feat: move trivy auto-update, node labels, fleet topology, and single-scan SBOM to Community (#1336)

Rebalance several capabilities from the paid tier to the free Community tier:

- Managed Trivy auto-update toggle is admin-only, no longer tier-gated.
- Node labels (assign, view, manage) are available on every tier; cordon and
  FleetSync anchor reset stay paid.
- Fleet topology layout modes (Hub, Grouped, Free) are available on Community.
- Single-scan SBOM export (SPDX and CycloneDX) is admin-only on Community;
  SARIF export stays paid via a dedicated canExportSarif capability split out
  from the former shared SBOM flag.

Backend route guards and frontend affordances are updated together, with tier
and admin-role tests covering the Community-allowed and still-paid paths.

backend/src/__tests__/node-labels-community-tier.test.ts

@@ -0,0 +1,87 @@
+/**
+ * Confirms the node-label routes (list, distinct, per-node read, add, remove)
+ * are reachable on the Community tier. Node labels drive fleet grouping and are
+ * a free organizational primitive; only the admin role is required for writes.
+ */
+import { describe, it, expect, beforeAll, afterAll, afterEach, vi } from 'vitest';
+import request from 'supertest';
+import jwt from 'jsonwebtoken';
+import { setupTestDb, cleanupTestDb, TEST_USERNAME, TEST_JWT_SECRET } from './helpers/setupTestDb';
+
+let tmpDir: string;
+let app: import('express').Express;
+let authHeader: string;
+let viewerAuthHeader: string;
+let nodeId: number;
+let LicenseService: typeof import('../services/LicenseService').LicenseService;
+
+beforeAll(async () => {
+  tmpDir = await setupTestDb();
+  ({ app } = await import('../index'));
+  ({ LicenseService } = await import('../services/LicenseService'));
+  const { NodeRegistry } = await import('../services/NodeRegistry');
+  const { DatabaseService } = await import('../services/DatabaseService');
+  nodeId = NodeRegistry.getInstance().getDefaultNodeId();
+  DatabaseService.getInstance().addUser({ username: 'node-labels-viewer', password_hash: 'hash', role: 'viewer' });
+  authHeader = `Bearer ${jwt.sign({ username: TEST_USERNAME }, TEST_JWT_SECRET, { expiresIn: '1m' })}`;
+  viewerAuthHeader = `Bearer ${jwt.sign({ username: 'node-labels-viewer' }, TEST_JWT_SECRET, { expiresIn: '1m' })}`;
+});
+
+afterAll(() => cleanupTestDb(tmpDir));
+
+function mockTier(tier: 'paid' | 'community') {
+  vi.spyOn(LicenseService.getInstance(), 'getTier').mockReturnValue(tier);
+}
+
+describe('Node labels on Community tier', () => {
+  afterEach(() => vi.restoreAllMocks());
+
+  it('GET /api/node-labels returns 200 on community', async () => {
+    mockTier('community');
+    const res = await request(app).get('/api/node-labels').set('Authorization', authHeader);
+    expect(res.status).toBe(200);
+    expect(typeof res.body).toBe('object');
+  });
+
+  it('GET /api/node-labels/all returns 200 on community', async () => {
+    mockTier('community');
+    const res = await request(app).get('/api/node-labels/all').set('Authorization', authHeader);
+    expect(res.status).toBe(200);
+    expect(Array.isArray(res.body.labels)).toBe(true);
+  });
+
+  it('POST then DELETE a node label as a Community admin', async () => {
+    mockTier('community');
+    const add = await request(app)
+      .post(`/api/node-labels/${nodeId}`)
+      .set('Authorization', authHeader)
+      .send({ label: 'community-edge' });
+    expect(add.status).toBe(201);
+    expect(add.body.label).toBe('community-edge');
+
+    const read = await request(app)
+      .get(`/api/node-labels/${nodeId}`)
+      .set('Authorization', authHeader);
+    expect(read.status).toBe(200);
+    expect(read.body.labels).toContain('community-edge');
+
+    const remove = await request(app)
+      .delete(`/api/node-labels/${nodeId}/community-edge`)
+      .set('Authorization', authHeader);
+    expect(remove.status).toBe(204);
+  });
+
+  it('denies a non-admin (viewer) the write routes with 403', async () => {
+    mockTier('community');
+    const add = await request(app)
+      .post(`/api/node-labels/${nodeId}`)
+      .set('Authorization', viewerAuthHeader)
+      .send({ label: 'viewer-denied' });
+    expect(add.status).toBe(403);
+
+    const remove = await request(app)
+      .delete(`/api/node-labels/${nodeId}/viewer-denied`)
+      .set('Authorization', viewerAuthHeader);
+    expect(remove.status).toBe(403);
+  });
+});

