From 1458ea92a41788a0f33e86e621817613f46055eb Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 7 Nov 2026 22:35:09 +0100 Subject: dashboard: own links over the API, and CORS GET /admin/dashboard/links/own and its event stream: a node's own links, as LINKS_REPLY carried them, for other members' dashboards with a token. CORS for the members' dashboard origins and --cors-origins, without credentials. Auth plan M3. --- src/api/mod.rs | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'src/api/mod.rs') diff --git a/src/api/mod.rs b/src/api/mod.rs index b62163e..38868e2 100644 --- a/src/api/mod.rs +++ b/src/api/mod.rs @@ -5,6 +5,7 @@ mod access; pub(crate) mod auth; mod changes; mod config; +mod cors; #[cfg(feature = "dashboard")] mod dashboard; mod debug; @@ -105,6 +106,9 @@ pub(crate) fn router(state: AppState, auth_state: AuthState, debug_api: bool) -> .layer(middleware::from_fn_with_state(auth_state, basic_auth)) // Outside authentication: a token, if the request brings one, names the user. .layer(middleware::from_fn_with_state(state.clone(), login::bearer)) + // Outermost: pages of other origins, and their preflights, which bring no + // credentials. + .layer(middleware::from_fn_with_state(state.clone(), cors::cors)) // The hand-written spec (`docs/openapi.yaml`), and the Swagger UI showing it. .merge( // Relative to the UI's page (`/swagger-ui/`), so it is found behind a proxy that -- cgit v1.3.1