49 lines
3.0 KiB
Markdown
49 lines
3.0 KiB
Markdown
# felhom.eu — task reports
|
|
|
|
> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).
|
|
|
|
## Polish batch — hub v0.52.0 (F-15 instant reset codes + F-16 inline confirms) — 2026-07-13
|
|
|
|
Hub half of the polish batch (take-two findings F-15/F-16); companion controller v0.123.0.
|
|
Commits `bad9203` (F-15), `5d66c62` (F-16), `0e05c69` (manifest 0.52.0).
|
|
|
|
### What shipped
|
|
|
|
1. **F-15** (`internal/api/handler.go`): `POST /api/v1/claim/reset-request` returns the ACTIVE
|
|
claim state — `{claim: {code_hash, generation, issued_at}}`, the report ACK's exact shape and
|
|
bcrypt-only guarantee — so the box applies the rotated hash in the SAME request cycle and the
|
|
emailed code works immediately (was: next-ACK, ~15 min — Viktor's take-two live failure).
|
|
Served on every authorized outcome; a cap-reached refusal returns the unrotated row (a
|
|
controller-side no-op by generation). The operator "Kód újraküldése" keeps its ACK lag —
|
|
its flash + confirm copy now state it; the unmapped `claim-resent`/`claim-resend-failed`
|
|
flash codes finally render.
|
|
2. **F-16** (`templates/inline_confirm.html` + 4 templates + `scripts/hub_confirm_gate.py`):
|
|
every native `confirm()` in the hub UI replaced by the inline "question + Igen/Mégse"
|
|
two-step (`felhomConfirm` / `data-confirm` + `requestSubmit`, so `formaction` buttons riding
|
|
the parent form still work). Danger-zone typed-confirm untouched by design. Gate enforces
|
|
zero native confirm/prompt.
|
|
|
|
### Tests + red-proofs
|
|
|
|
- `TestClaimResetRequest_ResponseCarriesRotatedHash` (rotated hash == stored row, != pre-rotation
|
|
row, bcrypt-only). **Red-proof:** handler mutated to serve the pre-rotation row → FAIL
|
|
"response generation = 1, want the rotated one (stored 2)". Restored → green.
|
|
- `hub_confirm_gate.py` **red-proof:** one `onclick="return confirm('redproof')"` reintroduced →
|
|
exit 1; restored → 0. Full hub green gate (build+vet+test) before each commit.
|
|
|
|
### Deployed + live-validated
|
|
|
|
- ArgoCD app `felhom` **Synced/Healthy**, deploy/hub image `felhom-hub:0.52.0`, clean startup log.
|
|
- **F-15 live:** drill-box reset request → controller cached the response hash **1 s** after the
|
|
POST; Viktor re-ran his exact take-two failure path — emailed code **accepted immediately**.
|
|
- **F-16 live (its own regression test):** "Re-issue offsite credentials" on demo-vm-felhom
|
|
driven fully by browser automation — inline strip rendered, Igen → `?flash=offsite_reissued`,
|
|
**zero CDP freezing** (with v0.51.0 this exact click froze the session).
|
|
|
|
### Observations
|
|
|
|
- Take-two §4 dispositions updated: F-15 and F-16 SHIPPED (this batch); the zero-toggle obs.
|
|
shipped controller-side (v0.123.0).
|
|
- Remaining from take-two: **F-14** (tenancy re-attach dead-end — needs the operator ruling on
|
|
auto-Reissue vs never-silently-re-key) and the S5 DR-restore drill.
|