Files
pulse/internal/api
rcourtman dd47cbe5b4 security: fix host token binding, AI findings scope, and DLQ credential exposure
1. Host agent link/unlink/delete now require settings:write scope
   - Prevents compromised host-agent:manage tokens from manipulating
     or deleting unrelated hosts
   - Host tokens scoped to one host can no longer affect other hosts

2. AI investigation endpoints now require ai:execute scope
   - /api/ai/findings/* was only protected by RequireAuth
   - Low-privilege tokens could read investigation details and chat logs

3. Notification DLQ endpoints now require settings:read/write scope
   - DLQ entries contain notification configs (webhooks, SMTP, etc.)
   - Prevents monitoring:read tokens from reading credential data
   - DLQ retry/delete operations require settings:write
2026-02-03 19:59:46 +00:00
..
2026-01-22 00:30:15 +00:00

Internal API Package

This directory contains the API server implementation for Pulse.

Important Note About frontend-modern/

The frontend-modern/ subdirectory that appears here is:

  • AUTO-GENERATED during builds
  • NOT the source code - just a build artifact
  • IN .gitignore - never committed
  • REQUIRED BY GO - The embed directive needs it here

Frontend Development Location

👉 Edit frontend files at: ${PULSE_REPOS_DIR}/pulse/frontend-modern/src/

Why This Structure?

Go's //go:embed directive has limitations:

  1. Cannot use ../ paths to access parent directories
  2. Cannot follow symbolic links
  3. Must embed files within the Go module

This is a known Go limitation and our structure works around it.