Public/Live_RC
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(auth): add optional admin PIN for all API writes

Browse Source 
Off by default. Once a PIN is set in Settings -> System & backup, every non-GET /api/*
request (plus GET /api/ammc/config) needs a signed 30-day HttpOnly cookie, which also
closes the unauthenticated /api/update/run restart trigger. A 401 opens a PIN dialog
and the pending save is retried after login. Reads stay open because the public overlay
hydrates through GET /api/state. Optional RC_ADMIN_ALLOWED_CIDRS restricts the same
routes by client address.

The PIN hash and signing secret live in data/, outside the app_state blob, so they
never leak through GET /api/state, exports or backups.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
larssand
2026-09-24 22:14:58 +02:00
parent bcd6e12a6c
commit 9016ce02e4
20 changed files with 627 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
CHANGELOG.md
View File

@@ -8,6 +8,13 @@ The application version is maintained in `package.json` and displayed in the adm
No changes recorded yet.
## 1.22.0 - 2026-09-24
### Added
- Optional admin PIN (Settings -> System & backup). Off by default; once set, every change through the API - including starting an update/restart - needs the PIN, entered once per browser and remembered for 30 days. A login dialog appears automatically when a change is blocked. Reading data and public overlay/training links are unaffected.
- Optional `RC_ADMIN_ALLOWED_CIDRS` environment variable to restrict changes to specific IP addresses/subnets.
## 1.21.2 - 2026-09-12
### Changed