From 8a6ed7cc711e797542a531091b3bdbc73e5f61e4 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 9 Nov 2026 02:24:51 +0000
Subject: dashboard: keys edited, the last removed with a password, failures
 kept

The credentials dialog listed a user's keys whole, to add one or
remove one but the last, and any failure replaced the dialog with the
error, the form lost.

* A key is shown short: its type, the first and last four characters
  of what tells it apart (an Ed25519 key's base64 after the part all of
  them share), its comment; the whole line in its tooltip.
* A key can be edited, its name and its line: saved under the name, a
  new name written first and the old one removed.
* A user with a password on this node (`--htpasswd`) may remove its
  last key: it logs in by the password. GET /auth/keys says so
  (`password`), and DELETE /auth/keys/{id} takes it then; the rules no
  longer keep the last key on every node (no other node can tell who
  has a password where; under a strict policy the signed entry keeps
  one still).
* What fails says why beside where it was asked (the add form, the
  edited row, the removed one), which stays as it was, to be set right
  and tried again.
---
 docs/openapi.yaml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

(limited to 'docs/openapi.yaml')

diff --git a/docs/openapi.yaml b/docs/openapi.yaml
index 4a49d2b..efda5e2 100644
--- a/docs/openapi.yaml
+++ b/docs/openapi.yaml
@@ -981,7 +981,7 @@ paths:
     get:
       tags: [Auth]
       summary: Your keys
-      description: Your keys, your registry entry as recorded, and under a strict policy the envelope holding it (`signed`), which signing it anew names (`prev`).
+      description: Your keys, your registry entry as recorded, under a strict policy the envelope holding it (`signed`), which signing it anew names (`prev`), and whether you have a password on this node (`password`), so you may remove your last key here.
       responses:
         '200':
           description: Yours.
@@ -993,6 +993,7 @@ paths:
                   keys: { type: object, additionalProperties: { type: string } }
                   entry: { type: object }
                   signed: { type: string, nullable: true }
+                  password: { type: boolean }
         '404': { description: No entry of yours. }
 
   /auth/keys/{id}:
@@ -1015,10 +1016,11 @@ paths:
     delete:
       tags: [Auth]
       summary: Remove one of your keys
+      description: Your last only with a password on this node (`--htpasswd`).
       responses:
         '204': { description: Done. }
         '404': { description: No entry of yours, or no such key. }
-        '409': { description: Strict policy. }
+        '409': { description: Strict policy, or your last key and no password on this node. }
 
   /auth/whoami:
     get:
-- 
cgit v1.3.1