- api/auth.js: zero-dep OIDC authorization-code flow with PKCE against
Authentik; HMAC-signed HttpOnly session cookies (SESSION_SECRET)
- requireAdmin now accepts an OIDC session in the admin group; legacy
ADMIN_SECRET bearer kept for n8n and scripts
- New client endpoints: GET /api/my-bookings, owner-gated contract download
- Bookings created while signed in are bound to the client's OIDC sub
- Dashboard: "Sign in with SSO" alongside passphrase fallback
- New /my-bookings portal page (nginx route + themed page)
- Fix booking modal: content area now scrolls; nav no longer overlaps the
calendar on short viewports (was swallowing clicks on date cells)
- 10 new Playwright tests; suite green at 67
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- New api/ service: Express + better-sqlite3, health check at GET /api/health,
POST /api/bookings stores sessions with all required fields
- Dockerfile with Alpine build deps for native sqlite3 module
- docker-compose.yml: api service with volume mounts for data, signed-contracts, contracts
- nginx.conf: proxy /api/ to api:3001; Immich regex locations remain higher priority
- .gitignore: exclude SQLite db file and signed PDFs from version control
Closes#1
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
jhodgkin