Commit Graph

2907 Commits

Author SHA1 Message Date
rcourtman de2ed1b33a Cover multi-org token authorization 2026-02-04 14:15:50 +00:00
rcourtman fdb7c9a1c5 Block cross-tenant org token use 2026-02-04 14:13:57 +00:00
rcourtman 526fb21076 Add tests for guest intelligence and reachability signals
Cover gatherGuestIntelligence (discovery matching, instance fallback,
reachability via mock prober, edge cases), parsePingOutput parsing,
DetectReachabilitySignals, enriched seed context (Service/Reachable
columns, quiet mode variants, health issues fallback), and extend
signal helper tests for SignalGuestUnreachable.
2026-02-04 14:12:50 +00:00
rcourtman 34ca427458 Add unified guest intelligence to patrol seed context
Enrich the patrol seed context with service identity (from discovery
store) and network reachability (via ICMP ping through host agents).
The guest metrics table now includes Service and Reachable columns,
and a Service Health Issues section highlights running-but-unreachable
guests. A new SignalGuestUnreachable signal type creates deterministic
findings for unreachable guests.

New files:
- patrol_intelligence.go: GuestProber interface, GuestIntelligence
  type, gatherGuestIntelligence() with concurrent per-node probing
- patrol_prober.go: agentExecProber implementation using batch ping
  commands via connected host agents
2026-02-04 14:08:57 +00:00
rcourtman 6de231fcf0 Enforce host config token binding 2026-02-04 14:06:30 +00:00
rcourtman cb788f18b9 Ignore bearer token in security status 2026-02-04 14:01:57 +00:00
rcourtman 9e3b8f722e Require host config read scope 2026-02-04 14:00:04 +00:00
rcourtman e1e70fd78b Fix build workflow: remove obsolete pulse-sensor-proxy step
The cmd/pulse-sensor-proxy directory was removed in a previous refactor
but the workflow still referenced it, causing build failures.
2026-02-04 13:58:45 +00:00
rcourtman 698a7b1926 Require auth for RBAC and reporting 2026-02-04 13:57:00 +00:00
rcourtman 098a722e03 Cover blocked AI fetch hosts 2026-02-04 13:54:32 +00:00
rcourtman dd3e9fc4a8 Cover loopback override in AI fetch guard 2026-02-04 13:53:29 +00:00
rcourtman 041148f90b Harden security status token handling 2026-02-04 13:52:36 +00:00
rcourtman 2d29b3dcd7 Unify Proxmox discovery and integrate PMG Patrol
- Unified Proxmox VE discovery by redirecting Node requests to linked Host Agents.
- Added smart deduplication and legacy fallback for Proxmox discovery results.
- Integrated Proxmox Mail Gateway (PMG) into AI Patrol system.
- Added comprehensive tests for discovery redirection and deduplication.
2026-02-04 13:52:36 +00:00
rcourtman 3b9019f216 Enforce audit/report scope checks 2026-02-04 13:47:32 +00:00
rcourtman 634594a168 Unify Proxmox discovery results
- Redirect PVE node lookups to linked Host Agent ID when available.
- Implement deduplication in discovery lists to prefer Host Agent data over redundant Node entries.
- Add fallback mechanism to original Node ID for discovery retrieval ensuring compatibility with legacy data.
- Update data adapters and added comprehensive unit tests for redirection and deduplication logic.
2026-02-04 13:46:56 +00:00
rcourtman a5c5172e51 Require settings:write for agent profiles 2026-02-04 13:43:28 +00:00
rcourtman f4f8134f59 Align disk detail time range selector with other drawers 2026-02-04 13:43:28 +00:00
rcourtman 17ebc203ff Test multi-tenant persistence guardrails 2026-02-04 13:35:57 +00:00
rcourtman 5c18748742 Add SMART disk lifecycle monitoring with historical charts
Expand the smartctl collector to capture detailed SMART attributes (SATA
and NVMe), propagate them through the full data pipeline, persist them
as time-series metrics, and display them in an interactive disk detail
drawer with historical sparkline charts.

