-
-
-
${escHtml(t('address_book_json_hint'))}
+
+
+
+
+
+
+ | ${escHtml(t('address_book_peer_id'))} |
+ ${escHtml(t('address_book_alias'))} |
+ ${escHtml(t('address_book_peer_tags'))} |
+ |
+
+
+
+
+
+
+
+
+
+
`;
+ renderAddressBookPeersTable();
+
+ document.getElementById('org-address-book-add-peer-btn')?.addEventListener('click', () => {
+ syncAddressBookPeersFromTable();
+ addressBookPeers.push({ id: '', alias: '', tags: [] });
+ renderAddressBookPeersTable();
+ });
+
+ document.getElementById('org-address-book-toggle-json')?.addEventListener('click', () => {
+ addressBookShowJson = !addressBookShowJson;
+ const wrap = document.getElementById('org-address-book-json-wrap');
+ const btn = document.getElementById('org-address-book-toggle-json');
+ const structured = document.getElementById('org-address-book-structured');
+ if (addressBookShowJson) {
+ syncAddressBookPeersFromTable();
+ const payload = buildAddressBookPayload();
+ document.getElementById('org-address-book-json').value = formatAddressBook(payload);
+ wrap?.classList.remove('hidden');
+ structured?.classList.add('hidden');
+ if (btn) btn.innerHTML = `
view_list ${escHtml(t('address_book_hide_json'))}`;
+ } else {
+ try {
+ const parsedJson = currentAddressBookJSON();
+ addressBookPeers = Array.isArray(parsedJson.peers) ? parsedJson.peers : [];
+ addressBookTags = Array.isArray(parsedJson.tags) ? parsedJson.tags : [];
+ document.getElementById('org-address-book-tags-input').value = addressBookTags.join(', ');
+ renderAddressBookPeersTable();
+ } catch (err) {
+ toast(err.message || t('address_book_invalid_json'), 'error');
+ addressBookShowJson = true;
+ return;
+ }
+ wrap?.classList.add('hidden');
+ structured?.classList.remove('hidden');
+ if (btn) btn.innerHTML = `
code ${escHtml(t('address_book_show_json'))}`;
+ }
+ });
+
const saveBtn = document.getElementById('save-address-book-btn');
const importBtn = document.getElementById('import-org-devices-btn');
if (saveBtn) saveBtn.onclick = saveAddressBook;
diff --git a/web-nodejs/routes/bd-api.routes.js b/web-nodejs/routes/bd-api.routes.js
index 79a6a2b9..00cdb910 100644
--- a/web-nodejs/routes/bd-api.routes.js
+++ b/web-nodejs/routes/bd-api.routes.js
@@ -240,14 +240,29 @@ router.post('/register', identifyDevice, async (req, res) => {
return res.status(400).json({ error: 'device_id is required' });
}
- // Reject registration with a stale/renamed peer ID (Issue #97)
- const newId = db.getRenamedPeerId ? await db.getRenamedPeerId(id) : null;
- if (newId) {
- return res.status(409).json({
- error: 'Device ID has been changed',
- new_id: newId,
- message: `This device ID was renamed to ${newId}. Please update your configuration.`,
+ // Reject registration with a stale/renamed peer ID unless same device (#97, #213)
+ if (typeof db.shouldRejectRenamedPeerRegistration === 'function') {
+ const renameCheck = await db.shouldRejectRenamedPeerRegistration(id, {
+ uuid: uuid || '',
+ pk: public_key || '',
+ ip,
});
+ if (renameCheck.reject && renameCheck.new_id) {
+ return res.status(409).json({
+ error: 'Device ID has been changed',
+ new_id: renameCheck.new_id,
+ message: `This device ID was renamed to ${renameCheck.new_id}. Please update your configuration.`,
+ });
+ }
+ } else {
+ const newId = db.getRenamedPeerId ? await db.getRenamedPeerId(id) : null;
+ if (newId) {
+ return res.status(409).json({
+ error: 'Device ID has been changed',
+ new_id: newId,
+ message: `This device ID was renamed to ${newId}. Please update your configuration.`,
+ });
+ }
}
// Build info JSON
diff --git a/web-nodejs/routes/devices.routes.js b/web-nodejs/routes/devices.routes.js
index 7ba57f35..1fd2cd58 100644
--- a/web-nodejs/routes/devices.routes.js
+++ b/web-nodejs/routes/devices.routes.js
@@ -457,6 +457,9 @@ router.delete('/api/devices/:id', requireAuth, requirePermission('device.delete'
// Clean up local auth.db data for this peer
try {
await db.cleanupDeletedPeerData(id);
+ if (hard && typeof db.purgePanelPeerRecord === 'function') {
+ await db.purgePanelPeerRecord(id);
+ }
} catch { /* non-critical: auth.db cleanup is secondary */ }
// Log action
@@ -614,6 +617,14 @@ router.post('/api/devices/:id/change-id', requireAuth, requirePermission('device
error: mapChangeIdError(req, result?.error)
});
}
+
+ try {
+ if (typeof db.cascadePeerIdChange === 'function') {
+ await db.cascadePeerIdChange(oldId, newId.toUpperCase());
+ }
+ } catch (cascadeErr) {
+ console.warn('Change ID panel cascade failed:', cascadeErr.message);
+ }
// Log action
await db.logAction(req.session.userId, 'device_id_changed', `Device ID changed from ${oldId} to ${newId}`, req.ip);
@@ -1046,4 +1057,159 @@ router.post('/api/devices/:id/rename', requireAuth, requirePermission('device.ed
}
});
+// ---------------------------------------------------------------------------
+// Panel access-control strategies (RustDesk Pro client policy rules)
+// ---------------------------------------------------------------------------
+
+const RUSTDESK_STRATEGY_PERM_KEYS = [
+ 'enable-file-transfer',
+ 'disable-clipboard',
+ 'enable-clipboard',
+ 'enable-audio',
+ 'enable-tunnel',
+ 'enable-camera',
+ 'enable-remote-restart',
+ 'enable-block-input',
+];
+
+function normalizeStrategyPermissions(raw) {
+ if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return {};
+ const out = {};
+ for (const [key, value] of Object.entries(raw)) {
+ if (value === true || value === 'Y' || value === 'y') out[key] = 'Y';
+ else if (value === false || value === 'N' || value === 'n') out[key] = 'N';
+ else if (typeof value === 'string' && value.trim()) out[key] = value.trim();
+ }
+ return out;
+}
+
+function serializeStrategy(row) {
+ if (!row) return null;
+ const perms = row.permissions && typeof row.permissions === 'object' ? row.permissions : {};
+ return {
+ guid: row.guid,
+ name: row.name || '',
+ user_group_guid: row.user_group_guid || '',
+ device_group_guid: row.device_group_guid || '',
+ enabled: row.enabled === true || row.enabled === 1,
+ permissions: perms,
+ permission_keys: RUSTDESK_STRATEGY_PERM_KEYS,
+ created_at: row.created_at || null,
+ updated_at: row.updated_at || null,
+ };
+}
+
+function normalizeStrategyPayload(body = {}) {
+ const name = String(body.name || '').trim();
+ if (!name) {
+ const err = new Error('Strategy name is required');
+ err.status = 400;
+ throw err;
+ }
+ const userGroupGuid = String(body.user_group_guid || '').trim();
+ const deviceGroupGuid = String(body.device_group_guid || '').trim();
+ if (userGroupGuid && !isValidGroupGuid(userGroupGuid)) {
+ const err = new Error('Invalid user group');
+ err.status = 400;
+ throw err;
+ }
+ if (deviceGroupGuid && !isValidGroupGuid(deviceGroupGuid)) {
+ const err = new Error('Invalid device group');
+ err.status = 400;
+ throw err;
+ }
+ return {
+ name: name.slice(0, 80),
+ user_group_guid: userGroupGuid,
+ device_group_guid: deviceGroupGuid,
+ enabled: body.enabled !== false,
+ permissions: normalizeStrategyPermissions(body.permissions),
+ };
+}
+
+/**
+ * GET /api/panel/strategies — list strategies for panel UI / RustDesk sync.
+ */
+router.get('/api/panel/strategies', requireAuth, requirePermission('device.view'), async (req, res) => {
+ try {
+ const strategies = await db.getAllStrategies();
+ res.json({
+ success: true,
+ data: {
+ strategies: (strategies || []).map(serializeStrategy),
+ total: strategies.length,
+ },
+ });
+ } catch (err) {
+ console.error('Get strategies error:', err);
+ res.status(500).json({ success: false, error: req.t('errors.server_error') });
+ }
+});
+
+/**
+ * POST /api/panel/strategies — create strategy.
+ */
+router.post('/api/panel/strategies', requireAuth, requirePermission('device.edit'), async (req, res) => {
+ try {
+ const payload = normalizeStrategyPayload(req.body || {});
+ const created = await db.createStrategy(payload);
+ await db.logAction(req.session.userId, 'strategy_created', `Created strategy: ${created.name}`, req.ip);
+ res.json({ success: true, data: { strategy: serializeStrategy(created) } });
+ } catch (err) {
+ console.error('Create strategy error:', err);
+ res.status(err.status || 500).json({
+ success: false,
+ error: err.status === 400 ? err.message : req.t('errors.server_error'),
+ });
+ }
+});
+
+/**
+ * PATCH /api/panel/strategies/:guid — update strategy.
