ced4568
85fa920f96
Replaces the single shared ADMIN_PASSWORD (Phase 2B) with real accounts: instructors table (email/display_name/role/status), scrypt password hashing with a fresh random salt PER INSTRUCTOR (Phase 2B used one fixed salt because there was exactly one shared password — that assumption is gone), auth_identities table so a future OIDC login can map to the same instructor_id without a schema change. New POST /api/auth/instructor/login, POST /api/auth/logout, GET /api/auth/session, POST /api/auth/change-password (old password required, revokes other sessions). No account enumeration: identical response whether the email doesn't exist or the password is wrong. bootstrap-owner.js is the only supported way to create the first account — no manual database editing to stand up a fresh deployment. Refuses to run if an active owner already exists unless the target email is an existing instructor (zero-owners recovery path).
18 lines
548 B
JSON
18 lines
548 B
JSON
{
|
|
"name": "rootnode-platform-api",
|
|
"version": "0.1.0",
|
|
"description": "RootNode Academy Platform API — students, cohorts, curriculum, progress, sessions, instructor/admin control plane. No k3s, no --privileged, no Lab terminal runtime.",
|
|
"private": true,
|
|
"main": "src/server.js",
|
|
"scripts": {
|
|
"start": "node src/server.js",
|
|
"migrate-sqlite": "node migrate-sqlite.js",
|
|
"bootstrap-owner": "node bootstrap-owner.js"
|
|
},
|
|
"dependencies": {
|
|
"express": "^4.19.2",
|
|
"pg": "^8.11.5",
|
|
"better-sqlite3": "^9.4.3"
|
|
}
|
|
}
|