v0.332.0: one sign-in for the file manager — a dashboard pass, a host-only files cookie, a per-box secret header (R-1100, operator D16)

CHANGELOG.md

@@ -1,7 +1,41 @@
-## Unreleased (2026-10-19) — the new recovery code replaces the old one only after the household typed it back (R-1151, controller half)
+## v0.332.0 — one sign-in for the file manager (R-1100, operator D16 = yes); the new recovery code replaces the old one only after the household typed it back (R-1151) (2026-10-19)
 
-Ships in the next release. **No new MinAgent:** it works with every agent — the agent's claim answer says whether a
-confirm is needed.
+**MinAgent: 0.158.1** — the floor's, carried. Neither change needs a new agent: the file manager's sign-in is the
+controller's alone, and R-1151's claim answer itself says whether the agent (≥ 0.160.0) waits for the typed-back words —
+an older agent stores the package at the claim, as before (pinned). No golden (`09` §3 decision 250). Task: the day
+brief of 2026-10-19 (felhom.eu `REPORT-day-2026-10-19.md`); design: felhom.eu `audits/proxyauth-spike-2026-10-18/DESIGN-NOTE.md`.
+
+- **One sign-in for the file manager (R-1100).** „Fájlok ↗" (and every FileBrowser folder link on the dashboard) now
+  goes to the dashboard's `GET /__files/open?to=<FileBrowser path>`. With the household's session it mints a pass — 60 s,
+  one use, bound to `files.<domain>` and to that session — and sends the browser to `files.<domain>/_felhom/sso?t=…`;
+  without a session, the dashboard's sign-in and back. Every request to `files.<domain>` now first asks the controller
+  (traefik forwardAuth `felhom-files-sso` → `GET /__felhom_gate/files`, the setup gate's pattern, decision 46):
+  `/_felhom/sso` swaps the pass for the files cookie `felhom_files` (host-only on `files.<domain>`, HttpOnly, Secure,
+  Lax; it carries a value DERIVED from the session's fingerprint for that host — the R-976 shape — never the session)
+  and clears FileBrowser's own earlier token; a valid files cookie → 200 with the box's secret header naming the
+  household's FileBrowser user `felhom-household`; no files cookie → 200 without it (FileBrowser's own password sign-in:
+  `admin`, the fallback and the operator's way — R-513 and the R-1126 gate unchanged); a files cookie that no longer opens
+  (the dashboard session ended, the dashboard password changed → the gate key rotates) → both cookies cleared and the
+  browser sent back to the dashboard, which asks for the sign-in again. **The header name is a per-box secret**
+  (`X-Felhom-User-<32 hex>`, made once, 0600, `<data>/filebrowser-sso-header`, `infra.LoadOrCreateFileBrowserSSOHeader`)
+  written only into FileBrowser's config (`auth.methods.proxy`, with `logoutRedirectUrl` = the dashboard; password
+  sign-in stays on) and traefik's route (`authResponseHeaders`, which strips a client's copy) — so an app container that
+  reaches `filebrowser:80` directly cannot forge it (the spike measured that it could with a fixed name). **The dashboard
+  cookie is NOT widened** to the parent domain. FileBrowser gives a header user only its userDefaults, so with the sign-in
+  the defaults are the household's file rights (change, add, delete, share, download, live updates — not admin, not
+  API); a user the household adds by hand starts from the same ticks. The data tab's „asks for its own password the first
+  time" note is shown only on a box without the sign-in. Every box's FileBrowser config and route change once, so
+  FileBrowser is re-created once. Tests (each refusal red-proved, `internal/web/files_sso_test.go`,
+  `internal/infra/filebrowser_sso_test.go`): `TestFilesSSO_R1100_HouseholdOpensTheFolderWithoutALogin`,
+  `_ReplayedPassRefused` (used-nonce check off → „a replayed pass set the files cookie again"), `_ExpiredPassRefused`
+  (expiry off → „a pass 61 s old set the files cookie"), `_PassForAnotherHostRefused` (host check AND host-bound session
+  key off → „a pass for files.other.hu passed …: 302"; X-Forwarded-Host check off → „the answer named the household on
+  felhom.example.hu: 200"; a setup-gate pass refused), `_NoSessionNoPass` (validity off → „a browser with no session got
+  a pass"), `_SignedOutAsksAgain` (session check always true → „after the sign-out the files cookie still named the
+  household"; also after a dashboard password change), `_DataTabLoginNote`, `TestFileBrowserSSOHeader_R1100_ABoxSecret`,
+  `TestFileBrowserConfig_R1100_TrustsOnlyTheBoxSecret`, `_HeaderUserGetsTheHouseholdsRights`,
+  `TestFileBrowserRoute_R1100_AsksTheControllerAndStripsTheHeader` (each red-proved). Link tests now read the folder from
+  the pass link's `to`. i18n fixtures: none changed (no fixture page shows a folder link or the note).
 
 - **The wizard's typed-back words now go to the box, not only to the browser.** The claim asks the agent to keep the
   new package (`{"defer_upload": true}`); an agent ≥ 0.160.0 answers with `confirm_required` and the two word