+ */
+router.patch('/api/panel/strategies/:guid', requireAuth, requirePermission('device.edit'), async (req, res) => {
+ try {
+ const guid = String(req.params.guid || '').trim();
+ if (!isValidGroupGuid(guid)) {
+ return res.status(400).json({ success: false, error: 'Invalid strategy identifier' });
+ }
+ const existing = await db.getStrategyByGuid(guid);
+ if (!existing) {
+ return res.status(404).json({ success: false, error: req.t('devices.strategy_not_found') });
+ }
+ const payload = normalizeStrategyPayload({ ...existing, ...req.body });
+ const updated = await db.updateStrategy(guid, payload);
+ await db.logAction(req.session.userId, 'strategy_updated', `Updated strategy: ${updated.name}`, req.ip);
+ res.json({ success: true, data: { strategy: serializeStrategy(updated) } });
+ } catch (err) {
+ console.error('Update strategy error:', err);
+ res.status(err.status || 500).json({
+ success: false,
+ error: err.status === 400 ? err.message : req.t('errors.server_error'),
+ });
+ }
+});
+
+/**
+ * DELETE /api/panel/strategies/:guid — delete strategy.
+ */
+router.delete('/api/panel/strategies/:guid', requireAuth, requirePermission('device.edit'), async (req, res) => {
+ try {
+ const guid = String(req.params.guid || '').trim();
+ if (!isValidGroupGuid(guid)) {
+ return res.status(400).json({ success: false, error: 'Invalid strategy identifier' });
+ }
+ const existing = await db.getStrategyByGuid(guid);
+ if (!existing) {
+ return res.status(404).json({ success: false, error: req.t('devices.strategy_not_found') });
+ }
+ await db.deleteStrategy(guid);
+ await db.logAction(req.session.userId, 'strategy_deleted', `Deleted strategy: ${existing.name}`, req.ip);
+ res.json({ success: true });
+ } catch (err) {
+ console.error('Delete strategy error:', err);
+ res.status(500).json({ success: false, error: req.t('errors.server_error') });
+ }
+});
+
module.exports = router;
diff --git a/web-nodejs/routes/rustdesk-api.routes.js b/web-nodejs/routes/rustdesk-api.routes.js
index dbc4d4ee..ea16b1aa 100644
--- a/web-nodejs/routes/rustdesk-api.routes.js
+++ b/web-nodejs/routes/rustdesk-api.routes.js
@@ -638,14 +638,28 @@ async function getRustDeskPeerList(user, params = {}) {
};
}
-async function sendRustDeskDeviceGroups(req, res) {
+function rustDeskAccessibleDeviceGroupPayload(group, index) {
+ const guid = String(group.guid || '').trim();
+ return {
+ name: group.name || '',
+ guid,
+ note: group.note || '',
+ sort: typeof index === 'number' ? index : 0
+ };
+}
+
+async function sendRustDeskDeviceGroups(req, res, accessibleOnly = null) {
try {
if (req.authUser && req.authUser.role === 'pro') {
return res.json({ data: [], total: 0, msg: 'success' });
}
+ const useAccessible = accessibleOnly !== null
+ ? accessibleOnly
+ : String(req.path || '').includes('/device-group');
const groups = await getRustDeskDeviceGroups(req.authUser);
+ const payloadFn = useAccessible ? rustDeskAccessibleDeviceGroupPayload : rustDeskDeviceGroupPayload;
return res.json({
- data: groups.map((g, i) => rustDeskDeviceGroupPayload(g, i)),
+ data: groups.map((g, i) => payloadFn(g, i)),
total: groups.length,
msg: 'success'
});
@@ -1933,6 +1947,28 @@ router.post('/api/strategies', requireAuth, requireAdmin, async (req, res) => {
}
});
+/**
+ * DELETE /api/strategies/:guid
+ * Remove an access control strategy (admin only).
