4 Commits

Include renames

Author	SHA1	Message	Date
stroblmeandClaude Opus 5	fe7a98f292	Bound a panel credential where the route check cannot reach ... Three things the security pass on the portal pairing turned up. The first two were already true of a screen on the local network; what changed is that a panel credential is now presentable from the internet, which is what makes them worth closing rather than recording. The artifact endpoint authenticates for itself, because a worker's credential has to open it and that token is no use anywhere else. It resolved the caller without handing over the request, so the one credential that is scoped by route was judged by no route at all — a panel could read and write the store as whoever approved it. It passes the request it already holds now. The websocket has no route to judge either, and there the bound has to be on what is sent: a panel is given the values its own dashboards draw and nothing else — no node status, no logs, no shape of the graph. The keys stay in the message, emptied, because a screen on a wall runs the bundle it was paired with. `messages_for` reads that set off the published dashboards, and is the walk the `/messages/` allowlist has wanted for a while. And locality is no longer a header anyone can type. The marker the connector stamps is a value minted per process, so reaching this API directly cannot buy a device the credential meant for one that cannot reach it at all. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017F9RnYCJgASuBTcAjxmnsp	2026-08-21 00:09:18 +02:00
stroblmeandClaude Opus 5	1d6918d8df	Pair a wall panel through the portal ... A screen somewhere this installation is not reachable from asks the portal for a code instead, and the portal mints its credential — because a token signed here is one such a device could never present. Where it was minted changes nothing about what it may do. The panel gate moved off the branch that decodes a local panel token and onto whatever claims name a panel, so the portal's and this installation's are bounded by the same check against the same panel's dashboards. A token of that scope naming no panel is refused rather than left holding the account it borrows. The connector marks what arrives on its socket, since that is the only thing that makes it true, and the approval screen now names what is holding a code — approving adopts whatever answers, so it is worth a look first. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017F9RnYCJgASuBTcAjxmnsp	2026-08-20 23:42:58 +02:00
stroblmeandClaude Opus 5	43f606969a	Point the panel link at the installation, not at the browser's origin ... Both links out of the dashboard editor were built root-relative, so a portal serving the app under `/i/{id}` got a URL to itself: the hub has no route there and answers a bare 404. That is what a device link and "open what a wall panel sees" both landed on. They want different answers. The view link is for the person already looking, so it takes the router's basepath — `appPath` in `lib/portal` is the same prefix the router applies to every `Link`, for the places that step outside it. The device link is for a screen, which cannot go through the portal at all: the shell is served only to a portal session, and the credential that page carries is the portal's rather than the panel's. So the server now says where it answers, and `FRONTEND_HOST` is that answer — the same setting the password-reset links already use. Also fixes the panel branch in the query error handler, which compared a raw pathname and so never fired under a portal. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AHpLJHozysQXjsxAyU1WHj	2026-08-20 17:24:20 +02:00
stroblmeandClaude Opus 5	c0ff1cd5c5	Panels: per-device dashboard sets, paired by code ... A panel is one screen and the ordered set of whole dashboards it shows, so a hallway tablet and a workshop tablet carry different sets without either dashboard knowing about the other. More than one and the device draws a rail to switch between them — the same rail the editor puts on screen, because the wall has it and it takes room off the canvas. A screen has no keyboard, so it pairs rather than logs in: it shows a six-character code, somebody approves it against a panel from the dashboards overview, and the credential that mints reaches that panel's published dashboards and the message endpoints its widgets speak, and nothing else. Deleting the panel revokes it. Closes the per-device view and the kiosk credential; supersedes the multi-page/multi-section UI, since a page is now a dashboard of its own. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AHpLJHozysQXjsxAyU1WHj	2026-08-20 16:23:36 +02:00