Bound a panel credential to its own widgets, and let one screen be re-paired

Three things a paired wall panel needed.

The scope check now walks the panel's widgets instead of allowing the
`/messages/` prefix wholesale: a screen may publish what its own controls and
querying charts point at, read the history of what its tiles draw, and nothing
else — the catalogue of every message in the installation included. The same
walk that already bounds its socket, so both surfaces agree.

Pending pairing codes moved out of the per-process dictionary into Redis, keyed
per code with the code's own TTL and indexed in a zset so the fifty-code cap
means the same thing to every worker. Without a Redis there is one process by
definition, and the dictionary stays.

And a per-panel nonce in the token, bumped by `POST /panels/{id}/unpair`: that
refuses the screen hanging there without touching the panel, its dashboards or
their arrangement. A save cannot write the nonce back, so a stale client cannot
undo a revocation. Only for a credential this installation signed — one the
portal minted carries no nonce and is revoked at the hub.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tULRZJUkZsw7rMJ3h4xvu

This commit is contained in:

stroblme

2026-08-22 11:57:37 +02:00

co-authored by

Claude Opus 5

parent 16ba11fb07

commit 6d84316ce5

7 changed files with 504 additions and 67 deletions

									
										docs/code/api.md
									
		+1
		
												View File
												
				@@ -146,6 +146,7 @@ code normally reaches these through `fluksio.save_artifact` /

				| `GET` `PUT` | `/panels/` | which device shows which dashboards |

				| `POST` | `/panels/pair` | start a pairing |

				| `GET` | `/panels/pair/{code}` | what is holding a code |

				| `POST` | `/panels/{id}/unpair` | drop this panel's credential, keep the panel |

				## Secrets, modules, alerts