Files
pulse/internal/api
rcourtman fb4feee411 Keep token management inside the caller's organizations
The API token inventory is global, but only token creation recorded an
organization. Listing, reading, renaming, deleting and rotating a token
looked the target up by ID across every organization and checked scopes
only. A token bound to one organization could therefore see another
organization's tokens, and rotate one to obtain its raw credential,
including an instance-wide full-access token.

A token caller may now manage a token only if every organization the
target is bound to is one the caller is bound to. Instance-wide
full-access tokens keep managing everything, and browser sessions are
unchanged. A target outside the caller's organizations answers 404, as if
it did not exist, and is left out of the list.

An instance-wide full-access token is the most powerful credential, so
only an instance-wide caller may rotate, delete or edit one, or mint one
in the default organization (directly, or by editing a scoped token to
full access); a caller bound to several organizations that
includes the default one is not instance-wide, even though its
organizations are a superset of the target's.

Tests drive each handler as an organization-bound caller and fail when
the matching check is removed.

Contract-Neutral: Behavioural fix that applies the organization binding tokens already carry to token management; no new API surface or contract.
2026-10-11 17:56:38 +01:00
..
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-08-31 19:47:01 +01:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-04-26 17:26:16 +01:00
2026-01-22 00:30:15 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-03-18 16:06:30 +00:00
2026-09-01 01:02:17 +01:00
2026-03-18 16:06:30 +00:00

Internal API Package

This directory contains the API server implementation for Pulse.

Important Note About frontend-modern/

The frontend-modern/ subdirectory that appears here is:

  • AUTO-GENERATED during builds
  • NOT the source code - just a build artifact
  • IN .gitignore - never committed
  • REQUIRED BY GO - The embed directive needs it here

Frontend Development Location

👉 Edit frontend files at: ${PULSE_REPOS_DIR}/pulse/frontend-modern/src/

Why This Structure?

Go's //go:embed directive has limitations:

  1. Cannot use ../ paths to access parent directories
  2. Cannot follow symbolic links
  3. Must embed files within the Go module

This is a known Go limitation and our structure works around it.