diff options
| author | tv <tv@krebsco.de> | 2026-11-07 22:35:09 +0100 |
|---|---|---|
| committer | tv <tv@krebsco.de> | 2026-11-07 22:35:09 +0100 |
| commit | 1458ea92a41788a0f33e86e621817613f46055eb (patch) | |
| tree | 8cbe202657c5f9eb006b9612d9dfa0a4b829d589 /docs/access.md | |
| parent | aea80cf1bfa39f17dbbd0b4782a71fca81e09f74 (diff) | |
dashboard: own links over the API, and CORS
GET /admin/dashboard/links/own and its event stream: a node's own links,
as LINKS_REPLY carried them, for other members' dashboards with a
token. CORS for the members' dashboard origins and --cors-origins,
without credentials.
Auth plan M3.
Diffstat (limited to 'docs/access.md')
| -rw-r--r-- | docs/access.md | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/docs/access.md b/docs/access.md index e8c5455..71aebea 100644 --- a/docs/access.md +++ b/docs/access.md @@ -105,6 +105,12 @@ curl -H "Authorization: Bearer ct1.…" http://other-node:3000/store `GET /auth/whoami` says who a request's user is, how it proved it, and what it may do. +Pages of other origins, the dashboards of other members, may call a node with a token: +its own links (`/admin/dashboard/links/own`, and its events), `/auth/refresh` and +`/auth/whoami`, nothing else. A node allows the origins of the dashboards its member +list names (`--dashboard-url`) and those of `--cors-origins`; without credentials (no +cookie or password crosses origins: the page sends its token). + ## Managing users Through `/admin/users` ([`openapi.yaml`](openapi.yaml), Users): looking needs `read` on |