kristianwindandClaude Opus 5
9b21b3eac5
Et projekt kunne kun deles ved at stave en e-mailadresse. Det er den forkerte
vej at spørge om en kollega, man kender navnet på og sidder i samme rum som —
og beslutningen om, hvorvidt en instans' konti må vises for hinanden, var
allerede taget: `UsersForSharing` har gjort det for noter hele tiden, med
begrundelsen skrevet ved siden af. Der er ingen åben oprettelse, så konti er en
lukket, inviteret mængde, og det er en adressebog frem for en udlevering.
Projekterne bruger nu den samme.
`GET /members` svarer med tre lister frem for én, så panelet åbner færdigt i ét
kald — samme form som notens delingspanel. `POST /invites` tager `user_id` ved
siden af `email`, og de to veje mødes ét sted: en adresse, der viser sig at høre
til en konto, ER den konto, og skal ikke gennem en oprettelsesside, den ikke kan
komme igennem.
De ventende invitationer kom med, fordi den nye liste skabte behovet for dem:
den, der er inviteret og ikke kommet, har ingen konto og står derfor hverken
blandt medlemmerne eller blandt dem, man kan vælge. Før betød det, at man ikke
kunne se sin egen invitation; nu ville det betyde, at man leder efter en person,
der mangler i listen, og inviterer igen. Det andet link virker lige så godt som
det første. De kan trækkes tilbage, for ellers er den ventende liste kun til at
se på.
Tre ting, der kostede en kørsel hver:
`OpenAPI is valid` fangede den nye DELETE-rute, før jeg selv gjorde.
To felter hed "Rolle" på den samme side. Det er ikke kun en prøve, der brokker
sig — en skærmlæser siger "Rolle" to gange uden at kunne skelne. De har nu hver
sin tilstand og hvert sit navn, og den gamle prøves `getByLabel('Rolle')` er
blevet `exact`, fordi den matchede som understreng.
Og e2e-prøven lånte først sin anden person fra prøven ovenfor. Det så jeg kun,
fordi jeg kørte den alene: basen tømmes for hver kørsel, så en prøve, der kun
består, når hele filen kører i rækkefølge, består ikke af sine egne grunde. Den
laver nu selv sin — og viser dermed skiftet: den samme person er først en
ventende adresse og bagefter et navn, der kan vælges.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2.8 KiB
Signing in
Three ways in, and you can have all of them at once.
A password
What the first account is created with. Nothing is emailed, nothing is registered anywhere: the first person to open a fresh instance creates the administrator account, and after that people arrive by invite link.
Being let into a project
Two different situations, one panel — the project's ⋯ menu → Share.
Somebody who already has an account here you pick from a list by name. You do not need to know their email address to share a project with a colleague whose name you know. The accounts on an instance are a closed set — there is no open signup, every one of them was invited — so listing them to each other is the address book the feature needs, not a disclosure.
Somebody who is not here yet you invite by email. If the address turns out to belong to an account it becomes an ordinary share straight away; otherwise it becomes a link that creates their account and their membership at once. With no mail server configured the link is shown in the panel instead of being sent, which is the correct behaviour on a one-person instance rather than an error.
An invitation that has not been taken up stays listed under the members, greyed, with a × to withdraw it. Without that it is invisible — the person has no account, so they are neither a member nor somebody you can pick — and the usual next move is to send it a second time. The second link works exactly as well as the first, and then there are two to keep track of.
A code on top of it
Settings → Account → Two-factor. An ordinary TOTP secret — any authenticator app reads the QR code. Once it is on, the password alone is not enough.
Recovery codes are shown once, when you turn it on. They are the way back if the phone is gone, and they are not shown again.
A passkey
Settings → Account → Passkeys → Add a passkey.
A key on a device instead of a secret in your head. The private half never leaves the device — a phone's secure element, a laptop's keychain, a hardware key — and the signature is bound to the address it was made for, so a convincing copy of the sign-in page at a different address gets nothing.
Give each one a name you will recognise later. min bærbare is what makes a list of keys reviewable, and a list nobody can read is a list nobody revokes from.
Passkeys need the address in VERDANDE_BASE_URL to be a hostname. Browsers refuse
to make one for a bare IP address, so an instance reached at http://192.168.1.10:8080
will show the passkey section as unavailable rather than failing at the moment
somebody tries.
!!! note "One is enough, two is better" Lose the only device holding your only passkey and you are back to the password. Keep the password, or register a second key — a phone as well as a laptop.