Passwords are encrypted with AES-256-GCM before being written to
users.json. The GET /api/users/:token endpoint no longer returns the
password field, so the settings form asks users to re-enter only when
changing it. Legacy plaintext passwords in users.json are decrypted
transparently and re-encrypted on next save.
Requires a new ENCRYPTION_KEY env var (64-char hex, 32 bytes).
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
Users visit the home page, enter their Nextcloud credentials and an admin
password, and receive a unique webhook URL for AudioPen. A bookmarkable
settings page (/?token=...) lets them update credentials later without
needing the admin password. New users.json entries are written at runtime
via POST/PUT API endpoints.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
Each user gets a unique secret token embedded in their webhook URL
(/webhook/:token). Credentials are loaded from users.json at startup
instead of environment variables, making it easy to add or remove users
without redeploying.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
nickandClaude Sonnet 4.6