Commit graph

2874 commits

Author SHA1 Message Date
rcourtman
5073c10030 Fix alert system reliability issues and update audit report
- Fix stale alerts not clearing when nodes/hosts go offline in CheckNode and HandleHostOffline
- Fix stale alerts persisting when thresholds are disabled or set to 0 in CheckGuest and CheckNode
- Fix CheckHost to properly clear disk alerts when overrides disable them
- Update audit_report.md with findings from the Alert System Reliability Audit
2026-02-04 12:50:36 +00:00
rcourtman
5ccf8ac7bc Fix UnifiedAgents test missing Router wrapper
UnifiedAgents calls useNavigate() which requires a Router context.
The test was rendering the component without one, breaking CI.
2026-02-04 12:49:40 +00:00
rcourtman
8ddcbf8c62 Add router route inventory test 2026-02-04 12:49:22 +00:00
rcourtman
8951b6f7f9 Require monitoring scope for socket.io 2026-02-04 12:41:12 +00:00
rcourtman
216ccf0be5 Require auth for socket.io js 2026-02-04 12:39:19 +00:00
rcourtman
63a846cf3b Allow bearer tokens for websocket auth 2026-02-04 12:37:46 +00:00
rcourtman
18ed23504d Harden encoded path traversal coverage 2026-02-04 12:36:44 +00:00
rcourtman
36f1504355 Cover bearer token auth for stats 2026-02-04 12:34:47 +00:00
rcourtman
6427f28a08 Fix stale metrics store reference in reporting engine after monitor reload
The reporting engine held a direct pointer to the metrics store, which
becomes invalid after a monitor reload (settings change, node config
save, etc.) closes and recreates the store. Use a dynamic getter closure
that always resolves to the current monitor's active store.

Also adds diagnostic logging when report queries return zero metrics,
and integration tests covering the full metrics-to-report pipeline
including reload scenarios.

Fixes #1186
2026-02-04 12:34:40 +00:00
rcourtman
e23a2a793b Cover socket.io query token auth 2026-02-04 12:32:30 +00:00
rcourtman
7fc9a98c47 Cover websocket query token auth 2026-02-04 12:25:25 +00:00
rcourtman
df08e45993 Require passphrase for config export/import 2026-02-04 12:19:53 +00:00
rcourtman
fb06ae00c1 Harden config export/import validation 2026-02-04 12:18:40 +00:00
rcourtman
0c1ff9da7f Reject invalid pulse_url in setup script 2026-02-04 12:16:20 +00:00
rcourtman
4298d87485 Allow setup token via query param for SSH endpoints 2026-02-04 12:15:22 +00:00
rcourtman
3f51dbb7de Assert security status auth token handling 2026-02-04 12:13:48 +00:00
rcourtman
77f23b35f7 Validate setup script input sanitization 2026-02-04 12:12:13 +00:00
rcourtman
f8c4a28600 Guard SSH key generation in containers 2026-02-04 12:10:10 +00:00
rcourtman
902bdd92c2 fix: prefer status-mem over status-freemem for VM memory calculation
Proxmox's FreeMem field reports free memory relative to the balloon's
guest-visible total (total_mem), not relative to MaxMem. When ballooning
is active and the VM's memory has been reduced, subtracting FreeMem from
MaxMem produces wildly inflated usage (e.g. 97% when actual usage is 20%).

Proxmox's Mem field is already calculated as (total_mem - free_mem),
giving the correct used bytes regardless of balloon state. Swap the
priority so Mem is checked before FreeMem.

Related to #1185
2026-02-04 12:08:33 +00:00
rcourtman
8313d66e64 Ensure public endpoints stay public in API mode 2026-02-04 12:06:50 +00:00
rcourtman
1fddbec07f Ensure public download endpoints bypass auth 2026-02-04 12:05:32 +00:00
rcourtman
a49fa8514a Cover OIDC callback public access 2026-02-04 12:03:56 +00:00
rcourtman
11e28689b2 Cover public setup script access 2026-02-04 12:02:27 +00:00
rcourtman
b57fdd2085 Add path traversal regression tests 2026-02-04 12:00:54 +00:00
rcourtman
f707e0ad40 Add audit auth regression checks 2026-02-04 11:59:48 +00:00
rcourtman
9f1877116b Verify security status bootstrap token exposure 2026-02-04 11:58:02 +00:00
rcourtman
e0e4d24428 Cover setup token access for SSH endpoints 2026-02-04 11:56:16 +00:00
rcourtman
f9489db9e0 Add public endpoint regression coverage 2026-02-04 11:52:15 +00:00
rcourtman
d0e0a85861 Cover RBAC trailing slash routes 2026-02-04 11:40:23 +00:00
rcourtman
fd108faa7d feat(profiles): de-emphasize AI suggestions and fix multi-tenant support
UI/UX Improvements for AI-skeptical users:
- Only show 'Ideas' button if AI is enabled AND configured
- Renamed 'Suggest Profile' to 'Ideas' with lightbulb icon
- Moved 'New Profile' button to primary position
- Changed AI button styling from prominent purple to subtle gray
- Updated modal title to 'Profile Ideas' with neutral language

