Files
felhom.eu/documentation/audits/more-night-apps-2026-09-30/B/wger-probe.txt
T
admin 42bf40bd2c
gates / gates (push) Successful in 29s
More apps update themselves at night (30+2 -> 35+3); the same-name security-fix gap measured (R-740, decision for the operator)
- Twelve steps published on both venues (catalog): first ladders for calibre-web, gitea, wger,
  crafty-controller, uptime-kuma, zipline (two steps); within-major emby, ghost, home-assistant,
  outline, rallly. immich's step v3.0.3 -> v3.2.2 re-proven at 768M (Part D).
- Part C: the night leg skips a digest-only change AND the catalog never records a same-tag re-test,
  so a same-name upstream fix reaches no box. Row R-740; the decision in STATUS; `09` decision 30
  carries a dated note (the decision itself unchanged).
- Rows: 369 -> 377. Opened R-735..R-742; closed R-735, R-738, R-742; narrowed R-462, R-624, R-446,
  R-440, R-734, R-732. The currency audit gains §1b (and corrects its 31+1 to 30+2).

Evidence: documentation/audits/more-night-apps-2026-09-30/. Report: REPORT-more-night-apps-2026-09-30.md.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-09-30 20:27:28 +02:00

16 lines
1.4 KiB
Plaintext

# wger probe on bench 9401, 2026-09-30 ~17:25-17:33 CEST (catalog template, wger/server:2.6, build_env values)
# Recorded from the session's probe output; tokens and passwords not recorded.
GET /api/v2/ -> 200 (router index: weightentry, userprofile, ... ; no login/token route)
POST /api/v2/login/, /api/v2/token(/), /api/v2/auth/login/ -> 404
POST /allauth/app/v1/auth/login wrong password -> 400 JSON "The username and/or password you specified are not correct"
POST /allauth/app/v1/auth/login RIGHT password -> 500 text/html
container log: allauth/core/internal/jwkkit.py line 34 load_pem -> ValueError: Unable to load PEM file ... MalformedFraming
settings/main.py:109 JWT_PRIVATE_KEY = env.str('JWT_PRIVATE_KEY', '') (the template sets none) -> R-737
after_install command (template's own, password as last argument) -> FELHOM_AFTER_INSTALL_OK
GET /en/user/login -> 200 (form: csrfmiddlewaretoken, login, password)
POST /en/user/login (Origin/Referer https://wger.gate.invalid) -> 302, sessionid set
POST /api/v2/weightentry/ {"date":"2026-09-30T10:00:00Z","weight":"77.35"} with session + X-CSRFToken -> 201
GET /api/v2/weightentry/?weight=77.35 -> 200 count 1 (positive)
GET /api/v2/weightentry/?weight=12.34 -> 200 count 0 (negative: a weight never entered)
GET /api/v2/weightentry/?weight=77.35 without session -> 403 (negative: no login)