mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 12:42:38 +00:00
Oliver Kieselbach
557dd22c53
Backend Changes: - Fix user identification to use UPN (User Principal Name) claim as primary identifier instead of display name - Add JWT authentication validation to all API endpoints with Authorization header support - Implement Galactic Admin role with cross-tenant access permissions for sessions, events, and SignalR groups - Add cross-tenant validation in GetSessionEventsFunction, SignalRAddToGroupFunction, and SignalRRemoveFromGroupFunction - Enhance AuthenticationMiddleware to log actual user identifier (UPN) instead of display name Admin Configuration: - Add GetAdminConfigurationFunction and UpdateAdminConfigurationFunction for global settings - Create AdminConfigurationService for managing platform-wide configuration - Add AdminConfiguration model with global rate limiting and maintenance settings - Restrict admin configuration access to Galactic Admins only SignalR Real-time Updates: - Implement "galactic-admins" SignalR group for cross-tenant session visibility - RegisterSessionFunction now sends "newSession" events to both tenant-specific and galactic-admins groups - IngestEventsFunction sends "newevents" only to tenant-specific groups (prevents flooding) - Frontend listens to both "newSession" and "newevents" for real-time updates - Galactic Admins see new sessions from all tenants without being flooded with event updates Frontend Changes: - Add Authorization headers with JWT tokens to all API fetch calls (sessions, events, metrics, configuration) - Implement automatic joining/leaving of "galactic-admins" SignalR group based on Galactic Admin mode - Handle both "newSession" and "newevents" SignalR events for complete session list updates - Add authentication error handling with user notifications for token failures Security Improvements: - Validate tenant access for all cross-tenant operations - Ensure users can only access their own tenant data unless they're Galactic Admins - Log all cross-tenant access attempts with user identifiers for audit trail