+ */
+router.delete('/api/strategies/:guid', requireAuth, requireAdmin, async (req, res) => {
+ try {
+ const guid = sanitizeStr(req.params.guid || '', 64);
+ if (!guid) {
+ return res.status(400).json({ error: 'Strategy guid is required' });
+ }
+ const existing = await db.getStrategyByGuid(guid);
+ if (!existing) {
+ return res.status(404).json({ error: 'Strategy not found' });
+ }
+ await db.deleteStrategy(guid);
+ return res.json({ status: 'deleted', guid });
+ } catch (err) {
+ console.error('[API:STRATEGIES] Delete error:', err.message);
+ return res.status(500).json({ error: 'Server error' });
+ }
+});
+
// ==================== Security: Peer Key Endpoint ====================
/**
diff --git a/web-nodejs/services/database.js b/web-nodejs/services/database.js
index 174b4fbe..2725e958 100644
--- a/web-nodejs/services/database.js
+++ b/web-nodejs/services/database.js
@@ -46,6 +46,15 @@ const facade = {
softDeletePeer: (id) => adapter.softDeletePeer(id),
deleteDevice: (id) => adapter.softDeletePeer(id),
getRenamedPeerId: (id) => adapter.getRenamedPeerId ? adapter.getRenamedPeerId(id) : null,
+ cascadePeerIdChange: (oldId, newId) => adapter.cascadePeerIdChange
+ ? adapter.cascadePeerIdChange(oldId, newId)
+ : Promise.resolve(),
+ purgePanelPeerRecord: (id) => adapter.purgePanelPeerRecord
+ ? adapter.purgePanelPeerRecord(id)
+ : Promise.resolve(),
+ shouldRejectRenamedPeerRegistration: (oldId, identity) => adapter.shouldRejectRenamedPeerRegistration
+ ? adapter.shouldRejectRenamedPeerRegistration(oldId, identity)
+ : Promise.resolve({ reject: false }),
setBanStatus: (id, banned, reason) => adapter.setBanStatus(id, banned, reason),
getPeerStats: () => adapter.getPeerStats(),
getStats: () => adapter.getPeerStats(),
diff --git a/web-nodejs/services/dbAdapter.js b/web-nodejs/services/dbAdapter.js
index 864ddd99..3b675ed6 100644
--- a/web-nodejs/services/dbAdapter.js
+++ b/web-nodejs/services/dbAdapter.js
@@ -28,6 +28,39 @@ const { hashAccessToken } = require('../lib/tokenHash');
// Lazy-loaded drivers — keeps startup fast when one backend isn't installed.
let _sqlite = null;
+
+/** Match Go signal peerIPMatches — client host vs stored peer IP (may include port). */
+function peerIPMatches(clientHost, storedIP) {
+ if (!clientHost || !storedIP) return false;
+ let storedHost = storedIP;
+ const idx = storedIP.lastIndexOf(':');
+ if (idx > 0) {
+ const hostPart = storedIP.slice(0, idx);
+ if (/^\d+\.\d+\.\d+\.\d+$/.test(hostPart)) storedHost = hostPart;
+ }
+ return clientHost === storedHost || storedIP.startsWith(`${clientHost}:`);
+}
+
+function pkEqual(a, b) {
+ if (!a || !b) return false;
+ try {
+ const toBuf = (v) => {
+ if (Buffer.isBuffer(v)) return v;
+ const s = String(v);
+ return /^[0-9a-f]+$/i.test(s) ? Buffer.from(s, 'hex') : Buffer.from(s);
+ };
+ const bufA = toBuf(a);
+ const bufB = toBuf(b);
+ return bufA.length === bufB.length && bufA.equals(bufB);
+ } catch (_) {
+ return false;
+ }
+}
+
+function uuidEqual(a, b) {
+ if (!a || !b) return false;
+ return String(a).replace(/-/g, '').toLowerCase() === String(b).replace(/-/g, '').toLowerCase();
+}
let _pg = null;
function getSqliteDriver() {
@@ -1021,6 +1054,112 @@ function createSqliteAdapter(config) {
let _lastGoPeerSyncSqlite = 0;
const GO_SYNC_INTERVAL_SQLITE_MS = 30_000;
+ function cascadePeerIdChangeSqlite(oldId, newId) {
+ if (!oldId || !newId || oldId === newId) return;
+ try {
+ openMain().prepare('UPDATE peer SET id = ? WHERE id = ?').run(newId, oldId);
+ } catch (err) {
+ console.warn('[DB] cascadePeerIdChange peer table:', err.message);
+ }
+ try {
+ const authDb = openAuth();
+ const stmts = [
+ ['UPDATE peer_sysinfo SET peer_id = ? WHERE peer_id = ?', [newId, oldId]],
+ ['UPDATE peer_metrics SET peer_id = ? WHERE peer_id = ?', [newId, oldId]],
+ ['UPDATE device_folder_assignments SET device_id = ? WHERE device_id = ?', [newId, oldId]],
+ ['UPDATE device_folder_assignments SET peer_id = ? WHERE peer_id = ?', [newId, oldId]],
