timothy
fba5233caf
168 records -> docs/decisions/records/<area>/<topic>.md (163 active, 23 dirs) and docs/decisions/archive/<area>/<topic>.md (5 archived). The filename IS the key, so one-active-record-per-key becomes a filesystem property rather than a validator check, and supersession becomes a `git mv`. WHY: the monolith was a concurrency problem before an aesthetic one. A 3,900-line append target made parallel sessions collide -- PR #605 and PR #614 both hit append-vs-append conflicts during routine rebases, and hand-resolving those inside the corpus is exactly the operation the rationale-rewrite guard exists to police. HOW IT IS VERIFIED: a ~170-file diff cannot be meaningfully read, so correctness does not rest on reading it. The parser was taught BOTH formats first, so the body-diff guard parses the old form at the merge-base and the new form at head -- the migration validates itself, no bypass. The proof is a field-level equivalence harness: 168 records before and after, zero lost, zero gained, zero field mismatches, zero rationale bodies differing. Reviewers should scrutinise the harness; it is the actual evidence. What measuring caught that reading would not have: - ~500 lines sit OUTSIDE any record -- decisions.md's lifecycle schema and each topic file's preamble, mostly the only copy. Source files are kept and stripped, never deleted. They also cannot be filed per-area: topic files hold several areas and 4 of 23 areas span several files. - Archive discovery was a non-recursive glob; after the split it found ZERO archived records, surfacing as four bogus "supersedes points to unknown key" errors rather than an obvious failure. - ~32 live docs point into the corpus BY DATE, which the split dangles. Each stripped file now ends with a generated "Records formerly in this file" index, which also rescues the identical breadcrumbs in old issue comments. - decisions.md's "In this file:" list was 97 same-file anchor bullets that the split makes WRONG, not merely stale. Dropped; the generated index replaces them with links that resolve. The equivalence harness now runs against a checked-in FIXTURE, not the live corpus. The earlier version migrated the real tree, which made it a one-shot: the moment the migration landed there was nothing left to move and the tests failed for reasons unrelated to the code. A fixture keeps them testing the SCRIPT rather than the repo's current state. Keys preserved verbatim, warts included: `sched` (12) and `scheduling` (1) remain two directories for one concept. Renaming a key is not a move -- it changes identity, breaks the equivalence proof, and invalidates MemPalace's per-key drawers. Taxonomy normalisation is separate work. refs #610
4.1 KiB
key, title, status, since, supersedes, superseded-by, rule, signals, mechanics
| key | title | status | since | supersedes | superseded-by | rule | signals | mechanics |
|---|---|---|---|---|---|---|---|---|
| security.session-cutover-postify | 2026-07-12 — #295 PR2: SPA session cutover + #301 side-effecting-GET POST-ification | active | 2026-07-12 | none | none | The browser SPA authenticates cookie-only (no more `X-Api-Key` from `web/`); the machine key is repurposed to external/MCP-only via `GET /api/auth/machine-key`; every side-effecting GET/HEAD under `/api` is converted to POST so the existing CSRF gate covers it (standing rule: never add a side-effecting GET/HEAD under `/api`). | SPA cookie-only cutover, CSRF POST-ification, AuthGate boot flow · paths: `web/src/api/client.ts`, `web/src/AuthGate.tsx` · issues: #295, #301, #197 | `docs/spa-conventions.md` §5e; `docs/api-conventions.md` §9; `docs/e2e-local.md` |
PR1 shipped the server side (previous entry): /api accepts a session cookie OR the machine X-Api-Key, with
X-CSRF required on session-authenticated mutations. PR2 is the SPA cutover — the browser now authenticates
with the session only — plus #301 (a session-cookie CSRF hole in side-effecting GETs).
Browser is cookie-only; the machine key is external/MCP-only. web/src/api/client.ts no longer attaches
X-Api-Key; it relies on the same-origin session cookie and sets X-Csrf: '1' on every mutating verb centrally.
The former "paste your key" ApiKeyScreen is repurposed to machine-key management: it reads the server key
from the new GET /api/auth/machine-key (session-gated; masked with Reveal + Copy) so an operator can hand it to
MCP / external REST clients — the browser itself never sends it again. Why: one credential per audience (the
ratified #295 model); leaving a browser key path alive would keep a CSRF-immune bypass around and defeat the
point.
Boot gate, not a route (web/src/AuthGate.tsx, wrapping <App/> in main.tsx): on load it calls the public
GET /api/auth/config then GET /api/auth/session and renders Setup (first-run local-admin claim) / Login
(local form + an OIDC "Sign in with SSO" button when oidcEnabled) / the app. Login and Setup mint no URL —
the gate renders them at whatever /app/* path was requested, so a deep link survives login for free and no
blazor-route-parity.md/domain-model.md route rows are added. It publishes AuthContext
({ username, method, signOut, requireLogin }); the 401 signal (notifyUnauthorized) now drives re-login via a
passive shell banner (never yanks a dirty draft — it consults the navigation guard first). Auth flows that expect
a 401 inline (login, change-password) pass suppressUnauthorizedSignal.
#301 — POST-ify, don't gate-the-GET. A side-effecting GET is a CSRF vector once a SameSite=Lax cookie is a
normal credential (it rides a cross-site top-level navigation). The three offenders became mutating verbs so the
existing filter CSRF gate covers them with zero new machinery: GET /api/troubleshoot/playback.m3u8 →
POST /api/troubleshoot/playback/start returning 200 { url } (the open /iptv manifest the player then
loads — so hls.js/native-HLS needs no header injection, strictly better than X-CSRF-on-GET); the archive and
sample GETs → POST (SPA downloads them via a fetch-blob helper, never window.open). Removing the HEAD
variants also fixed a latent bug: a HEAD opened the DeleteOnClose stream and destroyed the artifact. Standing
rule added to api-conventions.md §9: never add a side-effecting GET/HEAD under /api.
Machine-key GET discloses the key to any authenticated session — deliberate: the session principal is the
single admin (local or OIDC), same-origin policy blocks a cross-site page from reading the response body, and it
is how the "copy the key for MCP" UX works without a rotation endpoint (rotation is a later PR). Accepted
residual (OIDC logout): POST /api/auth/logout ends the app cookie but not the IdP session, so an OIDC user
who clicks "Sign out" then "Sign in with SSO" returns without re-entering credentials — a returnUrl/RP-initiated
logout is a future nicety. Docs: spa-conventions.md §5e (SPA seams), api-conventions.md §9, e2e-local.md
(browser setup/login flow). Refs #295 #301 #197.