Add random 4-digit TV token per child for obfuscated TV URLs

Each child is assigned a unique permanent tv_token on creation. The TV
dashboard URL (/tv/:tvToken) and WebSocket (/ws/:tvToken) now use this
token instead of the internal DB ID. Existing children are backfilled
on startup. README updated to reflect the change.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
This commit is contained in:
derekcandClaude Sonnet 4.6 committed 2026-03-10 22:53:26 -07:00
1 parent 4bd9218bf5
commit 68a5e9cb4f
7 files changed
+52 -12

No files matched your search

+1
View File
@@ -16,6 +16,7 @@ class Child(TimestampMixin, Base):
color: Mapped[str] = mapped_column(String(7), default="#4F46E5") # hex color for UI
strikes: Mapped[int] = mapped_column(Integer, default=0, nullable=False)
strikes_last_reset: Mapped[Optional[date]] = mapped_column(Date, nullable=True, default=None)
tv_token: Mapped[Optional[int]] = mapped_column(Integer, nullable=True, unique=True)
user: Mapped["User"] = relationship("User", back_populates="children") # noqa: F821
daily_sessions: Mapped[list["DailySession"]] = relationship( # noqa: F821