thegeneralist01/archivr
1
Fork 0
mirror of https://github.com/thegeneralist01/archivr synced 2026-07-21 18:55:36 +02:00
Code Issues Activity

feat(server): configurable bind address with loopback default and non-loopback warning

Browse source 
- Add optional `bind` field to ServerRegistry (TOML + ARCHIVR_BIND env var)
- Default bind address remains 127.0.0.1:8080; non-loopback prints a warning
- Add route security classification comment block (READ/ADMIN/WRITE/STATIC)
- Add Security and Deployment section to docs/README.md
- Replace vague auth note in ARCHIVR-MENTAL-MODEL.md with concrete model description
- Add three registry tests covering bind field round-trip and defaults
This commit is contained in:
TheGeneralist 2026-06-23 17:11:12 +02:00
parent 10c41ef84f
commit 2d7a4f1766
Signed by: thegeneralist01
SSH key fingerprint: SHA256:pp9qddbCNmVNoSjevdvQvM5z0DHN7LTa8qBMbcMq/R4
5 changed files with 118 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

31
crates/archivr-server/src/routes.rs
View file

@ -1,3 +1,27 @@
// ── Security Boundary ────────────────────────────────────────────────────────
// All routes are currently trusted-local: no authentication or authorization
// middleware is applied. The server is designed to bind on 127.0.0.1 only.
//
// Route classification (for when middleware is added later):
//
// STATIC — safe to expose publicly: GET / and static /assets/*
// READ — safe to expose read-only: GET /health
// GET /api/archives
// GET /api/archives/:id/entries
// GET /api/archives/:id/entries/search
// GET /api/archives/:id/entries/:uid
// GET /api/archives/:id/entries/:uid/artifacts/:idx
// GET /api/archives/:id/runs
// GET /api/archives/:id/tags
// ADMIN — requires auth if ever public: GET /api/admin/archives
// WRITE — requires auth if ever public: POST /api/archives/:id/captures
// POST /api/archives/:id/tags
// PUT /api/archives/:id/tags/:tag_id
// DELETE /api/archives/:id/tags/:tag_id
//
// Do not add middleware here until the auth model is chosen. See docs/README.md.
// ─────────────────────────────────────────────────────────────────────────────
use std::{path::PathBuf, sync::Arc};
use archivr_core::{archive, capture, database};
@ -301,6 +325,7 @@ mod tests {
label: "Personal".to_string(),
archive_path: std::path::PathBuf::from("/tmp/personal/.archivr"),
}],
bind: None,
};
let response = app(registry)
.oneshot(
@ -361,6 +386,7 @@ mod tests {
label: "Test".to_string(),
archive_path,
}],
bind: None,
};
let response = app(registry)
.oneshot(
@ -391,6 +417,7 @@ mod tests {
label: "Test".to_string(),
archive_path,
}],
bind: None,
};
let response = app(registry)
.oneshot(
@ -483,6 +510,7 @@ mod tests {
label: "Test".to_string(),
archive_path: paths.archive_path.clone(),
}],
bind: None,
};
let uri = format!(
"/api/archives/test/entries/{}/artifacts/0",
@ -526,6 +554,7 @@ mod tests {
label: "Test".to_string(),
archive_path,
}],
bind: None,
};
let response = app(registry)
.oneshot(
@ -556,6 +585,7 @@ mod tests {
label: "Test".to_string(),
archive_path,
}],
bind: None,
};
let response = app(registry)
.oneshot(
@ -585,6 +615,7 @@ mod tests {
label: "Test".to_string(),
archive_path: paths.archive_path.clone(),
}],
bind: None,
};
(registry, paths.archive_path)
}