diff options
| author | tv <tv@krebsco.de> | 2026-11-09 05:36:38 +0000 |
|---|---|---|
| committer | tv <tv@krebsco.de> | 2026-11-09 06:42:57 +0100 |
| commit | 8a7df0caa51fc1b01e2a744c9e48dd3a1af39296 (patch) | |
| tree | 6a9c715e840d90171a162f4c9f4300dd8eb69838 /src/api/cors.rs | |
| parent | b2c5096744c99453856f7281251b3f0cb4b9baae (diff) | |
dashboard: a subscribed node's own figures when it is in focus
A node in focus showed this node's `/peers` entry for it and the links it reports:
what this node knows of it, never what it says of itself, though the page subscribes to
it. Now a subscribed node in focus shows its own figures first (`Node:`), as this
node's are (its `/admin/stats`), then this node's entry for it (`as this node sees it`)
and its links, each a branch. A link in focus shows each end's paths to the other as
that end has them: this node's, and a subscribed node's from its `/peers`.
The page reads them from the node every 2 s while it is in focus (`readFigures`,
`figuresOf`), with its narrow token, which may look at a node as any user with a
capability may; pages of other origins may now call `/admin/stats` and `/peers`
(`cors::open`), as they do a node's links and messages. Where they can't be read, the
box says why.
Diffstat (limited to 'src/api/cors.rs')
| -rw-r--r-- | src/api/cors.rs | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/src/api/cors.rs b/src/api/cors.rs index fc8270d..287daf1 100644 --- a/src/api/cors.rs +++ b/src/api/cors.rs @@ -1,6 +1,7 @@ //! Pages of other origins reading this node: the dashboards of other members, which a //! page subscribes to for their own links and messages (`/admin/dashboard/links/own`, -//! `/admin/dashboard/messages/own/events`, and one written out), refreshing its +//! `/admin/dashboard/messages/own/events`, and one written out) and figures +//! (`/admin/stats`, `/peers`), refreshing its //! token on any node (`/auth/refresh`, `/auth/whoami`). Only those endpoints, only for //! the origins of the dashboards the member list names and those of `--cors-origins`, //! and without credentials: a page sends its token itself (`Authorization: Bearer`), @@ -26,6 +27,8 @@ fn open(path: &str) -> bool { || matches!( path, "/admin/dashboard/links/own" + | "/admin/stats" + | "/peers" | "/admin/dashboard/links/own/events" | "/admin/dashboard/messages/own/events" | "/auth/refresh" @@ -145,6 +148,8 @@ mod tests { assert!(open("/admin/dashboard/links/own")); assert!(open("/admin/dashboard/messages/own/42")); assert!(!open("/admin/dashboard/messages/own/x")); + assert!(open("/admin/stats") && open("/peers")); + assert!(!open("/peers/continuum:00")); assert!(open("/auth/refresh")); assert!(!open("/auth/login")); assert!(!open("/store")); |