diff options
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/access.md | 6 | ||||
| -rw-r--r-- | docs/example.toml | 6 | ||||
| -rw-r--r-- | docs/openapi.yaml | 35 |
3 files changed, 47 insertions, 0 deletions
diff --git a/docs/access.md b/docs/access.md index e8c5455..71aebea 100644 --- a/docs/access.md +++ b/docs/access.md @@ -105,6 +105,12 @@ curl -H "Authorization: Bearer ct1.…" http://other-node:3000/store `GET /auth/whoami` says who a request's user is, how it proved it, and what it may do. +Pages of other origins, the dashboards of other members, may call a node with a token: +its own links (`/admin/dashboard/links/own`, and its events), `/auth/refresh` and +`/auth/whoami`, nothing else. A node allows the origins of the dashboards its member +list names (`--dashboard-url`) and those of `--cors-origins`; without credentials (no +cookie or password crosses origins: the page sends its token). + ## Managing users Through `/admin/users` ([`openapi.yaml`](openapi.yaml), Users): looking needs `read` on diff --git a/docs/example.toml b/docs/example.toml index ab8237c..222db52 100644 --- a/docs/example.toml +++ b/docs/example.toml @@ -78,6 +78,12 @@ htpasswd = "/etc/continuum/htpasswd" # the login's end (session-lifetime). # token-lifetime = "12h" +# Origins (scheme://host[:port]) whose pages may read this node's own links and refresh +# tokens here, with a token (docs/access.md, Tokens): the dashboards of other members are +# allowed anyway, as the member list names them (dashboard-url). Without credentials: a +# page sends its token itself. +# cors-origins = ["https://dashboard.example.org"] + # How long after a login (POST /auth/login) its tokens may be refreshed; then the user # logs in again. # session-lifetime = "7d" diff --git a/docs/openapi.yaml b/docs/openapi.yaml index 64c5b9b..f8fb25d 100644 --- a/docs/openapi.yaml +++ b/docs/openapi.yaml @@ -1015,6 +1015,41 @@ paths: type: object required: [node, stats, peers, graph] additionalProperties: true + /admin/dashboard/links/own: + get: + tags: [Admin] + summary: This node's own links + description: | + As it measures them: its ID, its epoch, and each link (what the map draws). + Readable by pages of other members' dashboards, with a token (CORS: docs/access.md, Tokens). + responses: + '200': + description: The links. + content: + application/json: + schema: + type: object + properties: + node: { type: string } + epoch: { type: object } + links: { type: array, items: { type: object } } + '401': + $ref: '#/components/responses/Unauthorized' + + /admin/dashboard/links/own/events: + get: + tags: [Admin] + summary: This node's own links, as they change + description: Server-sent events, `links` with what `/admin/dashboard/links/own` answers at once and whenever it changed, `offline` when the node stops. Readable by pages of other members' dashboards, as that is. + responses: + '200': + description: The events. + content: + text/event-stream: + schema: { type: string } + '401': + $ref: '#/components/responses/Unauthorized' + /admin/dashboard/refresh: post: tags: [Admin] |