..
  This file is part of PEPSI.
  Copyright (C) 2026 Pepsi contributors

  PEPSI is free software; you can redistribute it and/or modify it under the
  terms of the GNU Affero General Public License as published by the Free
  Software Foundation; either version 3, or (at your option) any later version.

=================
pepsi-secure-link
=================

*Inspect and manage the messages held in the secure-link portal.*

Role
====

``pepsi-secure-link`` is the operator CLI for the secure-link fallback portal:
``list`` shows what is outstanding, ``show`` adds one message's access log,
``revoke`` destroys a message and ``prune`` deletes what has expired. It is not a
stage. Reference: :manpage:`pepsi-secure-link(1)`.

What it will not do
===================

It reports **who and when, never what**. There is no subcommand that shows a
stored message, no ``--decrypt`` and no escrow key: the content key is derived
from the recipient's PIN, which this server never receives and never stores, so
there is nothing for an administrator to look up. When a PIN is lost, the answer
is that the sender sends the message again. See :ref:`secure-link` for the whole
argument and its consequences.

Running it
==========

Run as ``root`` it adopts the ``pepsi`` service account. That role is granted
every column of ``pepsi.secure_message`` **except** ``ciphertext``, which is why
listing works and why nothing here can print a message even by accident;
``pepsi-setup`` verifies the boundary against the live database on every run.

``prune`` belongs in a daily cron job or systemd timer: the portal already refuses
an expired token, but nothing deletes the bytes until the job runs.