Site 1.3.0 · Guest Pass 2.0

• Short pass links: guest passes are numbered GC-00001, GC-00002 and so on. A link is the site plus the number and a 6-character secret, for example …/#/GC-00001-7KQ4XW, about 15 characters instead of 120. The secret stops anyone from claiming a pass by guessing the next number.
• Four clearances: LV2 Guest Pass (every section, no restricted documents), LV3 Guest Pass (Staff), LV5 Guest Pass · Low Clearance (Staff and Leads), LV6 Guest Pass · High Clearance (Staff, Leads and Administration).
• Claim by name, on one device: opening a link shows You have been granted temporary clearance via Guest Pass with the clearance. The recipient writes their name (required, for the pass index) and presses Claim. Their credential then rises in the middle of the window, with the sign-in reveal. The pass is bound to that browser by a key that can never be read out, and every request is signed with it. Anyone else opening the link is told This pass is already in use by ….
• 24 hours, with extensions: a pass runs 24 hours from the claim. An hour before the end, the guest is warned and can Request 24 h extension. Only one request waits at a time, and only LV7 can approve it.
• The LV7 desk: live passes on the left (New code, Revoke, Clear), visitor requests and extension requests on the right (approve a visitor at LV2, LV3, LV5 or LV6). Below them, the History of every pass ever issued: to whom, which level, when it was claimed, extensions, and whether it is active, never claimed, ran out of time, was revoked (by whom) or was ended by its holder. Forget removes a finished pass from the history on request.
• Visitor requests are bound at once to the requesting browser, so an approved pass opens there by itself.
• Security: the relay checks every signature and its time (2-minute window), opens only the repositories the pass's level allows, keeps codes only as an HMAC, and names are cleaned. 53 relay checks run on every pull request, and the whole flow was tested end to end in browsers. Passes from before this release stop working.
• Needs the relay update: deploy the new worker.js (relay version 4). For LV5 and LV6 passes, add GUEST_REPOS and install the GitHub App on hp-leads and hp-admin (sign-in setup, section 6).
• Roadmap: this release's base detail is a cloud's shadow drifting slowly across the sea, drawn by CSS alone.

Website: https://hound-protocol.github.io/Joint-Operations/ · Full changelog: CHANGELOG.md