sales-trainer/docs/engineering-log/2026-08-07-auth-gitea.md

2026-08-07 — Username-based login + first-time admin setup + Gitea push

Summary

Changed the account model to username-based login (was email-as-id), added mandatory first-time admin setup (set email + change password), pushed the repo to Gitea.

Changes

1. User id = username (was email). Email is now a separate optional field with uniqueness.
   • UserStore.create_user(username, email=None, ...); login via username; JWT sub = username.
   • Admin user-creation uses username (email fallback kept for compatibility).
2. Default admin: admin / 1234, with must_setup=True.
3. Forced first-time setup: after login with the default creds, the frontend router guards and sends the user to /setup — set email + new password (+ confirm), then must_setup clears.
   • Backend: new POST /api/auth/setup (complete_setup sets email + password, clears flag).
   • Login response now includes must_setup; me includes it too.
   • Frontend: Login.vue uses username, Setup.vue (new), router guard, auth.finishSetup.
4. Docs: README + HANDOFF + build-out log updated to admin/1234 + setup flow.

Verification

• Added test_setup.py (admin/1234 → must_setup → set email+password → old pw invalid, new pw works, admin can use app). ALL PASS.
• Adapted m0/m1/routes/security/e2e to username creds. All 6 suites PASS.
• Frontend npm run build ok. Live server: admin/1234 login returns must_setup=true, SPA served at http://localhost:5001.

Push

• Remote added: origin = https://git.moreminimore.com/kunthawat/sales-trainer.git (GITEA_TOKEN via env, not committed). Pushed main → eadf4f7..e8a95bf.

Next (needs user for live model, no blocker here)

• Set LLM_API_KEY (+ provider) to enable analyze/persona/chat live path.
• Validate Docker build on EasyPanel.