feat: move trivy auto-update, node labels, fleet topology, and single-scan SBOM to Community (#1336)

Rebalance several capabilities from the paid tier to the free Community tier:

- Managed Trivy auto-update toggle is admin-only, no longer tier-gated.
- Node labels (assign, view, manage) are available on every tier; cordon and
  FleetSync anchor reset stay paid.
- Fleet topology layout modes (Hub, Grouped, Free) are available on Community.
- Single-scan SBOM export (SPDX and CycloneDX) is admin-only on Community;
  SARIF export stays paid via a dedicated canExportSarif capability split out
  from the former shared SBOM flag.

Backend route guards and frontend affordances are updated together, with tier
and admin-role tests covering the Community-allowed and still-paid paths.

frontend/src/components/FleetView.tsx

@@ -41,7 +41,7 @@ export function FleetView({ onNavigateToNode }: FleetViewProps) {
 
     const { prefs, updatePrefs } = useFleetPreferences();
     const updateStatus = useFleetUpdateStatus();
-    const overview = useFleetOverview({ isPaid, prefs, updatePrefs, updateStatuses: updateStatus.updateStatuses });
+    const overview = useFleetOverview({ prefs, updatePrefs, updateStatuses: updateStatus.updateStatuses });
     const topology = useTopologyPreferences();
     const { exporting, exportDossier } = useFleetDossierExport();
 
@@ -205,7 +205,6 @@ export function FleetView({ onNavigateToNode }: FleetViewProps) {
                         onCordonChange={() => { void overview.fetchOverview(true); }}
                         onEditNode={isAdmin ? openEdit : undefined}
                         onDeleteNode={isAdmin ? openDelete : undefined}
-                        isPaid={isPaid}
                         topologyMode={topology.prefs.mode}
                         onTopologyModeChange={topology.setMode}
                         topologyPositions={topology.prefs.positions}

frontend/src/components/FleetView/OverviewTab.tsx

@@ -35,7 +35,6 @@ interface OverviewTabProps {
     onCordonChange?: () => void;
     onEditNode?: (node: Node) => void;
     onDeleteNode?: (node: Node) => void;
-    isPaid: boolean;
     topologyMode: LayoutMode;
     onTopologyModeChange: (mode: LayoutMode) => void;
     topologyPositions: SavedPositions;
@@ -68,7 +67,6 @@ export function OverviewTab({
     onCordonChange,
     onEditNode,
     onDeleteNode,
-    isPaid,
     topologyMode,
     onTopologyModeChange,
     topologyPositions,
@@ -121,7 +119,6 @@ export function OverviewTab({
                         <FleetTopology
                             nodes={topologyNodes}
                             onNodeClick={(id) => onNavigateToNode(id, '')}
-                            isPaid={isPaid}
                             mode={topologyMode}
                             onModeChange={onTopologyModeChange}
                             savedPositions={topologyPositions}

frontend/src/components/FleetView/__tests__/OverviewTab.test.tsx

@@ -36,7 +36,6 @@ function props(overrides: Partial<React.ComponentProps<typeof OverviewTab>> = {}
     updateStatusMap: new Map(),
     onNavigateToNode: vi.fn(),
     updatingNodeId: null,
-    isPaid: false,
     topologyMode: 'hub' as const,
     onTopologyModeChange: vi.fn(),
     topologyPositions: {},

frontend/src/components/FleetView/hooks/__tests__/useFleetOverview.test.tsx

@@ -36,7 +36,7 @@ function setup(prefs: Partial<FleetPreferences> = {}) {
   const updatePrefs = vi.fn();
   const merged = { ...DEFAULT_PREFS, ...prefs };
   const hook = renderHook(
-    (p: { prefs: FleetPreferences }) => useFleetOverview({ isPaid: false, prefs: p.prefs, updatePrefs, updateStatuses: [] }),
+    (p: { prefs: FleetPreferences }) => useFleetOverview({ prefs: p.prefs, updatePrefs, updateStatuses: [] }),
     { initialProps: { prefs: merged } },
   );
   return { ...hook, updatePrefs };

frontend/src/components/FleetView/hooks/__tests__/useNodeLabels.test.tsx

@@ -25,23 +25,13 @@ function node(id: number): FleetNode {
 beforeEach(() => apiFetchMock.mockReset());
 afterEach(() => vi.clearAllMocks());
 
