Amir Arsalan Yavari
c5cbeafd5e
Forgetting the dashboard password previously meant editing SQLite by hand: there was no reset route, no UI and no script. The login screen now offers a reset. POST /api/auth/forgot-password mints a one-time code and prints it to the server logs; the operator reads it off the box and enters it on the reset form. The code never crosses the wire. Proof of identity is being able to read the logs, the same trust model first-run setup already uses, which suits a single-user self-hosted tool with no mail server. Guards: 15-minute TTL, 10-second cooldown between requests, constant-time comparison, a new request invalidates the previous code, the code is burned after use, and forgot-password answers 200 even with no account so it cannot be used to probe whether one exists. Also adds change-password and change-email from inside the dashboard, and extracts the shared one-time-code primitive that setup now uses too. Rebased onto current main: the navbar had been split into AccountMenuItems and the theme toggle moved into the settings dialog, so the credential actions now sit beside Sign out. The 20 new auth strings were extended from 6 locales to all 60. Adds 9 tests over the reset flow. Co-authored-by: arsalanyavari <67124852+arsalanyavari@users.noreply.github.com>
23 lines
471 B
JSON
23 lines
471 B
JSON
{
|
|
"$schema": "https://opencode.ai/config.json",
|
|
"model": "freellmapi/auto",
|
|
"provider": {
|
|
"freellmapi": {
|
|
"npm": "@ai-sdk/openai-compatible",
|
|
"name": "FreeLLMAPI (local)",
|
|
"options": {
|
|
"baseURL": "http://127.0.0.1:3001/v1"
|
|
},
|
|
"models": {
|
|
"auto": {
|
|
"name": "FreeLLMAPI Auto Router",
|
|
"limit": {
|
|
"context": 1048576,
|
|
"output": 65536
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|