- Python 67.9%
- TypeScript 20.5%
- Vue 11.4%
2452ea6ad9
Some checks failed
## What does this PR do? Decouples the `Users` ORM model from all auth-owned tables, so `users/users/models.py` no longer imports or references any `auth.*` model. This completes the data-model side of the auth import-boundary work (the import-linter contracts were already in place; the ORM relationships were the remaining coupling). **Model changes** - Removes all 10 `Users` → auth-table relationships (`users_sessions`, `password_reset_tokens`, `sign_up_tokens`, `oauth_states`, `mfa_backup_codes`, `auth_mfa`, `users_api_keys`, `user_identity_providers`, `idp_link_tokens`, `local_credential`) and the `mfa_enabled` computed property. - Removes the matching auth-side `users` back-references from the 10 auth models. - `users/users/models.py` now has **zero** `auth.*` imports. **Cascade deletes** are preserved at the database level, every auth table's `user_id` FK already declares `ondelete="CASCADE"` (or `SET NULL`), so deleting a `Users` row still removes the dependent auth rows without an ORM relationship cascade. No schema/migration change is required. **`mfa_enabled` serialization** moves to the existing `IdentityService` router-enrichment pattern, the same seam already used by `external_auth_count` and `has_local_password`: - New batch lookup `IdentityService.get_mfa_enabled_for_users` (→ `mfa_workflow` → `auth.mfa.crud`) enriches the users list and `edit_user`; `get_mfa_status` enriches `/profile` (`/me`). - Defaults to `False` on the simple GET-by-id/username/email lookups, consistent with the existing `external_auth_count` behaviour. **MFA gates** in `auth.mfa.service` (setup/enable/disable) and `mfa_workflow.generate_backup_codes` now derive state from `is_mfa_enabled_for_user(...)` instead of the removed `Users.mfa_enabled` property. **Docs**: `docs/developer-guide/auth-boundary.md` "Known Structural Debt" → removed section about this decoupling work. ## Type of change - [x] Refactor / code quality - [x] Documentation (`auth-boundary.md` updated) ## Checklist - [x] This PR is focused on a single concern (decoupling the `Users` model from auth tables) - [ ] An issue was opened and acknowledged before writing this code — not opened (see *Related issue*) - [ ] New feature during freeze — N/A (refactor) - [ ] The PR is under ~300 lines changed — ~485 changed lines (+179 / −306), a net reduction; kept as one PR because it is a single cohesive concern - [x] Tests have been added or updated where applicable - [x] Documentation has been updated where applicable - [x] Commit messages follow Conventional Commits format Co-authored-by: hugobatista <hugobatista@noreply.codeberg.org> Reviewed-on: https://codeberg.org/endurain-project/endurain/pulls/794 |
||
|---|---|---|
| .forgejo | ||
| .github | ||
| aux_scripts | ||
| backend | ||
| docker | ||
| docs | ||
| frontend | ||
| logo | ||
| .dockerignore | ||
| .env.example | ||
| .gitignore | ||
| CODE_OF_CONDUCT.md | ||
| CONTRIBUTING.md | ||
| docker-compose.yml-multiple-backends.example | ||
| docker-compose.yml.example | ||
| docker-compose.yml.secrets.example | ||
| LICENSE | ||
| mkdocs.yml | ||
| README.md | ||
| renovate.json | ||
| ROADMAP.md | ||
| screenshot_01.png | ||
| SECURITY.md | ||
| TRADEMARK.md | ||
Note
GitHub Mirror - If you are viewing this on GitHub, please be aware that this repository is a read-only mirror. Issues, pull requests, and all project activity are tracked on Codeberg: https://codeberg.org/endurain-project/endurain
Note
Endurain is on a temporary feature freeze - The project is not paused. The focus is shifting from new features to strengthening the foundations. More details here
Endurain
A self-hosted fitness tracking service
Visit Endurain's Mastodon profile and Discord server.
🚀 Try the Demo
Experience Endurain without installation:
Demo URL: https://demo.endurain.com
- Username:
admin - Password:
admin - Reset Schedule: Daily at midnight (Europe/Lisbon timezone)
⚠️ Note: The demo environment resets every day. Do not store important data.
Table of Contents
- Endurain documentation
- What is Endurain?
- Endurain screenshots
- Sponsors
- Contributing
- Help Translate
- License
What is Endurain?
Endurain is a self-hosted fitness tracking service designed to give users full control over their data and hosting environment. It's similar to Strava but focused on privacy and customization. Built with:
- Frontend: Vue.js 3 with TypeScript, Tailwind CSS and shadcn-vue components, with Pinia and TanStack Query for state management
- Backend: Python FastAPI, Alembic, SQLAlchemy, Apprise, stravalib and python-garminconnect for Strava and Garmin Connect integration, gpxpy, tcxreader and fitdecode for .gpx, .tcx and .fit file import respectively
- Database: PostgreSQL for efficient data management
- Observability: Jaeger for basic tracing and monitoring
- Integrations: Supports Strava and Garmin Connect. Manual upload of activities using .gpx, .tcx and .fit files are also supported
To deploy Endurain, a Docker image is available, and a comprehensive example can be found in the "docker-compose.yml.example" file provided. Configuration is facilitated through environment variables, ensuring flexibility and ease of customization.
For more information please see the Endurain's documentation.
Sponsors
A huge thank you to the project sponsors! Your support helps keep this project going.
Support Endurain's development on:
Contributing
Contributions are welcomed! Please open an issue to discuss any changes or improvements before submitting a PR. Check out the Contributing Guidelines for more details.
Help Translate
Endurain has multi-language support, and you can help translate it into more languages via Codeberg Translate.
License
This project is licensed under the AGPL-3.0 License - see the LICENSE file for details.
Trademark Notice
Endurain® is a trademark of João Vitória Silva.
You are welcome to self-host Endurain and use the name and logo, including for personal, educational, research, or community (non-commercial) use.
Commercial use of the Endurain name or logos (such as offering paid hosting, products, or services) is not permitted without prior written permission.
See TRADEMARK.md for full details.