hernani/koopa-admin-log
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs/ops: merchant portal instance ids must be lowercase (avoid 401)

Browse source 
Document that mixed-case instance ids yield odd HTTP 401 in webui/API.
Lowercase MERCHANT_INSTANCE / shop paths defensively in monitoring and landings.
This commit is contained in:
Hernâni Marques 2026-07-17 22:36:54 +02:00
parent 57cf9aa2a1
commit ba48f334ea
No known key found for this signature in database
9 changed files with 44 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

17
configs/taler-hacktivism/README.md
View file

@ -56,6 +56,23 @@ After conf/hosts changes: `taler-merchant-exchangekeyupdate -t` and `taler-merch
| 9010 | nginx TLS in container (podman) |
| unix sock | `taler-merchant-httpd` |
## Merchant portal (SPA `/webui/`) — instance IDs **lowercase only**
The merchant **webui** (and private API paths under `/instances/{id}/…`) must use
**only lowercase** instance ids (`a-z`, digits, hyphens).
| Do | Do not |
|----|--------|
| `goa-shop`, `goa-demo-cp4zqk`, `fermes-des-collines` | `Goa-Shop`, `GOA-DEMO`, mixed case |
**Why:** uppercase (or mixed-case) ids produce **odd HTTP 401** failures on
login / private API even when the password/token is correct. Auth looks like
“wrong secret” but the real issue is path / instance string case.
Create instances, login fields, `Authorization` targets, and `taler://pay…`
paths with the **exact lowercase** id. Display names may use capitals;
**ids must not**.
## Demo instance (2026-07-09)
Self-provisioned shop **`goa-demo-cp4zqk`**, bank account same username, payto linked, seed **GOA:5000**.

4
configs/taler-hacktivism/demo-instance-goa-demo-cp4zqk.md
View file

@ -15,6 +15,10 @@ Created **2026-07-09** via self-provisioning (`POST /instances`, no SMS TAN).
Login: SPA → instance id + password (or bearer `secret-token:$PASSWORD`).
**Instance id must be all-lowercase** (`goa-demo-cp4zqk`). Typing capitals in
the portal login field (or calling `/instances/Goa-Demo-…/private/…`) yields
**strange 401s** even with the right password — use exact lowercase only.
## Bank account (linked)
| Field | Value |