+ ['UPDATE device_group_peers SET peer_id = ? WHERE peer_id = ?', [newId, oldId]],
+ ['UPDATE access_tokens SET client_id = ? WHERE client_id = ?', [newId, oldId]],
+ ['UPDATE audit_connections SET peer_id = ? WHERE peer_id = ?', [newId, oldId]],
+ ['UPDATE audit_files SET peer_id = ? WHERE peer_id = ?', [newId, oldId]],
+ ['UPDATE audit_alarms SET peer_id = ? WHERE peer_id = ?', [newId, oldId]],
+ ];
+ for (const [sql, params] of stmts) {
+ try {
+ authDb.prepare(sql).run(...params);
+ } catch (err) {
+ if (!err.message.includes('no such table') && !err.message.includes('no such column')) {
+ console.warn('[DB] cascadePeerIdChange:', err.message);
+ }
+ }
+ }
+ } catch (err) {
+ console.warn('[DB] cascadePeerIdChange auth:', err.message);
+ }
+ }
+
+ function syncPanelPeerIdRenamesFromGoSqlite() {
+ const db = openMain();
+ try {
+ const histTbl = db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='id_change_history'").get();
+ const peersTbl = db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='peers'").get();
+ if (!histTbl || !peersTbl) return;
+ const rows = db.prepare(`
+ SELECT h.old_id, h.new_id FROM id_change_history h
+ INNER JOIN peers p ON p.id = h.new_id AND (p.soft_deleted IS NULL OR p.soft_deleted = 0)
+ WHERE EXISTS (SELECT 1 FROM peer WHERE id = h.old_id)
+ `).all();
+ for (const row of rows) {
+ cascadePeerIdChangeSqlite(row.old_id, row.new_id);
+ }
+ } catch (err) {
+ if (!err.message.includes('no such table')) {
+ console.warn('[DB] syncPanelPeerIdRenamesFromGo:', err.message);
+ }
+ }
+ }
+
+ function purgePanelPeerRecordSqlite(id) {
+ if (!id) return;
+ try {
+ openMain().prepare('DELETE FROM peer WHERE id = ?').run(id);
+ } catch (err) {
+ console.warn('[DB] purgePanelPeerRecord:', err.message);
+ }
+ }
+
+ /**
+ * Identity-aware rename guard — mirrors Go signal rejectRenamedPeerRegistration (#213).
+ * @returns {{ reject: boolean, new_id?: string }}
+ */
+ function shouldRejectRenamedPeerRegistrationSqlite(oldId, { uuid, pk, ip } = {}) {
+ const newId = (() => {
+ try {
+ const db = openMain();
+ const tbl = db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='id_change_history'").get();
+ if (!tbl) return null;
+ const row = db.prepare('SELECT new_id FROM id_change_history WHERE old_id = ? ORDER BY rowid DESC LIMIT 1').get(oldId);
+ return row ? row.new_id : null;
+ } catch (_) {
+ return null;
+ }
+ })();
+ if (!newId) return { reject: false };
+
+ const db = openMain();
+ let successor = null;
+ try {
+ const peersTbl = db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='peers'").get();
+ if (peersTbl) {
+ successor = db.prepare('SELECT pk, uuid, ip FROM peers WHERE id = ? AND NOT soft_deleted').get(newId);
+ }
+ } catch (_) {}
+ if (!successor) {
+ try {
+ successor = db.prepare('SELECT pk, uuid, ip FROM peer WHERE id = ? AND is_deleted = 0').get(newId);
+ } catch (_) {}
+ }
+ if (!successor) return { reject: false };
+
+ const pkVal = pk || '';
+ const uuidVal = uuid || '';
+ if (pkVal && successor.pk && pkEqual(pkVal, successor.pk)) return { reject: false };
+ if (uuidVal && successor.uuid && uuidEqual(uuidVal, successor.uuid)) return { reject: false };
+ if (!pkVal && !uuidVal && ip && peerIPMatches(ip, successor.ip || '')) return { reject: false };
+
+ return { reject: true, new_id: newId };
+ }
+
function syncGoPeersSqlite() {
const now = Date.now();
if (now - _lastGoPeerSyncSqlite < GO_SYNC_INTERVAL_SQLITE_MS) return;
@@ -1078,6 +1217,7 @@ function createSqliteAdapter(config) {
console.log(`[DB] syncGoPeersSqlite: cleaned up ${result.changes} ghost peer(s) from ID changes`);
}
}
+ syncPanelPeerIdRenamesFromGoSqlite();
} catch (err) {
if (!err.message.includes('no such table')) {
console.warn('[DB] syncGoPeersSqlite error:', err.message);
@@ -1235,6 +1375,21 @@ function createSqliteAdapter(config) {
} catch (_) { return null; }
},
+ /**
+ * Update auth.db and panel peer rows when a device ID changes (#213).
