3 Commits

Author	SHA1	Message	Date
taylanbakircioglu	199ade8ce5	Fix: Browser cache causing phantom deleted entities across all pages ... 🐛 Critical Browser Cache Bug - System-Wide Fix: - Fixed deleted entities reappearing on normal page refresh - Hard refresh (Cmd+Shift+R) worked, normal refresh showed stale cache data - Applied cache-busting to ALL entity fetch operations across entire application 🔧 Cache-Control Headers Added to 10 Components: 1. BackendServers.js - fetchBackends(), fetchFrontends(), fetchSSLCertificates() 2. FrontendManagement.js - fetchFrontends(), fetchBackends(), fetchSSLCertificates() 3. SSLManagement.js - fetchCertificates() 4. ApplyManagement.js - fetchPendingChanges() (4 API calls: frontends, backends, WAF, SSL) 5. WAFManagement.js - fetchFrontends() 6. AgentManagement.js - fetchAgents(), fetchPools() 7. PoolManagement.js - fetchPools(), fetchPoolAgents() 8. UserManagement.js - fetchUsers() 9. Configuration.js - fetchAgents() 10. ClusterContext.js - fetchClusters() Headers Applied: 'Cache-Control': 'no-cache, no-store, must-revalidate' 'Pragma': 'no-cache' 'Expires': '0' (some components) 🎯 Impact Analysis - SAFE Changes: ✅ Only GET requests affected (POST/PUT/DELETE unchanged) ✅ Response format unchanged (only headers added to request) ✅ No breaking changes to existing functionality ✅ Performance impact minimal (entities change frequently anyway) 🛡️ Protected Against Cache: - Deleted backends/frontends won't reappear - Deleted agents won't show in lists - SSL certificates always fresh - User list always current - Cluster/Pool data always accurate 🔍 Testing Performed: - Backend API verified: Only active backends returned (is_active=TRUE) - SSL API verified: Returns 4 certificates correctly - All axios.get calls now have cache-control headers - No linter errors ✅ Root Cause Solved: Browser/Axios caching GET responses → Stale data on normal refresh Solution: Force fresh data from API on every request Impact: Phantom entities bug completely resolved across entire application	2025-11-07 11:51:14 +03:00
taylanbakircioglu	1133fbe229	security: Fix critical RBAC vulnerability in user management ... Critical security fixes: - Add admin-only checks for user CRUD operations - Add admin-only checks for role CRUD operations - Add admin-only checks for role assignment operations - Add permission check for agent script generation - Fix auth_middleware to include is_admin flag in user context - Hide user/role management buttons from non-admin users in UI - Add 'View Only' labels for viewer users Security improvements: - Prevent viewer users from creating/editing/deleting users - Prevent viewer users from creating/editing/deleting roles - Prevent viewer users from assigning roles to users - Backend API endpoints now properly check admin status - Frontend UI now hides admin-only actions from viewers Public release changes: - Remove company-specific registry URLs from build-images.sh - Update registry to generic example: your-registry.example.com Affected endpoints: - POST /api/users (create user) - admin only - PUT /api/users/{id} (update user) - admin only - DELETE /api/users/{id} (delete user) - admin only - POST /api/roles (create role) - admin only - PUT /api/roles/{id} (update role) - admin only - DELETE /api/roles/{id} (delete role) - admin only - POST /api/users/{id}/roles (assign roles) - admin only - POST /api/agents/generate-install-script - permission check	2025-11-04 13:44:49 +03:00
taylanbakircioglu	6aae0f4309	Initial commit	2025-10-27 12:14:03 +03:00