From d0b773065c441d3e153d9d53bca20ead655b17e7 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 8 Nov 2026 16:18:11 +0000 Subject: dashboard: a user's menu, with its credentials and logging out MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The user's name, top right, opens a menu: * "credentials…": the user's keys (GET /auth/keys), one added with its .pub line or removed but the last (/auth/keys/{id}); under a strict policy, how to sign them anew (continuum-signed key-add, key-remove); and where its password is: each node's --htpasswd, its operator's. * "log out": this browser's session ends. Where the page got in by what it can't end (the browser's password, the proxy's), it is greyed (aria-disabled, not disabled, so a click still lands), its tooltip saying how to log out, and a click says so in a dialog. The log out button and the text beside the name from 1165 go into it. Checked in Chromium against stubbed endpoints: the menu, both log out cases, the credentials dialog, no errors, nothing the content policy refuses. --- docs/dashboard.md | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) (limited to 'docs') diff --git a/docs/dashboard.md b/docs/dashboard.md index 027e094..9543be4 100644 --- a/docs/dashboard.md +++ b/docs/dashboard.md @@ -22,9 +22,12 @@ never asks for itself: no browser password prompt), or with a token: from `conti [`access.md`](access.md), Tokens), or any other. The page keeps a session for the browser, a cookie no script reads and no other site's page sends, renewed while the dashboard is open; it ends with the token's lifetime, or with "Log out of this -browser" on the login page, or "log out" on the dashboard, which ends this browser's -session only. Where the page got in by what it can't end, the browser's password or -the proxy's, it says so beside the user's name. The page and the login page run their +browser" on the login page, or "log out" in the user's menu on the dashboard (its +name, top right), which ends this browser's session only. Where the page got in by +what it can't end, the browser's password or the proxy's, "log out" is greyed, and +says how instead. The menu's "credentials…" shows the user's keys, to add one (its +`.pub` line) or remove one but the last; under a strict policy, how to sign them anew +(`continuum-signed key-add`); and where its password is: in each node's `--htpasswd`. The page and the login page run their own script only (a content security policy naming it by its hash), and no other page may frame them. The API listens on localhost unless `--bind-addr` says otherwise; to look at a node on another machine, forward the port (`ssh -L 3000:localhost:3000 -- cgit v1.3.1