admin/felhom-controller
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

R-241 part 4: the three-state surface, and the copy tells the truth about the date

Browse Source 
FULL PAGE ONCE PER ENTRY, NOT ONCE EVER. "Most nem" used to set a flag that
nothing ever cleared, so a box that abandoned its history and was rebuilt
months later - a genuinely NEW situation - would never see the page again. The
offer now carries an EPOCH, advanced on the edge into the offered state, and a
dismissal is recorded against the epoch it was made in. A fresh entry passes
the dismissal by arithmetic, with nothing to clear and nothing that can be
forgotten to clear.

That is NOT the flag the operator's ruling forbids. The forbidden thing
remembers that the customer decided so the screen can be suppressed while the
state stays wrong. This records WHICH SITUATION a dismissal was about.

A REAL BUG, caught by the test and not by review: the first draft returned
early from recoveryInterrupts when the offer was false, so the FALLING edge
was never recorded, RecoveryOfferActive stayed true through a settled period,
and the next entry counted as a continuation. The page never came back - the
exact defect the epoch exists to fix, reintroduced inside the fix. The sync is
now unconditional and the ordering is commented as load-bearing.

THREE LEVERS, THREE SCOPES, and none of them removes the route:
  - clicking the bar away  -> a browser SESSION cookie, cleared on login, so
    the reminder is genuinely back at the next login. Nothing persisted.
  - "ne emlekeztessen ujra" -> durable, epoch-scoped, silences the BANNER ONLY.
    It starts no countdown, abandons nothing, and a fresh entry reminds again.
  - "most nem" -> suppresses the full page only, as before.
The entry point on /backups/remote is bound to the OFFER and to nothing else,
pinned by a test that fires all three dismissals and asserts it survives.

SEC 7.3 / Q7 - THE TRAP DOES NOT SURVIVE THIS SESSION. While a recovery is
outstanding the "Helyrealitasi kod letrehozasa" button is UNAVAILABLE, not
merely captioned: creating a new code seals the current key, demotes the
package that opens the earlier history to retained custody that no shipped
path can read (R-199), and re-enables the recovery screen through the orphan
route while invalidating the code that screen accepts. A warning beside a
button is a warning people click past. The card now explains and points at
/recovery instead.

SEC 2.4 - the abandon confirmation changes with the behaviour. It used to
promise "felretesszuk - nem toroljuk". It now states the grace in days (from
the constant the countdown actually uses, never a literal in prose), that the
sealed package goes with it, that the customer can change their mind, where
the date is visible, and that the question does not come back afterwards.

The countdown is shown on /backups/remote for the WHOLE window - the bar
elsewhere is a nudge, this is the record, and a deletion date must be findable
on a quiet day too.

Tests: once-per-entry across a full settle-and-re-enter cycle; the banner
dismissal proven to be a session cookie (MaxAge 0, no Expires) and to persist
nothing; the opt-out proven to silence the banner while leaving the offer, the
route and the countdown untouched, and to remind again on a fresh entry; the
entry point surviving all three dismissals; a settled box showing nothing; and
the back-redirect refusing "//evil.example".

An existing test (TestRecovery_E) was updated: it asserted the legacy boolean,
which the epoch replaces. It now asserts the dismissal landed on the current
epoch, which is the stronger property.

