[enhancement]: Add multiuser support to InvokeAI

[lstein]

Is there an existing issue for this?

• I have searched the existing issues

Contact Details

No response

What should this feature add?

Overview

This feature will allow a single running instance of InvokeAI to support multiple isolated users, each with their own generation settings and image boards. Upon opening the new multi-user version, a user will be prompted for their username and password. They will then have access to Invoke's image generation, editing, canvas, and workflow functions. Each user will have their own Boards of generated images and assets. These will be isolated from each other, but there will be an option for an administrator to create shared boards that all users can read and write to.

Users will not be able to add or delete models, change server-side settings in the invoke config file, or make other significant changes that would be visible to other users.

An administrator mode will give designated administrative user(s) access to all of InvokeAI's features, including the ability to add and remove models, create shared folders, and administer users.

Administration

Upon the very first launch of InvokeAI, an Administrator setup mode dialog appears that prompts the user for an administrator name and password. These are to be stored in the invokeai config file using a password hashing scheme. The setup can be reinitialized by removing the administrator username and password manually from the config file.

The administrator has the ability to create, manage and delete ordinary users, as well as to grant selected users administrative privileges. The user interface for adding users prompts for the new user's email address. When a new user is added, a one-time login link is sent to them via email. The login link is then used by the user to set up their account.

The administrator has the ability to change a user's permissions. They can:

1. Change their name and email address.
2. Send a change-password link in the event the user has forgotten theirs.
3. Give the user Administrative privileges.
4. Add the user to a Group for future team/enterprise features.
5. View, pause and cancel queued generation sessions created by ordinary users.

Discussion point Would it be better to use OAuth2, OpenID and/or Google Identity Services for the authentication steps?

Users

Users must log in with a valid username and password in order to access InvokeAI. Once logged in, they can:

1. Create, edit and delete Image Boards.
2. Upload assets into boards
3. Use all of the image generation tools in the linear, canvas, upscale and workflow tabs.
4. Create, edit, save and load public workflows as well as their own custom workflows.
5. Adjust local preferences, such as night mode, hotkeys, and other UI settings.
6. View the generation queue and edit sessions that they created. They are not allowed to cancel or otherwise alter sessions created by other users.
7. Log out, returning to the login dialogue.

Users cannot add, delete or edit models. The model tab should be dimmed out for ordinary users.

Alternatives

None. These were part of the features offered by the enterprise edition, which is no longer supported.

Additional Content

No response