| Comment: | web: cookie sessions and a login page
Basic auth works and stays for the API, but a browser has no way to log out of it and the credential lives in the browser's keeping. A gated page now redirects to /login instead of raising a Basic prompt, the header names who is signed in and offers sign-out, and Basic remains for scripts. Session tokens are stored as SHA-256 digests, so the table cannot be read back into working cookies. Cookies are HttpOnly, Path=/, SameSite=Lax — Lax being what stops another origin POSTing quarry's write forms on a reader's behalf — and Secure under TLS. A password change or an account deletion ends that account's sessions; otherwise 'change your password' would leave the browser already holding one still signed in. Authorization for a cookie runs the same RoleOf lookup the password path uses, so a cookie is never worth more than a password. safeNext keeps the post-login redirect on this site: a reader is at their most trusting on the hop straight after authenticating, which is exactly when an open redirect pays. |
|---|---|
| Timelines: | family | ancestors | descendants | both | trunk |
| Files: | files | file ages | folders |
| SHA3-256: |
7bdf7a189b4ba57fb89cbcbe0dd81fb1 |
| User & Date: | dmestas on 2026-08-17 00:10:56.637 |
| Other Links: | manifest | tags |
|
2026-08-17
| ||
| 00:19 |
notify: authenticate triggers, and embed the inbox
Two things, one of them a live bug. notify's /v1 routes sit behind an API-key middleware and quarry's client sent no Authorization header, so every trigger it fired would have been answered 401. It went unnoticed because --notify was never configured and a trigger failure is logged rather than raised. --notify-key (or QUARRY_NOTIFY_KEY) supplies it, and serve says so at startup when it is missing rather than leaving the answer to be discovered in the log. The inbox is notify's, embedded (0001 §5): GET /v1/messages?channel=in_app for the signed-in account, rendered with unread emphasised. quarry models no notification state — it displays what notify owns. The wire field names are notify's Go field names: its domain.Message carries db tags but no json tags, so the encoder falls back to the identifiers. A test pins that, since decoding lowercase would silently produce empty subjects. An outage is not emptiness: a failed fetch says notifications are unavailable instead of showing an empty list, which would be a lie about whether anyone had written to you. check-in: e33f1c4e8c user: dmestas tags: trunk | |
| 00:10 |
web: cookie sessions and a login page
Basic auth works and stays for the API, but a browser has no way to log out of it and the credential lives in the browser's keeping. A gated page now redirects to /login instead of raising a Basic prompt, the header names who is signed in and offers sign-out, and Basic remains for scripts. Session tokens are stored as SHA-256 digests, so the table cannot be read back into working cookies. Cookies are HttpOnly, Path=/, SameSite=Lax — Lax being what stops another origin POSTing quarry's write forms on a reader's behalf — and Secure under TLS. A password change or an account deletion ends that account's sessions; otherwise 'change your password' would leave the browser already holding one still signed in. Authorization for a cookie runs the same RoleOf lookup the password path uses, so a cookie is never worth more than a password. safeNext keeps the post-login redirect on this site: a reader is at their most trusting on the hop straight after authenticating, which is exactly when an open redirect pays. check-in: 7bdf7a189b user: dmestas tags: trunk | |
|
2026-08-16
| ||
| 23:55 |
index: pin the artifacts that once vanished, and check corpus parity
Two nets for the same failure: an artifact that fails to parse becomes opaque content, so the record is simply absent and nothing reports it. TestAwkwardArtifactsSurviveIngest feeds shapes real repositories contain — empty C card, empty J value, empty T value, a titled technote, a forum post with no N card — through parse AND fold, asserting the row lands. Reverting the tokenizer fix fails all three empty-token cases, so the net catches what actually happened. TestCorpusParity compares a built index against fossil's own tables and is opt-in via QUARRY_PARITY, since the corpora are hundreds of megabytes. Known differences are listed individually with reasons, so anything else fails rather than being tolerated. It found one on its first run against libfossil: a wiki-tag-propagation-test tag that looks like a page name but is a tag applied to the FIXMEs artifacts. quarry was right and the ground-truth query could not tell the difference — recorded as such. check-in: 86b845671d user: dmestas tags: trunk | |