aboutsummaryrefslogtreecommitdiffstats
path: root/src/api/dashboard/dashboard.html
Commit message (Collapse)AuthorAgeFilesLines
* dashboard: hand over a token reading the member list onlytv3 days1-4/+4
| | | | | | | | | | | | | Review finding 8, second part: opening another member's dashboard handed it a token reading everything (READ_ALL). A member writes its own dashboard URL, so a malicious one received a read-everything token under the operator's identity: /admin/config, /admin/changes, /admin/log and the rest, on every node the user reaches. The token handed over now reads the member list only (READ_MEMBERS, as sent to subscribed nodes), which is enough to draw the map; the user logs in at the other dashboard to see more. With 1151 it lasts five minutes and isn't refreshed past them.
* dashboard: flashes below labelstv4 days1-3/+5
| | | | Flashes are drawn beneath the nodes' labels.
* dashboard: message flashestv4 days1-31/+93
| | | | | messages: off / dots / flash: a message expands at its own speed and leaves an afterglow fading out in the direction it went.
* dashboard: a token handed over to another member's dashboardtv4 days1-3/+14
| | | | | | | | Opening another member's dashboard passes a token reading only, for five minutes, in the URL's fragment; its login page begins a session with it. Tokens may be asked for with a shorter lifetime. Auth plan M3 (hand-off).
* access: members refused as a wholetv4 days1-3/+10
| | | | | | | | | With signatures required, a member whose own change broke a rule is refused as a whole: sent nothing, shown in /peers (refused), in stats (sync.refusedPeers) and on the dashboard, until a change of its is taken again or the epoch changes. Auth plan M6 (diverged standing).
* auth: the session cookie lets in reads onlytv4 days1-8/+14
| | | | | | | | The cookie lets in GET, HEAD and the session's own requests; anything changing something brings the token itself, which no page of another site or port can make a browser send. The dashboard's writes send it. Auth plan M3 (browsers).
* auth: a login page and browser sessionstv4 days1-4/+7
| | | | | | | | | GET /login without authentication: log in by password or with a token (from a login by key). POST/DELETE /auth/session keep the token as an HttpOnly, SameSite=Strict cookie; the dashboard sends a browser without a user there and renews the session while open. Auth plan M2/M3 (browsers).
* dashboard: subscriptions under patchestv4 days1-5/+17
| | | | | | | Subscribed nodes' data merged into the state as the page patches it, not overwritten by the next patch. Auth plan M3 (fix).
* dashboard: without LINKS; LINKS removedtv4 days1-112/+31
| | | | | | | | | The dashboard reads every member's links from the members themselves; LINKS and LINKS_REPLY, swarm::links and their wire tags go (wire version bumped). Nodes the browser can't reach are drawn from what the reachable ones measure. Auth plan M3.
* dashboard: clocks on the pagetv4 days1-2/+49
| | | | | | | | The page compares the clocks the reports on its map carry: this node's peers', and those of the nodes it subscribes to; the node no longer gathers them from LINKS (api/dashboard/clocks.rs goes). Auth plan M3 (preparing LINKS' removal).
* dashboard: subscribed nodes' messages in the consoletv4 days1-45/+100
| | | | | | | Each tick's messages of a subscribed node, listed in the console with this node's own, from its own stream. Auth plan M3 (live data from every reachable node).
* dashboard: subscribed nodes' messages as dotstv4 days1-59/+115
| | | | | | | The page reads a subscribed node's message counts from it too, and draws them as dots on the map, as this node's own. Auth plan M3 (live data from every reachable node).
* dashboard: subscriptionstv4 days1-7/+218
| | | | | | | | Double-click a node to subscribe: the page reads its own links from it directly with a narrowed token (reading the member list only), drawn over what this node knows; kept per swarm in the browser. Auth plan M3.
* dashboard: remake with golden count down halostv5 days1-32/+55
|
* dashboard: polish remake ringstv5 days1-13/+42
|
* dashboard: remake switch delaytv5 days1-3/+13
|
* dashboard: figures root in titletv5 days1-14/+23
|
* dashboard: document root in titletv5 days1-5/+18
|
* dashboard: drop neighbour columntv5 days1-4/+9
|
* dashboard: remaketv5 days1-2/+164
|
* dashboard: rates without linkstv5 days1-27/+84
|
* dashboard: layout time boundedtv6 days1-5/+16
|
* dashboard: neaten up peers boxtv7 days1-5/+12
|
* dashboard: human-friendly figurestv7 days1-5/+48
|
* dashboard: add epoch switch indicatortv7 days1-1/+43
|
* dashboard: map remake votestv7 days1-9/+83
|
* dashboard: swarm-wide epoch shinetv7 days1-9/+16
|
* dashboard: let evolving nodes shinetv7 days1-1/+44
|
* dashboard: unpin nodes don't move on static graphtv7 days1-12/+10
|
* dashboard: don't reset map after resizetv7 days1-10/+16
|
* dashboard: don't update tooltipstv7 days1-7/+66
|
* dashboard: make via column shortertv7 days1-1/+3
|
* dashboard: ignore traffic while suspendedtv7 days1-1/+10
|
* time blob messagestv7 days1-1/+1
|
* dashboard: hop delaystv7 days1-3/+35
|
* dashboard: show reach settv9 days1-2/+23
|
* dashboard: show writer treestv9 days1-0/+72
|
* replace eager links by treestv9 days1-35/+1
|
* dashboard: show eager links on the maptv9 days1-1/+35
|
* dashboard: neater graph title & legendtv9 days1-17/+37
|
* dashboard: legend doesn't interfere with graphtv9 days1-3/+13
|
* dashboard: add console clear buttontv9 days1-1/+13
|
* dashboard: indicate console followingtv9 days1-1/+16
|
* dashboard: pass state to next dashboardtv9 days1-5/+95
|
* dashboard: double-click opens peer dashboardtv9 days1-6/+61
|
* dashboard: pin with middle buttontv9 days1-25/+18
|
* dashboard: shorten long figures titletv9 days1-0/+6
|
* dashboard: add B/stv9 days1-21/+44
|
* dashboard: add msg/stv9 days1-1/+53
|
* dashboard: message dot speed is configurabletv9 days1-16/+37
|