c56cfb30ad
No self-signup: admins create every account in Config -> Benutzer with a typed start password; a forced password change gates first use. Session- cookie auth protects all /api/* routes; /api/users additionally requires the admin role. See docs/authentication.md. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
27 lines
971 B
TypeScript
27 lines
971 B
TypeScript
import { sql } from "drizzle-orm";
|
|
import { integer, sqliteTable, text, uniqueIndex } from "drizzle-orm/sqlite-core";
|
|
|
|
export const users = sqliteTable(
|
|
"users",
|
|
{
|
|
id: text("id").primaryKey(),
|
|
username: text("username").notNull(),
|
|
passwordHash: text("password_hash").notNull(),
|
|
name: text("name").notNull(),
|
|
role: text("role").notNull().default("user"),
|
|
active: integer("active", { mode: "boolean" }).notNull().default(true),
|
|
mustChangePassword: integer("must_change_password", { mode: "boolean" })
|
|
.notNull()
|
|
.default(true),
|
|
createdAt: integer("created_at", { mode: "timestamp" })
|
|
.notNull()
|
|
.default(sql`(unixepoch())`),
|
|
updatedAt: integer("updated_at", { mode: "timestamp" })
|
|
.notNull()
|
|
.default(sql`(unixepoch())`),
|
|
},
|
|
(table) => [uniqueIndex("users_username_unique").on(table.username)]
|
|
);
|
|
|
|
export type User = typeof users.$inferSelect;
|
|
export type NewUser = typeof users.$inferInsert;
|