-describe('useNodeLabels (node-tag aggregation stays paid)', () => {
-  it('does not fetch and reports unavailable when not paid', async () => {
-    const { result } = renderHook(() => useNodeLabels({ isPaid: false, nodes: [node(2)] }));
-    expect(result.current.isAvailable).toBe(false);
-    expect(result.current.labelsByNodeId).toEqual({});
-    // Allow any effect to flush; still no call.
-    await Promise.resolve();
-    expect(apiFetchMock).not.toHaveBeenCalled();
-  });
-
-  it('fetches and normalizes string keys to numbers when paid', async () => {
+describe('useNodeLabels (Community node-tag aggregation)', () => {
+  it('fetches and normalizes string keys to numbers on every tier', async () => {
     apiFetchMock.mockResolvedValue(okJson({ '2': ['prod', 'edge'], '3': ['db'] }));
 
-    const { result } = renderHook(() => useNodeLabels({ isPaid: true, nodes: [node(2), node(3)] }));
+    const { result } = renderHook(() => useNodeLabels({ nodes: [node(2), node(3)] }));
 
     await waitFor(() => expect(Object.keys(result.current.labelsByNodeId).length).toBe(2));
-    expect(result.current.isAvailable).toBe(true);
     expect(result.current.labelsByNodeId[2]).toEqual(['prod', 'edge']);
     expect(result.current.labelsByNodeId[3]).toEqual(['db']);
     // distinctLabels is the sorted union.
@@ -51,7 +41,7 @@ describe('useNodeLabels (node-tag aggregation stays paid)', () => {
 
   it('clears the map on a non-ok response', async () => {
     apiFetchMock.mockResolvedValue(new Response('nope', { status: 403 }));
-    const { result } = renderHook(() => useNodeLabels({ isPaid: true, nodes: [node(2)] }));
+    const { result } = renderHook(() => useNodeLabels({ nodes: [node(2)] }));
     await waitFor(() => expect(apiFetchMock).toHaveBeenCalled());
     expect(result.current.labelsByNodeId).toEqual({});
   });

frontend/src/components/FleetView/hooks/useFleetOverview.ts

@@ -18,13 +18,12 @@ interface MastheadStats {
 }
 
 interface UseFleetOverviewOptions {
-    isPaid: boolean;
     prefs: FleetPreferences;
     updatePrefs: (updates: Partial<FleetPreferences>) => void;
     updateStatuses: NodeUpdateStatus[];
 }
 
-export function useFleetOverview({ isPaid, prefs, updatePrefs, updateStatuses }: UseFleetOverviewOptions) {
+export function useFleetOverview({ prefs, updatePrefs, updateStatuses }: UseFleetOverviewOptions) {
     const [nodes, setNodes] = useState<FleetNode[]>([]);
     const [loading, setLoading] = useState(true);
     const [refreshing, setRefreshing] = useState(false);
@@ -35,7 +34,7 @@ export function useFleetOverview({ isPaid, prefs, updatePrefs, updateStatuses }:
     const abortRef = useRef<AbortController | null>(null);
 
     const { fleetPalette, fleetStackLabelMap } = useFleetLabels({ nodes });
-    const { labelsByNodeId, distinctLabels, isAvailable: nodeLabelsAvailable } = useNodeLabels({ isPaid, nodes });
+    const { labelsByNodeId, distinctLabels } = useNodeLabels({ nodes });
 