Backend: add SMARTAttributes struct, writeSMARTMetrics for persistent
storage, "disk" resource type in metrics API with live fallback.
Frontend: enhanced DiskList with Power-On column and SMART warnings,
new DiskDetail drawer matching NodeDrawer styling patterns, generic
HistoryChart metric support with proper tooltip formatting.
2026-02-04 13:35:40 +00:00
rcourtman 13ef837a5f Cover tenant auth middleware 2026-02-04 13:34:09 +00:00
rcourtman af1a14f3a7 Cover checksum token auth 2026-02-04 13:28:54 +00:00
rcourtman bbfc5a9fc4 Fix OIDC login bypass test to expect 302
redirectOIDCError uses http.StatusFound (302) but the test expected
307. The test was stale after the error redirect was introduced.
2026-02-04 13:27:10 +00:00
rcourtman 67e2dce78d Inventory download route exposure 2026-02-04 13:27:00 +00:00
rcourtman 0d564bfd8f Clarify download checksum auth 2026-02-04 13:23:55 +00:00
rcourtman ce9481e7bf Inventory frontend and static auth bypasses 2026-02-04 13:20:45 +00:00
rcourtman d1f602c93b Validate public allowlist backing 2026-02-04 13:18:29 +00:00
rcourtman 41c10e60d7 Add auth bypass inventory coverage 2026-02-04 13:16:29 +00:00
rcourtman 95d178b881 Add missing pmg_checked field to live patrol run record
The PatrolRunRecord interface requires pmg_checked but the live
run placeholder in AIIntelligence.tsx was missing it, causing a
type error that blocked pushes.
2026-02-04 13:15:33 +00:00
rcourtman f15a47c513 Fix stale kiosk mode test assertion
setKioskMode(false) stores 'false' explicitly rather than removing
the key, to distinguish disabled from unset. The test expectation
was outdated.
2026-02-04 13:14:50 +00:00
rcourtman fc9c2b2477 Add public paths inventory test 2026-02-04 13:05:12 +00:00
rcourtman 75710338a3 Add CSRF skip allowlist test 2026-02-04 13:01:00 +00:00
rcourtman 3c9a0ebc58 Cover apply-restart CSRF skip 2026-02-04 12:58:12 +00:00
rcourtman 49a570b574 Track bare routes in inventory test 2026-02-04 12:55:59 +00:00
rcourtman 5073c10030 Fix alert system reliability issues and update audit report
- Fix stale alerts not clearing when nodes/hosts go offline in CheckNode and HandleHostOffline
- Fix stale alerts persisting when thresholds are disabled or set to 0 in CheckGuest and CheckNode
- Fix CheckHost to properly clear disk alerts when overrides disable them
- Update audit_report.md with findings from the Alert System Reliability Audit
2026-02-04 12:50:36 +00:00
rcourtman 5ccf8ac7bc Fix UnifiedAgents test missing Router wrapper
UnifiedAgents calls useNavigate() which requires a Router context.
The test was rendering the component without one, breaking CI.
2026-02-04 12:49:40 +00:00
rcourtman 8ddcbf8c62 Add router route inventory test 2026-02-04 12:49:22 +00:00
rcourtman 8951b6f7f9 Require monitoring scope for socket.io 2026-02-04 12:41:12 +00:00
rcourtman 216ccf0be5 Require auth for socket.io js 2026-02-04 12:39:19 +00:00
rcourtman 63a846cf3b Allow bearer tokens for websocket auth 2026-02-04 12:37:46 +00:00
rcourtman 18ed23504d Harden encoded path traversal coverage 2026-02-04 12:36:44 +00:00
rcourtman 36f1504355 Cover bearer token auth for stats 2026-02-04 12:34:47 +00:00
rcourtman 6427f28a08 Fix stale metrics store reference in reporting engine after monitor reload
The reporting engine held a direct pointer to the metrics store, which
becomes invalid after a monitor reload (settings change, node config
save, etc.) closes and recreates the store. Use a dynamic getter closure
that always resolves to the current monitor's active store.

Also adds diagnostic logging when report queries return zero metrics,
and integration tests covering the full metrics-to-report pipeline
including reload scenarios.

Fixes #1186
2026-02-04 12:34:40 +00:00
rcourtman e23a2a793b Cover socket.io query token auth 2026-02-04 12:32:30 +00:00
rcourtman 7fc9a98c47 Cover websocket query token auth 2026-02-04 12:25:25 +00:00
rcourtman df08e45993 Require passphrase for config export/import 2026-02-04 12:19:53 +00:00
rcourtman fb06ae00c1 Harden config export/import validation 2026-02-04 12:18:40 +00:00
rcourtman 0c1ff9da7f Reject invalid pulse_url in setup script 2026-02-04 12:16:20 +00:00
rcourtman 4298d87485 Allow setup token via query param for SSH endpoints 2026-02-04 12:15:22 +00:00
rcourtman 3f51dbb7de Assert security status auth token handling 2026-02-04 12:13:48 +00:00
rcourtman 77f23b35f7 Validate setup script input sanitization 2026-02-04 12:12:13 +00:00