Registration, invitations and sign-in

Registration

On obscenter.site, and on any install where registration is open, the sign-in page has a Registration button. You enter an email address, a password of at least eight characters, and your organisation's name, such as your company, team or project. You become the owner of a new, empty organisation and are signed in straight away. An address that already has an account is refused with "That address already has an account. Sign in — then you can create an organisation of your own from the menu.", and a link to sign in.

On obscenter.site, registering needs two boxes ticked: the terms of service and the privacy notice, and — expressly — the highlighted sections 7 to 19 of the terms. The account is not made without them. What you ticked, the version of the terms, the time and the address it came from are recorded, every version of the terms stays readable at its own address, and a copy of what you accepted is mailed to you.

On obscenter.site the new organisation has a 15-day free trial, with 1 server and any number of websites and mobile apps. It does not start at registration: the 15 days start when your first agent or tag reports, so you can set up applications, keys and invitations first. See Plans and limits.

A confirmation mail, "Welcome — confirm your address", carries a link that is valid for 48 hours. Until you click it, the dashboard answers most requests with "confirm your address first". You can ask for the mail again once a minute, up to five times a day.

The install's administrator controls registration under Settings → Organisations → Registration → Open registration. It is open by default, on self-hosted installs too. On a private install, close it once your own people have accounts. With it closed, the registration endpoint answers that registration is not open, and nobody new can sign up through Google either. Mail me when someone signs up tells the administrator about each new registration.

Invitations

An administrator invites people from Settings → Accounts → Invite by mail, with an email and a role: Admin, Member or Viewer. Teams can be included too. The mail's subject reads "[Obscenter] … invited you to …". The link is valid for seven days. Each address has one open invitation per organisation, and a new invitation replaces the old one. If the install could not send the mail, the administrator is given the link to pass on another way.

Following the link:

• A new address chooses a password and is in. The address counts as confirmed, because the invitation reached it.
• An existing account enters its own password, or is simply signed in already, and joins the organisation.
• Either way, the person lands in the organisation they were invited to.
• On obscenter.site, joining as an owner or admin means acting for the organisation, so the same two terms boxes as on registration are ticked first. A member or viewer joins under the organisation's agreement; the page says the terms and the privacy notice apply.
• A used or expired link says so. Ask for a new one.

Mail is sent through the install's email channel. See Email.

Accepting changed terms

On obscenter.site, the owners and admins of organisations — the people who act for them — are asked once to accept the terms expressly when that is needed: for accounts made before the two boxes existed, and when a change to the highlighted sections 7 to 19 would be less favourable to you, which binds only once accepted. The page shows the two boxes, Accept and Sign out, and nothing else of the dashboard until you accept; your agents and tags go on reporting meanwhile as before, and what they measured is there afterwards. The acceptance is recorded like a registration's and a copy is mailed to you. Members and viewers are not asked; the terms are linked from the account menu.

Sign in with Google

When the install has Google sign-in configured, the sign-in page shows Continue with Google.

• An account is matched by Google's stable account id first.
• With no link yet, an existing account is linked by its email address only if Google says that address is verified.
• An address with no account gets a new account and an organisation of its own, as long as registration is open.
• A blocked account is refused.

You can link or unlink Google yourself under Settings → Personal → Signing in. An account made through Google has no password until you set one there.

To configure it, the install's administrator creates an OAuth client in the Google Cloud console and opens Settings → Sign-ins → Sign in with Google. Enter the Client ID and Client secret, and paste the redirect address the card shows into the Google console. The redirect address is <PUBLIC_URL>/auth/google/callback. Instead of the card, you can set OBSCENTER_GOOGLE_CLIENT_ID and OBSCENTER_GOOGLE_CLIENT_SECRET in the server's environment. The secret is never sent back to a browser. The flow uses PKCE and a state check, and expires after ten minutes.

Sign in with your phone

On a shared or unfamiliar computer, choose Sign in with your phone. The screen shows a QR code. Scan it with a phone that is already signed in to Obscenter. The phone shows where the request comes from: the screen's address, country and browser. Approve it, and the screen is signed in to the same account. A code lives for two minutes. The code only names the request. A separate secret stays in the browser that asked, so a photograph of the screen is not enough to take over the session.

Sessions and passwords

A dashboard session lasts 30 days and is renewed while you use it, so people who use it daily stay signed in. On a self-hosted install, SESSION_DAYS sets the length. The session is a cookie that is HttpOnly, SameSite=Lax, and Secure over HTTPS. Its server-side twin survives restarts. Passwords need at least eight characters. Changing your own password needs the current one, and ends your other sessions.

Forgot your password

Under the sign-in button, Forgot your password? asks for your address. The answer is the same whether or not the address has an account; if it has one, a link to choose a new password is mailed to it.

• The link works for 60 minutes and once. Asking again replaces the earlier link, and the mail goes at most once a minute and five times a day per account.
• Choosing the new password signs you in and signs the account out everywhere else. It also confirms your address, because the link reached it.
• An account made with Google and no password can set its first password this way.
• The link is mailed through the install's email channel; an install that cannot send mail cannot send it either.

The install's administrator cannot reset their password by mail: that account opens every organisation, and a mailbox is a weaker key than the server. They get the same answer and no mail. On the server, in the install's directory, set it with node server/cli.js passwd <email> <new password>, which also ends every session of the account. Another administrator of the install can set it from Settings → Accounts too.

The sign-in book

Settings → Sign-ins records every attempt to get into the dashboard, accepted or refused, including names that do not exist. Each attempt is logged with its address, country, place, browser, operating system and method: password, Google, QR, invitation, registration, a password link or setup. The page shows:

• accepted and refused sign-ins over the period;
• Tried, no such account;
• Where from;
• Recent attempts, flagged when the place is new or when the sign-in came after several failures.

An organisation's admin sees their own members. The install's administrator sees everybody. Rows are kept for 180 days.

The brake

Failed passwords are slowed and then stopped, counted over a sliding 15 minutes:

• 8 failures for one account from one address stop that account from that address.
• 20 failures from one address stop that address.
• 40 failures on one account from anywhere stop the account. Addresses that signed in successfully in the last 90 days are exempt, so an attack does not lock the real owner out.

The answer is "too many failed attempts — wait fifteen minutes and try again". Every failed password also costs a one-second delay. The counters live in the database, so restarting the install does not reset them.

Blocks

From the sign-in book, an administrator can Block an account, with a reason. The block lasts 1 hour, 24 hours (the default), 7 days, 30 days, or until unblocked. A block ends the account's sessions at once. While it stands, its password, Google and QR sign-in, invitation acceptance, its personal agent key and its API keys are all refused. Unblock lifts it. Nobody can block themselves, or the last administrator who can still sign in.