diff options
| author | Anders Betts <anders.betts@gmail.com> | 2026-09-23 11:36:11 +0200 |
|---|---|---|
| committer | Anders Betts <anders.betts@gmail.com> | 2026-09-23 11:36:11 +0200 |
| commit | 1abb7649b930d35d1f5a76fd72856659b1ee8275 (patch) | |
| tree | 50d1d3dd905056b75749e22a58e7247e4a4bb0e2 /docs/PROTOCOL.md | |
| parent | 71a702f375750829c634b552217c9925d549828b (diff) | |
| download | bokf-1abb7649b930d35d1f5a76fd72856659b1ee8275.tar.gz bokf-1abb7649b930d35d1f5a76fd72856659b1ee8275.zip | |
web: bokftui in the browser (ttyd + bokfweb login gate); per-user login limitv0.1.69
New image bokf-web (Dockerfile target "web", compose service "web" on
127.0.0.1:8790): Caddy routing with forward_auth, the bokfweb login gate
(C, authenticates with bokfd's session.open, per-address limit, cookie +
terminal handle, one login handed to the TUI via /redeem) and ttyd running
bokftui in web mode in an isolated throwaway HOME. TLS stays with the
host's reverse proxy. BOKF_WEB=1 blocks every local file and viewer path in
the TUI. bokfd's login limiter is now per user name instead of one global
counter (5 wrong guesses from anyone locked out everybody), and a full
counter table no longer disables it. The cross build and deploy.sh build
and ship both images.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Diffstat (limited to 'docs/PROTOCOL.md')
| -rw-r--r-- | docs/PROTOCOL.md | 13 |
1 files changed, 10 insertions, 3 deletions
diff --git a/docs/PROTOCOL.md b/docs/PROTOCOL.md index 709a475..3c8ba54 100644 --- a/docs/PROTOCOL.md +++ b/docs/PROTOCOL.md @@ -85,7 +85,11 @@ and returns an opaque, high-entropy session id: intentional. API tokens survive restarts. - Sliding TTL, `session_ttl` default 8 h. `session.close` ends one explicitly. - Passwords are stored as Argon2id hashes. Failed logins are rate limited per - peer (default: 5 failures per 15 minutes, then `RATE_LIMITED`). + user name (5 failures per 15 minutes, then `RATE_LIMITED` for that name + only): guessing one account never locks out the others. The table of + counters replaces expired or least-failed entries when full, so flooding + it with names neither disables the limiter nor lifts a block. The web + gate (`bokfweb`) adds its own limit per client address in front of this. - A user changes their own password with `user.set_password` from a password session (a token session gets `FORBIDDEN`). The current password is required — 5 wrong ones per 15 minutes give `RATE_LIMITED` — and the @@ -946,7 +950,10 @@ commands. Implemented screens (0.1.0-dev): - **Inloggning** — server, user, password; org picker when several exist. **Byt bolag** in the main menu reopens the picker during the session; - **Byt lösenord** calls `user.set_password`. + **Byt lösenord** calls `user.set_password`. The same TUI runs in the + browser at `/web` (DEPLOY.md "Web frontend"): the login page opens the + session with `session.open` and the TUI reuses it; file features are + off there. - **Dashboard** — status line with org, fiscal year, role and user. - **Verifikat** — list and detail view (rows with column headers, an underlag section separated by a rule, hash, link to corrected voucher); `c` @@ -1122,7 +1129,7 @@ beyond the session and calls nothing but public commands. | `session_ttl` | `8h` | sliding session lifetime | | `max_line_bytes` | `1048576` | NDJSON line limit | | `max_attachment_bytes` | `10485760` (10 MiB) | decoded attachment limit | -| `auth_fail_limit` | `5/15m` | login rate limit per peer | +| `auth_fail_limit` | `5/15m` | login rate limit per user name (fixed in the code) | | `synchronous` | `FULL` | SQLite durability (`FULL`/`NORMAL`) | | `audit_reads` | `false` | log read commands too | | `allow_org_create` | `true` | any user may create an org | |