31 lines
1.5 KiB
Markdown
31 lines
1.5 KiB
Markdown
# Profile and account operations
|
|
|
|
The profile screen reads account identity from `GET /api/Auth/me`, study preferences from
|
|
`GET /api/profile/me/preferences`, and performance metrics from `GET /api/dashboard`.
|
|
|
|
## Deployment
|
|
|
|
Authentication is hosted by the Questions API under `/api/Auth`; it does not depend on the
|
|
legacy Promiscuity Auth API. The merged service continues using the existing `Users`,
|
|
`BlacklistedTokens`, and `SteamAuthTransactions` collections in the `promiscuity` database.
|
|
|
|
Configure this Gitea repository secret before deploying:
|
|
|
|
- `AUTH_JWT_KEY`: the existing production signing key, unchanged during cutover
|
|
|
|
The deployment creates the `ranaze-auth` Kubernetes secret. Steam OpenID callbacks use
|
|
`https://s3q.ranaze.com/api/Auth/steam/callback`. Account deletion invokes the study-data purge
|
|
in process before deleting the user record. The internal purge endpoint remains temporarily for
|
|
older clients and can be removed after the old auth deployment is retired.
|
|
|
|
Password reset is disabled until an SMTP provider is configured. When enabled, codes expire after
|
|
10 minutes, are stored only as keyed hashes, and invalidate all existing sessions when consumed.
|
|
New and updated accounts require a unique normalized email. Legacy accounts with duplicate emails
|
|
must initiate recovery with their exact username.
|
|
|
|
## Data export
|
|
|
|
Exports are versioned JSON files containing account metadata and user-owned study records.
|
|
Password hashes, refresh tokens, global question content, and moderation data owned by other
|
|
users are excluded.
|