Commit Graph

2862 Commits

Author SHA1 Message Date
rcourtman fb06ae00c1 Harden config export/import validation 2026-02-04 12:18:40 +00:00
rcourtman 0c1ff9da7f Reject invalid pulse_url in setup script 2026-02-04 12:16:20 +00:00
rcourtman 4298d87485 Allow setup token via query param for SSH endpoints 2026-02-04 12:15:22 +00:00
rcourtman 3f51dbb7de Assert security status auth token handling 2026-02-04 12:13:48 +00:00
rcourtman 77f23b35f7 Validate setup script input sanitization 2026-02-04 12:12:13 +00:00
rcourtman f8c4a28600 Guard SSH key generation in containers 2026-02-04 12:10:10 +00:00
rcourtman 902bdd92c2 fix: prefer status-mem over status-freemem for VM memory calculation
Proxmox's FreeMem field reports free memory relative to the balloon's
guest-visible total (total_mem), not relative to MaxMem. When ballooning
is active and the VM's memory has been reduced, subtracting FreeMem from
MaxMem produces wildly inflated usage (e.g. 97% when actual usage is 20%).

Proxmox's Mem field is already calculated as (total_mem - free_mem),
giving the correct used bytes regardless of balloon state. Swap the
priority so Mem is checked before FreeMem.

Related to #1185
2026-02-04 12:08:33 +00:00
rcourtman 8313d66e64 Ensure public endpoints stay public in API mode 2026-02-04 12:06:50 +00:00
rcourtman 1fddbec07f Ensure public download endpoints bypass auth 2026-02-04 12:05:32 +00:00
rcourtman a49fa8514a Cover OIDC callback public access 2026-02-04 12:03:56 +00:00
rcourtman 11e28689b2 Cover public setup script access 2026-02-04 12:02:27 +00:00
rcourtman b57fdd2085 Add path traversal regression tests 2026-02-04 12:00:54 +00:00
rcourtman f707e0ad40 Add audit auth regression checks 2026-02-04 11:59:48 +00:00
rcourtman 9f1877116b Verify security status bootstrap token exposure 2026-02-04 11:58:02 +00:00
rcourtman e0e4d24428 Cover setup token access for SSH endpoints 2026-02-04 11:56:16 +00:00
rcourtman f9489db9e0 Add public endpoint regression coverage 2026-02-04 11:52:15 +00:00
rcourtman d0e0a85861 Cover RBAC trailing slash routes 2026-02-04 11:40:23 +00:00
rcourtman fd108faa7d feat(profiles): de-emphasize AI suggestions and fix multi-tenant support
UI/UX Improvements for AI-skeptical users:
- Only show 'Ideas' button if AI is enabled AND configured
- Renamed 'Suggest Profile' to 'Ideas' with lightbulb icon
- Moved 'New Profile' button to primary position
- Changed AI button styling from prominent purple to subtle gray
- Updated modal title to 'Profile Ideas' with neutral language

Multi-tenant bug fix:
- ProfileSuggestionHandler now uses MultiTenantPersistence
- Properly resolves tenant-specific persistence from request context
- Fixes potential nil pointer panic in multi-tenant deployments
- Existing profiles are now correctly loaded per-tenant for AI context

