Users Roles and Security

Users, roles & security

Manage people under Settings → Users (admin). Every user has their own Account page for profile photo, email, password, 2FA and connected cloud accounts.

Adding users

• Add User — create a user with a username + password directly.
• Send invite — create a pending account with just a username + email. They get an email link to set their own password, then are logged in. The Users table shows Pending until accepted. (Requires email to be configured.)

Roles & screen access

Each user has a role. Roles (under Settings → Roles) grant permissions and screen access:

• canManage — admin: full access, sees Settings, receives alerts.
• canUpload — may upload/import photos.
• canDelete — may delete photos/albums.
• Screens — the list of screens a role's members can see. Admins implicitly see every screen.

Non‑admins don't see the Settings button; they only see screens their role grants.

Sign‑in & account security

• Password login at /login, plus optional Single sign‑on (Microsoft/Google).
• Forgot password — request a reset from the login page; a secure, single‑use, 30‑minute link is emailed (no account enumeration).
• Two‑factor authentication (per user, on the Account page):
  • Authenticator app (TOTP) — scan the QR, enter a code.
  • Email code — a code is emailed at login (needs email configured).
  • Changing a password requires the current password first.
• Login lockout — after N failed attempts an account is auto‑blocked (configurable; admins can unblock).

Data & secrets

• All runtime state is in the data/ folder (data.json, uploads/, secret.key, optional ssl/). Back it up.
• Secrets are encrypted at rest with AES‑256‑GCM: OAuth client secrets, cloud refresh tokens, the Synology NAS password + device token, and stored WiFi passwords. Non‑secret identifiers (client IDs, usernames, emails, NAS URL) are stored as‑is.
• The encryption key comes from PHOTODOCK_SECRET_KEY (recommended in production) or an auto‑generated secret.key (mode 600). Both are kept out of git.
• This is encryption at rest: it protects a leaked data.json, not a fully compromised host (the key sits on the same server). Prefer PHOTODOCK_SECRET_KEY from your secrets manager.

Tip: use https:// everywhere — for the reverse proxy and for your Synology NAS URL — so passwords are never sent in clear text.