Bookhoard/bookhoard
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 12 Wiki Activity

docs: Update documentation for role-based access control

Browse Source 
- Update README.md with admin system documentation
- Add admin setup instructions and role permissions
- Update API endpoint documentation with access requirements
- Update Bruno collection to reflect admin-only operations
- Document shared library concept and security model
- Add comprehensive admin setup guide
This commit is contained in:
john-okeefe
2026-01-26 16:56:35 -05:00
parent f8eaca1b08
commit 48b6796bcd
5 changed files with 104 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bruno/README.md
+23 -10
View File
@@ -17,18 +17,28 @@ This directory contains Bruno collection for testing the Bookmann API with compr
- **Login User**: POST /api/auth/login - Authenticate (email or username)
- **Get Profile**: GET /api/auth/profile - Get user info (requires token)
### Ebooks (Protected - JWT Required)
- **List Ebooks**: GET /api/ebooks - Paginated ebook list
- **Get Ebook**: GET /api/ebooks/:id - Single ebook details
- **Create Ebook**: POST /api/ebooks - Add new ebook
- **Update Ebook**: PUT /api/ebooks/:id - Modify ebook metadata
- **Delete Ebook**: DELETE /api/ebooks/:id - Remove ebook
### Folders (Admin Only)
- **Add Ebook Folder**: POST /api/auth/ebook-folders - Add folder for scanning (admin only)
- **Get Ebook Folders**: GET /api/auth/ebook-folders - List configured folders (admin only)
- **Delete Ebook Folder**: DELETE /api/auth/ebook-folders - Remove folder (admin only)
### Reading Progress (Protected - JWT Required)
### Ebooks (Mixed Access)
- **List Ebooks**: GET /api/ebooks - Paginated ebook list (all authenticated users)
- **Get Ebook**: GET /api/ebooks/:id - Single ebook details (all authenticated users)
- **Create Ebook**: POST /api/ebooks - Add new ebook (admin only)
- **Update Ebook**: PUT /api/ebooks/:id - Modify ebook metadata (admin only)
- **Delete Ebook**: DELETE /api/ebooks/:id - Remove ebook (admin only)
### Scanner (Admin Only)
- **Scan Ebooks**: POST /api/scanner/scan - Scan configured folders (admin only)
- **Start Scanner**: POST /api/scanner/start - Start real-time monitoring (admin only)
- **Stop Scanner**: POST /api/scanner/stop - Stop monitoring (admin only)
### Reading Progress (All Users)
- **Get Reading Progress**: GET /api/ebooks/:id/progress - User's progress
- **Update Reading Progress**: PUT /api/ebooks/:id/progress - Update progress
### Ratings (Protected - JWT Required)
### Ratings (All Users)
- **Get Ebook Rating**: GET /api/ebooks/:id/rating - User's rating for ebook (returns 0 if unrated)
- **Create/Update Rating**: POST /api/ebooks/:id/rating - Rate ebook (1-5 stars)
- **Delete Rating**: DELETE /api/ebooks/:id/rating - Remove user's rating
@@ -47,8 +57,11 @@ Each request includes:
- **Authentication Flow**: Register → Login → Use Bearer token for all other requests
- **JWT Tokens**: Valid for 24 hours, include in `Authorization: Bearer <token>` header
- **User Isolation**: Progress, ratings, and data are user-specific
- **Role System**: Two roles - 'admin' and 'user'. Admins can manage folders and ebooks, users can view/rate/track progress
- **Shared Library**: All users can view the complete ebook collection, but only admins can modify it
- **User Isolation**: Progress, ratings, and profile data are user-specific
- **Rating Behavior**: Get rating returns 0 when no rating exists (instead of 404)
- **Admin Setup**: First admin must be created by updating user role in database: `UPDATE users SET role = 'admin' WHERE email = 'admin@example.com';`
- **Variables**: Update `ebook_id` for testing specific ebooks
- **Security**: Passwords hashed with bcrypt, unique email/username constraints
- **Security**: Passwords hashed with bcrypt, unique email/username constraints, role-based access control
- **JSON**: All requests/responses use JSON format