4 Commits

Include renames

Author	SHA1	Message	Date
Aleksandr BogomiakovandClaude	5ccf2b1108	Show the running version next to the brand; bump to 0.2.1 ... Co-Authored-By: Claude <noreply@anthropic.com>	2026-10-07 15:32:20 +01:00
Aleksandr BogomiakovandClaude	548494f12e	Restrict workspace settings to administrators, add demo countries, Helm chart and instance event log ... Employees keep schedule editing but can no longer change workspace preferences or existing scheduling-directory entries (enforced by the server, hidden in the UI). Demo accounts live in Cyprus, the United Kingdom and Armenia with matching bank holidays. A Helm chart deploys the service with a pre-upgrade migrate hook. Refused SSO sign-ins are stored with their support reference as instance events and searchable on the instance administration page. Co-Authored-By: Claude <noreply@anthropic.com>	2026-10-07 15:06:12 +01:00
Aleksandr Bogomiakov	7afdc4be97	Added OIDC workflow and Helm Chart	2026-10-07 14:22:37 +01:00
Aleksandr BogomiakovandClaude	4764f3545f	Add OIDC sign-in, group-derived roles and declarative instance configuration ... Workspaces, group mappings and sign-in methods now come from a configuration file synchronized at startup; workspaces dropped from it are disabled, never deleted. Instance administrators (a new role) see and help every workspace and may delete disabled ones; workspace administrators and employees are derived from the user's groups at every SSO sign-in or administrator edit, and the employee permission set belongs to the workspace. Self-registration is gone: users come from SSO (only when their groups map) or from the administrator. Break-glass bootstrap accounts get an HMAC-derived hourly password that all replicas agree on. First SSO sign-in links a matching email contact to the user. The demo runs on the same model with a generated per-start password. Co-Authored-By: Claude <noreply@anthropic.com>	2026-10-07 13:28:43 +01:00