Research verdict: upstream lfnovo/open-notebook has no multi-user / account model (native or partial). Confirmed against the live container image and the GitHub repo, 2026-10-20.
Auth is one shared secret (PasswordAuthMiddleware vs Bearer <OPEN_NOTEBOOK_PASSWORD>): no username, no signup, no OIDC/SSO/SAML/JWT anywhere.
SurrealDB has no user/account/owner/tenant table — every DEFINE TABLE is a domain object. Nothing to scope per-user by.
Its own docs: "one shared password, no user accounts"; "put an authenticating proxy in front." So the guard chain gates the door but cannot partition the workspace, and Authentik identity is never consumed.
Therefore this PR:
moves the homepage card from the user grid to the admin tier (one shared password = one shared workspace = an admin-side tool, not offered to users),
adds the single-tenant boundary + #712/#607 citation to the vault page,
fixes the card description (frank-zealot -> frank-archon),
updates the seam's incidental category=="user" pin to the new intentional "admin" (the attribute is consumer-visible: it decides which homepage page the card renders on).
Separately (host-only, not in this PR): OPEN_NOTEBOOK_PASSWORD rotated on the host. Verified — new token 200, old token 401, no token 401; unit active, container healthy; encryption key left unchanged so the stored model credentials survive. The deployer's secret seeder is idempotent (returns untouched when all four values are present), so a future deploy will not clobber the rotated password.
Research verdict: upstream lfnovo/open-notebook has **no multi-user / account model** (native or partial). Confirmed against the live container image and the GitHub repo, 2026-10-20.
- Auth is one shared secret (`PasswordAuthMiddleware` vs `Bearer <OPEN_NOTEBOOK_PASSWORD>`): no username, no signup, no OIDC/SSO/SAML/JWT anywhere.
- SurrealDB has **no user/account/owner/tenant table** — every `DEFINE TABLE` is a domain object. Nothing to scope per-user by.
- Multi-user **approved but unbuilt** (issue #712, "design phase, targeted post-v2"); OIDC request #607 **closed**.
- Its own docs: "one shared password, no user accounts"; "put an authenticating proxy in front." So the guard chain gates the door but cannot partition the workspace, and Authentik identity is never consumed.
Therefore this PR:
- moves the homepage card from the **user** grid to the **admin** tier (one shared password = one shared workspace = an admin-side tool, not offered to users),
- adds the single-tenant boundary + #712/#607 citation to the vault page,
- fixes the card description (`frank-zealot` -> `frank-archon`),
- updates the seam's incidental `category=="user"` pin to the new intentional `"admin"` (the attribute is consumer-visible: it decides which homepage page the card renders on).
Separately (host-only, not in this PR): `OPEN_NOTEBOOK_PASSWORD` rotated on the host. Verified — new token 200, old token 401, no token 401; unit active, container healthy; encryption key left unchanged so the stored model credentials survive. The deployer's secret seeder is idempotent (returns untouched when all four values are present), so a future deploy will not clobber the rotated password.
tests/run.sh: green (EXIT=0).
---
cwd: /home/blank/.omp/wt/wt-20261020-125416-6d1fc1f · session: 01a15b5c-ede9-7063-b05b-1ef94188b7c3
open-notebook has no user accounts upstream (PasswordAuthMiddleware = one
shared password; SurrealDB has no user/account/owner table — verified in the
running image). One shared password = one shared workspace; the guard chain
gates access but cannot partition data, and Authentik identity is never
consumed. Multi-user is approved-but-unbuilt upstream (#712, post-v2); OIDC
declined (#607). So move the homepage card from the user grid to the admin
tier and add the single-tenant boundary to the vault page. Fix the card's
stale 'frank-zealot' -> frank-archon. Update the seam's incidental category
pin to the new intentional value. Password rotated on the host (not repo).
dank
merged commit 854890a155 into main2026-10-20 17:44:45 -07:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Research verdict: upstream lfnovo/open-notebook has no multi-user / account model (native or partial). Confirmed against the live container image and the GitHub repo, 2026-10-20.
PasswordAuthMiddlewarevsBearer <OPEN_NOTEBOOK_PASSWORD>): no username, no signup, no OIDC/SSO/SAML/JWT anywhere.DEFINE TABLEis a domain object. Nothing to scope per-user by.Therefore this PR:
frank-zealot->frank-archon),category=="user"pin to the new intentional"admin"(the attribute is consumer-visible: it decides which homepage page the card renders on).Separately (host-only, not in this PR):
OPEN_NOTEBOOK_PASSWORDrotated on the host. Verified — new token 200, old token 401, no token 401; unit active, container healthy; encryption key left unchanged so the stored model credentials survive. The deployer's secret seeder is idempotent (returns untouched when all four values are present), so a future deploy will not clobber the rotated password.tests/run.sh: green (EXIT=0).
cwd: /home/blank/.omp/wt/wt-20261020-125416-6d1fc1f · session: 01a15b5c-ede9-7063-b05b-1ef94188b7c3