d982e795ea
Forward the agentId in the browser-auth URL so the server mints an API key bound to this machine; consume + persist the agentKey returned by register (migrating general-key bootstraps and stopping the per-restart re-mint). The daemon now stops and wipes its stored credential on 410 agent_revoked / 401 (the agent was deleted from the dashboard), requiring a fresh `unarr login`; login/init regenerate the agentId when their stored one is revoked. Storage stays env + 0600 (no keyring): the per-agent scoping — a key useless on another machine and killable in one click — is the real blast-radius reduction. --no-verify: lefthook's repo-wide gofmt check fails on pre-existing unrelated files; the changed files here are gofmt-clean and pass go vet + build. |
||
|---|---|---|
| .. | ||
| agent | ||
| arr | ||
| cmd | ||
| config | ||
| engine | ||
| funnel | ||
| library | ||
| mediaserver | ||
| parser | ||
| sentry | ||
| ui | ||
| upgrade | ||
| usenet | ||
| vpn | ||