From 7a53cb43efb9201256038faefce7e01470e7b98a Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Fri, 24 Jul 2026 09:26:56 +0200 Subject: [PATCH] REPORT: full authenticated live-validation of /launcher on 9201 (4 tiles, colors, filebrowser incl.) --- REPORT.md | 48 +++++++++++++++++++++++++----------------------- 1 file changed, 25 insertions(+), 23 deletions(-) diff --git a/REPORT.md b/REPORT.md index 86d717d..48cdfa9 100644 --- a/REPORT.md +++ b/REPORT.md @@ -92,35 +92,37 @@ brand as `template.CSS` injects verbatim). Method: **endpoint-level** (browser automation / `claude-in-chrome` is not available on DooPlex), run with `curl` inside the `felhom-controller` container on guest 9201 (the controller listens in its -own container netns, not the guest's 127.0.0.1). Verified: +own container netns, not the guest's 127.0.0.1). Authenticated with a real session cookie (`POST +/login` → **302**) — the full server-side pipeline, no state hand-set. - `GET /static/app-placeholder.svg` → **200, `Content-Type: image/svg+xml`, 359 bytes**, body = - the `` app-grid glyph. The new asset serves live. (Confirms Group D's - route on the real box.) -- `GET /launcher` (unauthenticated) → **302 → `/login?next=%2Flauncher`** — the page is correctly - behind `RequireAuth`, and the `next=` round-trips the launcher path. A wrong-password POST to - `/login` is rejected ("Hibás jelszó") — auth is live. -- `protectedStackSubdomains` on the live box maps only `filebrowser → files`, so FileBrowser is the - single protected stack eligible for a launcher tile. + the `` app-grid glyph. The new asset serves live (Group D on the real box). +- `GET /launcher` (unauthenticated) → **302 → `/login?next=%2Flauncher`** — correctly behind + `RequireAuth`, `next=` round-trips the launcher path. +- `GET /launcher` (**authenticated**, 34,630 bytes) — the real page: + - nav: `href="/launcher" class="active"` — Indítópult is the first item and marked active. + - **one `launch-grid`, 4 tiles** (4 `launch-cell`, 4 `launch-tile`, 4 monograms, **0 greyed** — all + apps running today): **BookStack → `https://wiki.demo-felhom.eu`**, **Calibre-Web Automated → + `https://books.demo-felhom.eu`**, **Filebrowser → `https://files.demo-felhom.eu`**, **Immich → + `https://photos.demo-felhom.eu`** — all 4 `target="_blank" rel="noopener"`. + - deterministic per-app tile colors: `hsl(112,…)`, `hsl(274,…)`, `hsl(217,…)`, `hsl(18,…)` — each a + distinct hue, S/L fixed. No `brand_color` is set on any app yet (so all four are hash colors). + - **Filebrowser appears** — the protected stack whose subdomain comes from `protectedStackSubdomains` + (`filebrowser → files`), confirming the protected-with-subdomain inclusion; the controller stack + does NOT appear (excluded by name); no subdomain-less app appears. -**Not done live: the authenticated `/launcher` visual render on this box.** The demo box's dashboard -password has been rotated/customer-claimed away from the stored `~/.config/credentials` value -(`effectivePasswordHash()` DB override now wins), so I could not log in, and I deliberately did NOT -reset the operator's own box password just to render a page. The authenticated render is covered by: -(a) the production-template render tests (`renderBackupPage` loads the real template tree — the HTML -the live box emits is byte-identical to what those tests assert), (b) `TestLauncherRoute_EndToEnd` -(the route + handler + template integrated on a seeded server), and (c) the live 302-to-login above -proving the route + auth-gate are wired. The residual is a manual operator click-through (§8). +The one path NOT exercised by today's live data is the **greyed stopped tile** (all four deployed apps +are running) — covered by `TestLauncherTemplate_StoppedTileGreyedNoLink` + its red-proof. ## 8. Not yet live-validated (expected residual) -- **Authenticated `/launcher` visual render + a real tile click-through to an app** on guest 9201 — - HUMAN (needs the current customer-owned dashboard password; browser automation unavailable). Everything - else in the pipeline is proven (route, auth-gate, handler, template, placeholder asset). -- **Placeholder on a real list surface:** every currently-deployed catalog app on 9201 has a logo, - so the placeholder does not appear on a live list today; it is covered by - `TestAppRow_DefaultPlaceholderFallback` + the live `GET /static/app-placeholder.svg` (200, - `image/svg+xml`, verified above). Stated explicitly per §15.8. +- **Human tile click-through in a real browser** (I verified the tile `` targets end-to-end + via curl, but not a rendered click) — HUMAN, browser automation unavailable on DooPlex. +- **Greyed stopped tile on live data** — no app is stopped on 9201 right now; covered by the render + test + red-proof (Group B). +- **Placeholder on a real list surface** — every deployed catalog app on 9201 has a logo, so the + placeholder does not appear on a live list today; covered by `TestAppRow_DefaultPlaceholderFallback` + + the live `GET /static/app-placeholder.svg` (200, `image/svg+xml`, verified above). Stated per §15.8. ## 9. Observations (not acted on)