admin
15206314ab
Mint a 160-bit capability URL (/s/<token>) serving a standalone read-only guest launcher: same tiles, opens apps in new tabs, no account, no admin session. Information only, zero control — every privilege stays behind each app's own auth. - /s/ pre-auth pass-through (after the claim gate) + session-CSRF exemption; guest password POST carries its own pre-auth HMAC CSRF. - Constant-time token match; empty stored token = disabled = byte-identical mux 404. - Optional per-share password: separate bcrypt hash + own attempt map; signed cookie = HMAC(token|passwordHash) keyed with web.session_secret, so rotate/change invalidates. - Guest labels ride the v0.164.0 ruling; never expose internal state vocabulary. - Token redacted in logs (/s/<redacted>); never in CHANGELOG/REPORT/CONTEXT. - Admin modal: copy-link, QR (go-qrcode), set/clear password, rotate, disable. - Tests: Groups A-G (14) + 3 red-proofs verified red.
44 lines
1.4 KiB
HTML
44 lines
1.4 KiB
HTML
{{define "launcher_shared"}}
|
|
<!DOCTYPE html>
|
|
<html lang="hu">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<meta name="robots" content="noindex, nofollow">
|
|
<title>Indítópult</title>
|
|
<link rel="icon" type="image/svg+xml" href="/static/favicon.svg">
|
|
<link rel="stylesheet" href="/static/style.css">
|
|
</head>
|
|
<body class="guest-body">
|
|
<main class="guest-content">
|
|
<div class="page-header">
|
|
<h2>Indítópult</h2>
|
|
<span class="domain-badge">{{.Domain}}</span>
|
|
</div>
|
|
{{if .Apps}}
|
|
<div class="launch-grid">
|
|
{{range .Apps}}
|
|
{{if .Clickable}}
|
|
<a class="launch-cell" href="{{.Href}}" target="_blank" rel="noopener noreferrer">
|
|
{{template "launch_tile" (dict "Slug" .Slug "BrandColor" .BrandColor "DisplayName" .DisplayName "Off" false)}}
|
|
<span class="launch-name">{{.DisplayName}}</span>
|
|
</a>
|
|
{{else}}
|
|
<div class="launch-cell launch-cell--off">
|
|
{{template "launch_tile" (dict "Slug" .Slug "BrandColor" .BrandColor "DisplayName" .DisplayName "Off" true)}}
|
|
<span class="launch-name">{{.DisplayName}}</span>
|
|
<span class="launch-off-label">{{.Label}}</span>
|
|
</div>
|
|
{{end}}
|
|
{{end}}
|
|
</div>
|
|
{{else}}
|
|
<div class="empty-state">
|
|
<p>Jelenleg nincs elérhető alkalmazás.</p>
|
|
</div>
|
|
{{end}}
|
|
</main>
|
|
</body>
|
|
</html>
|
|
{{end}}
|