Webstar/LibrePortal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: correct the lp-shot auth note — it signs its own session

Browse Source 
The previous note was wrong: it said lp-shot needs a session handed to it
in the environment and that agents should ask the maintainer for one.

It doesn't. The backend keeps {username, passwordHash, jwtSecret} in
frontend/.auth.json and mints cookies as jwt.sign({sub}, jwtSecret), so a
tool on the host signs the same token /api/auth/login would issue — no
password anywhere (the stored one is a bcrypt hash). The env overrides
are only for shooting a remote instance.

Also note the boot-splash wait, since a splash in the PNG now means boot
actually stalled rather than the tool firing too early.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
librelad 2026-08-18 22:05:51 +01:00
parent 2ea6340139
commit 133f54cd4f
1 changed files with 11 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
CLAUDE.md
View File

@ -18,13 +18,17 @@ Use it (and read the PNG) to self-check UI work instead of assuming it looks rig
asking the user to look. Skip it for purely backend/non-visual edits. If `lp-shot`
isn't present, fall back to asking the user for a screenshot.
Every route except `/` is behind the WebUI login, so `lp-shot` needs a session in
the environment — `LP_SHOT_TOKEN` (the `libreportal_token` cookie) or
`LP_SHOT_USER` + `LP_SHOT_PASS`. Without one it stops with that message rather
than screenshotting the sign-in box. Only the maintainer sets those: ask them to
export it (or to run the `lp-shot` command for you) — never go looking for the
credentials yourself. `lp-shot --help` lists the rest (`LP_SHOT_URL`,
`LP_SHOT_VIEWPORT`, `LP_SHOT_SCALE`, …).
Every route except `/` is behind the WebUI login, and `lp-shot` handles that
itself — it signs a one-hour session from the `jwtSecret` the backend stores in
`frontend/.auth.json`, the same token `/api/auth/login` would issue. No password
is involved (the stored one is a bcrypt hash). So no setup: just run it. Override
with `LP_SHOT_TOKEN`, or `LP_SHOT_USER`+`LP_SHOT_PASS`, when shooting a remote
instance. `lp-shot --help` lists the rest (`LP_SHOT_URL`, `LP_SHOT_VIEWPORT`,
`LP_SHOT_SCALE`, …).
If a shot comes back as the boot splash, the page wasn't ready — `lp-shot` waits
for `#libreportal-loading-screen` to leave the DOM, so a splash in the PNG means
boot genuinely stalled. Read the `page error:` lines it prints to stderr.
Testing against the live WebUI means updating the running install, not just the
repo: `/libreportal-containers/libreportal/frontend/` is bind-mounted into the