vrr/Pulse
2
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-05-09 02:44:24 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
Pulse/internal/api
History
rcourtman 6a48c759e8 Fix critical notification system bugs and security issues 
This commit addresses multiple critical issues identified in the notification
system audit conducted with Codex:

**Critical Fixes:**

1. **Queue Retry Logic (Critical #1)**
   - Fixed broken retry/DLQ system where send functions never returned errors
   - Made sendGroupedEmail(), sendGroupedWebhook(), sendGroupedApprise() return errors
   - Made sendWebhookRequest() return errors
   - ProcessQueuedNotification() now properly propagates errors to queue
   - Retry logic and DLQ now function correctly

2. **Attempt Counter Bug (Critical #2)**
   - Fixed double-increment bug in queue processing
   - Separated UpdateStatus() from attempt tracking
   - Added IncrementAttempt() method
   - Notifications now get correct number of retry attempts

3. **Secret Exposure (Critical #3 & #4)**
   - Masked webhook headers and customFields in GET /api/notifications/webhooks
   - Added redactSecretsFromURL() to sanitize webhook URLs in history
   - Truncated/redacted response bodies in webhook history
   - Protected against credential harvesting via API

4. **Email Rate Limiting (Critical #5)**
   - Added emailManager field to NotificationManager
   - Shared EnhancedEmailManager instance across sends
   - Rate limiter now accumulates across multiple emails
   - SMTP rate limits are now enforced correctly

5. **SSRF Protection (High #6)**
   - Added DNS resolution of webhook URLs
   - Added isPrivateIP() check using CIDR ranges
   - Blocks all private IP ranges (10/8, 172.16/12, 192.168/16, 127/8, 169.254/16)
   - Blocks IPv6 private ranges (::1, fe80::/10, fc00::/7)
   - Prevents DNS rebinding attacks
   - Returns error instead of warning for private IPs

**New Features:**

6. **Health Endpoint (High #8)**
   - Added GET /api/notifications/health
   - Returns queue stats (pending, sending, sent, failed, dlq)
   - Shows email/webhook configuration status
   - Provides overall health indicator

