homelable

url/homelable

Fork 0

Commit Graph

Author	SHA1	Message	Date
Pouzor	5897be70c2	fix: timing-safe key comparison and network-error state in liveview Use hmac.compare_digest() to prevent timing-based key enumeration. Distinguish network failures from invalid-key errors in the frontend.	2026-03-28 15:30:09 +01:00
Pouzor	210304394e	feat: read-only live view at /view?key=<LIVEVIEW_KEY> Implements issue #5. Off by default; set LIVEVIEW_KEY in .env to enable. No JWT required — key-based auth via ?key= query param. Returns 403 when disabled or key is wrong. Read-only ReactFlow canvas (pan/zoom, no editing). Standalone mode loads from localStorage without a key. Includes 8 backend tests and 9 frontend tests.	2026-03-28 15:27:54 +01:00

Author

SHA1

Message

Date

Pouzor

5897be70c2

fix: timing-safe key comparison and network-error state in liveview

Use hmac.compare_digest() to prevent timing-based key enumeration.
Distinguish network failures from invalid-key errors in the frontend.

2026-03-28 15:30:09 +01:00

Pouzor

210304394e

feat: read-only live view at /view?key=<LIVEVIEW_KEY>

Implements issue #5. Off by default; set LIVEVIEW_KEY in .env to enable.
No JWT required — key-based auth via ?key= query param.
Returns 403 when disabled or key is wrong.
Read-only ReactFlow canvas (pan/zoom, no editing).
Standalone mode loads from localStorage without a key.
Includes 8 backend tests and 9 frontend tests.

2026-03-28 15:27:54 +01:00

2 Commits