+ */
+ cascadePeerIdChange(oldId, newId) {
+ cascadePeerIdChangeSqlite(oldId, newId);
+ },
+
+ purgePanelPeerRecord(id) {
+ purgePanelPeerRecordSqlite(id);
+ },
+
+ shouldRejectRenamedPeerRegistration(oldId, identity) {
+ return shouldRejectRenamedPeerRegistrationSqlite(oldId, identity);
+ },
+
async setBanStatus(id, banned, reason = '') {
openMain().prepare(`
UPDATE peer SET is_banned = ?, banned_at = CASE WHEN ? THEN datetime('now') ELSE NULL END, banned_reason = ?
@@ -4048,6 +4203,94 @@ function createPostgresAdapter() {
let _lastGoPeerSync = 0;
const GO_SYNC_INTERVAL_MS = 30_000; // sync at most every 30 seconds
+ async function cascadePeerIdChangePg(oldId, newId) {
+ if (!oldId || !newId || oldId === newId) return;
+ try {
+ await q('UPDATE peer SET id = $1 WHERE id = $2', [newId, oldId]);
+ } catch (err) {
+ console.warn('[DB] cascadePeerIdChange peer table:', err.message);
+ }
+ const stmts = [
+ ['UPDATE peer_sysinfo SET peer_id = $1 WHERE peer_id = $2', [newId, oldId]],
+ ['UPDATE peer_metrics SET peer_id = $1 WHERE peer_id = $2', [newId, oldId]],
+ ['UPDATE device_folder_assignments SET device_id = $1 WHERE device_id = $2', [newId, oldId]],
+ ['UPDATE device_group_peers SET peer_id = $1 WHERE peer_id = $2', [newId, oldId]],
+ ['UPDATE access_tokens SET client_id = $1 WHERE client_id = $2', [newId, oldId]],
+ ['UPDATE audit_connections SET peer_id = $1 WHERE peer_id = $2', [newId, oldId]],
+ ['UPDATE audit_files SET peer_id = $1 WHERE peer_id = $2', [newId, oldId]],
+ ['UPDATE audit_alarms SET peer_id = $1 WHERE peer_id = $2', [newId, oldId]],
+ ];
+ for (const [sql, params] of stmts) {
+ try {
+ await q(sql, params);
+ } catch (err) {
+ if (!err.message.includes('does not exist')) {
+ console.warn('[DB] cascadePeerIdChange:', err.message);
+ }
+ }
+ }
+ }
+
+ async function syncPanelPeerIdRenamesFromGoPg() {
+ try {
+ const rows = await all(`
+ SELECT h.old_id, h.new_id FROM id_change_history h
+ INNER JOIN peers p ON p.id = h.new_id AND NOT p.soft_deleted
+ WHERE EXISTS (SELECT 1 FROM peer WHERE id = h.old_id)
+ `);
+ for (const row of rows) {
+ await cascadePeerIdChangePg(row.old_id, row.new_id);
+ }
+ } catch (err) {
+ if (!err.message.includes('does not exist')) {
+ console.warn('[DB] syncPanelPeerIdRenamesFromGo:', err.message);
+ }
+ }
+ }
+
+ async function purgePanelPeerRecordPg(id) {
+ if (!id) return;
+ try {
+ await q('DELETE FROM peer WHERE id = $1', [id]);
+ } catch (err) {
+ console.warn('[DB] purgePanelPeerRecord:', err.message);
+ }
+ }
+
+ /**
+ * Identity-aware rename guard — mirrors Go signal rejectRenamedPeerRegistration (#213).
+ * @returns {Promise<{ reject: boolean, new_id?: string }>}
+ */
+ async function shouldRejectRenamedPeerRegistrationPg(oldId, { uuid, pk, ip } = {}) {
+ let newId = null;
+ try {
+ const row = await q1('SELECT new_id FROM id_change_history WHERE old_id = $1 ORDER BY id DESC LIMIT 1', [oldId]);
+ newId = row ? row.new_id : null;
+ } catch (_) {
+ return { reject: false };
+ }
+ if (!newId) return { reject: false };
+
+ let successor = null;
+ try {
+ successor = await q1('SELECT pk, uuid, ip FROM peers WHERE id = $1 AND NOT soft_deleted', [newId]);
+ } catch (_) {}
+ if (!successor) {
+ try {
+ successor = await q1('SELECT pk, uuid, ip FROM peer WHERE id = $1 AND is_deleted = FALSE', [newId]);
+ } catch (_) {}
+ }
+ if (!successor) return { reject: false };
+
+ const pkVal = pk || '';
+ const uuidVal = uuid || '';
+ if (pkVal && successor.pk && pkEqual(pkVal, successor.pk)) return { reject: false };
+ if (uuidVal && successor.uuid && uuidEqual(uuidVal, successor.uuid)) return { reject: false };
+ if (!pkVal && !uuidVal && ip && peerIPMatches(ip, successor.ip || '')) return { reject: false };
+
+ return { reject: true, new_id: newId };
+ }
+
/**
* Sync devices from Go server's "peers" table into Node.js "peer" table.
