O96u
8408d01197
GitHub Release / release (push) Canceled after 0s
ci / ci (22, ubuntu-latest) (push) Canceled after 0s
Publish Docker image / build (linux/amd64, ubuntu-latest, amd64) (push) Canceled after 0s
Publish Docker image / build (linux/arm64, ubuntu-24.04-arm, arm64) (push) Canceled after 0s
Publish Docker image / merge (push) Canceled after 0s
59 lines
2.2 KiB
Markdown
59 lines
2.2 KiB
Markdown
# Users & permissions
|
|
|
|
PicHost uses role-based access control (RBAC): **admin** and **user**. Enforcement is server-side.
|
|
|
|
## Role capabilities
|
|
|
|
| Capability | Admin | User |
|
|
| ---------- | :---: | :--: |
|
|
| Upload images | ✓ | ✓ |
|
|
| Own gallery | ✓ | ✓ |
|
|
| All galleries / uploader badges | ✓ | — |
|
|
| Storage management (`/storage`) | ✓ | — |
|
|
| System settings (`/settings`) | ✓ | — |
|
|
| Allow registration | ✓ | — |
|
|
| Global API token | ✓ | — |
|
|
| Personal API token | ✓ | ✓ |
|
|
| Gallery stats overview (incl. user count) | ✓ | partial |
|
|
| Activity log (Settings → Activity log) | ✓ | — |
|
|
|
|
Regular users see **API**, **Gallery** in the nav; user menu: **Change password**, **Sign out**.
|
|
|
|
## Auth scenarios
|
|
|
|
| Scenario | Auth | Ownership / visibility |
|
|
| -------- | ---- | ---------------------- |
|
|
| Web upload | Session cookie | Current user |
|
|
| API upload + **user token** | `Auth-Token` header | Token owner |
|
|
| API upload + **global token** | `Auth-Token` header | Admin (`userId` null) |
|
|
| Twikoo `POST /api/index.php` | form `token` | Same as global token |
|
|
| Gallery list / search / delete | Session or token | Users: own only; admin: all |
|
|
| Direct link `GET /images/...` | None (Referer rules) | Public if URL is known |
|
|
|
|
## Accounts
|
|
|
|
- By default only admins create users; **allow registration** is an admin setting
|
|
- Passwords hashed with scrypt
|
|
- Web login requires a slider captcha (align the thumb with the gap)
|
|
- Login rate limiting
|
|
|
|
## Upload preferences & auto-delete
|
|
|
|
- **Upload preferences**: admins configure client compression and auto-copy in **Settings → Basic**; regular users can flip the home upload card for personal preferences
|
|
- **Auto-delete**: global (admin) and per-user policies; affects **new uploads after enable** only
|
|
|
|
## API tokens
|
|
|
|
| Type | Managed by | Upload owner | Typical use |
|
|
| ---- | ---------- | ------------ | ----------- |
|
|
| **Global** | Admin (API page) | Admin account | Twikoo, site-wide scripts |
|
|
| **Personal** | Each user (API page) | That user | Personal blog, private scripts |
|
|
|
|
`API_UPLOAD_TOKEN` in env locks the global token — see [Environment variables](./configuration.md).
|
|
|
|
## See also
|
|
|
|
- [API](./api.md)
|
|
- [Twikoo](./twikoo.md)
|
|
- [Storage](./storage.md)
|