vrr/Pulse
2
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-05-12 05:45:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2
Pulse/internal/api
History
rcourtman 552173b262 fix: improve alert system robustness and security 
Addresses multiple issues identified during comprehensive alert system audit:

1. Fix ZFS device loop lock issue
   - Moved lock acquisition outside loop in checkZFSPoolHealth
   - Changed clearAlert to clearAlertNoLock when lock already held
   - Prevents multiple lock acquisitions in same iteration

2. Add alert deduplication on restore
   - Prevents duplicate alerts after service restart
   - Tracks seen alert IDs during LoadActiveAlerts
   - Logs warnings for any duplicates found

3. Add API input validation
   - validateAlertID function prevents DOS attacks
   - Limit alert ID length to 500 characters
   - Whitelist allowed characters (alphanumeric, -, _, :, /, .)
   - Cap history limit parameter at 10,000 records
   - Applied validation to acknowledge, unacknowledge, and clear endpoints

4. Add panic recovery to goroutines
   - All SaveActiveAlerts goroutines now have defer/recover
   - Cleanup goroutines protected from panics
   - Contextual error logging for each goroutine type

5. Document lock ordering
   - Added comprehensive documentation for Manager mutexes
   - Explains m.mu and resolvedMutex relationship
   - Clarifies acquisition rules to prevent deadlocks
   - Inline comments for resolvedMutex field

These fixes improve stability, security, data integrity, and maintainability
of the alert system without breaking API compatibility.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-09-30 15:35:39 +00:00
..
alerts.go fix: improve alert system robustness and security 2025-09-30 15:35:39 +00:00
auth.go feat: add OIDC single sign-on 2025-09-29 10:22:27 +00:00
config_handlers.go Add runtime mock toggles and auth-safe dev assets 2025-09-30 10:02:26 +00:00
csrf_store.go chore: tidy repo formatting and linting 2025-09-29 20:19:18 +00:00
demo_middleware.go feat: add demo mode with read-only protection 2025-09-30 14:46:20 +00:00
diagnostics.go chore: tidy repo formatting and linting 2025-09-29 20:19:18 +00:00
DO_NOT_EDIT_FRONTEND_HERE.md enhance: improve mock data realism and alert system 2025-09-02 21:11:01 +00:00
frontend_embed.go feat: add OIDC single sign-on 2025-09-29 10:22:27 +00:00
guest_metadata.go chore: tidy repo formatting and linting 2025-09-29 20:19:18 +00:00
middleware.go chore: tidy repo formatting and linting 2025-09-29 20:19:18 +00:00
notifications.go chore: tidy repo formatting and linting 2025-09-29 20:19:18 +00:00
oidc_handlers.go feat: add OIDC single sign-on 2025-09-29 10:22:27 +00:00
oidc_service.go feat: add OIDC single sign-on 2025-09-29 10:22:27 +00:00
rate_limit_config.go chore: tidy repo formatting and linting 2025-09-29 20:19:18 +00:00
ratelimit.go chore: tidy repo formatting and linting 2025-09-29 20:19:18 +00:00
README.md enhance: improve mock data realism and alert system 2025-09-02 21:11:01 +00:00
recovery_tokens.go chore: tidy repo formatting and linting 2025-09-29 20:19:18 +00:00
router.go feat: add demo mode with read-only protection 2025-09-30 14:46:20 +00:00
security.go chore: tidy repo formatting and linting 2025-09-29 20:19:18 +00:00
security_oidc.go feat: add OIDC single sign-on 2025-09-29 10:22:27 +00:00
security_setup_fix.go chore: tidy repo formatting and linting 2025-09-29 20:19:18 +00:00
session_store.go chore: tidy repo formatting and linting 2025-09-29 20:19:18 +00:00
settings.go chore: tidy repo formatting and linting 2025-09-29 20:19:18 +00:00
system_settings.go chore: tidy repo formatting and linting 2025-09-29 20:19:18 +00:00
types.go chore: tidy repo formatting and linting 2025-09-29 20:19:18 +00:00
updates.go chore: tidy repo formatting and linting 2025-09-29 20:19:18 +00:00

README.md

Internal API Package

This directory contains the API server implementation for Pulse.

Important Note About frontend-modern/

The frontend-modern/ subdirectory that appears here is:

  • AUTO-GENERATED during builds
  • NOT the source code - just a build artifact
  • IN .gitignore - never committed
  • REQUIRED BY GO - The embed directive needs it here

Frontend Development Location

👉 Edit frontend files at: /opt/pulse/frontend-modern/src/

Why This Structure?

Go's //go:embed directive has limitations:

  1. Cannot use ../ paths to access parent directories
  2. Cannot follow symbolic links
  3. Must embed files within the Go module

This is a known Go limitation and our structure works around it.