- remove the separate casdoor-postgres container; casdoor uses the main
postgres (db casdoor, created by sql/02-casdoor-db.sql on fresh volumes);
data migrated via pg_dump/pg_restore (backups kept outside the repo)
- Traefik v3.6 as the public edge (ports 80/443): docker provider pinned to
the dedicated traefik_network (fixed-name network), host rules for
app/api/auth/s3/storage (env-overridable, localhost defaults), frontend
nginx demoted to internal SPA server; docker-compose.prod.yml adds real
domains + Let's Encrypt + HTTP→HTTPS redirect (redirect middleware in
infra/traefik-dynamic.yml)
- v3.6 required (Traefik <=3.3 fails against Docker Engine 29.x); socket
mounted rw (Docker Desktop rejects :ro)
- start.ps1: app URL now http://localhost, casdoor + db notes
- pm.py/inventory.py: remove db.begin() on already-begun sessions — the
scope dependencies read from the session first, so opening a new
transaction raised InvalidRequestError -> 500 on every receipt/transaction
(JWT path); get_db already commits/rolls back atomically
- pm.py: receipt response returns the real derived state (was hardcoded
'arrived'); dev-user creation is race-free (insert on conflict)
- expand_service: aggregate 1:N receipts per line item (received_qty sum +
count) so the ledger can show partial-receipt totals
- users.py: role changes are admin-only (RBAC); new POST /users/sync mirrors
Casdoor org users into the app users table (identity only, roles untouched)
- config/compose: CASDOOR_ADMIN_USER/PASSWORD for the sync endpoint
- seed_casdoor: redirect URI updated for the Traefik edge
- docs/casdoor-auth.md: addresses and credentials (Casdoor console
admin/123, seeded users), in-page login flow, status-code table, the
User/Organization/Role/Permission/Application model, the 9 failure
scenarios with debug steps, Test 1-6 results, 23-item checklist, and how
to manage Casdoor (console, seeding, first-admin bootstrap)
- README: replace the 'no authentication' and 'Casdoor not seeded' notes
with the current login flow, developer-mode toggle and a link to the
auth guide
- redesigned /login (Tailwind, RTL): centered username/password/organization
form posting to POST /api/v1/auth/login — session starts without leaving
the page; PM lands on the inventory panel, others on the procurement office
- Developer Mode button fixed top-left opens a role/project test panel
(admin role added) gated by VITE_ENABLE_DEV_LOGIN (DEV_LOGIN_ENABLED build
arg in Docker, default enabled)
- removed the old Casdoor redirect button, the PKCE ?code= callback, and the
public casdoor-config.js — the client secret is no longer shipped to the
browser; backend mediates the password grant instead
- seed_casdoor.py: JSON type=login + cookie session (the old form-encoded
login-normal API is gone), application with grantTypes incl. password,
passwordType=plain for the seeded users, idempotent re-runs; adds a
dedicated tester user
- docker-compose: Casdoor env for the api service (endpoint casdoor:8000
in-network, issuer http://localhost:8080 as advertised by discovery) and
the DEV_LOGIN_ENABLED build arg for the frontend
- verify kid from the JWT header (pyjwt decode() returns claims, not the
header — the old lookup was always None and rejected every token)
- convert JWK entries to crypto keys explicitly (pyjwt 2.13 dropped dict
keys) and fetch the JWKS from /.well-known/jwks
- 401 for missing/invalid/expired/wrong-issuer/wrong-audience tokens
(was 403/400); 403 stays for valid-but-roleless users; 503 when Casdoor
is unreachable; new CASDOOR_ISSUER setting separates the in-network
endpoint from the browser-facing issuer
- dev-header fallback in inventory/pm scopes now requires an explicit
X-User-Role header (no auth info at all -> 401)
- new POST /api/v1/auth/login: password grant against Casdoor, local JWT
verification, auto-provisioning, returns token + profile with the role
resolved from the app users table
ali_mohaghegh