Users, Auth & Security

Accounts, authentication, and the security model: how Chinaski decides who is allowed to do what, how sessions stay real, and where every security-relevant action is recorded. The pages follow the operator’s journey: getting people in, scoping them, watching the trail.

In this section

• Users & Roles: the two roles (admin/editor), user management, suspension, and self-registration.
• Authentication: sign-in mechanics, lockouts, the dual session model (cookie + server-side record), and session invalidation.
• Passwords: password rules, expiry, resets, and what a password change invalidates.
• SSO & OAuth: enabling a real identity provider for teams; accounts created from identity providers.
• Permissions: scoping editors by allowed content types and languages, beyond the two roles.
• Security Model: the code-level guarantees: CSRF everywhere, hashed-at-rest secrets, signed sessions, and the trust rules for proxy headers.
• Audit Log: every recorded security action (logins, locks, content changes), who wrote what, and retention.
• Secrets: what’s encrypted and where (stored credentials, signing key rotation, the env’s CHINASKI_SECRET contract).
• Hardening: the deployment-level measures: upload checks, honeypots, rate limiting, external security log.
• My Account: self-service: password changes, profile, interface preferences, and “log out everywhere”.

The model in one paragraph

People log in with username + password (or an SSO provider when configured) and get a signed, server-validated session; their capabilities then come from two levels: a role (what they can reach) and per-user restrictions (which content types and languages they manage). Every authentication outcome and every mutation is recorded: an audit trail plus separate auth/event logs, with lockouts, expiry, and rate limits enforced server-side. Secrets (credentials, keys) live encrypted at rest under a key derived from the instance’s CHINASKI_SECRET, which is exactly why that env file matters as much as the backups.

What’s deliberately simple

• Two roles, then refinement. There is no roles-per-route matrix: editor plus allowed-content/languages covers real-world agency needs; admin covers the rest.
• Sessions are revocable. Suspending a user, resetting a password, or “log out everywhere” ends sessions instantly, not at the next re-login. Password expiry is enforced at the application level.
• The audit trail is a plain table: robust enough for day-to-day forensics, with a best-effort durability note and an optional external JSON log for the events you can’t afford to lose.
• Self-registration exists but ships off: registration, password resets, and Turnstile all come disabled/optional; enabling them is a deliberate choice.