The domain edit dialog returns to pure local domain editing — the remote
toggle, sync URL field, uplink probing and per-domain token management
are gone (the bad checkbox-on-its-own-line UX with them).
Satellite setup now lives in a self-contained Satellites section of the
admin overview, covering both roles:
- Upstream: links table (satellite label, served domains, live status,
the satellite's rejection reports), New satellite link dialog with
domain scope checkboxes minting the wss link URL (shown once, 10 min,
single-use), scope editing pushed live, revocation with confirm.
- Satellite: uplinks table (upstream URL, served domains, live
connected/cached/offline status with gentle polling while
disconnected), Add uplink dialog taking the pasted link URL with the
registration handshake running synchronously (immediate errors),
unlink with confirm.
Remote domains in the domains list are no longer clickable/editable or
deletable — they carry a 'via uplink' badge pointing at the Satellites
panel.
Registration simplified to a single sync URL: minted in the upstream's
admin UI (Satellite access section of the domain dialog), carrying the
token as userinfo — https://<token>@<auth-host>. Tokens live hashed in
the upstream database, scoped to one rp-id, revocable (drops live
connections). PASKIA_SYNC_TOKENS env is gone.
Data minimization: the sync feed now carries only the scope's sessions
and credentials; the user graph never leaves the upstream. Each session
upsert embeds its master-computed ApiSessionContext (identity display
data + effective permissions for the session's host); user-graph
mutations eagerly re-push affected sessions with fresh contexts, so
revocations land within ~1 RTT. /check and /user-info are proxied to
the upstream (they need the user graph).
Satellite side: replicas keyed by rp-id (no more shared-replica config
conflicts — each remote domain has its own token), the replica refuses
to go live on a ready-message scope mismatch, write-backs are confined
to the token's scope server-side.
Admin dialog: one sync-URL paste field (token split from userinfo,
write-only), uplink verification required to save (reachability, rp-id
match, no nesting, auth host present); a verified uplink takes over the
domain's origins (**.<rp-id> + upstream auth host) and auth host. New
domains adopt the upstream's rp-id and name.
Geographically separate servers may have notable latency between them, making forward/validate request roundtrip unnecessarily slow. This adds a proxy support, where the local server can keep a local copy of a remote domain, while the auth host remains authoritative, but requests can be answered in less than 1ms from local copy.
Reviewed-on: https://git.zi.fi/LeoVasanko/paskia/pulls/5
Break the monolithic admin dialog component into a thin dispatcher plus
one component per dialog type under admin/dialogs/, with a shared
AdminDialog frame (Modal wrapper, title, error and Cancel/Save actions).
No functional change. Also drop two unused input refs (nameInput,
displayNameInput).
LeoVasanko