fai/chain-studio
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(settings): hub auth-policy panel — T4/T5 security parity in the GUI
Some checks failed
Security / Security check (push) Failing after 1s
Details

Browse source 
Settings → Security now shows the hub's effective auth policy via the
new read-only AuthStatus RPC: active token validator (static / jwt-rs256
with issuer, audience, JWKS source), anonymous-access warning, per-token
cards with scope grants, env-var presence and rate limits, plus a
localized admin-denied story for non-admin tokens. Live-reloads on
endpoint change.

Also fixes a batch of fai→chain rename leftovers this panel's
verification uncovered: hub_auth_token.dart and registry_token.dart
read/wrote ~/.fai/ while the hub reads ~/.chain/ (stored registry
tokens never reached the hub), today_story_loader + tools/today used
~/.fai/today, chain_log legacy ~/.fai/logs migration removed per the
no-legacy-recognisers decision, and UI strings still advertised the
retired .fai bundle extension.

Includes 5 widget tests for the panel, an integration-test screenshot
harness (auth_policy_shots_test.dart, guide-shots style), and DE+EN
l10n. flutter analyze clean, 58 tests green.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
This commit is contained in:
flemming-it 2026-07-15 03:19:33 +02:00
parent c6da5025ce
commit efaa089454
18 changed files with 1208 additions and 74 deletions
Download patch file Download diff file Expand all files Collapse all files

26
lib/data/chain_log.dart
View file

@ -51,31 +51,7 @@ class ChainLog {
Platform.environment['HOME'] ??
Platform.environment['USERPROFILE'] ??
'.';
final path = p.join(home, '.chain', 'logs', 'studio-errors.log');
_migrateLegacyLog(home, path);
return path;
}
// Pre-rename installs wrote to `~/.fai/logs/`. Move that file (and
// its rotation sibling) over once so the error trail survives the
// rename; never overwrite an existing new-path file. Best-effort
// and cheap enough to run per access (two stat calls after the
// first migration).
static void _migrateLegacyLog(String home, String newPath) {
try {
for (final suffix in const ['', '.1']) {
final legacy = File(
p.join(home, '.fai', 'logs', 'studio-errors.log$suffix'),
);
final target = File('$newPath$suffix');
if (legacy.existsSync() && !target.existsSync()) {
target.parent.createSync(recursive: true);
legacy.renameSync(target.path);
}
}
} catch (_) {
// Best-effort: a failed migration must not break logging.
}
return p.join(home, '.chain', 'logs', 'studio-errors.log');
}
/// Absolute path of the studio-errors log. Public so the