Public: anyone can read this; the crew can change it.
With `signin.edge` off the owner signs in by passkey, and Settings → Capacity turns it back on #9059
Check · Review · Land · Live done — Landed and live in production.
Main already had the `signin.edge` switch, the refusal for an admin with no password or passkey, and the capacity row. What was missing was proof through the pages people actually use, plus the steps for operators. This pull adds a test and a docs passage; the app code is unchanged.
shipped production is serving it deploy 84c60a0
Main already had the signin.edge switch, the refusal for an admin with no password or passkey, and the capacity row. What was missing was proof through the pages people actually use, plus the steps for operators. This pull adds a test and a docs passage; the app code is unchanged.
test/signin-edge-off.test.ts(new) is the round trip, run against a live server:
- Settings → Capacity lists signin.edge, set to on.
- An admin with no password or passkey, signed in only by the edge, is refused when they try to turn it off from the page.
- The owner turns it off from the page. After that the edge headers get 401 for everyone, even an account the edge made, and the edge can't turn it back on.
- The owner then signs in two ways: with their password, and with a passkey through the full ceremony using the test helper's software authenticator. The existing test only checked that the passkey options request answers.
- From the passkey session, the owner sets it back on from the page. The change log shows off → on and the edge headers sign people in again.
docs/OPERATING.mdnow says how to switch it off on a preview and how to roll back:
- Use the Capacity row, or Put back to return to the default.
- With no browser, use PUT /api/v1/admin/capacity/signin.edge with an admin token. A token can still be made with the password while the switch is off.
- A saved value overrides FORGE_SIGNIN_EDGE, so changing the environment alone doesn't roll anything back.
- Switching production off stays the owner's job, with the owner present.
Production was not switched off, and no preview was either. I didn't add a test that a read-only token can't change the setting, because test/capacity.test.ts already covers it. The keep_plan tool wasn't available in this run, so there is no plan on the issue.
Gate, bun x tsc --noEmit, and the 14 test files named by scripts/fast.ts plus test/signin-edge.test.ts all pass (177 tests).
To try it: bun test test/signin-edge-off.test.ts. On a preview, follow the new passage in docs/OPERATING.md.
🤖 Generated with Claude Code
Test and docs only; the app code already had the switch, the lockout refusal and the Capacity row. The test walks the round trip through the real pages (edge-only admin refused, owner turns it off, edge headers get 401, password and passkey sign-in, back on from the passkey session). The docs claims match the code: the Capacity label, Put back, and PUT /api/v1/admin/capacity/:key all exist. README is untouched and there is no new dependency. Next, two things I would do: (1) add a terminal path or a docs/features note for the signin.edge switch, since the how-to now lives only in OPERATING.md; (2) assert in the refusal test that the page shows the error text, so a silent 303 cannot pass.
Main already had the
signin.edgeswitch, the refusal for an admin with no password or passkey, and the capacity row. What was missing was proof through the pages people actually use, plus the steps for operators. This pull adds a test and a docs passage; the app code is unchanged.test/signin-edge-off.test.ts(new) is the round trip, run against a live server:- Settings → Capacity lists
signin.edge, set to on. - An admin with no password or passkey, signed in only by the edge, is refused when they try to turn it off from the page. - The owner turns it off from the page. After that the edge headers get 401 for everyone, even an account the edge made, and the edge can't turn it back on. - The owner then signs in two ways: with their password, and with a passkey through the full ceremony using the test helper's software authenticator. The existing test only checked that the passkey options request answers. - From the passkey session, the owner sets it back on from the page. The change log showsoff → onand the edge headers sign people in again.docs/OPERATING.mdnow says how to switch it off on a preview and how to roll back:- Use the Capacity row, or Put back to return to the default. - With no browser, use
PUT /api/v1/admin/capacity/signin.edgewith an admin token. A token can still be made with the password while the switch is off. - A saved value overridesFORGE_SIGNIN_EDGE, so changing the environment alone doesn't roll anything back. - Switching production off stays the owner's job, with the owner present.Production was not switched off, and no preview was either. I didn't add a test that a read-only token can't change the setting, because
test/capacity.test.tsalready covers it. Thekeep_plantool wasn't available in this run, so there is no plan on the issue.Gate,
bun x tsc --noEmit, and the 14 test files named byscripts/fast.tsplustest/signin-edge.test.tsall pass (177 tests).To try it:
bun test test/signin-edge-off.test.ts. On a preview, follow the new passage in docs/OPERATING.md.🤖 Generated with Claude Code
Closes #9048