dashboard: going to another node's dashboard without its login page in between

Going to another member's dashboard showed its login page for a moment: a browser
without a session there was sent from `/admin/dashboard` to `/login` (by
`auth::basic_auth`), which began a session with the token handed over and went on to
the dashboard.

Now the dashboard's page is served without authentication, as the login page is (it
holds nothing: what it shows it reads with the browser's session). Opened with a token
handed over, the page begins the session with it (`POST /auth/session`) before it reads
anything; without a session, `obtainTokens` goes to the login page, as the redirect
did. A request without credentials is refused at once rather than after the 1.5 s
that slow down guessing passwords: nothing is guessed there, and a page without a
session goes to the login page without waiting twice for it.

1 files changed, 5 insertions, 3 deletions

diff --git a/src/api/dashboard/mod.rs b/src/api/dashboard/mod.rs
index 3a50ca6..9cf88a1 100644
--- a/src/api/dashboard/mod.rs
+++ b/src/api/dashboard/mod.rs
@@ -498,7 +498,6 @@ pub(crate) fn router(state: AppState) -> Router<AppState> {
     // Its streams end when the node shuts down (`AppState::closing`).
     let closing = state.closing.subscribe();
     Router::new()
-        .route("/admin/dashboard", get(page_html))
         .route("/admin/dashboard/state", get(current_state))
         .route("/admin/dashboard/events", get(events))
         .route("/admin/dashboard/refresh", post(refresh))
@@ -701,8 +700,11 @@ pub(crate) async fn login_page() -> Response {
     guarded(LOGIN, POLICY.get_or_init(|| content_policy(LOGIN)))
 }
 
-/// `GET /admin/dashboard`: the page.
-async fn page_html() -> Response {
+/// `GET /admin/dashboard`: the page, without authentication, as the login page (it holds
+/// nothing; what it shows it reads with the browser's session, and without one it goes
+/// to `/login`). So a page opened from another member's comes up at once, beginning a
+/// session with the token handed over, with no login page in between.
+pub(crate) async fn page_html() -> Response {
     static POLICY: OnceLock<String> = OnceLock::new();
     let page = page().1.as_str();
     guarded(page, POLICY.get_or_init(|| content_policy(page)))