6 Commits

Include renames

Author	SHA1	Message	Date
Hermes	94ee76e9de	[grade=A urn:ump:josd2g7kqv476vux6euigmygdkijya2s4tsbyivtobw5ftzuf6ba] fix(DC-170): revive 19 CSP-blocked inline handlers across the dashboard — audit P0-3 ... The meta CSP (no unsafe-inline/unsafe-hashes) blocks ALL inline event handlers; 19 controls were silently dead in every modern browser. Revived: - Disk Safety: toolbar button, injected modal Close/Save/Clean Up, and the 5 settings sliders (oninput -> input listeners; value labels never updated) - AI chat FAB click; hover scale moved to a #ai-chat-fab:hover rule - TOTP/login logo broken-image fallbacks: capture-phase error delegation + WeakSet + complete/naturalWidth race guard in totp-auth.js; updateTotpLogo never resurrects a broken logo (6 onerror attrs stripped from index.html + auth-gate.js templates) - favicon-preview data-URI fallback (same race guard) - app-selector folder-chip remove buttons (data-remove-folder) - premium upsells in backup-restore + workflows (data-upgrade-msg) — their old onclick also called scrollToSection('license'), a function that has never existed anywhere in the codebase; now opens the real license UI via window.openLicenseModal (license.js) - health-check Edit/Delete dispatch the same CustomEvents via data-health-action/data-service-id - smart-arr Test button via data-smart-test Verified: zero inline handler attributes remain across index.html + hand-written js (grep); node --check clean x12; status suite 68/68; dist rebuilt (SW dashcaddy-shell-36d9aa3364, CSP hash unchanged). r1 grade C (missed sliders + logo onerror) -> r2 grade A: urn:ump:mptri3qhywc2e47f2ba4qjafhwm3olzvrvt5vphxoyhea3vgt32a / urn:ump:josd2g7kqv476vux6euigmygdkijya2s4tsbyivtobw5ftzuf6ba	2026-10-28 00:48:32 -07:00
Hermes	84edb035e3	[grade=B] feat(auth): onboard missing credentials into encrypted vault	2026-08-22 05:41:38 -07:00
Hermes	d313b1e872	[grade=B] fix(auth): reuse valid session for cross-host SSO	2026-08-22 04:06:27 -07:00
Krystie	003b152230	[grade=A] fix(auth): preserve cross-host SSO return URLs ... Codex: urn:ump:endpmb3rgtqogn2u2jkbbjmsaha6ysjjcxl46fd27ayig5yosawq	2026-07-24 14:36:28 -07:00
Hermes Agent	c54739e110	DC-049 follow-on: email fallback link on TOTP-only overlay ... When only TOTP is enabled (today's production state for everyone), auth-gate.js was falling through to the legacy TOTP overlay with no visible path to the email provider. The email method was unreachable from the UI even when configured. Fixed: append a small 'Or sign in with email instead ->' link to the bottom of the TOTP card. Clicking swaps the body to the email challenge form. Why this matters even for the single-totp path: email is the phone-friendly, no-app-required recovery path. Operator forgets their TOTP secret at 2am, they can request a link without touching the authenticator app. The link just wasn't reachable before. Renders the link only when the methods response includes both totp and email — preserves the truly-single-provider case unchanged.	2026-07-20 02:21:59 -07:00
Hermes	923ce8c300	DC-049 auth gate UI: pluggable provider selector + email challenge ... New module status/js/auth-gate.js owns the Caddy ?auth=required flow. On load it queries GET /api/v1/auth/login/methods to discover which AuthProviders are configured. Three branches: * 0 providers → legacy TOTP overlay (delegates to window._showTotpOverlay) * 1 provider (totp only) → legacy TOTP overlay (delegates, no UI change) * 2+ providers → provider selector with 'Sign in with …' buttons Email provider challenge is a single email input + 'Send sign-in link' button. POST to /api/v1/auth/login/email/initiate. On success the UI shows 'check the server logs' message if deliveredVia == 'dev-console' (production hosts without SMTP fall back gracefully) or 'check your inbox' when SMTP is configured. TOTP button just calls window.location.reload() — simplest path because totp-auth.js wires the 6-digit input handlers at module-load time, and a reload re-runs all IIFEs with the original markup. Same behavior as the legacy single-provider path. Coordination with totp-auth.js: auth-gate.js sets window.__dc_049_handled = true at IIFE entry. totp-auth.js's top-level ?auth=required check reads that flag and skips its own UI when set — eliminates the flicker in multi-provider installs. Single-provider installs still work because the legacy code path is unchanged (auth-gate delegates to it). Bundle order in build.js: auth-gate.js BEFORE totp-auth.js so the flag is set in time. Webpack-style bundle markers verified offline: __dc_049_handled, auth-gate-email-input, provider-btn, _showAuthGate, totp_redirect all present in dist/core.js (now 20 files, 248KB raw / 153KB min). New SW cache hash dashcaddy-shell-680e230383 (was 743f9c17b0).	2026-07-20 02:17:12 -07:00