From 95e797eac16d35eabb0b6feec8d557aa4c3968da Mon Sep 17 00:00:00 2001 From: rcourtman Date: Sat, 9 May 2026 10:52:49 +0100 Subject: [PATCH] Disclose what the agent install token authorizes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add a 'What this token authorizes' card to the Pulse Agent install token step (Unraid, Docker, Kubernetes, generic Linux/macOS/Windows host). Mirrors the disclosure pattern from the PVE Auth flow so a security-aware user knows up front: - The token reports host telemetry only - Read-only by default; assistant control and host shell stay off until opted in per host - Revocable any time from Settings → Infrastructure → Tokens Reframe the input placeholder from 'Token name (optional)' to 'Token name (optional label for your audit log)' so the optionality clearly applies to the label, not the token itself. Add a hover tooltip to TrueNAS and VMware 'Preview impact' buttons explaining that they show the resources Pulse would ingest without saving or starting polling. Normalize the PVE coverage section header from 'Data collection' to 'Collection scope' to match the TrueNAS form's terminology. --- .../CredentialSlots/TrueNASCredentialSlot.tsx | 1 + .../CredentialSlots/VMwareCredentialSlot.tsx | 1 + .../InfrastructureInstallerSection.tsx | 29 ++++++++++++++++++- .../Settings/NodeModalMonitoringSection.tsx | 6 ++-- 4 files changed, 33 insertions(+), 4 deletions(-) diff --git a/frontend-modern/src/components/Settings/ConnectionEditor/CredentialSlots/TrueNASCredentialSlot.tsx b/frontend-modern/src/components/Settings/ConnectionEditor/CredentialSlots/TrueNASCredentialSlot.tsx index 47dfd2d43..3355b6375 100644 --- a/frontend-modern/src/components/Settings/ConnectionEditor/CredentialSlots/TrueNASCredentialSlot.tsx +++ b/frontend-modern/src/components/Settings/ConnectionEditor/CredentialSlots/TrueNASCredentialSlot.tsx @@ -388,6 +388,7 @@ export const TrueNASCredentialSlot: Component = (pro class={buttonClass} onClick={() => void props.state.previewCurrentForm()} disabled={props.state.saving() || props.state.testing() || props.state.previewing()} + title="Show the resources Pulse would ingest from this connection without saving or starting polling." > {props.state.previewing() ? 'Previewing…' : 'Preview impact'} diff --git a/frontend-modern/src/components/Settings/ConnectionEditor/CredentialSlots/VMwareCredentialSlot.tsx b/frontend-modern/src/components/Settings/ConnectionEditor/CredentialSlots/VMwareCredentialSlot.tsx index 9100b928c..4f87a5b85 100644 --- a/frontend-modern/src/components/Settings/ConnectionEditor/CredentialSlots/VMwareCredentialSlot.tsx +++ b/frontend-modern/src/components/Settings/ConnectionEditor/CredentialSlots/VMwareCredentialSlot.tsx @@ -337,6 +337,7 @@ export const VMwareCredentialSlot: Component = (props disabled={ props.state.saving() || props.state.testing() || props.state.previewing() } + title="Show the resources Pulse would ingest from this connection without saving or starting polling." > {props.state.previewing() ? 'Previewing…' : 'Preview impact'} diff --git a/frontend-modern/src/components/Settings/InfrastructureInstallerSection.tsx b/frontend-modern/src/components/Settings/InfrastructureInstallerSection.tsx index a12cdd98b..21126aeba 100644 --- a/frontend-modern/src/components/Settings/InfrastructureInstallerSection.tsx +++ b/frontend-modern/src/components/Settings/InfrastructureInstallerSection.tsx @@ -291,6 +291,33 @@ export const InfrastructureInstallerSection: Component +
+

+ What this token authorizes: +

+
    +
  • + ✓ + Pulse Agent on this host reports its own telemetry to this Pulse instance. +
    • +
  • + ✓ + + Read-only by default. Assistant control and host shell stay off until you opt in + per host from Settings → Infrastructure. + +
    • +
  • + ✓ + + Revoke the token any time from{' '} + Settings → Infrastructure → Tokens; the agent + stops reporting immediately. + +
    • +
+
+