hz
48a8c8361d
Adds a full flashcards system: FSRS-based scheduling, cloze/basic card types, CSV import/export, media storage, and study UI, wired into navigation and the dashboard alongside existing question flows.
1.7 KiB
Profile and account operations
The profile screen reads account identity from GET /api/Auth/me, study preferences from
GET /api/profile/me/preferences, and performance metrics from GET /api/dashboard.
Deployment
Authentication is hosted by the Questions API under /api/Auth; it does not depend on the
legacy Promiscuity Auth API. The merged service continues using the existing Users,
BlacklistedTokens, and SteamAuthTransactions collections in the promiscuity database.
Configure this Gitea repository secret before deploying:
AUTH_JWT_KEY: the existing production signing key, unchanged during cutover
The deployment creates the ranaze-auth Kubernetes secret. Steam OpenID callbacks use
https://s3q.ranaze.com/api/Auth/steam/callback. Account deletion invokes the study-data purge
in process before deleting the user record. The internal purge endpoint remains temporarily for
older clients and can be removed after the old auth deployment is retired.
Password reset is disabled until an SMTP provider is configured. When enabled, codes expire after 10 minutes, are stored only as keyed hashes, and invalidate all existing sessions when consumed. New and updated accounts require a unique normalized email. Legacy accounts with duplicate emails must initiate recovery with their exact username.
Data export
Exports are versioned JSON files containing account metadata and user-owned study records. Password hashes, refresh tokens, global question content, and moderation data owned by other users are excluded.
Flashcard decks, notes, generated cards, review logs, media, and settings are user-owned collections (see FLASHCARDS.md) and are included in export/purge the same way as the rest of a learner's study data.