4 Commits

Include renames

Author	SHA1	Message	Date
Aleksandr BogomiakovandClaude	38105c65c2	Merge NEXT: planning, generation map and portable configuration on top of the OIDC access model ... NEXT predates the access work, so the identity layer follows master: access comes from configured groups, instance administrators replace the site administration, and accounts are created by SSO or by an administrator. Kept from NEXT: manual publication with the Review changes panel and shared generator drafts, portable import/export (meguri/v2), the layered generation map with binding provenance, JSM provider changes, contact/approval semantics and the account-owned Person. Dropped: site administration, local sign-up, and the mandatory unique email with its contact/account migrations. The manual-publication migration is renumbered m_0010 after m_0009_access. Accounts without an email still get a Person in every workspace they reach, a changed sign-in email updates the account's person, and an account that loses access keeps its linked person so schedules stay valid. Instance administrators may use Sync and shared drafts. Co-Authored-By: Claude <noreply@anthropic.com>	2026-10-07 16:06:10 +01:00
Ultradesu	5260c2828b	NEXT	2026-10-07 15:30:31 +01:00
Aleksandr BogomiakovandClaude	4764f3545f	Add OIDC sign-in, group-derived roles and declarative instance configuration ... Workspaces, group mappings and sign-in methods now come from a configuration file synchronized at startup; workspaces dropped from it are disabled, never deleted. Instance administrators (a new role) see and help every workspace and may delete disabled ones; workspace administrators and employees are derived from the user's groups at every SSO sign-in or administrator edit, and the employee permission set belongs to the workspace. Self-registration is gone: users come from SSO (only when their groups map) or from the administrator. Break-glass bootstrap accounts get an HMAC-derived hourly password that all replicas agree on. First SSO sign-in links a matching email contact to the user. The demo runs on the same model with a generated per-start password. Co-Authored-By: Claude <noreply@anthropic.com>	2026-10-07 13:28:43 +01:00
ab	a47c4a0398	Init	2026-09-24 14:35:05 +03:00