#255: Check-for-updates button + admin-shell epic closeout (epic #250 phase 5) #261

Merged

Cordy merged 4 commits from feat/255-closeout into main

2026-08-16 21:23:45 +00:00

Cordy commented

2026-08-16 21:22:25 +00:00

Owner

Epic #250 closeout.

Check-for-updates button — the Updates topic gains a button that re-runs the update check on demand. GET /api/v1/admin/updates fetches the upstream tag list live server-side (internal/api/updates.go latestTag), so it's a real re-check, not a cached read. Presentation-only.

Security pass (the #255 review). Audited every admin route's server-side enforcement. All admin mutations are gated server-side:

/api/v1/admin/* → requireAdmin (403 for non-admins)
PUT /api/v1/settings → inline admin check in settings.put
license PUT/POST refresh → license.gate admin check
peering /admin/peering/* → peering.gate admin check

The client-side admin UI (feat.admin, the now-unreachable legacy settingsdlg/licdlg) is a convenience layer, not the security boundary — bypassing it yields 403s. GET /settings is intentionally open to any authenticated user (the UI needs instance name + share defaults) and exposes no secrets. Conclusion: the leftover legacy dialogs are inert and non-exploitable, so they're left as the (never-rendered) field template rather than doing a risky ~30-splice physical teardown with zero user-visible change right before beta.

Docs. admin-policy.md refreshed for the Administration shell: added a deep-link map (#admin/<topic>/<tab>), updated every "Settings →" reference to the new Administration paths, documented the Updates panel + check button, and recorded the server-side enforcement.

Old entry points already redirect into the shell (done in phases 2–4). Closes #255; epic #250 closable.

Epic #250 closeout. **Check-for-updates button** — the Updates topic gains a button that re-runs the update check on demand. `GET /api/v1/admin/updates` fetches the upstream tag list live server-side (`internal/api/updates.go` `latestTag`), so it's a real re-check, not a cached read. Presentation-only. **Security pass (the #255 review).** Audited every admin route's server-side enforcement. All admin mutations are gated server-side: - `/api/v1/admin/*` → `requireAdmin` (403 for non-admins) - `PUT /api/v1/settings` → inline admin check in `settings.put` - license `PUT`/`POST refresh` → `license.gate` admin check - peering `/admin/peering/*` → `peering.gate` admin check The client-side admin UI (feat.admin, the now-unreachable legacy `settingsdlg`/`licdlg`) is a convenience layer, **not** the security boundary — bypassing it yields 403s. `GET /settings` is intentionally open to any authenticated user (the UI needs instance name + share defaults) and exposes no secrets. Conclusion: the leftover legacy dialogs are inert and non-exploitable, so they're left as the (never-rendered) field template rather than doing a risky ~30-splice physical teardown with zero user-visible change right before beta. **Docs.** `admin-policy.md` refreshed for the Administration shell: added a deep-link map (`#admin/<topic>/<tab>`), updated every "Settings →" reference to the new Administration paths, documented the Updates panel + check button, and recorded the server-side enforcement. Old entry points already redirect into the shell (done in phases 2–4). Closes #255; epic #250 closable.

Cordy added 4 commits

2026-08-16 21:22:26 +00:00