backend/src/__tests__/security-sbom-sarif-tier.test.ts

@@ -0,0 +1,91 @@
+/**
+ * Tier split for the two scan-export endpoints:
+ *   POST /api/security/sbom            -> Community (admin only, no tier gate)
+ *   GET  /api/security/scans/:id/sarif -> Admiral (paid) only
+ *
+ * SBOM is a per-image artifact useful to any self-hoster; SARIF (CI/security
+ * pipeline ingestion) stays a paid governance export.
+ */
+import { describe, it, expect, beforeAll, afterAll, afterEach, vi } from 'vitest';
+import request from 'supertest';
+import bcrypt from 'bcrypt';
+import { setupTestDb, cleanupTestDb, loginAsTestAdmin } from './helpers/setupTestDb';
+
+let tmpDir: string;
+let app: import('express').Express;
+let adminCookie: string;
+let viewerCookie: string;
+let LicenseService: typeof import('../services/LicenseService').LicenseService;
+let TrivyService: typeof import('../services/TrivyService').default;
+
+beforeAll(async () => {
+  tmpDir = await setupTestDb();
+  ({ LicenseService } = await import('../services/LicenseService'));
+  TrivyService = (await import('../services/TrivyService')).default;
+  vi.spyOn(LicenseService.getInstance(), 'getTier').mockReturnValue('paid');
+  ({ app } = await import('../index'));
+  adminCookie = await loginAsTestAdmin(app);
+
+  const { DatabaseService } = await import('../services/DatabaseService');
+  const viewerHash = await bcrypt.hash('sbomviewer1', 1);
+  DatabaseService.getInstance().addUser({ username: 'sbom-viewer', password_hash: viewerHash, role: 'viewer' });
+  const viewerRes = await request(app).post('/api/auth/login').send({ username: 'sbom-viewer', password: 'sbomviewer1' });
+  const cookies = viewerRes.headers['set-cookie'] as string | string[];
+  viewerCookie = Array.isArray(cookies) ? cookies[0] : cookies;
+});
+
+afterAll(() => cleanupTestDb(tmpDir));
+
+function mockTier(tier: 'paid' | 'community') {
+  vi.spyOn(LicenseService.getInstance(), 'getTier').mockReturnValue(tier);
+}
+
+describe('POST /api/security/sbom (Community)', () => {
+  afterEach(() => { vi.restoreAllMocks(); mockTier('paid'); });
+
+  it('lets a Community admin generate an SBOM (no PAID_REQUIRED gate)', async () => {
+    mockTier('community');
+    const svc = TrivyService.getInstance();
+    vi.spyOn(svc, 'isTrivyAvailable').mockReturnValue(true);
+    vi.spyOn(svc, 'generateSBOM').mockResolvedValue('{"bomFormat":"CycloneDX"}');
+
+    const res = await request(app)
+      .post('/api/security/sbom')
+      .set('Cookie', adminCookie)
+      .send({ imageRef: 'nginx:latest', format: 'cyclonedx' });
+
+    expect(res.status).toBe(200);
+    expect(res.headers['content-disposition']).toContain('nginx_latest.cdx.json');
+  });
+
+  it('denies a non-admin (viewer) with 403 (admin gate is the sole guard now)', async () => {
+    mockTier('community');
+    const res = await request(app)
+      .post('/api/security/sbom')
+      .set('Cookie', viewerCookie)
+      .send({ imageRef: 'nginx:latest', format: 'cyclonedx' });
+    expect(res.status).toBe(403);
+  });
+});
+
+describe('GET /api/security/scans/:scanId/sarif (Admiral only)', () => {
+  afterEach(() => { vi.restoreAllMocks(); mockTier('paid'); });
+
+  it('rejects a Community admin with 403 PAID_REQUIRED', async () => {
+    mockTier('community');
+    const res = await request(app)
+      .get('/api/security/scans/999999/sarif')
+      .set('Cookie', adminCookie);
+    expect(res.status).toBe(403);
+    expect(res.body.code).toBe('PAID_REQUIRED');
+  });
+
+  it('passes the tier gate for a paid admin (404 for a missing scan, not 403)', async () => {
+    mockTier('paid');
+    const res = await request(app)
+      .get('/api/security/scans/999999/sarif')
+      .set('Cookie', adminCookie);
+    expect(res.status).not.toBe(403);
+    expect(res.status).toBe(404);
+  });
+});

backend/src/__tests__/security-trivy-auto-update-route.test.ts

@@ -1,9 +1,10 @@
 /**
- * Tests for the role + tier gate on PUT /api/security/trivy-auto-update.
+ * Tests for the admin-role gate on PUT /api/security/trivy-auto-update.
  *
  * The route flips the global `trivy_auto_update` setting that the scheduler
  * reads every 24h to decide whether to pull newer Trivy binary releases.
- * It must be reachable only by an admin on a paid (Admiral) tier.
+ * It must be reachable by any admin, on Community as well as Admiral; only the
+ * admin role is required (no tier gate).
  */
 import { describe, it, expect, beforeAll, afterAll, vi } from 'vitest';
 import request from 'supertest';
@@ -51,7 +52,7 @@ describe('PUT /api/security/trivy-auto-update', () => {
     expect(res.status).toBe(403);
   });
 
