admin
3a12c7341a
gates / gates (push) Successful in 27s
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
22 lines
2.1 KiB
Markdown
22 lines
2.1 KiB
Markdown
# REPORT — v0.280.0: the setup gate (decision 46); "I changed it" (R-710); password fields off the page (R-709); a special-character generator (2026-09-29)
|
||
|
||
Architecture: `felhom.eu/documentation/architecture/09-update-architecture.md` §3 decisions 45–46, `01-topology-and-trust.md`
|
||
§5. Evidence: `felhom.eu/documentation/audits/login-gate-2026-09-29/`. Session report: `felhom.eu/REPORT-login-gate-2026-09-29.md`.
|
||
|
||
- **Built only after the spike passed** (`B/B-VERDICT.md`). `setup_gate: true` → a fresh install writes
|
||
`<stacks>/traefik/dynamic/setup-gate-<app>.yml` BEFORE the first start (forwardAuth on every router the app's labels
|
||
publish, priority 100000 + rule length); the answerer (`/__felhom_gate/auth`, before the host check) lets through only
|
||
a host-bound gate cookie, minted after a valid dashboard session on `felhom.<domain>/__gate/start` (60 s one-use token).
|
||
The loop (20 s) opens a gate when `setup_done_probe:` flips; „Kész, beállítottam" opens one without a probe.
|
||
- **Tests:** stacks `TestSetupGate_*` (9), `TestGenerateValue_PasswordWithASpecialCharacter`; web `TestSetupGate_*` (4),
|
||
`TestSetupGatePage_*`, `TestKnownLogin_*`, `TestR709_*`. `go build`, `go vet`, `go test ./...` green; controller gates
|
||
green; parity fixtures: 4 new cases, 6 deploy fixtures regenerated (diff = the R-709 lines and the generator only).
|
||
- **Red-proofs RP1–RP16**, each seen failing on an assertion (`C/redproofs/`).
|
||
- **Live on 9202** (drill catalog): immich, n8n, audiobookshelf (probe), uptime-kuma (button) — 0 app answers to a
|
||
stranger before each gate opened; the household in 0.2 s; a restart kept a closed gate and the household's pass;
|
||
immich's phone-app API unchanged after. mealie, wger, calibre-web: default refused, generated signs in.
|
||
R-709: the revealed value is not in the settings page. **Delivered:** floor 0.280.0; demo-hp and demo-felhom run it;
|
||
demo-hp's "I changed it" pressed on bookstack and calibre-web (the operator's ruling).
|
||
- **Not live:** a restore of a gated app (test only; R-648 forbids the whole-box backup a drill would need).
|
||
- MinAgent 0.131.0 (unchanged).
|