admin/memby
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

0.2.45 - Server side git commits

Browse Source
This commit is contained in:
ponzischeme89
2026-08-10 20:54:00 +12:00
parent 4c47a5f8a0
commit dd2dd497f2
11 changed files with 170 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/README.md
+15 -8
View File
@@ -424,6 +424,13 @@ while left open; the verdict is `none`, `optional` or `mandatory`. This endpoint
deliberately public and remains available during maintenance: update policy is checked
before login and never reads, validates, or mutates a viewer session.
The App updates page separates a required update from a destructive one. Required covers
the home screen until the APK is installed but keeps the viewer's session. “Set the
destructive floor to this update” records the release as the destructive floor: the next request
from an older build deletes its session, and signing in again is refused until that build
has updated. “Sign out builds below” lets the operator set that floor to an exact version
instead; leaving it blank disables destructive retirement.
### First-time TV installation
The gateway hosts a public bootstrap page at:
@@ -522,7 +529,8 @@ For a server-only emergency deployment, explicitly opt out:
```
Set it on the admin page: **latest version**, **APK URL** (normally the same file the
landing page serves), release notes, and a **Require this update** toggle.
landing page serves), release notes, the required-update toggle, and an optional
destructive compatibility floor.
- *Optional* — a dismissable prompt. Dismissal lasts for that session only.
- *Required* — a full-screen panel over the home screen with no way past it. Back is
@@ -533,13 +541,12 @@ landing page serves), release notes, and a **Require this update** toggle.
`minimumVersion` can also be set directly for a staged rollout where the forced floor is
older than the newest build.
Builds below 0.2.44 are permanently retired once the enabled policy points at an
actionable 0.2.44-or-newer release. On their next authenticated request the gateway
deletes the session and returns 401, which makes the TV remove the rejected local profile;
the public update check continues to return the mandatory update screen. The gateway also
refuses a new login from a retired build, so signing in again cannot bypass the update.
This floor remains dormant when the policy has no download URL or its latest release is
older than 0.2.44.
When **Sign out builds below** is set, a build below that version is retired on its next
authenticated request: the gateway deletes the session and returns 401, which makes the TV
remove the rejected local profile. The public update check continues to return the
mandatory update screen, and the gateway refuses a new login from the retired build, so
signing in again cannot bypass the update. The floor remains dormant when the policy has no
download URL or its latest release is older than the selected floor.
Two deliberate safeguards, both tested in `internal/appupdate`: