mirror of
https://github.com/maziggy/bambuddy.git
synced 2026-09-30 19:21:33 +02:00
maziggy
e9cddc544a
After the GHSA-r2qv gate (b7d7c825), /api/v1/ws needs a token from
POST /api/v1/auth/ws-token (Permission.WEBSOCKET_CONNECT). When the mint
failed, useWebSocket swallowed the error, opened a tokenless socket, the
server closed it 4401, and ws.onclose rescheduled connect() every 3s -
an endless loop that hammered /auth/ws-token. The dominant trigger is a
validly-logged-in user whose group lacks WEBSOCKET_CONNECT (mint returns
403). A secondary leak: the unmount-triggered onclose could schedule a
post-unmount reconnect.
Classify the mint failure: 401 (JWT expired; request() already clears it
and dispatches auth:expired) or 403 (valid session, missing permission;
degrade to REST polling) now stop the hook - no tokenless socket, no
reconnect. A 4401 close is terminal. Network/5xx still reconnect. A
disposedRef set in cleanup before close() prevents the unmount-race
reconnect. Same 401/403 no-open guard applied to StreamOverlayPage.
Also surface a one-line hint under the WebSocket permission in the group
editor (all 11 locales) explaining that live updates need it and fall
back to polling without it - rather than auto-granting the permission,
which would partly undo the GHSA-r2qv gate.
41 lines
1.8 KiB
HTML
41 lines
1.8 KiB
HTML
<!doctype html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8" />
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no" />
|
|
<!-- L-4: Restrict Referer header to origin-only on cross-origin navigation so
|
|
sensitive tokens in query parameters are not leaked to third-party servers. -->
|
|
<meta name="referrer" content="strict-origin-when-cross-origin" />
|
|
<title>Bambuddy</title>
|
|
|
|
<!-- PWA Meta Tags -->
|
|
<meta name="description" content="Monitor and manage your Bambu Lab 3D printers" />
|
|
<meta name="theme-color" content="#00ae42" />
|
|
<meta name="mobile-web-app-capable" content="yes" />
|
|
<meta name="apple-mobile-web-app-capable" content="yes" />
|
|
<meta name="apple-mobile-web-app-status-bar-style" content="black-translucent" />
|
|
<meta name="apple-mobile-web-app-title" content="Bambuddy" />
|
|
|
|
<!-- Manifest -->
|
|
<link rel="manifest" href="/manifest.json" />
|
|
|
|
<!-- Favicons -->
|
|
<link rel="icon" type="image/png" sizes="32x32" href="/img/favicon-32x32.png" />
|
|
<link rel="icon" type="image/png" sizes="16x16" href="/img/favicon-16x16.png" />
|
|
<link rel="apple-touch-icon" sizes="180x180" href="/img/apple-touch-icon.png" />
|
|
|
|
<!-- Splash screens for iOS -->
|
|
<link rel="apple-touch-startup-image" href="/img/android-chrome-512x512.png" />
|
|
<script type="module" crossorigin src="/assets/index-DnnRRVNb.js"></script>
|
|
<link rel="stylesheet" crossorigin href="/assets/index-BxVhuRti.css">
|
|
</head>
|
|
<body>
|
|
<div id="root"></div>
|
|
|
|
<!-- Service Worker Registration (skip on SpoolBuddy kiosk).
|
|
Kept as an external file so the CSP `script-src 'self'` covers it
|
|
without needing 'unsafe-inline' or per-build hashes. -->
|
|
<script src="/sw-register.js"></script>
|
|
</body>
|
|
</html>
|