Feature: Single User Mode (--single-user flag) #76

Summary

Add a --single-user mode for personal/mobile deployments where only one user needs access to the pod.

Motivation

JSS is designed to be lightweight and run on mobile devices (Android/Termux). In many personal use cases:

• Only one person will use the server
• Registration should be disabled after initial setup
• Login friction should be minimized
• The server acts as a personal data store, not a multi-tenant service

Proposed Behavior

sandymount start --single-user
# or
jss start --single-user

First Run

1. Create default user pod at / or /me/ (configurable)
2. Generate WebID profile
3. Optionally prompt for username/password or generate credentials
4. Disable registration endpoint

Subsequent Runs

1. Skip registration UI entirely
2. Optional: Auto-login if running locally (localhost only)
3. Optional: Session persistence across restarts

Implementation Approach

Config Addition

// config.js
singleUser: false,
singleUserPath: '/',  // or '/me/'
singleUserAutoLogin: false,  // localhost auto-login

CLI Flags

--single-user          Enable single-user mode
--single-user-path     Pod path (default: /)
--auto-login           Auto-login on localhost (security consideration)

Server Changes

1. On startup with --single-user:

   • Check if user pod exists at configured path
   • If not, run first-time setup (create pod structure)
   • Disable /idp/register endpoint
   • Set openRegistrations: false in NodeInfo

2. Optional auto-login (localhost only):

   • If request from 127.0.0.1/localhost and no session
   • Auto-authenticate as the single user
   • Security: Only enable with explicit --auto-login flag

Files to Modify

• src/config.js - Add singleUser options
• src/server.js - Handle single-user initialization
• src/idp/index.js - Conditionally disable registration
• src/idp/interactions.js - Auto-login logic (optional)
• bin/jss.js - CLI flags

Security Considerations

• Auto-login should ONLY work for localhost connections
• Clear warning in logs when auto-login is enabled
• Single-user mode should still support proper authentication for remote access
• Consider generating a strong random password on first run and displaying it once

Related

• Sandymount mobile deployment use case
• --invite-only flag (partial solution)
• --no-idp flag (disables auth entirely, too extreme)

Acceptance Criteria

• --single-user creates pod on first run
• Registration disabled in single-user mode
• Existing auth still works for remote access
• Optional --auto-login for localhost convenience
• Documentation updated