Subjects can name students or describe their situation (FERPA). The
closed feed and unassigned queries no longer request subject, the
returned objects never include it, and feed cards show the ticket
number instead. SECURITY.md, NOTES.md and the README are updated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
docs/SECURITY.md covers the layers of protection, what is stored, third
parties, limits and open items to investigate. SESSION.md moves to docs/
and is rewritten as the handoff for removing ticket subjects next.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Any Zoho account can approve the client, and an outside account got a
session that returned the .env site, group and technician names.
ALLOWED_EMAIL_DOMAINS is now required: the callback refuses other
domains and revokes their token, and every API call re-checks it so
older cookies stop working. /api/names also makes the caller's token
read from SDP before returning the shared names.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The per-user sign-in was tested live on bare metal behind NPM: Zoho
sign-in, SDP data, Sign out and the IP access list all work. Token
renewal and the first Docker deploy are still to check.
- README: section on testing on the server without Docker (Gitea holds
port 3000, NPM runs in Docker so forward to its network gateway, keep
PORT out of the production .env), plus Cloudflare proxy and access
list notes. The screenshots are removed until they're retaken.
- NOTES: deployment gotchas from the test run.
- ROADMAP and SESSION: what's verified, what's left, new resume prompt.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
README covers the Server-based Zoho client, the new .env settings,
deployment (image, compose, Nginx Proxy Manager), signing in and the
security model. NOTES records the Zoho OAuth gotchas and the decisions
behind the rebuild. ROADMAP describes the current architecture and the
planned per-browser settings panel. CLAUDE.md and SESSION.md are
brought up to date.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
