Backend:
- password hashing via hashlib.scrypt
- stateless HMAC-SHA256 tokens (7-day expiry)
- POST /api/auth/login, /api/auth/register (admin), /api/auth/reset-password
- admin user created from NAT20_ADMIN_USERNAME/PASSWORD on first startup
- users table, campaign_shares table, created_by on campaigns
- require_user dependency on all routes except auth
- campaign sharing: GET/POST/DELETE /api/campaigns/{id}/shares
Frontend:
- AuthContext: user/token state, login/logout, global fetch Auth header
- Login page, Users page (admin user management)
- route protection, sidebar user info/sign out
Docker/CI:
- split backend/Dockerfile into thin app-only image
- backend/Dockerfile.deps builds the heavy WhisperX/PyTorch base
- CI builds deps only when requirements.txt changes
- docker compose pull now fetches ~100KB app layer instead of 3.5GB
- Download full audio as Blob on mount so seeking is instant (no network range-requests)
- Remove readyState guard from playAt() that was silently blocking seek attempts
- Add disabled/ready state to SessionReel for reliable click-to-seek
- Generate 48kbps Opus playback file during extraction (~65MB for 3hrs vs 1.5GB lossless)
- Serve Opus first in audio endpoint, then original upload, then extracted WAV
- Delete original upload after successful transcription to reclaim storage
- Reorder extract_audio checks so retry works without the original file
- Fix Back links on Speakers and Notes pages to go to home
The audio endpoint was serving the extracted WAV (16kHz mono PCM)
which balloons to ~1GB for a 3-hour session. Browsers cannot seek
efficiently in such a large uncompressed file.
Now the endpoint serves the original uploaded file (m4a, mp3, opus, etc.)
— a compressed format the browser can seek via byte-range requests.
Falls back to the WAV if the original is missing.
- Campaigns: new table, CRUD API, React context + provider
- Sessions: scoped to campaigns, paths under campaigns/{id}/
- File browser: scoped per campaign, removed copy/paste/autoPlay
- Sidebar: campaign selector dropdown at top
- Transcribe: GPU model cached/released via job counter
- Jobs: status text updates dynamically in real-time
- Auto-redirect: blocked when summarize job is active
Dockerfile: split into whisperx-base and runtime stages so app-only
changes skip the 10min pip install on rebuild. Example compose updated.
Player recap: replace hardcoded 'story so far' prompt with selectable
styles (story/diary/bullets/custom) via dropdown in Setup and Settings.
Settings: add NAT20_ONBOARDING_COMPLETED env var; fix merge logic so
env vars properly override defaults (not just empty DB values).
