update: link to authentik to change password if needed

src/config.js

@@ -42,6 +42,11 @@ module.exports = {
     process.env.POST_LOGOUT_REDIRECT_URI ||
     (process.env.OIDC_REDIRECT_URI ? new URL('/', process.env.OIDC_REDIRECT_URI).href : undefined),
   adminGroupName: process.env.ADMIN_GROUP_NAME || 'octane-admins',
+  // Optional: public URL of the Authentik instance (e.g. https://auth.dandrove.com),
+  // used only to show users a link to manage their own account/password.
+  // Distinct from AUTHENTIK_ISSUER_URL, which is often an internal/Docker
+  // address not reachable from a user's browser. Hidden from the UI if unset.
+  authentikPublicUrl: process.env.AUTHENTIK_PUBLIC_URL || null,
   // All optional: the "add a song" autocomplete works with none of these set
   // (title/artist suggestions come from Apple's free, key-less iTunes Search
   // API). Without Spotify/YouTube credentials, the matching links are just

src/routes/users.js

@@ -1,14 +1,28 @@
 const express = require('express');
 const usersRepo = require('../repositories/usersRepo');
+const config = require('../config');
 const asyncHandler = require('../lib/asyncHandler');
 
 const router = express.Router();
 
+function authentikAccountUrl() {
+  if (!config.authentikPublicUrl) return null;
+  return new URL('/if/user/', config.authentikPublicUrl).href;
+}
+
 router.get(
   '/me',
   asyncHandler(async (req, res) => {
     const { id, name, username, email, avatar_url, is_admin } = req.user;
-    res.json({ id, name, username, email, avatarUrl: avatar_url, isAdmin: is_admin });
+    res.json({
+      id,
+      name,
+      username,
+      email,
+      avatarUrl: avatar_url,
+      isAdmin: is_admin,
+      authentikAccountUrl: authentikAccountUrl(),
+    });
   })
 );
 
@@ -27,6 +41,7 @@ router.get(
       isAdmin: is_admin,
       createdAt: created_at,
       stats,
+      authentikAccountUrl: authentikAccountUrl(),
     });
   })
 );