diff options
| author | tv <tv@krebsco.de> | 2026-11-09 05:36:38 +0000 |
|---|---|---|
| committer | tv <tv@krebsco.de> | 2026-11-09 06:42:57 +0100 |
| commit | 8a7df0caa51fc1b01e2a744c9e48dd3a1af39296 (patch) | |
| tree | 6a9c715e840d90171a162f4c9f4300dd8eb69838 /docs/access.md | |
| parent | b2c5096744c99453856f7281251b3f0cb4b9baae (diff) | |
dashboard: a subscribed node's own figures when it is in focus
A node in focus showed this node's `/peers` entry for it and the links it reports:
what this node knows of it, never what it says of itself, though the page subscribes to
it. Now a subscribed node in focus shows its own figures first (`Node:`), as this
node's are (its `/admin/stats`), then this node's entry for it (`as this node sees it`)
and its links, each a branch. A link in focus shows each end's paths to the other as
that end has them: this node's, and a subscribed node's from its `/peers`.
The page reads them from the node every 2 s while it is in focus (`readFigures`,
`figuresOf`), with its narrow token, which may look at a node as any user with a
capability may; pages of other origins may now call `/admin/stats` and `/peers`
(`cors::open`), as they do a node's links and messages. Where they can't be read, the
box says why.
Diffstat (limited to 'docs/access.md')
| -rw-r--r-- | docs/access.md | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/docs/access.md b/docs/access.md index 38ae180..50c0265 100644 --- a/docs/access.md +++ b/docs/access.md @@ -173,7 +173,8 @@ it may do. Pages of other origins, the dashboards of other members, may call a node with a token: its own links (`/admin/dashboard/links/own`, and its events) and messages (`/admin/dashboard/messages/own/events`, and one written out, -`/admin/dashboard/messages/own/{seq}`), `/auth/refresh` and `/auth/whoami`, nothing +`/admin/dashboard/messages/own/{seq}`), its figures and peers (`/admin/stats`, +`/peers`), `/auth/refresh` and `/auth/whoami`, nothing else. A node allows the origins of the dashboards its member list names (`--dashboard-url`) and those of `--cors-origins`; without credentials (no cookie or password crosses origins: the page sends its token). |