v0.165.0: Indítópult megosztása — guest launcher via capability URL (+ optional password, QR)

Mint a 160-bit capability URL (/s/<token>) serving a standalone read-only guest launcher: same tiles, opens apps in new tabs, no account, no admin session. Information only, zero control — every privilege stays behind each app's own auth. - /s/ pre-auth pass-through (after the claim gate) + session-CSRF exemption; guest password POST carries its own pre-auth HMAC CSRF. - Constant-time token match; empty stored token = disabled = byte-identical mux 404. - Optional per-share password: separate bcrypt hash + own attempt map; signed cookie = HMAC(token|passwordHash) keyed with web.session_secret, so rotate/change invalidates. - Guest labels ride the v0.164.0 ruling; never expose internal state vocabulary. - Token redacted in logs (/s/<redacted>); never in CHANGELOG/REPORT/CONTEXT. - Admin modal: copy-link, QR (go-qrcode), set/clear password, rotate, disable. - Tests: Groups A-G (14) + 3 red-proofs verified red.
2026-07-24 12:08:43 +02:00
parent 8e5edb2865
commit 15206314ab
19 changed files with 1341 additions and 115 deletions
@@ -0,0 +1,43 @@
+{{define "launcher_shared"}}
+<!DOCTYPE html>
+<html lang="hu">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <meta name="robots" content="noindex, nofollow">
+    <title>Indítópult</title>
+    <link rel="icon" type="image/svg+xml" href="/static/favicon.svg">
+    <link rel="stylesheet" href="/static/style.css">
+</head>
+<body class="guest-body">
+<main class="guest-content">
+    <div class="page-header">
+        <h2>Indítópult</h2>
+        <span class="domain-badge">{{.Domain}}</span>
+    </div>
+    {{if .Apps}}
+    <div class="launch-grid">
+        {{range .Apps}}
+        {{if .Clickable}}
+        <a class="launch-cell" href="{{.Href}}" target="_blank" rel="noopener noreferrer">
+            {{template "launch_tile" (dict "Slug" .Slug "BrandColor" .BrandColor "DisplayName" .DisplayName "Off" false)}}
+            <span class="launch-name">{{.DisplayName}}</span>
+        </a>
+        {{else}}
+        <div class="launch-cell launch-cell--off">
+            {{template "launch_tile" (dict "Slug" .Slug "BrandColor" .BrandColor "DisplayName" .DisplayName "Off" true)}}
+            <span class="launch-name">{{.DisplayName}}</span>
+            <span class="launch-off-label">{{.Label}}</span>
+        </div>
+        {{end}}
+        {{end}}
+    </div>
+    {{else}}
+    <div class="empty-state">
+        <p>Jelenleg nincs elérhető alkalmazás.</p>
+    </div>
+    {{end}}
+</main>
+</body>
+</html>
+{{end}}