Dave
2594dead84
Add PocketBase login, first-sign-in password changes, account settings, and user activation, reactivation and deletion with self-removal guards. Protect application pages and APIs and keep private pages out of PWA caches. Resolve plant locations from site assignments and improve map controls, profit chart views, navigation and mobile table layouts. Validation: production build and TypeScript passed; 28 unit tests passed. Backend access integration tests and mobile verification are documented.
2.7 KiB
Mega Plant accounts
Open Account → Settings at the top right. The users table lists names, emails, active/inactive status and whether first sign-in is pending. Make inactive blocks app login and existing sessions on their next request, while retaining the user's password and onboarding state. Reactivate restores access. Delete opens a confirmation and permanently removes the user and their private access state. You cannot disable or delete your own account. All users have the same permissions, including managing other users.
Add users in Settings → Add user, using their name and email. The app assigns mega2026. They must choose a different password of at least eight characters on their first sign-in. No uppercase, number or special-character rules apply.
You can also create accounts directly in PocketBase's users auth collection: set name, email, password and password confirmation to mega2026. Use a regular users account for the app; PocketBase _superusers accounts are for database administration. Every manually created account also goes through the password-change step.
Run npm run setup:auth once per PocketBase environment, and again when upgrading an environment with the original login feature. It adds or upgrades the private user_onboarding collection, including a disabled boolean, without changing existing users or collection permissions. Missing access state means active with first sign-in pending. Onboarding records are created after password changes or access changes, and are removed when the related user is deleted.
The app server needs NEXT_PUBLIC_PB_URL, PB_ADMIN and PB_PASS at runtime. PB_ADMIN and PB_PASS remain server-only and are used for provisioning accounts and maintaining private onboarding state. Keep the existing PocketBase URL build argument for deployment. No seed/reimport is needed.
App pages and API routes require a signed-in user who has completed onboarding; /api/health stays public, and POST /api/auth/logout only validates the origin and removes the local cookie. Existing direct PocketBase endpoint rules were deliberately deferred, so the login does not restrict direct access to those public database APIs. This change adds application authentication only.
The PWA precaches static assets only. Protected pages and API responses use the network, and sign-out removes the session cookie and browser caches.
Verification: npm test, npm run typecheck, npm run build. For disposable real-backend integration tests: MEGA_AUTH_INTEGRATION=1 node --env-file=.env.local --import tsx --test lib/auth-service.test.ts. The tests remove their users, with onboarding state cascading on deletion.