* Called before bulk queries (getAllPeers, getPeerStats) to ensure the
@@ -4088,6 +4331,14 @@ function createPostgresAdapter() {
info = CASE WHEN peer.info IS NULL OR peer.info = '{}' THEN EXCLUDED.info ELSE peer.info END,
is_deleted = FALSE
`);
+ await q(`
+ DELETE FROM peer WHERE id IN (
+ SELECT h.old_id FROM id_change_history h
+ LEFT JOIN peers p ON p.id = h.old_id AND NOT p.soft_deleted
+ WHERE p.id IS NULL
+ )
+ `);
+ await syncPanelPeerIdRenamesFromGoPg();
} catch (err) {
// 'peers' table might not exist when Go server is not used
if (!err.message.includes('does not exist')) {
@@ -4227,6 +4478,18 @@ function createPostgresAdapter() {
} catch (_) { return null; }
},
+ async cascadePeerIdChange(oldId, newId) {
+ await cascadePeerIdChangePg(oldId, newId);
+ },
+
+ async purgePanelPeerRecord(id) {
+ await purgePanelPeerRecordPg(id);
+ },
+
+ async shouldRejectRenamedPeerRegistration(oldId, identity) {
+ return shouldRejectRenamedPeerRegistrationPg(oldId, identity);
+ },
+
async setBanStatus(id, banned, reason = '') {
await q(`
UPDATE peer SET is_banned = $1, banned_at = CASE WHEN $1 THEN NOW() ELSE NULL END, banned_reason = $2
diff --git a/web-nodejs/services/deviceStatusPush.js b/web-nodejs/services/deviceStatusPush.js
index a2d4aeca..5f5c6428 100644
--- a/web-nodejs/services/deviceStatusPush.js
+++ b/web-nodejs/services/deviceStatusPush.js
@@ -4,13 +4,14 @@
* Connects to Go server's WebSocket event bus and pushes device status
* changes to browser clients in real time.
*
- * Go server endpoint: GET /api/ws/events?filter=peer_online
+ * Go server endpoint: GET /api/ws/events
* Browser endpoint: WS /ws/device-status
*/
'use strict';
const WebSocket = require('ws');
+const db = require('./database');
const log = {
info: (...a) => console.log('[DeviceStatus]', ...a),
@@ -91,7 +92,7 @@ function initDeviceStatusPush(httpServer, sessionMiddleware, goApiUrl, apiKey) {
.replace(/^https:/, 'wss:')
.replace(/\/api$/, '');
- const url = `${wsUrl}/api/ws/events?filter=peer_online&api_key=${encodeURIComponent(apiKey)}`;
+ const url = `${wsUrl}/api/ws/events?api_key=${encodeURIComponent(apiKey)}`;
log.info('Connecting to Go event bus...');
@@ -111,13 +112,33 @@ function initDeviceStatusPush(httpServer, sessionMiddleware, goApiUrl, apiKey) {
goWs.on('message', (data) => {
try {
const event = JSON.parse(data.toString());
+ const payload = event.data || {};
+
+ if (event.type === 'peer_id_changed') {
+ const oldId = payload.old_id;
+ const newId = payload.new_id;
+ if (oldId && newId && typeof db.cascadePeerIdChange === 'function') {
+ Promise.resolve(db.cascadePeerIdChange(oldId, newId)).catch((err) => {
+ log.warn('Panel ID cascade failed:', err.message || err);
+ });
+ }
+ broadcast({
+ type: 'device_id_changed',
+ old_id: oldId,
+ new_id: newId,
+ source: payload.source || '',
+ timestamp: event.timestamp || Date.now(),
+ });
+ return;
+ }
+
// Forward peer status events to browser clients
if (event.type === 'peer_online' || event.type === 'peer_offline' ||
event.type === 'peer_status_changed' || event.type === 'peer_registered') {
broadcast({
type: 'device_status',
- device_id: event.peer_id || event.id || event.device_id,
- status: event.status || (event.type === 'peer_online' ? 'online' : 'offline'),
+ device_id: payload.peer_id || payload.id || event.peer_id || event.id || event.device_id,
+ status: payload.status || event.status || (event.type === 'peer_online' ? 'online' : 'offline'),
timestamp: event.timestamp || Date.now(),
details: event,
});
diff --git a/web-nodejs/tests/bd-api.routes.test.js b/web-nodejs/tests/bd-api.routes.test.js
new file mode 100644
index 00000000..21e0648a
--- /dev/null
+++ b/web-nodejs/tests/bd-api.routes.test.js