Green: go build, go vet, go test ./... all pass; controller gates OK.
This commit is contained in:
authentik Default Admin
2026-08-07 12:01:30 +02:00
parent a5d90ff801
commit de39e47f53
11 changed files with 551 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
controller/internal/web/recovery_handlers.go
+143 -7
View File
@@ -7,6 +7,7 @@ import (
"gitea.dooplex.hu/admin/felhom-controller/internal/agentapi"
"gitea.dooplex.hu/admin/felhom-controller/internal/backup"
"gitea.dooplex.hu/admin/felhom-controller/internal/settings"
)
// R-193 — THE RECOVERY SCREEN. A customer whose machine was rebuilt has everything they need to get
@@ -44,14 +45,67 @@ func (s *Server) recoveryOffer() bool {
return s.backupMgr != nil && s.backupMgr.OffsiteRecoveryOffer()
}
// recoveryInterrupts reports whether the FULL PAGE should take over the landing pages. "Most nem"
// suppresses this and nothing else — recoveryOffer stays true, so the backups-area entry point
// survives. That asymmetry is the whole of Scenario E.
// recoveryBannerCookie is the PER-VISIT banner dismissal (v0.206.0, R-241, §7.1). It is a browser
// SESSION cookie — no MaxAge, no Expires — and it is cleared on login, so "I have seen this" lasts
// for the visit and the reminder is back next time.
//
// It is deliberately NOT persisted in settings. A dismissal that outlived the visit would be a
// permanently-dismissed banner over data still sitting there, which is the failure Scenario H exists
// to catch. The durable, deliberate version of "stop reminding me" is the tick-box (§7.1), and that
// one is an explicit decision the customer takes, not a click to get a bar off the screen.
const recoveryBannerCookie = "felhom_recovery_banner"
// recoveryOfferEpoch advances and returns the offer-epoch view. Called from the landing-page
// interception, which runs on every dashboard/launcher GET — so the edge is detected promptly without
// a second scheduler job. Writes only on a transition.
func (s *Server) recoveryOfferEpoch() settings.RecoveryOfferView {
if s.settings == nil {
return settings.RecoveryOfferView{}
}
v, err := s.settings.SyncRecoveryOfferEpoch(s.recoveryOffer())
if err != nil {
s.logger.Printf("[WARN] [web] recovery: could not persist the offer epoch: %v", err)
}
return v
}
// recoveryInterrupts reports whether the FULL PAGE should take over the landing pages.
//
// ⚠ ONCE PER ENTRY INTO THE OFFERED STATE, NOT ONCE EVER (v0.206.0, §7.1). "Most nem" used to set a
// flag that nothing ever cleared, so a box that abandoned its history and was rebuilt months later —
// a genuinely NEW situation — would never show the page again. The epoch fixes that by arithmetic:
// a fresh entry advances it past the dismissal, with nothing to clear.
//
// It still suppresses the full page ONLY. `recoveryOffer` stays true, so the banner and the
// backups-area entry point both survive, and that asymmetry is the whole of Scenario E.
func (s *Server) recoveryInterrupts() bool {
if !s.recoveryOffer() {
// ⚠ THE EPOCH IS SYNCED FIRST AND UNCONDITIONALLY, and that ordering is the whole mechanism.
// The first draft returned early when the offer was false, so the FALLING edge was never
// recorded — `RecoveryOfferActive` stayed true through a settled period and the next entry
// therefore counted as a continuation rather than a new situation. The page never came back.
// Caught by TestR241_FullPageAppearsOncePerEntryNotOnceEver, not by review.
if s.settings == nil {
return s.recoveryOffer()
}
v := s.recoveryOfferEpoch()
if !v.Active {
return false
}
return s.settings == nil || !s.settings.GetRecoveryNoticePostponed()
return v.Epoch > v.PostponedEpoch
}
// recoveryBannerVisible reports whether the per-visit reminder bar should render on ordinary pages.
// Three conditions, and each is a separate lever: the situation holds, the customer has not opted out
// of reminders for THIS epoch, and they have not clicked the bar away during this visit.
func (s *Server) recoveryBannerVisible(r *http.Request) bool {
if !s.recoveryOffer() || s.settings == nil {
return false
}
if c, err := r.Cookie(recoveryBannerCookie); err == nil && c.Value == "1" {
return false // dismissed for this visit only
}
v := s.settings.GetRecoveryOfferView()
return v.Epoch > v.OptOutEpoch
}
// recoveryNoStore stamps the page uncacheable. The rendered page carries no secret, but it does carry
@@ -112,6 +166,9 @@ func (s *Server) renderRecoveryState(w http.ResponseWriter, r *http.Request, err
// unless the tier is orphaned. Showing a button that is guaranteed to refuse would be worse than
// not showing it, and rewriting the move-aside is explicitly out of scope.
data["CanSetAside"] = s.backupMgr != nil && s.backupMgr.OffboxOrphaned()
// §7.3: the confirmation states the grace in days, from the constant the countdown actually uses —
// never a literal in the copy, which is how a number in prose drifts away from the number in code.
