shiyuyun/wyndham-ARR
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: record web credential rotation

Browse Source
This commit is contained in:
Wyndham ARR
2026-07-31 15:41:36 +08:00
parent bf7939dd1a
commit a891c0ae7a
6 changed files with 42 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
.project-docs/50-evidence/topics/2026-07-30-web-login-runtime-mismatch.md
View File

@@ -28,6 +28,11 @@ The login change was nevertheless relevant to recovery: current source intention
separate macOS Keychain item and a credential-free local launcher restored the prior controlled database, OSS,
processing, monthly and company-report inputs. Detached Screen session `arr2-web-8766` owns the sole `*:8766` listener.
On 2026-07-31 the operator requested a credential rotation. Both values were replaced through interactive no-echo
Keychain input, the password item was rebuilt under stable non-credential account metadata, and the credential-free
launcher remained valid. A controlled restart replaced only the resolved Web listener and recreated the same detached
Screen topology; no credential value is recorded here.
## Completed Source Implementation
- `arr_web.auth` validates runtime `ARR_WEB_USERNAME` / `ARR_WEB_PASSWORD` with constant-time comparison and a bounded
@@ -60,8 +65,14 @@ processing, monthly and company-report inputs. Detached Screen session `arr2-web
welcome/access introduction and support disclaimers. The live gateway now presents one `ARR Report` heading, the
`username` and `password` fields, password visibility and the existing submit/error states. Thirty-three focused
Web/auth/UI tests pass; browser checks at 390x844 and 1280x720 have no horizontal overflow or console warnings/errors.
- Read-only totals remained 24 daily jobs, 4 monthly versions and 3 company jobs. No XML upload, company-report job,
monthly worker or other business mutation was started during activation.
- The credential-rotation acceptance rejects the prior pair and accepts the new pair, then verifies anonymous root/API
boundaries, hardened cookie/session/CSRF, desktop/H5, logout revocation, all six current detailed readiness flags and
loopback plus `192.168.3.48` health. Two read-only snapshots remained 30 daily jobs, 4 monthly versions and 4 company
jobs; latest creation times predate the 15:30 +08 restart. Nine focused auth/deployment tests pass, and literal scans
of the workspace, launcher, state logs and process list are clean.
- The initial activation totals were 24 daily jobs, 4 monthly versions and 3 company jobs. No XML upload,
company-report generation, Booking activation, monthly worker or other business mutation was started by either
activation or rotation acceptance.
## Activation Result and Operating Boundary
@@ -70,8 +81,9 @@ processing, monthly and company-report inputs. Detached Screen session `arr2-web
values. Its `--check` mode validates required private inputs without printing them.
- The active Screen session is detached but not a reboot-persistent process manager. A future controlled restart should
validate the launcher, stop the exact 8766 listener and start one `screen -dmS arr2-web-8766` session.
- Credential rotation to a password distinct from the public username is recommended. Update the Keychain item and
restart once; never commit the value or put it in process arguments.
- The latest requested values were rotated successfully, but the password still matches the username. A future
strength rotation should use a distinct high-entropy password, update only Keychain and restart once; never commit the
value or put it in process arguments.
Live login/readiness is complete. A no-PII upload-filename check and one released 5/5 company-report job remain separate
business-mutation acceptance work.