justin
c5631d3eab
Provenance had no system-level owner: ownership was only per-tree (TreeMembership), so a self-hosted instance had no operator account and no instance-admin surface. This adds one, declared by environment per the project's twelve-factor rule. - OWNER_EMAIL (comma-separated): the account(s) named here are instance owners. Derived at request time — no DB column, no migration, can't drift from the env, survives DB resets. is_instance_owner()/InstanceOwner dependency in api/deps.py. - Ownership requires a VERIFIED email (independent of REQUIRE_EMAIL_VERIFICATION). Registration is open, so without this an attacker could seize the role by registering the owner address first; verification ties it to inbox control. - GET /api/v1/admin/instance (owner-only): operational status — version, env, user/tree counts, configured AI providers. Deliberately exposes no tree data or PII: instance ownership is an operator role, NOT a privacy-engine bypass. - /users/me reports is_instance_owner; frontend gains an owner-only /admin page and a conditional sidebar link (server-enforced, not just client-hidden). Found-and-fixed by an adversarial security review before merge: the verified-email land-grab (above) and a frontend null-deref where the admin page crashed on 401/5xx instead of failing closed. Docs: .env.example + ARCHITECTURE (notes the not-a-privacy-bypass boundary and the verified-email requirement). Tests: owner matching, the land-grab guard, /users/me, and owner-only /admin. Suite 96 passing. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Justin Paul <justin@jpaul.me>
43 lines
1.0 KiB
Python
43 lines
1.0 KiB
Python
"""Versioned API surface. Mounts under /api/v1."""
|
|
|
|
from fastapi import APIRouter
|
|
|
|
from app.api.v1 import (
|
|
admin,
|
|
ai,
|
|
auth,
|
|
citations,
|
|
cleanup,
|
|
events,
|
|
gedcom,
|
|
media,
|
|
members,
|
|
names,
|
|
persons,
|
|
proposals,
|
|
public,
|
|
relationships,
|
|
sources,
|
|
trees,
|
|
users,
|
|
)
|
|
|
|
api_router = APIRouter(prefix="/api/v1")
|
|
api_router.include_router(auth.router)
|
|
api_router.include_router(users.router)
|
|
api_router.include_router(trees.router)
|
|
api_router.include_router(persons.router)
|
|
api_router.include_router(names.router)
|
|
api_router.include_router(events.router)
|
|
api_router.include_router(relationships.router)
|
|
api_router.include_router(sources.router)
|
|
api_router.include_router(citations.router)
|
|
api_router.include_router(media.router)
|
|
api_router.include_router(gedcom.router)
|
|
api_router.include_router(cleanup.router)
|
|
api_router.include_router(public.router)
|
|
api_router.include_router(members.router)
|
|
api_router.include_router(proposals.router)
|
|
api_router.include_router(ai.router)
|
|
api_router.include_router(admin.router)
|