Drop fixed container names so each worktree gets its own containers,
add docker/dev/worktree.sh to set up and tear down a worktree, and
document it under a new Development section in the README.
Import uploads were always written to /usr/src/app/temp, presets were
read from /usr/src/app/import_presets and the caches lived in /var/tmp,
so WYGIWYH only worked from the Docker image's layout. Running it as a
systemd service with a strict sandbox, or on an immutable distro like
NixOS, needs these folders to follow the app or be configurable.
- Presets are read from IMPORT_PRESETS_ROOT, the import_presets folder
next to the app.
- Uploads wait in IMPORT_TEMP_ROOT, the temp folder next to the app by
default, and movable with the IMPORT_TEMP_ROOT env var. The web views,
the API and the import service all use it.
- The file-based caches live under CACHE_ROOT, /var/tmp by default, and
movable with the CACHE_ROOT env var.
In the Docker image the app sits in /usr/src/app, so every default
resolves to the same folder as before.
The import service checked that a file was inside the temp folder with a
plain string prefix, which also accepted sibling folders such as
/usr/src/app/temp-other. It now compares paths.
CI no longer needs to create /usr/src/app before running the tests.
Fixes#472
- Add flag-off login page and admin password tests so the refusal tests can't pass for unrelated reasons
- Expect exactly 401 from refused basic auth
- Gate OIDC_DISABLE_LOCAL_LOGIN on an explicit OIDC_CONFIGURED flag
- Realign the README OIDC table, use "email" consistently, and warn about lockout with OIDC_ALLOW_SIGNUP=false
When the flag is on and an OIDC provider is configured, every e-mail and
password check is refused: the login page, the admin and the API's basic
auth. OIDC logins, API tokens, OAuth apps and permission checks keep working.
The login page hides the password form.
- Personal API tokens (model, user-settings UI, admin, management command,
DRF auth class) for non-interactive API access from automations like n8n.
Raw token shown once; only a SHA-256 hash is stored; last_used_at writes
are throttled.
- OAuth2 authorization server via django-oauth-toolkit with authorization
server metadata and optional, off-by-default Dynamic Client Registration
(RFC 7591), so remote OAuth/MCP clients can authenticate and self-register.
- Tests for token auth, DCR gating and the management commands, plus
.env.example and README documentation.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
I've added django-allauth and configured it for OIDC authentication.
This included changes to settings, URLs, and login templates to support OIDC.
I verified that the User model and UserSettings creation are compatible.
I also added documentation for OIDC environment variables to README.md.
Herculino Trotta
Asish Kumar
fariskazmi
Herculino Trotta
google-labs-jules[bot]
luzpaz
Ikko Eltociear Ashimine