61 lines
2.4 KiB
Markdown
61 lines
2.4 KiB
Markdown
# Users & permissions
|
|
|
|
PicHost uses role-based access control (RBAC): **admin** and **user**. Enforcement is server-side.
|
|
|
|
## Role capabilities
|
|
|
|
| Capability | Admin | User |
|
|
| ---------- | :---: | :--: |
|
|
| Upload images | ✓ | ✓ |
|
|
| Own gallery | ✓ | ✓ |
|
|
| All galleries / uploader badges | ✓ | — |
|
|
| Storage management (`/storage`) | ✓ | — |
|
|
| System settings (`/settings`) | ✓ | — |
|
|
| Allow registration | ✓ | — |
|
|
| Login verification (slider / Turnstile / Cap) | ✓ | — |
|
|
| Global API token | ✓ | — |
|
|
| Personal API token | ✓ | ✓ |
|
|
| Gallery stats overview (incl. user count) | ✓ | partial |
|
|
| Activity log (Settings → Activity log) | ✓ | — |
|
|
|
|
Regular users see **API**, **Gallery** in the nav; user menu: **Change password**, **Sign out**.
|
|
|
|
## Auth scenarios
|
|
|
|
| Scenario | Auth | Ownership / visibility |
|
|
| -------- | ---- | ---------------------- |
|
|
| Web upload | Session cookie | Current user |
|
|
| API upload + **user token** | `Auth-Token` header | Token owner |
|
|
| API upload + **global token** | `Auth-Token` header | Admin (`userId` null) |
|
|
| Twikoo `POST /api/index.php` | form `token` | Same as global token |
|
|
| Gallery list / search / delete | Session or token | Users: own only; admin: all |
|
|
| Direct link `GET /images/...` | None (Referer rules) | Public if URL is known |
|
|
|
|
## Accounts
|
|
|
|
- By default only admins create users; **allow registration** is an admin setting
|
|
- Passwords hashed with scrypt
|
|
- Web login/register requires verification: local slider by default; admins can switch to Turnstile or Cap under **Settings → Access control**
|
|
- If verification is misconfigured: `docker exec pichost slider` resets to the local slider
|
|
- Login rate limiting
|
|
|
|
## Upload preferences & auto-delete
|
|
|
|
- **Upload preferences**: admins configure client compression and auto-copy in **Settings → Basic**; regular users can flip the home upload card for personal preferences
|
|
- **Auto-delete**: global (admin) and per-user policies; affects **new uploads after enable** only
|
|
|
|
## API tokens
|
|
|
|
| Type | Managed by | Upload owner | Typical use |
|
|
| ---- | ---------- | ------------ | ----------- |
|
|
| **Global** | Admin (API page) | Admin account | Twikoo, site-wide scripts |
|
|
| **Personal** | Each user (API page) | That user | Personal blog, private scripts |
|
|
|
|
`API_UPLOAD_TOKEN` in env locks the global token — see [Environment variables](./configuration.md).
|
|
|
|
## See also
|
|
|
|
- [API](./api.md)
|
|
- [Twikoo](./twikoo.md)
|
|
- [Storage](./storage.md)
|