diff options
Diffstat (limited to 'src/api/cors.rs')
| -rw-r--r-- | src/api/cors.rs | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/src/api/cors.rs b/src/api/cors.rs index fc8270d..287daf1 100644 --- a/src/api/cors.rs +++ b/src/api/cors.rs @@ -1,6 +1,7 @@ //! Pages of other origins reading this node: the dashboards of other members, which a //! page subscribes to for their own links and messages (`/admin/dashboard/links/own`, -//! `/admin/dashboard/messages/own/events`, and one written out), refreshing its +//! `/admin/dashboard/messages/own/events`, and one written out) and figures +//! (`/admin/stats`, `/peers`), refreshing its //! token on any node (`/auth/refresh`, `/auth/whoami`). Only those endpoints, only for //! the origins of the dashboards the member list names and those of `--cors-origins`, //! and without credentials: a page sends its token itself (`Authorization: Bearer`), @@ -26,6 +27,8 @@ fn open(path: &str) -> bool { || matches!( path, "/admin/dashboard/links/own" + | "/admin/stats" + | "/peers" | "/admin/dashboard/links/own/events" | "/admin/dashboard/messages/own/events" | "/auth/refresh" @@ -145,6 +148,8 @@ mod tests { assert!(open("/admin/dashboard/links/own")); assert!(open("/admin/dashboard/messages/own/42")); assert!(!open("/admin/dashboard/messages/own/x")); + assert!(open("/admin/stats") && open("/peers")); + assert!(!open("/peers/continuum:00")); assert!(open("/auth/refresh")); assert!(!open("/auth/login")); assert!(!open("/store")); |