1541 Commits

Author SHA1 Message Date
rcourtman c9547f226e fix: add rateTracker to host report tests and block direct tag pushes
Initialize rateTracker in ApplyHostReport test monitors to prevent nil
pointer panic when CalculateRates is called during host report processing.

Add pre-push hook guard that blocks pushing version tags directly —
releases must go through the create-release.yml workflow.
2026-02-04 16:47:31 +00:00
rcourtman 25285e64bc Require proxy admin for AI test endpoints 2026-02-04 16:30:22 +00:00
rcourtman 5a494b10a5 Cover proxy auth for AI settings updates 2026-02-04 16:27:48 +00:00
rcourtman 34f35f0322 Protect discovery notes secrets for proxy users 2026-02-04 16:25:16 +00:00
rcourtman 12038e4e9a Guard discovery settings against proxy non-admin 2026-02-04 16:23:08 +00:00
rcourtman a2f01f14af Require proxy admin for token regeneration 2026-02-04 16:19:57 +00:00
rcourtman 0867490ae0 Block proxy non-admin password changes 2026-02-04 16:17:00 +00:00
rcourtman 27d8cc92dc Cover proxy auth on config export/import 2026-02-04 16:13:15 +00:00
rcourtman ce9ee2481a Enforce proxy user RBAC via RequirePermission 2026-02-04 16:11:41 +00:00
rcourtman 9d4d392026 fix: host network sparklines showing cumulative bytes instead of rates
Host network sparklines were displaying wildly incorrect values (e.g., 147 GB/s
for an idle Raspberry Pi) because cumulative byte counters (total bytes since
boot) were being stored directly instead of being converted to rates.

Changes:
- monitor.go: Use RateTracker to calculate network rates for hosts, matching
  the existing pattern used for VMs and containers. Only record network
  metrics when we have enough samples to calculate valid rates.
- router.go: Remove network metrics from live fallback for hosts since we
  can't calculate rates from a single snapshot. Better to show nothing than
  misleading cumulative totals.

The fix follows the established codebase pattern where:
1. Agent reports cumulative RXBytes/TXBytes
2. RateTracker compares consecutive samples to calculate bytes/second
3. Rates are stored in metrics history for sparkline display
2026-02-04 16:11:04 +00:00
rcourtman f7bc69fac2 Add AI reapprove scope and license tests 2026-02-04 16:04:46 +00:00
rcourtman c724bb04cf Extend proxy admin denial coverage 2026-02-04 16:00:43 +00:00
rcourtman 5f2990deec Require proxy admin for SSH config endpoints 2026-02-04 15:57:59 +00:00
rcourtman 145e5c46bb Require admin for host config patch and delete 2026-02-04 15:56:07 +00:00
rcourtman 5ede1f6a97 Harden apply-restart auth for proxy/OIDC 2026-02-04 15:48:06 +00:00
rcourtman 0f2122ea85 Cover proxy admin gating for config management 2026-02-04 15:45:31 +00:00
rcourtman 093235b0a9 Extend proxy admin gating to agent manage endpoints 2026-02-04 15:44:24 +00:00
rcourtman df799c66d5 Expand proxy admin gating for host and profiles 2026-02-04 15:42:54 +00:00
rcourtman b3fa409b74 Allow SMTP auth over unencrypted connections, fix rate limit persistence, sanitize diagnostics export
- Replace Go stdlib smtp.PlainAuth (which refuses credentials without TLS)
  with a custom plainAuth that respects the user's explicit transport choice
- Remove TLS guard from LoginAuth for the same reason
- Add RateLimit field to EmailConfig so the user's configured value is
  persisted instead of being silently overwritten with 60
- Implement actual sanitization in the "Export for GitHub" diagnostics
  button (was previously ignored — both exports produced identical data)

Related to #1189
2026-02-04 15:42:47 +00:00
rcourtman e9860eb4c6 Block proxy non-admin for security restart and OIDC 2026-02-04 15:41:50 +00:00
rcourtman b5373749db Fix alert history duration and re-evaluation threshold bugs
Update history entry LastSeen on alert resolution so the stored duration
reflects how long the alert was actually active, not the snapshot captured
at creation time. This fixes the "0m" duration display for all resolved
metric-based alerts.