Multi-tenant bug fix:
- ProfileSuggestionHandler now uses MultiTenantPersistence
- Properly resolves tenant-specific persistence from request context
- Fixes potential nil pointer panic in multi-tenant deployments
- Existing profiles are now correctly loaded per-tenant for AI context

Tests updated to use MultiTenantPersistence with org context injection.
2026-02-04 11:39:50 +00:00
rcourtman
a73352a396 Add recovery endpoint regression test 2026-02-04 11:39:30 +00:00
rcourtman
aa61c8edc5 Add quick setup and token auth regression tests 2026-02-04 11:38:09 +00:00
rcourtman
0c4b19ddf4 Add SSH security regression coverage 2026-02-04 11:36:11 +00:00
rcourtman
06df067cd7 Cover apply-restart auth guards 2026-02-04 11:30:37 +00:00
rcourtman
a9dc469de7 Add permission denial regression tests 2026-02-04 11:28:09 +00:00
rcourtman
a2b8b21ada Fix rate limit flake in config export/import tests 2026-02-04 11:23:12 +00:00
rcourtman
ee5931ac7d test: extend admin proxy and reset lockout auth coverage 2026-02-04 11:16:53 +00:00
rcourtman
df4ae9d639 test: deny non-admin proxy users on admin endpoints 2026-02-04 11:14:53 +00:00
rcourtman
65a0b7a0e4 test: cover change-password and public export/import guards 2026-02-04 11:12:54 +00:00
rcourtman
5553214256 test: require auth for license status 2026-02-04 11:08:21 +00:00
rcourtman
1af342da2d fix: add 7-day snooze cooldown to GitHub star modal
"Maybe later" previously only hid the modal for the current session,
causing it to reappear on every subsequent visit. Now it snoozes the
modal for 7 days before showing again.
2026-02-04 11:04:52 +00:00
rcourtman
ed0f85149d test: require auth for logs and update status 2026-02-04 11:00:46 +00:00
rcourtman
cea2fdd40f fix: add FreeBSD binaries to release manifest and validation
The previous commit added FreeBSD binaries to the Docker build and
release directory but didn't update the manifest generator or validation
script. Without this, FreeBSD binaries would be built but not tracked
or validated, and release validation would fail on the new entries.

Related to #1051
2026-02-04 11:00:31 +00:00
rcourtman
ae58e16525 test: include /api/config in monitoring read coverage 2026-02-04 11:00:03 +00:00
rcourtman
764805b0b9 test: require auth for auto-register 2026-02-04 10:59:24 +00:00
rcourtman
d6172b9a86 test: require auth for config export/import in api mode 2026-02-04 10:57:14 +00:00
rcourtman
47a4dc01cf test: require auth for ai status, license features, scheduler health 2026-02-04 10:56:17 +00:00
rcourtman
7346d48872 fix: add FreeBSD agent binaries to Docker build and fix pfSense boot (#1051)
Two fixes for FreeBSD agent support:

1. The Docker image never built or included FreeBSD agent binaries, causing
   404 errors when FreeBSD clients requested the download. Added FreeBSD
   amd64/arm64 cross-compilation for both host-agent and unified-agent,
   plus COPY statements to include them in the image. Also added bare
   FreeBSD binaries to GitHub release assets for the redirect fallback.

2. pfSense does not use the standard FreeBSD rc.d boot system — scripts
   in /usr/local/etc/rc.d/ must end in .sh to run at boot. The installer
   now detects pfSense and creates a .sh boot wrapper alongside the
   standard rc.d script. Also added -r flag to daemon for auto-restart.

Related to #1051
2026-02-04 10:55:55 +00:00
rcourtman
5850ddf584 test: enforce proxy admin for config export/import and notifications 2026-02-04 10:54:51 +00:00
rcourtman
83311cdf8c test: require settings:write for ai patrol autonomy update 2026-02-04 10:48:56 +00:00