From 8a6ed7cc711e797542a531091b3bdbc73e5f61e4 Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 9 Nov 2026 02:24:51 +0000 Subject: dashboard: keys edited, the last removed with a password, failures kept The credentials dialog listed a user's keys whole, to add one or remove one but the last, and any failure replaced the dialog with the error, the form lost. * A key is shown short: its type, the first and last four characters of what tells it apart (an Ed25519 key's base64 after the part all of them share), its comment; the whole line in its tooltip. * A key can be edited, its name and its line: saved under the name, a new name written first and the old one removed. * A user with a password on this node (`--htpasswd`) may remove its last key: it logs in by the password. GET /auth/keys says so (`password`), and DELETE /auth/keys/{id} takes it then; the rules no longer keep the last key on every node (no other node can tell who has a password where; under a strict policy the signed entry keeps one still). * What fails says why beside where it was asked (the add form, the edited row, the removed one), which stays as it was, to be set right and tried again. --- src/api/mod.rs | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'src/api/mod.rs') diff --git a/src/api/mod.rs b/src/api/mod.rs index 0dde808..5c7c8e7 100644 --- a/src/api/mod.rs +++ b/src/api/mod.rs @@ -114,7 +114,12 @@ pub(crate) fn router(state: AppState, auth_state: AuthState, debug_api: bool) -> state.clone(), access::authorize, )) - .layer(middleware::from_fn_with_state(auth_state, basic_auth)) + .layer(middleware::from_fn_with_state( + auth_state.clone(), + basic_auth, + )) + // Who has a password here (`/auth/keys`: a user's last key goes only then). + .layer(axum::Extension(auth_state)) // Outside authentication: a token, if the request brings one, names the user. .layer(middleware::from_fn_with_state(state.clone(), login::bearer)) // Outermost: pages of other origins, and their preflights, which bring no -- cgit v1.3.1