6bf219f50a
- preferred_locale and the request locale are normalised (comma lists, q-weights, region subtags, case) to pl or en by NormalizeMailLocale, so a raw Accept-Language such as en-GB,en;q=0.9 selects the -en templates - new golem15.user.mail.fallback_locale (default pl) is used when neither names a supported language; ResolveMailLocaleFor applies it, and Boot rejects any value other than pl or en - activate, reactivate and restore Polish templates get Polish subjects - no template, route or payload changes; MailTemplate and ResolveMailLocale keep their signatures
71 lines
2.9 KiB
YAML
71 lines
2.9 KiB
YAML
jwt:
|
|
secret: ""
|
|
ttl: 60
|
|
refresh_ttl: 20160
|
|
blacklist_grace: 0
|
|
leeway: 0
|
|
blacklist_sweep_interval: 10m
|
|
# On: POST /login, /register (when it signs the account in) and
|
|
# /activate-by-code set the HttpOnly session cookie from auth.cookie.* and
|
|
# leave token out of the body. A POST /refresh carried by that cookie
|
|
# rewrites it either way. Keep auth.cookie.name token or auth_token.
|
|
token_cookie: false
|
|
activation:
|
|
require_activation: true
|
|
activate_mode: auto
|
|
reset_ttl_minutes: 60
|
|
activation_ttl_hours: 72
|
|
mail:
|
|
# The language of this plugin's mails when neither the user's
|
|
# preferred_locale nor the request locale (the translate plugin's locale,
|
|
# else the Accept-Language header) names one the plugin has mail for (pl or
|
|
# en). pl keeps the unsuffixed Polish templates; an English-only site sets
|
|
# en (SUMMER_GOLEM15__USER__MAIL__FALLBACK_LOCALE=en). Any other value
|
|
# fails boot.
|
|
fallback_locale: pl
|
|
registration:
|
|
allow_registration: true
|
|
use_register_throttle: true
|
|
throttle:
|
|
attempt_limit: 5
|
|
suspension_minutes: 15
|
|
use_throttle: true
|
|
password:
|
|
bcrypt_cost: 10
|
|
min_length: 8
|
|
# false leaves POST /login, /forgot-password and /reset-password
|
|
# unregistered, so they 404 like any unknown path; /register and the other
|
|
# routes stay. Read at boot (a change needs a restart). Takes true or false.
|
|
public_routes: true
|
|
api_tokens:
|
|
prefix: usr_
|
|
privileged_groups:
|
|
- admin
|
|
# Cloudflare Turnstile on POST /login and /register. Empty (the default) adds
|
|
# nothing. "open" lets requests pass when Cloudflare is unreachable, "closed"
|
|
# refuses them. The turnstile:* middleware comes from the framework (summercms
|
|
# v0.3.0 and later); its secret is turnstile.secret (SUMMER_TURNSTILE__SECRET).
|
|
turnstile: ""
|
|
# The site this plugin's links point to (the account link page,
|
|
# <frontend_url><backend_links.page_path>#code=..., and the device
|
|
# authorization page of device_auth.auth_url). Empty falls back to app.url.
|
|
frontend_url: ""
|
|
device_auth:
|
|
# The page a new device shows as its QR code, where a signed-in user
|
|
# authorizes it. {frontend_url} is frontend_url (else app.url, no trailing
|
|
# slash), {short_code} the session's short code and {token} the device
|
|
# token. Keep {token} out of it: the device token is also the secret the
|
|
# device collects its session token with, and whoever sees the QR code or
|
|
# the page's URL could take the session.
|
|
auth_url: "{frontend_url}/device/scan/{short_code}"
|
|
# Minutes a device session can be authorized and handed over.
|
|
ttl_minutes: 5
|
|
backend_links:
|
|
# How long a link request an administrator starts on My account stays
|
|
# usable (a Go duration). The code is one-shot.
|
|
request_ttl: 10m
|
|
# The site page that confirms a link. My account sends the administrator
|
|
# to <frontend_url><page_path>#code=<code>; the code is in the fragment,
|
|
# which browsers never send to a server.
|
|
page_path: /link-admin
|