rbrooks/WeatherBot

Watch

Fork 0

Public-surface privacy consistency: hide exact coords; make public_enabled off actually stop exposure #60

New issue

Closed

opened 2026-07-18 05:31:24 +00:00 by claude-bot · 1 comment

claude-bot commented

2026-07-18 05:31:24 +00:00

Contributor

(1) public_location.html:21 renders lat/lon to 4 decimal places (~11 m) on
the login-free page, contradicting the privacy rules the /p/{token} pages
enforce (and test). Show name/zone/radar only.
(2) The NWS-alert branch of /p/{token} (app/api/public.py:318-428) doesn't
filter on Location.public_enabled, unlike both SPC paths (public.py:239,
spc_impacts.py:414); nothing revokes tokens when the flag is turned off, so
disabling public sharing leaves live NWS links serving until retention
expiry. Add the filter to the NWS branch and revoke-or-suspend the location's
tokens on toggle-off (suspend preserves re-enable).

Acceptance criteria:

Public location page shows no precise coordinates
public_enabled=false 404s existing NWS-alert public links
Toggle-off test covers both page types

Filed from the 2026-07-17 codebase audit (docs/.internal/report-2026-07-17.md), finding F-21.

(1) public_location.html:21 renders lat/lon to 4 decimal places (~11 m) on the login-free page, contradicting the privacy rules the `/p/{token}` pages enforce (and test). Show name/zone/radar only. (2) The NWS-alert branch of `/p/{token}` (app/api/public.py:318-428) doesn't filter on `Location.public_enabled`, unlike both SPC paths (public.py:239, spc_impacts.py:414); nothing revokes tokens when the flag is turned off, so disabling public sharing leaves live NWS links serving until retention expiry. Add the filter to the NWS branch and revoke-or-suspend the location's tokens on toggle-off (suspend preserves re-enable). **Acceptance criteria:** - [ ] Public location page shows no precise coordinates - [ ] public_enabled=false 404s existing NWS-alert public links - [ ] Toggle-off test covers both page types --- _Filed from the 2026-07-17 codebase audit (`docs/.internal/report-2026-07-17.md`), finding F-21._

claude-bot added this to the v1.0.3 - Security hardening milestone

2026-07-18 05:31:24 +00:00

claude-bot added the

area:public-pages

type:security

labels

2026-07-18 05:31:24 +00:00

claude-bot referenced this issue

2026-07-18 05:32:24 +00:00

Public Link Admin Console #7

rbrooks referenced this issue from a commit

2026-07-18 07:24:46 +00:00

Vendor frontend assets locally; harden public page; POST logout

rbrooks referenced this issue from a commit

2026-07-18 07:24:46 +00:00

Harden auth, media, and public API surfaces

claude-bot referenced this issue

2026-07-18 07:25:01 +00:00

v1.0.3 — Security hardening #93

claude-bot commented

2026-07-18 07:29:56 +00:00

Author

Contributor

Fixed in #93 (merged to main). Three changes for one coherent posture: (1) the public location page no longer renders exact lat/lon (name/zone/radar only); (2) the NWS-alert branch of /p/{token} now filters Location.public_enabled like the SPC branches already did, so a disabled location's links 404; (3) toggling public_enabled off now revokes that location's NWS public tokens immediately (via the existing revoke_public_token helper) instead of leaving links live until retention expiry. SPC tokens are intentionally not revoked on toggle — they're shared across locations and already gated at render time. Tests cover the coord removal, the public_enabled gate, and token revocation on unshare.

Fixed in #93 (merged to `main`). Three changes for one coherent posture: (1) the public location page no longer renders exact lat/lon (name/zone/radar only); (2) the NWS-alert branch of `/p/{token}` now filters `Location.public_enabled` like the SPC branches already did, so a disabled location's links 404; (3) toggling `public_enabled` off now revokes that location's NWS public tokens immediately (via the existing `revoke_public_token` helper) instead of leaving links live until retention expiry. SPC tokens are intentionally not revoked on toggle — they're shared across locations and already gated at render time. Tests cover the coord removal, the public_enabled gate, and token revocation on unshare.

claude-bot closed this issue

2026-07-18 07:31:05 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

rbrooks/WeatherBot#60

No description provided.

Rows
Columns