-  it('rejects Community tier with 403', async () => {
+  it('accepts a Community admin (no tier gate) and persists the setting', async () => {
     const { LicenseService } = await import('../services/LicenseService');
     const spy = vi.spyOn(LicenseService.getInstance(), 'getTier').mockReturnValue('community');
     try {
@@ -59,7 +60,9 @@ describe('PUT /api/security/trivy-auto-update', () => {
         .put('/api/security/trivy-auto-update')
         .set('Cookie', adminCookie)
         .send({ enabled: true });
-      expect(res.status).toBe(403);
+      expect(res.status).toBe(200);
+      expect(res.body.autoUpdate).toBe(true);
+      expect(DatabaseService.getInstance().getGlobalSettings().trivy_auto_update).toBe('1');
     } finally {
       spy.mockReturnValue('paid');
     }

backend/src/routes/nodeLabels.ts

@@ -1,6 +1,6 @@
 import { Router, type Request, type Response } from 'express';
 import { authMiddleware } from '../middleware/auth';
-import { requirePaid, requireAdmin, requireBody } from '../middleware/tierGates';
+import { requireAdmin, requireBody } from '../middleware/tierGates';
 import { DatabaseService } from '../services/DatabaseService';
 import { NodeLabelService } from '../services/NodeLabelService';
 import { parseIntParam } from '../utils/parseIntParam';
@@ -10,7 +10,6 @@ export const nodeLabelsRouter = Router();
 nodeLabelsRouter.use(authMiddleware);
 
 nodeLabelsRouter.get('/', (req: Request, res: Response): void => {
-    if (!requirePaid(req, res)) return;
     try {
         const map = NodeLabelService.getInstance().listAll();
         res.json(map);
@@ -21,7 +20,6 @@ nodeLabelsRouter.get('/', (req: Request, res: Response): void => {
 });
 
 nodeLabelsRouter.get('/all', (req: Request, res: Response): void => {
-    if (!requirePaid(req, res)) return;
     try {
         const labels = NodeLabelService.getInstance().listDistinct();
         res.json({ labels });
@@ -32,7 +30,6 @@ nodeLabelsRouter.get('/all', (req: Request, res: Response): void => {
 });
 
 nodeLabelsRouter.get('/:nodeId', (req: Request, res: Response): void => {
-    if (!requirePaid(req, res)) return;
     const nodeId = parseIntParam(req, res, 'nodeId');
     if (nodeId === null) return;
     try {
@@ -50,7 +47,6 @@ nodeLabelsRouter.get('/:nodeId', (req: Request, res: Response): void => {
 });
 
 nodeLabelsRouter.post('/:nodeId', (req: Request, res: Response): void => {
-    if (!requirePaid(req, res)) return;
     if (!requireAdmin(req, res)) return;
     if (!requireBody(req, res)) return;
     const nodeId = parseIntParam(req, res, 'nodeId');
@@ -75,7 +71,6 @@ nodeLabelsRouter.post('/:nodeId', (req: Request, res: Response): void => {
 });
 
 nodeLabelsRouter.delete('/:nodeId/:label', (req: Request, res: Response): void => {
-    if (!requirePaid(req, res)) return;
     if (!requireAdmin(req, res)) return;
     const nodeId = parseIntParam(req, res, 'nodeId');
     if (nodeId === null) return;

backend/src/routes/security.ts

@@ -205,7 +205,6 @@ securityRouter.post('/trivy-update', trivyInstallLimiter, authMiddleware, async
 
 securityRouter.put('/trivy-auto-update', authMiddleware, (req: Request, res: Response): void => {
   if (!requireAdmin(req, res)) return;
-  if (!requirePaid(req, res)) return;
   const enabled = req.body?.enabled === true;
   try {
     DatabaseService.getInstance().updateGlobalSetting('trivy_auto_update', enabled ? '1' : '0');
@@ -440,7 +439,6 @@ securityRouter.get('/image-summaries', authMiddleware, (req: Request, res: Respo
 
 securityRouter.post('/sbom', authMiddleware, async (req: Request, res: Response): Promise<void> => {
   if (!requireAdmin(req, res)) return;
-  if (!requirePaid(req, res)) return;
   const svc = TrivyService.getInstance();
   if (!svc.isTrivyAvailable()) {
     res.status(503).json({ error: 'Trivy is not available on this host' }); return;