Tests updated to use MultiTenantPersistence with org context injection.
2026-02-04 11:39:50 +00:00
rcourtman a73352a396 Add recovery endpoint regression test 2026-02-04 11:39:30 +00:00
rcourtman aa61c8edc5 Add quick setup and token auth regression tests 2026-02-04 11:38:09 +00:00
rcourtman 0c4b19ddf4 Add SSH security regression coverage 2026-02-04 11:36:11 +00:00
rcourtman 06df067cd7 Cover apply-restart auth guards 2026-02-04 11:30:37 +00:00
rcourtman a9dc469de7 Add permission denial regression tests 2026-02-04 11:28:09 +00:00
rcourtman a2b8b21ada Fix rate limit flake in config export/import tests 2026-02-04 11:23:12 +00:00
rcourtman ee5931ac7d test: extend admin proxy and reset lockout auth coverage 2026-02-04 11:16:53 +00:00
rcourtman df4ae9d639 test: deny non-admin proxy users on admin endpoints 2026-02-04 11:14:53 +00:00
rcourtman 65a0b7a0e4 test: cover change-password and public export/import guards 2026-02-04 11:12:54 +00:00
rcourtman 5553214256 test: require auth for license status 2026-02-04 11:08:21 +00:00
rcourtman 1af342da2d fix: add 7-day snooze cooldown to GitHub star modal
"Maybe later" previously only hid the modal for the current session,
causing it to reappear on every subsequent visit. Now it snoozes the
modal for 7 days before showing again.
2026-02-04 11:04:52 +00:00
rcourtman ed0f85149d test: require auth for logs and update status 2026-02-04 11:00:46 +00:00
rcourtman cea2fdd40f fix: add FreeBSD binaries to release manifest and validation
The previous commit added FreeBSD binaries to the Docker build and
release directory but didn't update the manifest generator or validation
script. Without this, FreeBSD binaries would be built but not tracked
or validated, and release validation would fail on the new entries.

Related to #1051
2026-02-04 11:00:31 +00:00
rcourtman ae58e16525 test: include /api/config in monitoring read coverage 2026-02-04 11:00:03 +00:00
rcourtman 764805b0b9 test: require auth for auto-register 2026-02-04 10:59:24 +00:00
rcourtman d6172b9a86 test: require auth for config export/import in api mode 2026-02-04 10:57:14 +00:00
rcourtman 47a4dc01cf test: require auth for ai status, license features, scheduler health 2026-02-04 10:56:17 +00:00
rcourtman 7346d48872 fix: add FreeBSD agent binaries to Docker build and fix pfSense boot (#1051)
Two fixes for FreeBSD agent support:

1. The Docker image never built or included FreeBSD agent binaries, causing
   404 errors when FreeBSD clients requested the download. Added FreeBSD
   amd64/arm64 cross-compilation for both host-agent and unified-agent,
   plus COPY statements to include them in the image. Also added bare
   FreeBSD binaries to GitHub release assets for the redirect fallback.

2. pfSense does not use the standard FreeBSD rc.d boot system — scripts
   in /usr/local/etc/rc.d/ must end in .sh to run at boot. The installer
   now detects pfSense and creates a .sh boot wrapper alongside the
   standard rc.d script. Also added -r flag to daemon for auto-restart.

Related to #1051
2026-02-04 10:55:55 +00:00
rcourtman 5850ddf584 test: enforce proxy admin for config export/import and notifications 2026-02-04 10:54:51 +00:00
rcourtman 83311cdf8c test: require settings:write for ai patrol autonomy update 2026-02-04 10:48:56 +00:00
rcourtman 32426aa6ca test: license gate audit verify endpoint 2026-02-04 10:48:11 +00:00
rcourtman f8b495c54c test: enforce scope on security token endpoints 2026-02-04 10:47:36 +00:00
rcourtman 0a26ef622a test: license gate audit webhook endpoint 2026-02-04 10:46:53 +00:00
rcourtman 1fdb96db1f test: require settings scopes for config export/import 2026-02-04 10:46:19 +00:00
rcourtman f8a8affe26 test: enforce license gating for enterprise endpoints 2026-02-04 10:42:44 +00:00
rcourtman a6e1b7f6ee test: require license for audit and reporting 2026-02-04 10:42:00 +00:00
rcourtman 71440c9521 test: require host:manage for host config patch 2026-02-04 10:40:58 +00:00
rcourtman ac006ff5b9 test: require ai:chat scope for chat endpoints 2026-02-04 10:40:19 +00:00
rcourtman 563f4893fb test: guard ai settings endpoints by scope 2026-02-04 10:39:28 +00:00
rcourtman 86b75c9e7c test: enforce monitoring:write for metadata mutations 2026-02-04 10:38:48 +00:00
rcourtman 9409969ddd test: require monitoring:read for core data endpoints 2026-02-04 10:37:53 +00:00
rcourtman 8ed47b8971 test: enforce agent scope checks 2026-02-04 10:37:06 +00:00