From b2c5096744c99453856f7281251b3f0cb4b9baae Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 9 Nov 2026 05:22:14 +0000
Subject: dashboard: a subscribed node's message written out, read from it when
 shown
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A subscribed node's messages come without being written out (their stream leaves the
text out: up to 8 KiB each, 500 at a time), so the figures box said only when, both
ends, type and size of one. Now the node answers for one message by its number,
`GET /admin/dashboard/messages/own/{seq}` (`{"text": …}`, `404` once it isn't kept),
which pages of other origins may call as they do its streams (`cors::open`), and the
page reads it when the message is shown, with its narrow token, and keeps it on the
message. Where it can't be read, the box says why.
---
 docs/access.md    |  3 ++-
 docs/dashboard.md |  5 +++--
 docs/openapi.yaml | 27 +++++++++++++++++++++++++++
 3 files changed, 32 insertions(+), 3 deletions(-)

(limited to 'docs')

diff --git a/docs/access.md b/docs/access.md
index a4c5375..38ae180 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -172,7 +172,8 @@ it may do.
 
 Pages of other origins, the dashboards of other members, may call a node with a token:
 its own links (`/admin/dashboard/links/own`, and its events) and messages
-(`/admin/dashboard/messages/own/events`), `/auth/refresh` and `/auth/whoami`, nothing
+(`/admin/dashboard/messages/own/events`, and one written out,
+`/admin/dashboard/messages/own/{seq}`), `/auth/refresh` and `/auth/whoami`, nothing
 else. A node allows the origins of the dashboards its member
 list names (`--dashboard-url`) and those of `--cors-origins`; without credentials (no
 cookie or password crosses origins: the page sends its token).
diff --git a/docs/dashboard.md b/docs/dashboard.md
index 5eee5c9..590f72f 100644
--- a/docs/dashboard.md
+++ b/docs/dashboard.md
@@ -399,8 +399,9 @@ A subscribed node's messages with its peers are listed too, as they come from it
 named by both ends, the receiver first (`b ← a`), each once, as on the map (those
 with this node only from this node, between two subscribed nodes from the sender); its
 tooltip names the node that logged it. Shown in the figures box, it says when, both
-ends, its type and size: the message itself is written out only on the node that
-logged it.
+ends, its type, size and address, and the message written out, read from the node that
+logged it as it is shown (`/admin/dashboard/messages/own/{seq}` there, with the page's
+token), while that node still keeps it (its latest 1000).
 
 A click on a message shows it in the figures box: when, with whom, its type and size,
 and the message written out (its bytes as sizes). A click on it again, or on anything on
diff --git a/docs/openapi.yaml b/docs/openapi.yaml
index 0fad136..03afa2f 100644
--- a/docs/openapi.yaml
+++ b/docs/openapi.yaml
@@ -1293,6 +1293,33 @@ paths:
         '401':
           $ref: '#/components/responses/Unauthorized'
 
+  /admin/dashboard/messages/own/{seq}:
+    get:
+      tags: [Admin]
+      summary: One of this node's messages, written out
+      description: |
+        The message `seq` (its number in `messages/own/events`) written out, as this
+        node's own console shows it, for a page subscribed to this node showing it (CORS,
+        with a token). Kept while the message log is: the latest 1000, while one looks.
+      parameters:
+        - name: seq
+          in: path
+          required: true
+          schema: { type: integer }
+      responses:
+        '200':
+          description: The message written out.
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  text: { type: string }
+        '401':
+          $ref: '#/components/responses/Unauthorized'
+        '404':
+          description: Not kept any more.
+
   /admin/dashboard/refresh:
     post:
       tags: [Admin]
-- 
cgit v1.3.1