Webstar/LibrePortal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: correct the lp-shot auth note — it signs its own session

Browse Source 
The previous note was wrong: it said lp-shot needs a session handed to it
in the environment and that agents should ask the maintainer for one.

It doesn't. The backend keeps {username, passwordHash, jwtSecret} in
frontend/.auth.json and mints cookies as jwt.sign({sub}, jwtSecret), so a
tool on the host signs the same token /api/auth/login would issue — no
password anywhere (the stored one is a bcrypt hash). The env overrides
are only for shooting a remote instance.

Also note the boot-splash wait, since a splash in the PNG now means boot
actually stalled rather than the tool firing too early.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
librelad 2026-08-18 22:05:51 +01:00
parent 2ea6340139
commit 133f54cd4f
1 changed files with 11 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
CLAUDE.md
View File

@ -18,13 +18,17 @@ Use it (and read the PNG) to self-check UI work instead of assuming it looks rig
asking the user to look. Skip it for purely backend/non-visual edits. If `lp-shot` asking the user to look. Skip it for purely backend/non-visual edits. If `lp-shot`
isn't present, fall back to asking the user for a screenshot. isn't present, fall back to asking the user for a screenshot.
Every route except `/` is behind the WebUI login, so `lp-shot` needs a session in Every route except `/` is behind the WebUI login, and `lp-shot` handles that
the environment — `LP_SHOT_TOKEN` (the `libreportal_token` cookie) or itself — it signs a one-hour session from the `jwtSecret` the backend stores in
`LP_SHOT_USER` + `LP_SHOT_PASS`. Without one it stops with that message rather `frontend/.auth.json`, the same token `/api/auth/login` would issue. No password
than screenshotting the sign-in box. Only the maintainer sets those: ask them to is involved (the stored one is a bcrypt hash). So no setup: just run it. Override
export it (or to run the `lp-shot` command for you) — never go looking for the with `LP_SHOT_TOKEN`, or `LP_SHOT_USER`+`LP_SHOT_PASS`, when shooting a remote
credentials yourself. `lp-shot --help` lists the rest (`LP_SHOT_URL`, instance. `lp-shot --help` lists the rest (`LP_SHOT_URL`, `LP_SHOT_VIEWPORT`,
`LP_SHOT_VIEWPORT`, `LP_SHOT_SCALE`, …). `LP_SHOT_SCALE`, …).
If a shot comes back as the boot splash, the page wasn't ready — `lp-shot` waits
for `#libreportal-loading-screen` to leave the DOM, so a splash in the PNG means
boot genuinely stalled. Read the `page error:` lines it prints to stderr.
Testing against the live WebUI means updating the running install, not just the Testing against the live WebUI means updating the running install, not just the
repo: `/libreportal-containers/libreportal/frontend/` is bind-mounted into the repo: `/libreportal-containers/libreportal/frontend/` is bind-mounted into the