v0.333.0: the file manager's own token ends with the dashboard sign-out (R-1155); the recovery-code page says the code becomes live after the check (R-1161)

2026-10-19 11:30:59 +02:00
parent a741bc1d0f
commit c809dd3bc6
10 changed files with 172 additions and 8 deletions
@@ -388,7 +388,9 @@ forwardAuth on `files.<domain>` (`GET /__felhom_gate/files`, `web/files_sso.go`)
 host-only `felhom_files` cookie and then sets the box's SECRET header (`X-Felhom-User-<32 hex>`, `<data>/filebrowser-sso-header`)
 naming FileBrowser user `felhom-household` — FileBrowser opens at the folder with no login. No files cookie → no header:
 FileBrowser's own password (`admin`, the fallback). A dashboard sign-out or password change ends the files cookie at the
-next request. The dashboard cookie stays host-only.
+next request; since v0.333.0 (R-1155) so does FileBrowser's own 2-hour token for the household — with no valid files
+cookie, a request carrying a non-admin FileBrowser token (cookie, Bearer or `?auth=`) is refused like a stale files
+cookie, while `admin`'s token still passes. The dashboard cookie stays host-only.

 #### „Még egy lépés" — a value asked AFTER the app starts (v0.315.0)