v0.332.0: one sign-in for the file manager — a dashboard pass, a host-only files cookie, a per-box secret header (R-1100, operator D16)

2026-10-19 04:56:56 +02:00
parent ba4a6f060b
commit 9bdd8f8fe8
21 changed files with 1078 additions and 54 deletions
@@ -382,7 +382,13 @@ wrote or FileBrowser's (`InitialCreds`) · a sentence from the catalog's `app_in
 admin/admin refused, store encrypted, state `generated`). *„Fájlok ↗"* in the header opens the library folder, else
 the first declared folder, else a media app's first present drive's `media` folder (`datapath_card.go`
 `filesButtonLink`); the data tab lists each drive's media folders, and a folder whose drive is not bound into
-FileBrowser is text, never a link.
+FileBrowser is text, never a link. **One sign-in (v0.332.0, R-1100):** every folder link goes through the dashboard's
+`GET /__files/open`, which mints a 60-second one-use pass bound to `files.<domain>` and the session; traefik's
+forwardAuth on `files.<domain>` (`GET /__felhom_gate/files`, `web/files_sso.go`) swaps it at `/_felhom/sso` for the
+host-only `felhom_files` cookie and then sets the box's SECRET header (`X-Felhom-User-<32 hex>`, `<data>/filebrowser-sso-header`)
+naming FileBrowser user `felhom-household` — FileBrowser opens at the folder with no login. No files cookie → no header:
+FileBrowser's own password (`admin`, the fallback). A dashboard sign-out or password change ends the files cookie at the
+next request. The dashboard cookie stays host-only.

 #### „Még egy lépés" — a value asked AFTER the app starts (v0.315.0)