4 Commits

Include renames

Author	SHA1	Message	Date
stroblmeandClaude Opus 5	335e9182af	Adopt the portal owner on attach, rather than demanding a re-enrolment ... An installation enrolled before per-user mapping has nobody mapped, and fail-closed means its owner is refused. Re-enrolling fixes it and can only be done from the machine's own network, which is the wrong thing to require of a machine whose only route in is the portal. The hub names the owner in the handshake now, and this takes it: if the enrolling account has no portal identity and nobody else holds that one, it is written once and every later attach is a no-op. A mapping somebody else holds is never moved - enrolment was told who that is, and this is only a repair. A failure to write one does not drop the link. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-21 12:07:43 +02:00
stroblmeandClaude Opus 5	81dad0a449	A portal session names a person, not whoever enrolled ... Remote access used to collapse every portal session onto the account that performed the enrolment. That was the only thing it could do while nothing here knew who was at the other end, and it is why letting a second person in meant handing them the first one's account. `user.portal_sub` is where a portal identity meets a local one: set for the enrolling superuser at enrolment, and for each person a superuser admits afterwards through Settings -> Remote access -> Add remote user. The code they type comes from the newcomer's own portal account, and it is redeemed against the hub with this installation's tunnel credential rather than with a portal session, so being let in is not itself the power to let others in. The account created is never a superuser, which closes the same door from this side. A proxy token now resolves through that mapping and nowhere else. An identity nobody mapped resolves to no user rather than falling back on the enroller, so deleting the local row under Admin -> Users is the whole of the revocation: it bites on a credential already in flight, and it does not wait on the portal being reachable to be told. Telling the portal is best effort for exactly that reason. The cost is stated where it lands, in DEPLOY.md: an installation enrolled before this has no mapping, so its owner reconnects once with a fresh code. Panels and the health summary still act as the enrolling account - neither of them is a person, and neither gained a way to name one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-21 11:34:01 +02:00
stroblmeandClaude Opus 5	1d6918d8df	Pair a wall panel through the portal ... A screen somewhere this installation is not reachable from asks the portal for a code instead, and the portal mints its credential — because a token signed here is one such a device could never present. Where it was minted changes nothing about what it may do. The panel gate moved off the branch that decodes a local panel token and onto whatever claims name a panel, so the portal's and this installation's are bounded by the same check against the same panel's dashboards. A token of that scope naming no panel is refused rather than left holding the account it borrows. The connector marks what arrives on its socket, since that is the only thing that makes it true, and the approval screen now names what is holding a code — approving adopts whatever answers, so it is worth a look first. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017F9RnYCJgASuBTcAjxmnsp	2026-08-20 23:42:58 +02:00
stroblmeandClaude Opus 5	b190897301	Optional remote access: dial out to a Fluksio portal ... An installation can be enrolled with a portal by redeeming a claim code, after which it holds one authenticated websocket open and answers proxied API calls over it. Requests are dispatched into this process's own ASGI app, so the HTTP trigger routes flows install at runtime are visible to it, and the live flow stream is bridged straight off the event bus. decode_token grows the third branch its docstring anticipated: tokens signed by the enrolled portal resolve to the local account that performed the enrolment, verified against a JWKS pinned at that moment. With no enrolment the branch raises immediately, so an offline installation is unchanged and untouched. Disconnecting deletes one file, which is the entire local revocation. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XtBzdDyLsmDaF1W7DLYtYM	2026-08-19 16:28:38 +02:00