
|
|
-- Apply: wrangler d1 execute reasonix-crash --remote --file=migrate-access.sql
|
|
CREATE TABLE IF NOT EXISTS access (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
email TEXT NOT NULL UNIQUE,
|
|
role TEXT NOT NULL DEFAULT 'pending',
|
|
created_at TEXT NOT NULL,
|
|
approved_at TEXT,
|
|
approved_by TEXT
|
|
);
|
|
|
|
-- Carry over every existing dashboard account's role by email, so current
|
|
-- admins/viewers keep their access when they next sign in via id.reasonix.io.
|
|
INSERT OR IGNORE INTO access (email, role, created_at, approved_at)
|
|
SELECT lower(email), role, created_at, approved_at FROM users;
|