hub v0.135.0: CSRF on the Basic-auth path (R-135), console passwords sealed at rest (R-133), boxes left behind listed and alarmed (R-604, R-530), no-e-mail banner (R-508)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-10-05 11:12:56 +02:00
parent 9bb45eaaa2
commit 3d7a2761fc
24 changed files with 1148 additions and 17 deletions
@@ -83,6 +83,14 @@
        </div>
        {{end}}

+        {{if .WaitingNoEmail}}
+        <div class="flash flash-error">
+            <strong>No registered e-mail, and no box yet</strong> — the connect link and the setup code cannot reach
+            this household. Set an address on the Edit tab before you send the install guide (R-508); the link then
+            goes out by itself.
+        </div>
+        {{end}}
+
        {{if .OffsiteUnprovisioned}}
        <div class="flash flash-warn">
            <strong>Offsite is enabled but was never provisioned</strong> — no descriptor exists for