From 4b79b2db999a4896025b7eb9f6fb3d0fc423ebce Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 28 Oct 2026 11:54:10 +0000 Subject: [PATCH] =?UTF-8?q?Escape=20the=20placeholders=20in=20deployment.m?= =?UTF-8?q?d's=20web=20UI=20paths=20Three=20UI=20paths=20in=20docs/deploym?= =?UTF-8?q?ent.md=20wrote=20their=20placeholders=20bare=20in=20bold=20text?= =?UTF-8?q?:=20**Admin=20=E2=86=92=20Users=20=E2=86=92=20=20?= =?UTF-8?q?=E2=86=92=20Deactivate**,=20**Admin=20=E2=86=92=20Users=20?= =?UTF-8?q?=E2=86=92=20=20=E2=86=92=20Tokens**=20and=20**Admin=20?= =?UTF-8?q?=E2=86=92=20Service=20accounts=20=E2=86=92=20**.=20Mar?= =?UTF-8?q?kdown=20reads=20=20and=20=20as=20HTML=20tags,=20?= =?UTF-8?q?so=20GitHub's=20sanitizer=20dropped=20them=20("Admin=20?= =?UTF-8?q?=E2=86=92=20Users=20=E2=86=92=20=E2=86=92=20Deactivate")=20and?= =?UTF-8?q?=20mdBook=20dropped=20them=20too,=20warning=20about=20an=20uncl?= =?UTF-8?q?osed=20HTML=20tag=20while=20exiting=20Strong.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A backslash escapes each one (\, \), which GitHub and pulldown-cmark both render as the literal text. A code span would not fit, since the rest of each path is plain bold text. CHANGELOG.md has the same problem in two 2.0.0 entries but stays as it is: a change never edits it. Fixes #624 Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_012e6DJXh2a4iuE7x7K94GNJ --- docs/changes/2.1.1/624.docs.md | 4 ++++ docs/deployment.md | 6 +++--- 2 files changed, 7 insertions(+), 3 deletions(-) create mode 100644 docs/changes/2.1.1/624.docs.md diff --git a/docs/changes/2.1.1/624.docs.md b/docs/changes/2.1.1/624.docs.md new file mode 100644 index 00000000..1f3f217e --- /dev/null +++ b/docs/changes/2.1.1/624.docs.md @@ -0,0 +1,4 @@ +The deployment guide's web UI paths for deactivating a user and for issuing +an API token (**Admin → Users → \**, **Admin → Service accounts → +\**) lost their placeholders when rendered: the bare `` and +`` read as HTML tags and were dropped. The guide escapes them now. diff --git a/docs/deployment.md b/docs/deployment.md index 23244c49..0d9197e5 100644 --- a/docs/deployment.md +++ b/docs/deployment.md @@ -396,7 +396,7 @@ invited user's page calls `POST /auth/invitations/lookup` and ### Deactivating users To cut a user off without deleting the account, deactivate it on the user's -page (**Admin → Users → → Deactivate**, or `PATCH /admin/users/{id}` +page (**Admin → Users → \ → Deactivate**, or `PATCH /admin/users/{id}` with `{"active": false}`): - every sign-in is refused: the password, the browser, OIDC, credential @@ -948,8 +948,8 @@ What Forge believes, and when: included. So a request they authenticate holds the account's grants but **never the `admin` role**: the admin API and minting tokens refuse it (403), and publishing packages or images takes an API token, which an - administrator issues on the account's page (**Admin → Users → → - Tokens**, or **Admin → Service accounts → **). State-changing + administrator issues on the account's page (**Admin → Users → \ → + Tokens**, or **Admin → Service accounts → \**). State-changing requests a browser marks as cross-site are refused (403) before authentication. An account of the realm never holds the `admin` role either (creating or making it an admin is a 400): it would count as an