mrambossekandClaude Opus 5
40e76c52ca
Enrolling a device that cannot reach the admin UI meant transcribing a 200-character link with a base64 pin in it — the step the link format exists to avoid, and the one where a pin wrong by one character fails later as an inscrutable TLS error. Rendered as inline SVG rather than a PNG data: URI, because the page's CSP is default-src 'none' and means it: a data: image would need img-src opened, markup needs nothing. One path rather than a rect per module, since a link this long encodes to about 60x60 and two thousand elements is a lot of DOM for a picture of a square. It is generated from the same validated value as the href, so a rejected link produces neither. This relaxes the stdlib-only rule, deliberately and recorded in CLAUDE.md. The rule bought one self-contained binary with no supply chain to audit, which one small pure-Go package barely dents; F-Droid never applied to the server, only the app ships there. A correct QR encoder is ~500 lines of Reed-Solomon that nobody should be hand-writing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
6 lines
119 B
AMPL
6 lines
119 B
AMPL
module echo-lot.app/server
|
|
|
|
go 1.24
|
|
|
|
require github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e // indirect
|