dashboard: a subscribed node's message written out, read from it when shown

A subscribed node's messages come without being written out (their stream leaves the
text out: up to 8 KiB each, 500 at a time), so the figures box said only when, both
ends, type and size of one. Now the node answers for one message by its number,
`GET /admin/dashboard/messages/own/{seq}` (`{"text": …}`, `404` once it isn't kept),
which pages of other origins may call as they do its streams (`cors::open`), and the
page reads it when the message is shown, with its narrow token, and keeps it on the
message. Where it can't be read, the box says why.

1 files changed, 16 insertions, 9 deletions

diff --git a/src/api/cors.rs b/src/api/cors.rs
index 406b7be..fc8270d 100644
--- a/src/api/cors.rs
+++ b/src/api/cors.rs
@@ -1,6 +1,6 @@
 //! Pages of other origins reading this node: the dashboards of other members, which a
 //! page subscribes to for their own links and messages (`/admin/dashboard/links/own`,
-//! `/admin/dashboard/messages/own/events`), refreshing its
+//! `/admin/dashboard/messages/own/events`, and one written out), refreshing its
 //! token on any node (`/auth/refresh`, `/auth/whoami`). Only those endpoints, only for
 //! the origins of the dashboards the member list names and those of `--cors-origins`,
 //! and without credentials: a page sends its token itself (`Authorization: Bearer`),
@@ -18,14 +18,19 @@ use crate::swarm::members;
 
 /// The endpoints other origins may call.
 fn open(path: &str) -> bool {
-    matches!(
-        path,
-        "/admin/dashboard/links/own"
-            | "/admin/dashboard/links/own/events"
-            | "/admin/dashboard/messages/own/events"
-            | "/auth/refresh"
-            | "/auth/whoami"
-    )
+    // A message written out (`/admin/dashboard/messages/own/{seq}`).
+    let message = path
+        .strip_prefix("/admin/dashboard/messages/own/")
+        .is_some_and(|seq| !seq.is_empty() && seq.bytes().all(|byte| byte.is_ascii_digit()));
+    message
+        || matches!(
+            path,
+            "/admin/dashboard/links/own"
+                | "/admin/dashboard/links/own/events"
+                | "/admin/dashboard/messages/own/events"
+                | "/auth/refresh"
+                | "/auth/whoami"
+        )
 }
 
 /// `url`'s origin (`scheme://host[:port]`), if it is a URL with one.
@@ -138,6 +143,8 @@ mod tests {
     #[test]
     fn only_some_endpoints() {
         assert!(open("/admin/dashboard/links/own"));
+        assert!(open("/admin/dashboard/messages/own/42"));
+        assert!(!open("/admin/dashboard/messages/own/x"));
         assert!(open("/auth/refresh"));
         assert!(!open("/auth/login"));
         assert!(!open("/store"));