sjg/trx-rs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Refactor HTTP account system
CI / frontend (pull_request) Successful in 5m13s
Details
CI / reuse (pull_request) Successful in 29s
Details
CI / frontend (push) Successful in 4m15s
Details
CI / reuse (push) Successful in 5s
Details
CI / lint (pull_request) Successful in 2m25s
Details
CI / test (pull_request) Successful in 9m24s
Details
CI / lint (push) Successful in 2m23s
Details
CI / test (push) Successful in 8m19s
Details

Browse Source
This commit was merged in pull request #61.
This commit is contained in:
sjg
2026-08-10 23:47:51 +02:00
parent d539ff96e5
commit 3c3fc69542
30 changed files with 1115 additions and 462 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/UX_Guidelines.md
+10 -11
View File
@@ -121,13 +121,12 @@ The spectrum panel uses `<canvas>` elements (WebGL renderer optional) and offers
When auth is enabled, an **auth gate** blocks the UI with:
- Title: "Access Required"
- Subtitle: "Enter passphrase to continue"
- Password input + Login button (green accent, full-width)
- Optional "Continue as Guest" button (shown when RX passphrase is not set)
- Subtitle: "Sign in to continue"
- Username and password inputs + Login button (green accent, full-width)
- Error message area (red `#ff6b6b`)
- Role badge display
Two roles: **Rx** (read-only) and **Control** (full access including TX/PTT).
Two roles: **User** (read-only) and **Admin** (full access including user management).
Session cookie: `trx_http_sid`, HttpOnly, configurable Secure and SameSite attributes.
@@ -340,21 +339,21 @@ Routes are classified into three tiers:
| Tier | Examples | Requirement |
|---|---|---|
| **Public** | `/`, `/index.html`, `/map`, `/auth/*`, static assets | None |
| **Read** | `/status`, `/events`, `/audio`, `/decode`, `/spectrum`, `/bookmarks` | Rx or Control role |
| **Control** | `/set_freq`, `/set_mode`, `/set_ptt`, `/toggle_power`, all other POST | Control role only |
| **Public** | `/`, `/index.html`, `/map`, login/session endpoints, static assets | None |
| **Read** | `/status`, `/events`, `/audio`, `/decode`, `/spectrum`, `/bookmarks` | User or Admin role |
| **Control** | `/set_freq`, `/set_mode`, `/set_ptt`, `/toggle_power`, all other POST | Admin role only |
### 7.2 Session Management
- Sessions are 128-bit random hex tokens stored in HttpOnly cookies
- Configurable TTL (default from TOML config)
- Expired sessions auto-pruned on access
- Constant-time passphrase comparison to mitigate timing attacks
- Passwords are verified against salted Argon2id hashes
### 7.3 TX Access Control
### 7.3 User Management
An additional `tx_access_control_enabled` flag can restrict transmit-related actions even
for Control-role users, providing an extra safety layer.
Only administrators can list, add, update, or remove accounts. The final
administrator cannot be removed or demoted.
---