[18.0][FIX] vault: do not present exhausted inboxes as writable - #989
Open
jans23 wants to merge 2 commits into
Open
[18.0][FIX] vault: do not present exhausted inboxes as writable#989jans23 wants to merge 2 commits into
jans23 wants to merge 2 commits into
Conversation
The frontend inbox share form showed 'Invalid token' for valid links and wrongly required a file even when a name and secret were provided. - Resolve the recipient public key for any valid token instead of only when the inbox still has accesses left, so a valid link no longer reports 'Invalid token'. Distinguish an unknown token from a recipient without a key pair with clearer messages. - Drop the hardcoded 'required' on the file input so name + secret are sufficient; the file remains optional (the JS still toggles the requirements and the server/model already accept secret or file).
jans23
force-pushed
the
18.0-fix-vault-inbox-ux
branch
from
August 24, 2026 13:29
5b60899 to
8130bb6
Compare
An inbox that can no longer be written to (access counter at 0 or expired) still showed its writable inbox link, and submitting to it silently did nothing while the form reported 'Successfully stored'. This is misleading for received/delivered secrets which are created with accesses = 0. - Add a computed 'writable' flag (accesses left and not expired) and hide the inbox link in the list and form views when it is not writable. - Make the controller report 'This link is no longer active' when store_in_inbox performs no write instead of a false success message. - Cover the exhausted-inbox submit path in the controller test.
jans23
force-pushed
the
18.0-fix-vault-inbox-ux
branch
from
August 24, 2026 13:56
8130bb6 to
9e9f671
Compare
jans23
marked this pull request as ready for review
August 24, 2026 14:01
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
An inbox that can no longer be written to (access counter at 0 or expired) still showed its writable inbox link, and submitting to it silently did nothing while the form reported 'Successfully stored'. This is misleading for received/delivered secrets which are created with accesses = 0.
This depends on #987