Files
pulse/internal/api
rcourtman 74504427df Show diagnostics callers only the API tokens they may manage
/api/diagnostics is readable with settings:read and lists the whole token
inventory: every token's ID, name, timestamps, key hint and which agents
use it, across organizations. A token bound to one organization could
read the other organizations' credential metadata, which the token
management endpoints already refuse to show it.

The diagnostics result is computed once per organization scope and cached
for every caller, so the filter runs after the cache: an API-token caller
that is not instance-wide gets an API token section rebuilt over the
tokens callerTokenMayManage allows, with counts, notes and agent usage
computed over that view. Instance-wide tokens and browser sessions get the
full section, and the cache itself still holds the full result.

Tests cover the builder (tokens, counts, usage) and the handler on the
cached path, including that a scoped caller served from the cache does
not change what the next caller sees. Each filter fails when removed.

Contract-Neutral: Behavioural fix that applies the token visibility rule to diagnostics; no new API surface or contract.
2026-10-11 20:29:30 +01:00
..
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-08-31 19:47:01 +01:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-04-26 17:26:16 +01:00
2026-01-22 00:30:15 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-09-01 01:02:17 +01:00
2026-03-18 16:06:30 +00:00

Internal API Package

This directory contains the API server implementation for Pulse.

Important Note About frontend-modern/

The frontend-modern/ subdirectory that appears here is:

  • AUTO-GENERATED during builds
  • NOT the source code - just a build artifact
  • IN .gitignore - never committed
  • REQUIRED BY GO - The embed directive needs it here

Frontend Development Location

👉 Edit frontend files at: ${PULSE_REPOS_DIR}/pulse/frontend-modern/src/

Why This Structure?

Go's //go:embed directive has limitations:

  1. Cannot use ../ paths to access parent directories
  2. Cannot follow symbolic links
  3. Must embed files within the Go module

This is a known Go limitation and our structure works around it.