Fix reevaluateActiveAlertsLocked to use HostDefaults for host agent alerts
and PBSDefaults for PBS alerts instead of falling through to GuestDefaults
and NodeDefaults respectively, which could incorrectly resolve or retain
alerts on config save when thresholds differ.
2026-02-04 15:40:28 +00:00
rcourtman 248f4c69a5 Ensure proxy non-admins blocked for AI admin endpoints 2026-02-04 15:40:14 +00:00
rcourtman 773ba13ada Require ai:execute for approvals approve/deny 2026-02-04 15:39:04 +00:00
rcourtman 23cc5af69f Require proxy admin for test-notification 2026-02-04 15:34:30 +00:00
rcourtman e3179e49ac Cover RBAC mutation license gating 2026-02-04 15:22:38 +00:00
rcourtman 4e3811e69e Cover RBAC mutations in permission denial tests 2026-02-04 15:21:02 +00:00
rcourtman 895a7e07e2 Verify host uninstall enforces token binding 2026-02-04 15:16:12 +00:00
rcourtman e069507d97 Add scope checks for notification endpoints 2026-02-04 15:10:02 +00:00
rcourtman d257815564 Reject recovery via untrusted XFF 2026-02-04 15:01:09 +00:00
rcourtman b35de694bb Document legacy token org access 2026-02-04 14:55:20 +00:00
rcourtman f6b70da39f Enforce token precedence for tenant access 2026-02-04 14:54:14 +00:00
rcourtman 8300ec8460 Prefer org header over cookie 2026-02-04 14:51:14 +00:00
rcourtman d06c749c1a Reject org cookie for non-member 2026-02-04 14:48:03 +00:00
rcourtman 9ff395eba4 Cover tenant user membership checks 2026-02-04 14:41:08 +00:00
rcourtman 5e4de1e849 Deny proxy non-admin despite token 2026-02-04 14:35:08 +00:00
rcourtman cffb91f9ea Pre-populate node display name cache before guest polling
Guest polling (CheckGuest) runs before CheckNode in each poll cycle,
so the display name cache was empty when the first guest alert was
created. This caused the initial notification to use the raw Proxmox
node name. Fix by seeding the cache from modelNodes (which are already
available) before guest polling starts.

Related to #1188
2026-02-04 14:29:49 +00:00
rcourtman 3fe152bba8 Allow API tokens with OIDC enabled 2026-02-04 14:27:46 +00:00
rcourtman 05266d9062 Show node display name in alerts instead of raw Proxmox node name
Alerts previously showed the raw Proxmox node name (e.g., "on pve") even
when users configured a display name (e.g., "SPACEX") via Settings or the
host agent --hostname flag. This affected the alert UI, email notifications,
and webhook payloads.

Add NodeDisplayName field to the alert chain: cache display names in the
alert Manager (populated by CheckNode/CheckHost on every poll), resolve
them at alert creation via preserveAlertState, refresh on metric updates,
and enrich at read time in GetActiveAlerts. Update models.Alert, the
syncAlertsToState conversion, email templates, Apprise body text, webhook
payloads, and all frontend rendering paths.

Related to #1188
2026-02-04 14:26:44 +00:00
rcourtman 313df78cf7 Require auth for admin endpoints with OIDC 2026-02-04 14:26:38 +00:00
rcourtman c5308adf6e Cover admin bypass routing 2026-02-04 14:24:42 +00:00
rcourtman fecfc74c0a Gate admin endpoints for proxy users 2026-02-04 14:21:10 +00:00
rcourtman de2ed1b33a Cover multi-org token authorization 2026-02-04 14:15:50 +00:00
rcourtman fdb7c9a1c5 Block cross-tenant org token use 2026-02-04 14:13:57 +00:00
rcourtman 526fb21076 Add tests for guest intelligence and reachability signals
Cover gatherGuestIntelligence (discovery matching, instance fallback,
reachability via mock prober, edge cases), parsePingOutput parsing,
DetectReachabilitySignals, enriched seed context (Service/Reachable
columns, quiet mode variants, health issues fallback), and extend
signal helper tests for SignalGuestUnreachable.
2026-02-04 14:12:50 +00:00
rcourtman 34ca427458 Add unified guest intelligence to patrol seed context
Enrich the patrol seed context with service identity (from discovery
store) and network reachability (via ICMP ping through host agents).
The guest metrics table now includes Service and Reachable columns,
and a Service Health Issues section highlights running-but-unreachable
guests. A new SignalGuestUnreachable signal type creates deterministic
findings for unreachable guests.

New files:
- patrol_intelligence.go: GuestProber interface, GuestIntelligence
  type, gatherGuestIntelligence() with concurrent per-node probing
- patrol_prober.go: agentExecProber implementation using batch ping
  commands via connected host agents
2026-02-04 14:08:57 +00:00
rcourtman 6de231fcf0 Enforce host config token binding 2026-02-04 14:06:30 +00:00
rcourtman cb788f18b9 Ignore bearer token in security status 2026-02-04 14:01:57 +00:00
rcourtman 9e3b8f722e Require host config read scope 2026-02-04 14:00:04 +00:00
rcourtman 698a7b1926 Require auth for RBAC and reporting 2026-02-04 13:57:00 +00:00
rcourtman 098a722e03 Cover blocked AI fetch hosts 2026-02-04 13:54:32 +00:00