Commit `4ffdc2c645`

4ffdc2c645a82458594f2b5cf72bf7c87de7b4c2

parent: 8a379d4719

Verified · cmc ci/build: success ci/test: success

cmc <hello@cleberg.net> · 2026-09-28 09:03 UTC

wiki: fix API token-refusal claim, batched-review status, watch/pin dispatch, login-link URL exception

Closes #261

Layout: unified · split

.gitbay/wiki/API.org +3 −2

	@@ -59,8 +59,9 @@ the command wrote diagnostics:
59		59
60	HTTP status maps the exit code: 0→200, 2→400, 3→404, 4→403, else 500.	60	HTTP status maps the exit code: 0→200, 2→400, 3→404, 4→403, else 500.
61	Commands that emit raw text rather than an envelope (=help=, =mr diff=)	61	Commands that emit raw text rather than an envelope (=help=, =mr diff=)
62	come wrapped as ={"output": "..."}=. Git transport commands and the	62	come wrapped as ={"output": "..."}=. Git transport commands are refused
63	token commands are refused by name.	63	by name; the token commands are not — a full-scope token can mint,
		64	list and revoke tokens the same way it can run anything else.
64		65
65	#+begin_src sh	66	#+begin_src sh
66	curl -s -H "Authorization: Bearer $TOKEN" \	67	curl -s -H "Authorization: Bearer $TOKEN" \

.gitbay/wiki/Parity.org +12 −7

 fifth state, so every =state = 'open'= rule still means what it did.
 =mr revisions= lists the heads a merge request has had; the web page
 lists them beside the reviews they staled, and the iOS client has a
-Revisions section. =mr range-diff= compares two heads: the iOS client
+Revisions section. =mr range-diff= compares two heads: the iOS client shows it from a
-shows it from a revision to the one before, as text; the web has no
+revision to the one before, as text; the web has no view yet
-view. Batched review is not built.
+(krz/gitbay#269). Batched review — draft diff comments held with
+=mr comment --pending= and sent together with =--comment=/=--discard=
+or a verdict — is built and the web uses it: composing review
+comments before publishing them is the same round trip as the CLI's
+=--pending= flag.
 =mr review request --add <user>= asks a *particular* person, who then
 carries the merge request in their queue and is notified; =--remove=
 | bookmark list               | yes | yes | yes |
 | bookmarks on your profile   | n/a | yes | no  |
 | watch, unwatch              | yes | yes | yes |
-| mute                        | yes | no  | yes |
+| mute                        | yes | yes | yes |
 | settings, protection        | yes | yes | yes |
 | default branch              | yes | yes | yes |
 | merge requests only         | yes | yes | yes |
 private drops out of the listing rather than leaking that it exists
 (krz/gitbay#146).
-The web's watch and pin controls write the store directly instead of
+The web's watch and pin controls dispatch =repo pin=/=repo unpin= and
-dispatching =repo watch= and =repo pin=. That is why the web cannot
+=repo watch=/=repo mute=/=repo unwatch=, the same commands the CLI runs
-mute: its toggle knows watching and default only.
+(krz/gitbay#261). The single watch button cycles default, watching and
+muted.
 Dependency checks are off until a repository's admin turns them on: the
 check tells a public registry what the repository depends on. =repo deps

.gitbay/wiki/Threat-Model.org +9 −4

 - *Serve repository HTML on its own origin as active content.* Raw file
   serving is =text/plain= with =nosniff=. Rendered markdown/org is
   sanitized (bluemonday) and served under a CSP that forbids scripts.
-- *Put secrets in argv, URLs, or logs.* Import and mirror credentials,
+- *Put secrets in argv, URLs, or logs, with one documented exception.*
-  registration invites, and API tokens travel on stdin or in request
+  Import and mirror credentials, registration invites, and API tokens
-  bodies, never as command arguments (visible in =/proc=) or query
+  travel on stdin or in request bodies, never as command arguments
-  strings. Tokens are stored only as SHA-256 hashes.
+  (visible in =/proc=) or query strings. The one exception is the
+  emailed login link, =/login?token=...=: single-use, 15-minute expiry,
+  and the response that consumes it carries =Cache-Control: no-store= so
+  no intermediary keeps a copy. An operator running gitbay behind a
+  reverse proxy should configure that proxy to strip the query string
+  from its own access logs. Tokens are stored only as SHA-256 hashes.
 - *Name a mail recipient in the log.* A queued mail is logged by its
   queue row id, never by address, and the relay's own error is redacted
   before it is logged because a rejection usually quotes the address it

CHANGELOG.org +3

	@@ -110,6 +110,9 @@ for the eighteen commands whose CLI path differs from the registry's
110	- The response that consumes a login link's =?token== sends	110	- The response that consumes a login link's =?token== sends
111	=Cache-Control: no-store=, so no intermediary keeps a copy of the	111	=Cache-Control: no-store=, so no intermediary keeps a copy of the
112	single-use URL (#261).	112	single-use URL (#261).
		113	- Wiki documentation fixes: API.org clarifies token commands work on the
		114	API, Parity.org documents batched review and web watch/pin dispatch,
		115	Threat-Model.org documents the login-link URL exception (#261).
113		116
114	* v1.36.0 — 2026-09-23	117	* v1.36.0 — 2026-09-23
115		118

Commit 4ffdc2c645

Commit `4ffdc2c645`