Migrate to Postgresql for better network handling. Add more user functionality.

app/models/user.rb

@@ -6,6 +6,10 @@ class User < ApplicationRecord
 
   enum :role, { admin: 0, user: 1, viewer: 2 }, default: :user
 
+  generates_token_for :password_reset, expires_in: 1.hour do
+    updated_at
+  end
+
   validates :email_address, presence: true, uniqueness: true, format: { with: URI::MailTo::EMAIL_REGEXP }
   validates :role, presence: true
 
@@ -18,13 +22,18 @@ class User < ApplicationRecord
 
     user = find_or_initialize_by(email_address: email)
 
-    # Map OIDC groups to role
+    # Map OIDC groups to role for new users or update existing user's role
     if auth_hash.dig('extra', 'raw_info', 'groups')
       user.role = map_oidc_groups_to_role(auth_hash.dig('extra', 'raw_info', 'groups'))
     end
 
-    # Don't override password for OIDC users
-    user.save!(validate: false) if user.new_record?
+    # For OIDC users, set a random password if they don't have one
+    if user.new_record? && !user.password_digest?
+      user.password = SecureRandom.hex(32) # OIDC users won't use this
+    end
+
+    # Save the user (skip password validation for OIDC users)
+    user.save!(validate: false) if user.changed?
     user
   end