RSS to Google Chat

@@ -19,8 +19,8 @@ https://vendor.example.com/blog/product-2-0 - **Two dedup modes** — `guid` posts once per item (news, blogs, release   notes); `guid+date` re-posts when an item updates (status pages: you see   Investigating, then Resolved).-- **Pinnable editor** — a token-gated web page to add/edit/remove feeds.-  Pin its link in the space; changes are live within one poll cycle.+- **Pinnable editor** — a secret-free link you pin in the space; sign in+  with your Adom account to add/edit/remove feeds, live within one poll cycle. - **Self-contained** — runs on your container, supervised by a watchdog.   No central service, and your webhooks never leave your box. @@ -47,12 +47,12 @@ to boot.  ```bash ssh -o StrictHostKeyChecking=accept-new <ssh-username>@adom.cloud \-  'curl -fsSL https://wiki.adom.inc/download/adom/adom-rss-gchat/1.0.2/install.sh | bash'+  'curl -fsSL https://wiki.adom.inc/download/adom/adom-rss-gchat/1.1.0/install.sh | bash' ```  No Rust, git, or other tooling needed on the container — the installer-downloads a prebuilt binary, sets up the watchdog, and prints your **editor-token** plus the exact next steps.+downloads a prebuilt binary, sets up the watchdog, and prints the exact next+steps.  ### 3. Expose the feed editor @@ -62,7 +62,11 @@ Back on your dev container: adom-cli carbon containers port-add <slug> --port 8842 --prefix rss-editor ``` -Your editor URL is `https://<returned-hostname>/?token=<token-from-step-2>`.+Your editor URL is `https://<returned-hostname>/` — no secret in it. The+first visit asks you to **Sign in with Adom** (approve in the tab that opens,+once per browser); only the container's owner gets in. If the installer chose+token mode instead (no api-key on the container), the URL is+`https://<returned-hostname>/?token=<token-from-step-2>`.  ### 4. Add your first feed @@ -104,33 +108,36 @@ by URL, so relabeling never re-posts old items.  ## Security model -The editor URL is a **capability link**: the long random token in it is the-whole credential. Anyone with the link can view and edit your feed list — that-is the point of pinning it in the space, so treat the link like a password for-that space's membership. Two properties limit what a leaked link is worth:+**Default: Sign in with Adom.** The pinned editor URL carries no secret — it's+just the hostname. Opening it prompts a one-time "Sign in with Adom" (approve+the request in the tab that opens; the session lasts 30 days per browser).+Access is limited to the **container's owner**, resolved automatically —+nothing to configure. Allow teammates by adding+`EDITOR_ALLOWED_USERS=name1,name2` to `~/rss-gchat/env`. Anyone else who+clicks the pinned link gets a named "not authorized" refusal, so the space+audience and the feed audience can safely differ — including feeds whose URLs+embed private credentials.++Defense-in-depth, active in both modes:  - **Webhooks are write-only.** The editor never returns stored webhook URLs —-  it shows a masked form with the key/token stripped. A link holder can't-  harvest posting credentials. (Leave the field blank to keep a saved webhook;-  paste to replace. Changing a feed's URL requires re-entering its webhook.)+  it shows a masked form with the key/token stripped. (Leave the field blank+  to keep a saved webhook; paste to replace. Changing a feed's URL requires+  re-entering its webhook.) - **Changes are loud.** Every save posts a short "feed configuration changed"   notice to all affected spaces — including a space a feed was just removed-  from. Silently rerouting a feed to another webhook is not possible.+  from. Silently rerouting a feed is not possible.   (`EDITOR_CHANGE_NOTICE=0` in `~/rss-gchat/env` disables this.) -Remaining trust: a link holder can still see **feed URLs** and add/remove-feeds. If a feed URL itself embeds a private credential (a personal wiki feed,-a secret calendar URL), anyone with the editor link can read that URL — so pin-the link only in spaces whose members you'd trust with those feeds, or keep-private-credential feeds in a solo space with its own deployment. Stronger-per-user identity ("Sign in with Adom") is on the roadmap for deployments where-the space audience and the feed audience differ.+**Token mode** (`EDITOR_AUTH=token`) remains available for non-Adom+deployments or when you *want* a capability link anyone in the space can use:+the URL embeds a long random token — treat it like a password, and rotate a+leak with `rm ~/rss-gchat/editor.token` + re-run the installer + re-pin.+Fresh installs default to `adom` when the container can identify its owner,+`token` otherwise; upgrades never change an existing choice. -- **Rotate a leaked link:** on the service container run-  `rm ~/rss-gchat/editor.token`, re-run the installer one-liner, and pin the-  freshly printed URL.-- Webhook URLs live only in `~/rss-gchat/feeds.json` (0700-permission dir,-  file readable only by your user) on your container.+Webhook URLs live only in `~/rss-gchat/feeds.json` (0700-permission dir) on+your container.  ## Operations @@ -154,6 +161,8 @@ Settings live in `~/rss-gchat/env` on the service container (all optional): | `GCHAT_WEBHOOK_URL` | unset | Deployment-wide default webhook; per-feed webhooks override it. Usually unset — feeds carry their own. | | `POLL_INTERVAL_MINUTES` | `30` | Poll frequency (min 1) | | `RSS_EDITOR_PORT` | `8842` | Editor port |+| `EDITOR_AUTH` | auto | `adom` (Sign in with Adom, owner-only) or `token` (capability link) |+| `EDITOR_ALLOWED_USERS` | unset | Extra Adom usernames allowed in `adom` mode (comma-separated) | | `SEED_ON_FIRST_RUN` | `true` | Silently mark a new feed's backlog as read | | `RUST_LOG` | `info` | Log verbosity |