aboutsummaryrefslogtreecommitdiffstats
path: root/src/api/dashboard
Commit message (Collapse)AuthorAgeFilesLines
* dashboard: hand over a token reading the member list onlytv3 days2-5/+5
| | | | | | | | | | | | | Review finding 8, second part: opening another member's dashboard handed it a token reading everything (READ_ALL). A member writes its own dashboard URL, so a malicious one received a read-everything token under the operator's identity: /admin/config, /admin/changes, /admin/log and the rest, on every node the user reaches. The token handed over now reads the member list only (READ_MEMBERS, as sent to subscribed nodes), which is enough to draw the map; the user logs in at the other dashboard to see more. With 1151 it lasts five minutes and isn't refreshed past them.
* dashboard: flashes below labelstv4 days1-3/+5
| | | | Flashes are drawn beneath the nodes' labels.
* dashboard: message flashestv4 days1-31/+93
| | | | | messages: off / dots / flash: a message expands at its own speed and leaves an afterglow fading out in the direction it went.
* dashboard: a token handed over to another member's dashboardtv4 days2-3/+32
| | | | | | | | Opening another member's dashboard passes a token reading only, for five minutes, in the URL's fragment; its login page begins a session with it. Tokens may be asked for with a shorter lifetime. Auth plan M3 (hand-off).
* access: members refused as a wholetv4 days1-3/+10
| | | | | | | | | With signatures required, a member whose own change broke a rule is refused as a whole: sent nothing, shown in /peers (refused), in stats (sync.refusedPeers) and on the dashboard, until a change of its is taken again or the epoch changes. Auth plan M6 (diverged standing).
* auth: the session cookie lets in reads onlytv4 days1-8/+14
| | | | | | | | The cookie lets in GET, HEAD and the session's own requests; anything changing something brings the token itself, which no page of another site or port can make a browser send. The dashboard's writes send it. Auth plan M3 (browsers).
* auth: a login page and browser sessionstv4 days3-4/+96
| | | | | | | | | GET /login without authentication: log in by password or with a token (from a login by key). POST/DELETE /auth/session keep the token as an HttpOnly, SameSite=Strict cookie; the dashboard sends a browser without a user there and renews the session while open. Auth plan M2/M3 (browsers).
* dashboard: subscriptions under patchestv4 days1-5/+17
| | | | | | | Subscribed nodes' data merged into the state as the page patches it, not overwritten by the next patch. Auth plan M3 (fix).
* dashboard: without LINKS; LINKS removedtv4 days3-219/+272
| | | | | | | | | The dashboard reads every member's links from the members themselves; LINKS and LINKS_REPLY, swarm::links and their wire tags go (wire version bumped). Nodes the browser can't reach are drawn from what the reachable ones measure. Auth plan M3.
* dashboard: clocks on the pagetv4 days3-143/+50
| | | | | | | | The page compares the clocks the reports on its map carry: this node's peers', and those of the nodes it subscribes to; the node no longer gathers them from LINKS (api/dashboard/clocks.rs goes). Auth plan M3 (preparing LINKS' removal).
* dashboard: the writers' trees as this node knows themtv4 days1-39/+5
| | | | | | | | The tree drawn is computed as every node computes its own part of it: from the member list, and whom it and its neighbours reach, as they told it; no longer from the links members report over LINKS. Auth plan M3 (preparing LINKS' removal).
* dashboard: subscribed nodes' messages in the consoletv4 days2-71/+136
| | | | | | | Each tick's messages of a subscribed node, listed in the console with this node's own, from its own stream. Auth plan M3 (live data from every reachable node).
* dashboard: subscribed nodes' messages as dotstv4 days2-59/+163
| | | | | | | The page reads a subscribed node's message counts from it too, and draws them as dots on the map, as this node's own. Auth plan M3 (live data from every reachable node).
* dashboard: subscriptionstv4 days1-7/+218
| | | | | | | | Double-click a node to subscribe: the page reads its own links from it directly with a narrowed token (reading the member list only), drawn over what this node knows; kept per swarm in the browser. Auth plan M3.
* dashboard: own links over the API, and CORStv4 days1-0/+54
| | | | | | | | | GET /admin/dashboard/links/own and its event stream: a node's own links, as LINKS_REPLY carried them, for other members' dashboards with a token. CORS for the members' dashboard origins and --cors-origins, without credentials. Auth plan M3.
* dashboard: what its user may readtv4 days1-3/+69
| | | | | | | The dashboard's document box is read through the store, as its user may, and the page is told only of changes where its user may read. Auth plan M1 (the dashboard).
* dashboard: remake with golden count down halostv5 days1-32/+55
|
* dashboard: polish remake ringstv5 days1-13/+42
|
* dashboard: remake switch delaytv5 days1-3/+13
|
* dashboard: figures root in titletv5 days1-14/+23
|
* dashboard: document root in titletv5 days1-5/+18
|
* dashboard: drop neighbour columntv5 days1-4/+9
|
* dashboard: remaketv5 days1-2/+164
|
* dashboard: rates without linkstv5 days1-27/+84
|
* dashboard: browser checkstv6 days2-0/+114
|
* dashboard: snapshot lazytv6 days1-18/+47
|
* dashboard: layout time boundedtv6 days1-5/+16
|
* round trips in treestv7 days1-10/+20
|
* dashboard: neaten up peers boxtv7 days1-5/+12
|
* dashboard: human-friendly figurestv7 days1-5/+48
|
* dashboard: add epoch switch indicatortv7 days2-1/+44
|
* dashboard: map remake votestv7 days2-11/+93
|
* dashboard: swarm-wide epoch shinetv7 days2-11/+25
|
* dashboard: let evolving nodes shinetv7 days1-1/+44
|
* dashboard: unpin nodes don't move on static graphtv7 days1-12/+10
|
* dashboard: don't reset map after resizetv7 days1-10/+16
|
* dashboard: don't update tooltipstv7 days1-7/+66
|
* dashboard: make via column shortertv7 days1-1/+3
|
* dashboard: ignore traffic while suspendedtv7 days1-1/+10
|
* time blob messagestv7 days1-1/+1
|
* dashboard: hop delaystv7 days1-3/+35
|
* dashboard: show reach settv9 days1-2/+23
|
* dashboard: show writer treestv9 days2-0/+119
|
* replace eager links by treestv9 days3-39/+1
|
* dashboard: show eager links on the maptv9 days3-1/+39
|
* dashboard: neater graph title & legendtv9 days1-17/+37
|
* dashboard: legend doesn't interfere with graphtv9 days1-3/+13
|
* dashboard: add console clear buttontv9 days1-1/+13
|
* dashboard: indicate console followingtv9 days1-1/+16
|
* dashboard: pass state to next dashboardtv9 days1-5/+95
|