From f7d91069fb3fe68a07daee90c8dd530485ec73aa Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Tue, 29 Sep 2026 11:24:38 +0200 Subject: [PATCH] wanderer: first step says anyone can make an account (decision 47; not gated, R-714) Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS --- FIRST-ADMIN.md | 2 +- scripts/copy_freeze/hu.json | 2 +- templates/wanderer/.felhom.yml | 5 +++-- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/FIRST-ADMIN.md b/FIRST-ADMIN.md index 5592c98..ed7779f 100644 --- a/FIRST-ADMIN.md +++ b/FIRST-ADMIN.md @@ -81,7 +81,7 @@ asks the probe first where there is one. Open sign-up is closed by the box after | **uptime-kuma** | 4 | first visitor creates admin (socket.io `setup`) | **setup gate**, no HTTP probe → the household's „Kész, beállítottam" | **GATED** — catalog, 2026-09-29 | **M 9202**: gate held across a controller restart; the press opened it (second press 409). The proof pressed WITHOUT doing the socket.io setup — the press trusts the household | | vaultwarden | 1 | `ADMIN_TOKEN` generated; invite-only (R-512) | – | fine | R | | **vikunja** | 4 | open registration | **setup gate**, opened by the household's press („Kész, beállítottam", confirm first); sign-up closed by the box after the setup: `/api/v1/register` | **GATED** — catalog, 2026-09-29 (decisions 46–47) | **M 9202**: stranger → gate page / 401; household reached the first-setup screen; gate opened after the setup; the app answered after (`felhom.eu/documentation/audits/gate-rollout-2026-09-29/`) | -| wanderer | 4 | `PUBLIC_DISABLE_SIGNUP=false` | NOT gated: its web part calls its own database host through the public name, which a gate would refuse (the household could not finish the setup); open sign-up (`PUBLIC_DISABLE_SIGNUP=false`) and PocketBase's own first-run screen on the second host — R-714 | open — **needs a design** | R; measured the call on 9202 | +| wanderer | 4 | `PUBLIC_DISABLE_SIGNUP=false` | NOT gated: its web part calls its own database host through the public name, which a gate would refuse (the household could not finish the setup); open sign-up (`PUBLIC_DISABLE_SIGNUP=false`) and PocketBase's own first-run screen on the second host — R-714 | open — **needs a design**; its first step says plainly that anyone who finds the address can make an account (decision 47) | R; measured the call on 9202 | | **wger** | 3 | `admin / adminadmin` | (b) Django `set_password`, password as `sys.argv[1]` | **FIXED** — catalog, 2026-09-29; + R-712 (a browser's https Origin was refused by CSRF) | **M 9202**: fresh install — default refused, generated signs in (302), wrong refused, with the browser's https Origin | | **wishlist** | 4 | first sign-up is admin | **setup gate**, opened by the household's press („Kész, beállítottam", confirm first); sign-up closed by the box after the setup: `/signup` | **GATED** — catalog, 2026-09-29 (decisions 46–47) | **M 9202**: stranger → gate page / 401; household reached the first-setup screen; gate opened after the setup; the app answered after (`felhom.eu/documentation/audits/gate-rollout-2026-09-29/`) | | **zipline** | 4 | v4 sets up on first run; the stale `admin / zipline` note is **removed** (2026-09-29) | **setup gate**, opened by probe `/api/server/public` → `firstSetup` = false; the app itself refuses a stranger's second first-admin / sign-up call | **GATED** — catalog, 2026-09-29 (decisions 46–47) | **M 9202**: stranger → gate page / 401; household reached the first-setup screen; gate opened after the setup; the app answered after (`felhom.eu/documentation/audits/gate-rollout-2026-09-29/`) | diff --git a/scripts/copy_freeze/hu.json b/scripts/copy_freeze/hu.json index 0fb0ddd..f25049e 100644 --- a/scripts/copy_freeze/hu.json +++ b/scripts/copy_freeze/hu.json @@ -1079,7 +1079,7 @@ }, "wanderer": { "app_info.first_steps[0]": "Nyisd meg a hike.DOMAIN címet a böngészőben", - "app_info.first_steps[1]": "Hozd létre a fiókodat", + "app_info.first_steps[1]": "Hozd létre a fiókodat azonnal a telepítés után. Figyelem: ebben az alkalmazásban bárki, aki megtalálja a címet, fiókot hozhat létre.", "app_info.first_steps[2]": "Importálj egy GPX fájlt vagy tervezz új útvonalat", "app_info.first_steps[3]": "Fedezd fel a térképes megjelenítést", "app_info.tagline": "Túra tervező - útvonalak, GPX nyomok és domborzati térképek", diff --git a/templates/wanderer/.felhom.yml b/templates/wanderer/.felhom.yml index 9302581..e043e4f 100644 --- a/templates/wanderer/.felhom.yml +++ b/templates/wanderer/.felhom.yml @@ -69,11 +69,12 @@ app_info: first_steps: - 'Nyisd meg a hike.DOMAIN címet a böngészőben' - - 'Hozd létre a fiókodat' + - 'Hozd létre a fiókodat azonnal a telepítés után. Figyelem: ebben az alkalmazásban bárki, aki megtalálja a címet, fiókot hozhat létre.' - 'Importálj egy GPX fájlt vagy tervezz új útvonalat' - 'Fedezd fel a térképes megjelenítést' +# `09` §3 decision 47: wanderer cannot close sign-up or be gated yet (R-714) — the first step says so plainly. # --- Controller-side health probe --- healthcheck: checks: @@ -96,7 +97,7 @@ i18n: - 'Share a route with other people' first_steps: - 'Open hike.DOMAIN in your browser' - - 'Create your account' + - 'Create your account right after the install. Note: in this app, anyone who finds the address can make an account.' - 'Import a GPX file, or plan a new route' - 'Have a look at the map view' deploy_fields: