..
  This file is part of PEPSI.
  Copyright (C) 2026 GNUnet e.V.

  PEPSI is free software; you can redistribute it and/or modify it under the
  terms of the GNU Affero General Public License as published by the Free
  Software Foundation; either version 3, or (at your option) any later version.

=================
pepsi-secure-link
=================

*Inspect and manage the messages held in the secure-link portal.*

Role
====

``pepsi-secure-link`` is the operator CLI for the secure-link fallback portal:
``list`` shows what is outstanding (``--limit``, ``--expired`` to include
messages that have expired but not yet been pruned, ``--json``), ``show``
*TOKEN* adds one message's access log, ``revoke`` *TOKEN* destroys a message and
``prune`` deletes what has expired (``--grace-hours`` keeps it a while longer).
It is not a stage. Reference: :manpage:`pepsi-secure-link(1)`.

What it will not do
===================

It reports **who and when, never what**. There is no subcommand that shows a
stored message, no ``--decrypt`` and no escrow key: the content key is derived
from the recipient's PIN, which this server never stores, so there is nothing for an administrator to look up. When a PIN is lost, the answer
is that the sender sends the message again. See :ref:`secure-link` for the whole
argument and its consequences.

Running it
==========

Run as ``root`` it adopts the ``pepsi`` service account. That role can read
every column of ``pepsi.secure_message`` **except** ``ciphertext``, which is why
listing works and why nothing here can print a message even by accident;
``pepsi-setup`` verifies the boundary against the live database on every run.

``prune`` belongs in a daily cron job or systemd timer: the portal already refuses
an expired token, but nothing deletes the bytes until the job runs.