# Manyangles

Event photo collection for a wedding day — and for any gathering that needs
the same guest-upload, host-moderate, public-gallery loop.

Guests open a shareable event link, optionally add a name, email, and note,
and upload photos. Event people approve what appears in the gallery.
Originals stay full quality in S3-compatible object storage.

## Repository

```text
apps/
  web/       Public site, guest pages, dashboard, platform admin
  worker/    image variants, EXIF/GPS strip, HEIC conversion
packages/
  contracts/ shared Zod payloads
  database/  Drizzle schema, migrations, seed
  storage/  S3/Garage client, object keys, presign
  email/     Mailpit (dev) / Resend (prod) for auth and guest mail
```

## Quick start

Requirements: Bun 1.3+ and Docker.

```bash
cp .env.example .env
bun install
bun run docker:up
bun run db:migrate
bun run auth:seed
bun run db:seed
bun run dev
```

The app runs at `http://localhost:3000`. Garage S3 is at
`http://localhost:3900`. Mailpit is at `http://localhost:8027`.

- Public: `/` (listed events) and `/e/demo`
- Dashboard: `/dashboard`
- Platform: `/admin`

Example accounts (password `host`, admin password `admin`):

- `admin@example.com` — platform super-admin
- `host@example.com` / `partner@example.com` — event owners
- `manager@example.com` — event manager

## Authentik sign-in

Manyangles can use an Authentik OAuth2/OpenID Connect provider alongside email and
password authentication. In Authentik, create a confidential OAuth2/OpenID
provider and application with the `openid`, `profile`, and `email` scopes.

Add a strict redirect URI for each Manyangles deployment:

```text
https://photos.example.com/api/auth/oauth2/callback/authentik
```

For local development, use
`http://localhost:3000/api/auth/oauth2/callback/authentik`.

Set all three variables to enable the Authentik button:

```dotenv
AUTHENTIK_ISSUER=https://auth.example.com/application/o/manyangles/
AUTHENTIK_CLIENT_ID=your-client-id
AUTHENTIK_CLIENT_SECRET=your-client-secret
```

`AUTHENTIK_ISSUER` is the application issuer URL, not the Authentik root URL.
Manyangles discovers the authorization, token, user-info, and signing-key endpoints
from `<issuer>/.well-known/openid-configuration`. If none of these variables are
set, Authentik support stays disabled. A partial configuration fails at startup
instead of silently hiding a broken provider.