@@ -0,0 +1,58 @@
+'use strict';
+
+const request = require('supertest');
+const express = require('express');
+
+jest.mock('../services/authService', () => ({}));
+
+jest.mock('../services/database', () => ({
+ shouldRejectRenamedPeerRegistration: jest.fn(),
+ getRenamedPeerId: jest.fn(),
+ upsertPeer: jest.fn().mockResolvedValue(undefined),
+ updatePeerOnlineStatus: jest.fn().mockResolvedValue(undefined),
+ getAccessToken: jest.fn(),
+ touchAccessToken: jest.fn(),
+}));
+
+const db = require('../services/database');
+const bdApiRoutes = require('../routes/bd-api.routes');
+
+describe('BD-API register rename guard', () => {
+ let app;
+
+ beforeEach(() => {
+ app = express();
+ app.use(express.json());
+ app.use('/api/bd', bdApiRoutes);
+ jest.clearAllMocks();
+ });
+
+ it('rejects stale renamed ID when identity does not match successor', async () => {
+ db.shouldRejectRenamedPeerRegistration.mockResolvedValue({
+ reject: true,
+ new_id: 'NEWID123',
+ });
+
+ const res = await request(app)
+ .post('/api/bd/register')
+ .set('X-Device-Id', 'OLDID123')
+ .send({ device_id: 'OLDID123', uuid: 'other-uuid' });
+
+ expect(res.status).toBe(409);
+ expect(res.body.new_id).toBe('NEWID123');
+ expect(db.upsertPeer).not.toHaveBeenCalled();
+ });
+
+ it('allows registration when same device owns renamed ID', async () => {
+ db.shouldRejectRenamedPeerRegistration.mockResolvedValue({ reject: false });
+
+ const res = await request(app)
+ .post('/api/bd/register')
+ .set('X-Device-Id', 'OLDID123')
+ .send({ device_id: 'OLDID123', uuid: 'device-uuid', hostname: 'PC' });
+
+ expect(res.status).toBe(200);
+ expect(res.body.success).toBe(true);
+ expect(db.upsertPeer).toHaveBeenCalled();
+ });
+});
diff --git a/web-nodejs/tests/devices.routes.test.js b/web-nodejs/tests/devices.routes.test.js
index 2b15e78f..4844a764 100644
--- a/web-nodejs/tests/devices.routes.test.js
+++ b/web-nodejs/tests/devices.routes.test.js
@@ -26,7 +26,9 @@ jest.mock('../services/database', () => ({
removeDeviceFromGroup: jest.fn().mockResolvedValue(undefined),
getAllFolders: jest.fn().mockResolvedValue([]),
getAllFolderAssignments: jest.fn().mockResolvedValue({}),
- cleanupDeletedPeerData: jest.fn().mockResolvedValue(undefined)
+ cleanupDeletedPeerData: jest.fn().mockResolvedValue(undefined),
+ cascadePeerIdChange: jest.fn().mockResolvedValue(undefined),
+ purgePanelPeerRecord: jest.fn().mockResolvedValue(undefined)
}));
jest.mock('../services/serverBackend', () => ({
@@ -396,6 +398,22 @@ describe('Devices Routes', () => {
expect(res.body.success).toBe(false);
expect(res.body.error).toBe('devices.id_reserved_deleted');
});
+
+ it('should cascade panel peer ID change into local databases', async () => {
+ serverBackend.getDeviceById.mockImplementation(async (id) => {
+ if (id === 'OLDCAS') return { id: 'OLDCAS', online: false };
+ return null;
+ });
+ serverBackend.changePeerId.mockResolvedValue({ success: true });
+
+ const res = await request(app)
+ .post('/api/devices/OLDCAS/change-id')
+ .send({ newId: 'NEWCAS' });
+
+ expect(res.status).toBe(200);
+ expect(res.body.success).toBe(true);
+ expect(db.cascadePeerIdChange).toHaveBeenCalledWith('OLDCAS', 'NEWCAS');
+ });
});
describe('DELETE /api/devices/:id', () => {
@@ -413,6 +431,7 @@ describe('Devices Routes', () => {
cascade: false,
hard: true
});
+ expect(db.purgePanelPeerRecord).toHaveBeenCalledWith('MACPRO');
});
it('should hard delete a soft-deleted device when active lookup misses', async () => {
diff --git a/web-nodejs/views/devices.ejs b/web-nodejs/views/devices.ejs
index c6f25f9a..4310eb3e 100644
--- a/web-nodejs/views/devices.ejs
+++ b/web-nodejs/views/devices.ejs
@@ -57,6 +57,23 @@