An empty password left the built-in admin unable to log in -- the login
endpoint rejects an empty password and the stored hash is of "" -- so the
service came up listening but unusable. Fail at startup instead, with a
message naming the setting.
Signed-off-by: GL.iNet-Yongping.Xie <yongping.xie@gl-inet.com>
These routes only verified that a session existed, so any logged-in user
could drive any device by id, including ungrouped ones the device list
never showed them. Apply the same visibility rule as the list: admins
reach everything, a regular user only devices in a group linked to one
of their user groups. Denials answer with the error page, a bare 403 for
websocket upgrades, and err 1004 for /cmd.
Also drop the two shortcuts in httpAuth that skipped authentication when
no password was configured or when local-auth was off and the request
came from loopback -- behind a reverse proxy every request looks local.
Both settings now log a warning instead.
Signed-off-by: GL.iNet-Yongping.Xie <yongping.xie@gl-inet.com>
- SMTP config with TLS/STARTTLS/plain support and test email
- Notification rules for device online, offline, and remote access
- Recipient management with add/remove endpoints
- Async email sending via goroutines to avoid blocking device runtime
- Admin settings page with SMTP, rules, and recipients sections
- Bell icon added to sidebar menu
- i18n support for all 7 languages
Signed-off-by: GL.iNet-Yongping.Xie <yongping.xie@gl-inet.com>
- Record device online/offline, remote SSH, Web and Control sessions
- Add device_event_logs table with MAC, event type and time range indexes
- Distinguish remote_control vs remote_web by device client type
- Admin-only log page with device/access tabs, duration column and filters
- Permission-gated sidebar entry (device_log.read)
Signed-off-by: GL.iNet-Yongping.Xie <yongping.xie@gl-inet.com>
- Personal Center page with profile editing and last-login info
- TOTP-based two-factor authentication with QR code setup
- 30-day trusted-device cookie to skip 2FA on familiar browsers
- Friendly browser/OS labels for the trusted device list
Signed-off-by: GL.iNet-Yongping.Xie <yongping.xie@gl-inet.com>
Move deprecated interfaces into the updated project layout to align with the new architecture.
Signed-off-by: GL.iNet-Yongping.Xie <yongping.xie@gl-inet.com>
Remove the obsolete legacy main entry to avoid confusion and reduce maintenance overhead.
Signed-off-by: GL.iNet-Yongping.Xie <yongping.xie@gl-inet.com>
GL.iNet-Yongping.Xie