felhom-controller/REPORT.md

REPORT — v0.320.0: FileBrowser is part of the box again, every app says where its login is, a „Fájlok" button (2026-10-16)

Written in ASD-STE100 Simplified Technical English. Task: „logins and folders" (operator brief). The full report, with the decisions taken, the browser check and the rows: felhom.eu REPORT-logins-folders-2026-10-16.md. Design read first: felhom.eu architecture/02-controller-module-map.md „The app page" (now with „Logins and folders"). Evidence: felhom.eu documentation/audits/logins-folders-2026-10-16/.

1. Plain words first

• Why FileBrowser showed „Telepítés": it has no app.yaml, so the box marks it not deployed. Since v0.315.0 the app page read only that mark. Now a protected infra stack is installed by definition on the app page. Its login is back.
• The Install press could have installed the infra stack as an app (no guard). Refused now, in the API and in DeployStack.
• „Új jelszó beállítása": when the box does not know FileBrowser's password, one press sets a new one with FileBrowser's own CLI (server stopped ~3 s), verifies it, and stores it encrypted. Pressed on demo-hp: it works.
• Every installed app has „Belépés az alkalmazásba" with one answer; the catalog's new app_info.login_kind picks the sentence when the box holds no login.
• „Fájlok ↗" opens one folder of the app in FileBrowser; the data tab lists each drive's media folders.

2. Commits and images

39bf562 (v0.319.0) → f30a808 (the work) → 1296e7a (the FileBrowser line's link style, seen in the browser) → this docs commit. Built from the clean clone with its own build.sh: 0.320.0-rc.1, rc.2 (demo-hp only), release 0.320.0 (MinAgent 0.158.1).

3. What changed

• web/app_page.go: installed = Deployed || Infra; infra tabs settings/guide/logs; data tab and install page 302 for infra; the settings tab skips the install form for infra and sets LoginAnswer.
• web/handlers.go (appCommonData): Infra, InfraInfo, the infra subdomain, FilesLink; appFileBrowserResetHandler. web/server.go: the reset route.
• web/app_login.go: loginAnswerFor. web/datapath_card.go: media folder rows, drivePresent, filesButtonLink, a folder with no source is text. web/inframeta.go: infraMetaIn.
• stacks/filebrowser_password.go: ResetFileBrowserAdminPassword, fileBrowserCLISetPassword. stacks/deploy.go + api/router.go: the protected-stack refusal. stacks/metadata.go: AppInfo.LoginKind, EffectiveLoginKind.
• Templates: app_settings.html (one login panel, infra Restart only), app_shell.html (infra tagline, „Fájlok ↗"), app_data.html (text rows, the FileBrowser line), app_guide.html (infra two lines); style.css.

4. Tests and gates

Red-proved: TestAppPage_InfraAppHasNoInstall, _EveryInstalledAppHasOneLoginAnswer, _FilesButtonTarget, _UnknownSourceIsTextNotLink, TestFileBrowserReset_SetsVerifiesAndStoresEncrypted, _FailedVerifyKeepsOperator, _OnlyInOperatorState, TestDeployStack_RefusesProtectedStack (mutations and failures: felhom.eu audits/logins-folders-2026-10-16/redproof.txt). Also TestFileBrowserResetEndpoint_Refusals, TestEffectiveLoginKind_DefaultAndUnknown. Green gate go build/vet/test ./... rc 0; controller_gates.py --fast all OK. Parity fixtures: 25 re-captured, 6 new (named in the CHANGELOG); every other one byte-identical.

5. Observations

1. One sign-in for the dashboard and FileBrowser. FILED: R-1100.
2. FileBrowser's stored password goes stale when changed in FileBrowser. FILED: R-1101.
3. Eight apps say „starts with a known, shared password" about a generated or typed login. FILED: R-1102.
4. The install button could deploy a protected stack. NOT-A-FINDING: small, fixed in this release with a test.