From 5291bdd04545f30a2152fe51c090658bbd90a4c5 Mon Sep 17 00:00:00 2001 From: mrambossek Date: Sat, 1 Aug 2026 12:08:11 +0200 Subject: [PATCH] enrollment: actually emit enroll_uri from the admin endpoint The previous commit's edit to the admin handler silently did not apply, so the endpoint still returned just the token. Caught by deploying and looking at the response rather than by trusting the build to have picked it up. Co-Authored-By: Claude Fable 5 --- server/cmd/echolot-server/main.go | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/server/cmd/echolot-server/main.go b/server/cmd/echolot-server/main.go index 908f460..ababd1a 100644 --- a/server/cmd/echolot-server/main.go +++ b/server/cmd/echolot-server/main.go @@ -234,7 +234,17 @@ func serve(cfg *config.Config) error { http.Error(w, err.Error(), 500) return } - fmt.Fprintf(w, `{"token":%q,"expires_in_s":86400}`+"\n", tok) + // The whole bootstrap, not just the token: this is what gets pasted or turned into a + // QR code, and assembling it here is what keeps an operator from transcribing a pin by + // hand — a pin wrong by one character fails as an inscrutable TLS error days later. + w.Header().Set("Content-Type", "application/json") + enc := json.NewEncoder(w) + enc.SetEscapeHTML(false) // the link is full of / and =; escaping them helps nobody + _ = enc.Encode(map[string]any{ + "token": tok, + "expires_in_s": 86400, + "enroll_uri": ctl.EnrollmentLink(tok), + }) }) adminSrv := &http.Server{Addr: cfg.AdminListen, Handler: admin, ReadHeaderTimeout: 10 * time.Second} go func() { errCh <- fmt.Errorf("admin: %w", adminSrv.ListenAndServe()) }()