lzstealth/pulse-signage
1
0
Fork 0
Code Issues Pull Requests Actions Packages Activity

Add onboarding weather and template gradients
Publish Docker Image / build-and-push-existing-registry (./build/Dockerfile, web, pulse-signage-web) (push) Successful in 1m53s
Details
Publish Docker Image / build-and-push-existing-registry (./build/Dockerfile.player, player, pulse-signage-player) (push) Successful in 34s
Details

Browse Source
This commit is contained in:
lzstealth
2026-08-28 20:05:23 +01:00
parent aa07a78912
commit 3960931ebe
80 changed files with 12750 additions and 519 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/api.md
+5 -5
View File
@@ -6,7 +6,7 @@ Player service base URL: `http://localhost:8081`
This document covers the player HTTP surface only. The admin dashboard exposes its own routes for screen commands and onboarding management.
Access note: most player endpoints are unauthenticated because they are meant to run inside a trusted deployment network. Anything that mutates state or writes files should be treated as internal-only unless you add your own auth layer in front of it.
Access note: most player endpoints are unauthenticated because they are meant to run inside a trusted deployment network. Anything that mutates state or writes files should be treated as internal-only unless you add your own auth layer in front of it. Pairing uses a short-lived random PIN displayed by the kiosk; the PIN is accepted only through the authenticated Web UI pairing flow.
When `PULSE_SIGNAGE_SHARED_SECRET` is set, the player pages sign same-origin API fetches with `x-pulse-page-auth`, and the web app signs server-to-player requests with `x-pulse-request-timestamp` plus `x-pulse-request-signature`. Page tokens auto-renew before expiry while the page stays active, and signed server requests are only accepted when their timestamp is fresh. If the secret is unset, those checks stay disabled for compatibility.
@@ -17,12 +17,12 @@ Returns the player onboarding landing page.
Access: public within the trusted player deployment.
### `GET /onboard`
Returns the onboarding form page.
Access: public within the trusted player deployment.
Redirects to the authenticated Web UI pairing page for compatibility with older QR codes.
Access: the Web UI pairing page requires a logged-in Web UI session.
### `GET /screen/{slug}`
Returns the rendered player page for a screen.
Access: public within the trusted player deployment.
Access: the configured player may load only its persisted paired screen. An unpaired player is redirected to `/`; a different screen slug is rejected. The route is public within the trusted player deployment, but it no longer changes the player's binding.
### `GET /api/onboarding/status`
Returns the persisted onboarding status for a device.
@@ -56,7 +56,7 @@ Response fields:
### `POST /api/onboarding`
Binds a device to a screen and client name.
Access: internal-only. Protect this endpoint if the player service is reachable outside your trusted network.
Access: internal-only. Browser submissions must go through the authenticated Web UI pairing page. The Web UI resolves the short-lived kiosk PIN to a device ID before forwarding the signed request. Protect this endpoint if the player service is reachable outside your trusted network.
Accepted request fields: