diff options
| author | tv <tv@krebsco.de> | 2026-11-09 05:22:14 +0000 |
|---|---|---|
| committer | tv <tv@krebsco.de> | 2026-11-09 06:30:44 +0100 |
| commit | b2c5096744c99453856f7281251b3f0cb4b9baae (patch) | |
| tree | cf1ff79be48513eda4b901c7197b452c557547d7 /docs/access.md | |
| parent | d7e3d9f8310aa40903f43272fbb30f37a1f68c2b (diff) | |
dashboard: a subscribed node's message written out, read from it when shown
A subscribed node's messages come without being written out (their stream leaves the
text out: up to 8 KiB each, 500 at a time), so the figures box said only when, both
ends, type and size of one. Now the node answers for one message by its number,
`GET /admin/dashboard/messages/own/{seq}` (`{"text": …}`, `404` once it isn't kept),
which pages of other origins may call as they do its streams (`cors::open`), and the
page reads it when the message is shown, with its narrow token, and keeps it on the
message. Where it can't be read, the box says why.
Diffstat (limited to 'docs/access.md')
| -rw-r--r-- | docs/access.md | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/docs/access.md b/docs/access.md index a4c5375..38ae180 100644 --- a/docs/access.md +++ b/docs/access.md @@ -172,7 +172,8 @@ it may do. Pages of other origins, the dashboards of other members, may call a node with a token: its own links (`/admin/dashboard/links/own`, and its events) and messages -(`/admin/dashboard/messages/own/events`), `/auth/refresh` and `/auth/whoami`, nothing +(`/admin/dashboard/messages/own/events`, and one written out, +`/admin/dashboard/messages/own/{seq}`), `/auth/refresh` and `/auth/whoami`, nothing else. A node allows the origins of the dashboards its member list names (`--dashboard-url`) and those of `--cors-origins`; without credentials (no cookie or password crosses origins: the page sends its token). |