08491c0c9b
All checks were successful
Deploy / deploy (push) Successful in 27s
- system.html crashed with a 500 whenever SABnzbd history loaded: the trend() macro compared the formatted "avg_speed" string (e.g. "900 KB/s") against a number. Added a real numeric avg_speed_kbps field and pointed the macro at that instead. - Replaced "held"/"not held" wording with "in library"/"not in library" on Home and Discover. - Moved CLAUDE.md's Deployment/reverse-proxy and account-management sections into two on-demand skills (deploy-arr-summary, manage-accounts) so they only load when actually relevant, with a one-line pointer left in their place. - Updated PRODUCT.md's restructure note now that meridian-marquee has merged to main. - Dropped two stale/broken entries from settings.local.json's permission allowlist (a rule from a different machine/path, and one with a corrupted token). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NBw1QodG8ZMYHrGeQfqyDS
39 lines
2 KiB
Markdown
39 lines
2 KiB
Markdown
---
|
|
name: manage-accounts
|
|
description: Use when adding, removing, or changing dashboard login accounts for Arr Summary (Media Centre), or explaining the difference between its multi-user and legacy single-shared-password login modes.
|
|
---
|
|
|
|
Two modes, chosen by whether `settings.json` holds a non-empty `users` map:
|
|
|
|
- **Multi-user** (once any account exists): username + password, each
|
|
password stored as a salted pbkdf2 hash under `users` in `settings.json`.
|
|
`verify_credentials()` is the only entry point; `load_users()` re-reads
|
|
the file per check, so adding a user or changing a password is live
|
|
immediately in every gunicorn worker — no restart, unlike the API keys.
|
|
- **Legacy single shared password** (no accounts yet): the original
|
|
`LOGIN_PASSWORD` / `settings.json.login_password` path, username ignored.
|
|
This fallback exists so deploying multi-user support can't lock an
|
|
existing install out; the login page hides the username field entirely
|
|
until accounts exist.
|
|
|
|
Manage accounts with `manage_users.py`, which prompts for passwords
|
|
(never echoed, never a CLI argument, so they stay out of shell history)
|
|
and only ever writes hashes:
|
|
|
|
```bash
|
|
docker exec -it arr-summary python3 manage_users.py list
|
|
docker exec -it arr-summary python3 manage_users.py add <username>
|
|
docker exec -it arr-summary python3 manage_users.py passwd <username>
|
|
docker exec -it arr-summary python3 manage_users.py remove <username>
|
|
```
|
|
|
|
**Adding the first account switches the whole dashboard to per-user
|
|
logins and the shared password stops working** — verify you can sign in
|
|
as that user before closing the shell. `remove` refuses to delete the
|
|
last account for the same reason.
|
|
|
|
Users live in `settings.json` rather than an env var deliberately: a
|
|
pbkdf2 hash contains `$`, which docker compose interpolates when reading
|
|
`.env`. `PASSWORD_HASH_METHOD` is pinned to pbkdf2 rather than Werkzeug's
|
|
default scrypt, which needs a hashlib built against OpenSSL and is absent
|
|
on the macOS system Python.
|