**Related to notification system audit**

Files changed:
- internal/notifications/notifications.go: Error returns, rate limiting, SSRF hardening
- internal/notifications/queue.go: Attempt tracking fix
- internal/api/notifications.go: Secret masking, health endpoint
2025-11-06 23:26:03 +00:00
..
alerts.go Implement Pulse tag overrides and alert clear persistence 2025-10-25 14:28:32 +00:00
alerts_test.go Allow printable alert IDs for acknowledgements (#550) 2025-10-14 16:48:22 +00:00
auth.go Refactor: Code cleanup and localStorage consolidation 2025-11-04 21:50:46 +00:00
auth_scope_test.go Add API token scopes and standalone host agent 2025-10-23 11:40:31 +00:00
bootstrap_token.go Improve bootstrap token UX for easier discovery 2025-11-06 17:29:49 +00:00
config_handlers.go Fix config backup/restore failures (related to #646) 2025-11-06 17:53:54 +00:00
config_handlers_auto_register_test.go Harden setup token flow and enforce encrypted persistence 2025-10-25 16:00:37 +00:00
config_handlers_cluster_test.go Respect custom ports when discovering Proxmox clusters 2025-10-22 17:42:52 +00:00
config_handlers_setup_script_test.go Refactor: Code cleanup and localStorage consolidation 2025-11-04 21:50:46 +00:00
csrf_store.go Refactor: Code cleanup and localStorage consolidation 2025-11-04 21:50:46 +00:00
demo_middleware.go Fix demo mode to allow authentication endpoints 2025-11-06 13:48:28 +00:00
diagnostics.go Fix guest agent disk data regression on Proxmox 8.3+ 2025-11-06 18:42:46 +00:00
DO_NOT_EDIT_FRONTEND_HERE.md Fix settings security tab navigation 2025-10-11 23:29:47 +00:00
docker_agents.go Add custom display name support for Docker hosts 2025-11-05 23:18:03 +00:00
docker_metadata.go Consolidate pending changes 2025-10-28 23:20:44 +00:00
frontend_embed.go Improve static asset caching for hashed files 2025-11-06 13:54:26 +00:00
guest_metadata.go Fix settings security tab navigation 2025-10-11 23:29:47 +00:00
host_agents.go Improve host agent onboarding flow 2025-10-25 09:37:29 +00:00
host_agents_test.go perf: reduce polling allocations and guest metadata load 2025-10-25 13:12:47 +00:00
http_metrics.go feat: comprehensive diagnostics and observability improvements 2025-10-21 12:37:39 +00:00
middleware.go feat: comprehensive diagnostics and observability improvements 2025-10-21 12:37:39 +00:00
notification_queue.go Add comprehensive alert system reliability improvements 2025-11-06 16:46:30 +00:00
notifications.go Fix critical notification system bugs and security issues 2025-11-06 23:26:03 +00:00
oidc_handlers.go Fix settings security tab navigation 2025-10-11 23:29:47 +00:00
oidc_service.go Fix settings security tab navigation 2025-10-11 23:29:47 +00:00
rate_limit_config.go Add comprehensive release validation to prevent missing artifacts 2025-11-06 16:33:49 +00:00
rate_limit_config_test.go test: add X-RateLimit-Limit header regression test 2025-10-20 15:10:59 +00:00
ratelimit.go Fix settings security tab navigation 2025-10-11 23:29:47 +00:00
README.md Fix settings security tab navigation 2025-10-11 23:29:47 +00:00
recovery_tokens.go perf: reduce polling allocations and guest metadata load 2025-10-25 13:12:47 +00:00
router.go Add comprehensive release validation to prevent missing artifacts 2025-11-06 16:33:49 +00:00
router_integration_test.go Refactor: Code cleanup and localStorage consolidation 2025-11-04 21:50:46 +00:00
security.go Fix CSRF token validation and improve token management 2025-11-05 09:23:44 +00:00
security_oidc.go feat: add professional logging with runtime configuration and performance optimization 2025-10-20 15:13:38 +00:00
security_setup_fix.go Improve bootstrap token UX for easier discovery 2025-11-06 17:29:49 +00:00
security_setup_fix_test.go Refactor: Code cleanup and localStorage consolidation 2025-11-04 21:50:46 +00:00
security_test.go Refactor: Code cleanup and localStorage consolidation 2025-11-04 21:50:46 +00:00
security_tokens.go Refactor: Code cleanup and localStorage consolidation 2025-11-04 21:50:46 +00:00
security_tokens_test.go Add API token scopes and standalone host agent 2025-10-23 11:40:31 +00:00
session_store.go Refactor: Code cleanup and localStorage consolidation 2025-11-04 21:50:46 +00:00
system_settings.go Fix CSRF token validation and improve token management 2025-11-05 09:23:44 +00:00
types.go Add per-node temperature monitoring and fix critical config update bug 2025-11-05 14:11:53 +00:00
updates.go Fix settings security tab navigation 2025-10-11 23:29:47 +00:00

README.md

Internal API Package

This directory contains the API server implementation for Pulse.

Important Note About frontend-modern/

The frontend-modern/ subdirectory that appears here is:

  • AUTO-GENERATED during builds
  • NOT the source code - just a build artifact
  • IN .gitignore - never committed
  • REQUIRED BY GO - The embed directive needs it here

Frontend Development Location

👉 Edit frontend files at: /opt/pulse/frontend-modern/src/

Why This Structure?

Go's //go:embed directive has limitations:

  1. Cannot use ../ paths to access parent directories
  2. Cannot follow symbolic links
  3. Must embed files within the Go module

This is a known Go limitation and our structure works around it.