From b2c5096744c99453856f7281251b3f0cb4b9baae Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 9 Nov 2026 05:22:14 +0000 Subject: dashboard: a subscribed node's message written out, read from it when shown MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A subscribed node's messages come without being written out (their stream leaves the text out: up to 8 KiB each, 500 at a time), so the figures box said only when, both ends, type and size of one. Now the node answers for one message by its number, `GET /admin/dashboard/messages/own/{seq}` (`{"text": …}`, `404` once it isn't kept), which pages of other origins may call as they do its streams (`cors::open`), and the page reads it when the message is shown, with its narrow token, and keeps it on the message. Where it can't be read, the box says why. --- docs/access.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'docs/access.md') diff --git a/docs/access.md b/docs/access.md index a4c5375..38ae180 100644 --- a/docs/access.md +++ b/docs/access.md @@ -172,7 +172,8 @@ it may do. Pages of other origins, the dashboards of other members, may call a node with a token: its own links (`/admin/dashboard/links/own`, and its events) and messages -(`/admin/dashboard/messages/own/events`), `/auth/refresh` and `/auth/whoami`, nothing +(`/admin/dashboard/messages/own/events`, and one written out, +`/admin/dashboard/messages/own/{seq}`), `/auth/refresh` and `/auth/whoami`, nothing else. A node allows the origins of the dashboards its member list names (`--dashboard-url`) and those of `--cors-origins`; without credentials (no cookie or password crosses origins: the page sends its token). -- cgit v1.3.1