mirror of
https://github.com/nestriness/nestri.git
synced 2026-11-03 14:12:39 +02:00
Wanjohi
eee3727d0c
The installer no longer needs a token copied from the dashboard. Run bare, the host agent shows a link, a code and a QR; approving it in a browser registers the machine. **Issuer** - New device client `installer`. Its access token lasts 15 minutes and it gets no refresh token: a refresh lifetime of 0 now means none is stored or returned. - `clientTTL(clientID)` sets lifetimes per client and wins over what a sign-in asks for. Desktop is unchanged. - `/device/authorize` allows 10 requests per address per 10 minutes. Past that it answers 429 `slow_down` with `Retry-After`. - The confirm page for the installer reads "Add a computer as a Nestri host?". The wording is fixed per client id. **API** - An `installer` token is accepted only on `POST /machine/install-token`. Everything else answers 403 `insufficient_permissions`. - Install tokens: at most 5 per person per hour, and at most 3 unspent at once (429 `too_many_requests`). - A team may own at most 10 machines. This is checked at mint and at redeem under a row lock (429 `quota_exceeded`). A refused redeem leaves the token unspent. Organisation hosts are not counted. **install.sh** - The token is optional. With none, `NESTRI_INSTALL_TOKEN` is left unset and onboarding signs in. - **Do not release this file until `DEFAULT_VERSION` points at a host agent that can sign in.** Older agents need a token. Tests: packages/core 256, apps/api 193, packages/auth 74, apps/auth 28, all passing.