From 513675c852de25c9baf49cbd5db0480b87f8fd8b Mon Sep 17 00:00:00 2001 From: mirivlad Date: Fri, 17 Jul 2026 06:03:49 +0800 Subject: [PATCH] docs(web): document console diagnostics and smoke --- README.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/README.md b/README.md index 9ae491a..6c1c893 100644 --- a/README.md +++ b/README.md @@ -245,6 +245,11 @@ values are `ru`, `en`, or `system`; `system` uses `Accept-Language`, then Registration is controlled by `web.allow_registration`; when disabled the public registration page does not expose account creation. +The admin console also provides bounded user/device/audit lists, a vault detail +view with aggregates only (never file payloads), safe retention cleanup, and a +sanitized diagnostics download. General web settings are stored in the existing +`config.yml`; SMTP passwords are not returned to a browser form. + All browser mutations use POST and validate a server-side session plus CSRF token. The server returns security headers including a restrictive CSP, `frame-ancestors 'none'`, `nosniff`, and a same-origin referrer policy. The @@ -335,6 +340,9 @@ new clients. # Run tests go test ./... +# Run real headless Chromium smoke screenshots in a temporary directory +./scripts/smoke-web.sh + # Build for production CGO_ENABLED=1 go build -o verstak-sync-server ./cmd/server ```