Alec Perkins
1af217f6fb
Sign-in via django-allauth: emailed one-time codes, GitHub, Discord, and Forgejo instances as OpenID Connect apps registered in admin. Regular users never have a password; sysadmins sign in only at /admin/ and are redirected there from the normal sign-in. Organizations at the URL root with owner and collaborator roles, a per-member project-create grant, and invites by username or email. Email invites carry a bearer token stored only as a hash. The last owner can't leave, be removed or be demoted. Permission checks live in intent/access.py. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
13 lines
584 B
Python
13 lines
584 B
Python
from allauth.account.adapter import DefaultAccountAdapter
|
|
from django.contrib import messages
|
|
from django.shortcuts import redirect
|
|
|
|
|
|
class AccountAdapter(DefaultAccountAdapter):
|
|
def pre_login(self, request, user, **kwargs):
|
|
# Sysadmins are separate from regular users and cannot act within projects,
|
|
# so they only sign in through the admin site.
|
|
if user.is_staff:
|
|
messages.error(request, "Administrator accounts sign in at the admin site.")
|
|
return redirect("admin:login")
|
|
return super().pre_login(request, user, **kwargs)
|