9 commits

Author	SHA1	Message	Date
Emi Griffith	81135c1be5	accounts: sign in with Google, on a shared provider-agnostic OAuth engine ... Adds Google as a second identity provider. Rather than a second copy of the Discord flow, the flow itself moves to accounts/oauth.py and both providers become configurations of it — account resolution is the security-critical part, and a parallel hand-rolled copy is where a subtle divergence becomes a takeover. A third provider is now a PROVIDERS entry and nothing else. Identity moves to an oauth_account table keyed (provider, subject), so a login resolves on the provider's own stable id rather than an email that can be changed or reassigned. user.discord_id deliberately stays: it is the DM delivery address notify.py reads, not merely an identity, and the Discord link keeps writing it. discord_only becomes oauth_only, and the lockout guard now refuses to unlink the *last* provider from a password-less account rather than singling out Discord — with two linked, either may go. Migration 0005 renames the flag and backfills an oauth_account row for every existing discord_id. Without that backfill an already-linked user would stop being recognised at login and would silently get a second account on their next sign-in. It also drops a vestigial discord_only that 0003 re-adds on a database whose 0001 already built oauth_only from current metadata, which otherwise left fresh and upgraded databases with different schemas. Compatibility, since the frontend deploys independently of this service: /discord/link/callback keeps answering because that URL is registered in Discord's developer portal, the other /discord/* routes stay because the deployed frontend calls them, the callback still emits ?discord= alongside ?oauth=, and UserRead still carries discord_only as a computed alias. Google needs THERMOGRAPH_GOOGLE_CLIENT_ID/_CLIENT_SECRET and its own registered redirect URI; unset, it reports disabled and shows no UI.	2026-07-26 17:53:34 -07:00
emi	3ec72ca75b	bookmarks: don't fabricate a local save when the server rejects it (#121)	2026-07-26 18:51:02 +00:00
emi	17cc14b48b	bookmarks: map + account UI for saved locations	2026-07-26 18:36:39 +00:00
emi	d6ead56971	bookmarks: map + account UI for saved locations	2026-07-26 18:36:34 +00:00
emi	4e1c4a4197	bookmarks: map + account UI for saved locations	2026-07-26 18:36:31 +00:00
emi	8572c4aa6d	accounts: sign in with Discord, sharing the existing link callback (#115)	2026-07-26 18:16:55 +00:00
emi	5b7e30dad9	fix(frontend): Weekly view must always send an explicit date to /grade	2026-07-26 06:20:19 +00:00
emi	6df4968679	Frontend QA batch: date/TZ, https origin, date-422, VAPID rotation, trace-precip, partial-day gate (#70)	2026-07-24 23:13:36 +00:00
Emi Griffith	d6df04eab2	Subtree-merge thermograph-frontend (origin/main) into frontend/ ... git-subtree-dir: frontend git-subtree-mainline: a4be7066e5 git-subtree-split: 3a98146da4	2026-07-22 22:01:11 -07:00