data["AbandonGraceDays"] = backup.AbandonGraceDays
data["ConfirmSetAside"] = r.URL.Query().Get("setaside") == "1"
if inv != nil {
data["Unlocked"] = true
@@ -483,10 +540,89 @@ func (s *Server) recoveryUnlockHandler(w http.ResponseWriter, r *http.Request) {
// interruption ONLY: recoveryOffer stays true, so the backups-area entry point survives permanently.
func (s *Server) recoveryPostponeHandler(w http.ResponseWriter, r *http.Request) {
if s.settings != nil {
if err := s.settings.SetRecoveryNoticePostponed(true); err != nil {
// Recorded against the CURRENT epoch (v0.206.0): a dismissal is about the situation the
// customer is in, not about the screen for ever. A later fresh entry shows the page again.
if err := s.settings.PostponeRecoveryNoticeForEpoch(); err != nil {
s.logger.Printf("[WARN] [web] recovery: recording the postpone failed: %v", err)
}
}
s.logger.Printf("[INFO] [web] recovery: the customer chose to postpone; the backups-area entry point stays")
s.logger.Printf("[INFO] [web] recovery: the customer chose to postpone; the banner and the backups-area entry point both stay")
http.Redirect(w, r, "/launcher", http.StatusFound)
}
// recoveryBannerDismissHandler records "seen it, for now" (POST /recovery/banner/dismiss) — a browser
// SESSION cookie and nothing durable. The bar is back at the next login, because the data is still
// sitting there whether or not anyone clicked.
func (s *Server) recoveryBannerDismissHandler(w http.ResponseWriter, r *http.Request) {
http.SetCookie(w, &http.Cookie{
Name: recoveryBannerCookie, Value: "1", Path: "/",
HttpOnly: true, SameSite: http.SameSiteLaxMode, Secure: r.TLS != nil,
// NO MaxAge and NO Expires — a session cookie, deliberately. See recoveryBannerCookie.
})
http.Redirect(w, r, redirectBackTo(r, "/launcher"), http.StatusFound)
}
// recoveryRemindOptOutHandler records „ne emlékeztessen újra" (POST /recovery/remind-optout).
//
// ⚠ IT SILENCES THE BANNER AND NOTHING ELSE (§7.1 condition 3). It is not an abandonment, it starts
// no countdown, and it must never be presented as a way of deciding. The entry point on the backups
// page stays exactly where it was (condition 1) — silencing a reminder is not removing the route, and
// this whole session exists partly because a route disappeared. A fresh entry into the offered state
// reminds again (condition 2), by epoch arithmetic.
func (s *Server) recoveryRemindOptOutHandler(w http.ResponseWriter, r *http.Request) {
if s.settings != nil {
if err := s.settings.OptOutRecoveryRemindersForEpoch(); err != nil {
s.logger.Printf("[WARN] [web] recovery: recording the reminder opt-out failed: %v", err)
}
}
s.logger.Printf("[INFO] [web] recovery: reminders silenced for this situation at the customer's request — the backups-area entry point is UNCHANGED and no countdown was started")
http.Redirect(w, r, redirectBackTo(r, "/backups/remote"), http.StatusFound)
}
// redirectBackTo returns a SAFE same-site redirect target from the form, or the fallback. Only a
// leading single "/" is accepted: "//evil.example" is a protocol-relative URL and must not pass.
func redirectBackTo(r *http.Request, fallback string) string {
v := r.FormValue("back")
if len(v) > 1 && v[0] == '/' && v[1] != '/' {
return v
}
return fallback
}
// addRecoveryBanner decorates a page's data with the reminder bar's state (R-241, v0.206.0).
//
// It is an EXPLICIT call rather than a `baseData` change, deliberately: `baseData` has no request and
// the per-visit dismissal is a cookie, and threading a request through every caller to reach four
// pages would be a large diff for a small feature. The callers are the pages a customer actually
// lands on — the dashboard, the launcher and the backups area.
//
// ⚠ IT IS A REMINDER, NOT THE ROUTE. Nothing here gates the entry point on /backups/remote; that is
// driven by `.RecoveryOffer` in the template and stays put whatever the customer does about the bar.
func (s *Server) addRecoveryBanner(data map[string]interface{}, r *http.Request) {
if !s.recoveryBannerVisible(r) {
return
}
data["RecoveryBanner"] = true
data["RecoveryBannerBack"] = r.URL.Path
if data["CSRFField"] == nil {
data["CSRFField"] = s.csrfField(r)
}
// While a countdown runs the bar counts it down instead of asking the same question — and the
// reminder opt-out is deliberately NOT offered there: a deletion date is not something to silence.
if s.backupMgr != nil {
if st := s.backupMgr.AbandonStatus(); st.Active {
for _, mark := range backup.AbandonRemindAtDays {
if st.DaysLeft <= mark {
data["RecoveryAbandonDays"] = st.DaysLeft
data["RecoveryAbandonDate"] = st.DueAt.Format("2006-01-02")
break
}
}
if data["RecoveryAbandonDays"] == nil {
// Outside the reminder marks the countdown is visible on the backups page only —
// a bar on every screen for fourteen days is a bar nobody reads by day three.
delete(data, "RecoveryBanner")
}
}
}
}