mirror of
https://github.com/narrrl/narl-workspace.git
synced 2026-11-03 16:41:27 +01:00
nvrl
f629f5af97
POST /api/capture takes a line of text and puts it on a card in an inbox, or at the end of today's diary entry, starting the entry when there is none yet. It answers a logged-in browser, and also a request that carries an Authorization: Bearer token from :token add, so a phone shortcut, a script or curl can capture with no tab open. A token is nwc_ and 32 random bytes. It is shown once, copied, and stored only as its SHA-256, the way a share key is. Only the capture route reads the header. The Session extractor never does, so a token opens nothing else. Wrong tokens go through the login's backoff on a throttle of their own. A removed token is refused from the next request on, because each capture looks the hash up again. A card lands where :card puts one outside the board: the inbox of the space named by "space", or else of the first space with a board. That rule now lives server-side as boards::inbox_of. The first line of the text becomes the title and the rest becomes the notes. Diary text becomes "- HH:MM text" in WORKSPACE_TIMEZONE, appended to the first document written today at the top of the diary. That is the entry :today opens. The append keeps a revision and indexes links like any other save. :token lists, adds and removes tokens, and completes their names after rm. The message that shows a new token stays in the status bar instead of fading, because it cannot be shown again.
14 lines
643 B
SQL
14 lines
643 B
SQL
-- Tokens that may write into the workspace from outside a logged-in browser:
|
|
-- a phone shortcut, a script, `curl`. One per thing that captures, so losing
|
|
-- a phone means removing one row. A token opens `POST /api/capture` and
|
|
-- nothing else; the session cookie remains the only way to read anything.
|
|
CREATE TABLE api_tokens (
|
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
|
name TEXT NOT NULL UNIQUE,
|
|
-- SHA-256 of the token, base64url. The token itself is shown once, when
|
|
-- it is made, and kept nowhere.
|
|
hash TEXT NOT NULL UNIQUE,
|
|
created_at INTEGER NOT NULL,
|
|
last_used_at INTEGER
|
|
);
|