Skip to content
Archiedocscookbooknewssign in

    Release 1.34.0

    News ·

    archied — Dashboard: an actionable authentication failure state

    • An unauthenticated document request now receives a self-contained HTML page with a paste-the-token form, instead of plain text. Previously the whole dashboard – index.html, the bundle and every asset – sat behind the token check, so a bookmarked bare URL returned a text/plain “unauthorised: open the dashboard URL archied logged at startup”, the SPA never ran, and none of the dashboard’s existing failure surfaces were reachable at all.
    • The response is still 401, with Cache-Control: no-store and a CSP. It is deliberately not a 200: a login page served as success would be cacheable, would read as healthy to anything that checks status alone, and a shared cache could hand it to the wrong person.
    • API and stream callers are unaffected. application/json, */* and text/event-stream requests keep the plain-text 401, with a test pinning that split so an XHR or an EventSource reconnect can never start receiving a page.
    • The auth banner gains a Retry action that re-runs the dashboard’s bootstrap reads, so a recovered session is actionable without a browser-level reload. It deliberately does not re-drive the SSE stream, which already reports its own reconnect state.
    • The page’s guidance stays generic: it points at the dashboard URL the daemon logs rather than naming where the token is stored, so the HTTP layer is not coupled to the token file’s location.