     const fetchOverview = useCallback(async (showRefresh = false) => {
         abortRef.current?.abort();
@@ -217,7 +216,6 @@ export function useFleetOverview({ isPaid, prefs, updatePrefs, updateStatuses }:
         fleetStackLabelMap,
         labelsByNodeId,
         distinctNodeLabels: distinctLabels,
-        nodeLabelsAvailable,
         activeFilterCount,
         clearFilters,
     };

frontend/src/components/FleetView/hooks/useNodeLabels.ts

@@ -5,28 +5,23 @@ import type { FleetNode } from '../types';
 export interface UseNodeLabelsResult {
     labelsByNodeId: Record<number, string[]>;
     distinctLabels: string[];
-    isAvailable: boolean;
 }
 
 interface UseNodeLabelsOptions {
-    isPaid: boolean;
     nodes: FleetNode[];
 }
 
-export function useNodeLabels({ isPaid, nodes }: UseNodeLabelsOptions): UseNodeLabelsResult {
+export function useNodeLabels({ nodes }: UseNodeLabelsOptions): UseNodeLabelsResult {
     const [labelsByNodeId, setLabelsByNodeId] = useState<Record<number, string[]>>({});
 
     const fetchLabels = useCallback(async () => {
-        if (!isPaid) {
-            setLabelsByNodeId({});
-            return;
-        }
         try {
             const res = await apiFetch('/node-labels', {
                 localOnly: true,
                 signal: AbortSignal.timeout(5000),
             });
             if (!res.ok) {
+                console.error(`[useNodeLabels] node-label fetch failed: ${res.status}`);
                 setLabelsByNodeId({});
                 return;
             }
@@ -38,10 +33,11 @@ export function useNodeLabels({ isPaid, nodes }: UseNodeLabelsOptions): UseNodeL
                 if (!Number.isNaN(id) && Array.isArray(v)) map[id] = v;
             }
             setLabelsByNodeId(map);
-        } catch {
+        } catch (err) {
+            console.error('[useNodeLabels] node-label fetch errored:', err);
             setLabelsByNodeId({});
         }
-    }, [isPaid]);
+    }, []);
 
     // Refetch only when the set of node ids actually changes, not on every poll
     // (poll mints a fresh nodes array reference).
@@ -51,13 +47,8 @@ export function useNodeLabels({ isPaid, nodes }: UseNodeLabelsOptions): UseNodeL
     );
 
     useEffect(() => {
-        if (!isPaid) {
-            setLabelsByNodeId({});
-            return;
-        }
         void fetchLabels();
-        // eslint-disable-next-line react-hooks/exhaustive-deps
-    }, [isPaid, nodeIdKey, fetchLabels]);
+    }, [nodeIdKey, fetchLabels]);
 
     const distinctLabels = useMemo(() => {
         const set = new Set<string>();
@@ -67,5 +58,5 @@ export function useNodeLabels({ isPaid, nodes }: UseNodeLabelsOptions): UseNodeL
         return Array.from(set).sort((a, b) => a.localeCompare(b));
     }, [labelsByNodeId]);
 
-    return { labelsByNodeId, distinctLabels, isAvailable: isPaid };
+    return { labelsByNodeId, distinctLabels };
 }

frontend/src/components/NodeManager.tsx

@@ -36,7 +36,7 @@ export interface SenchoNavigateDetail {
 export function NodeManager() {
   const { isPaid } = useLicense();
   const { isAdmin, can } = useAuth();
-  const canEditLabels = isPaid && isAdmin;
+  const canEditLabels = isAdmin;
   // Mirror the backend node:manage guard. This top-level flag checks the global
   // role only (admin or global node-admin); the per-row Test/Edit/Delete buttons
   // below additionally honor scoped per-node grants via can('node:manage', 'node', id).
@@ -368,11 +368,7 @@ export function NodeManager() {
                 </TableCell>
                 <TableCell>{getStatusBadge(node.status)}</TableCell>
                 <TableCell>
-                  {isPaid ? (
-                    <NodeLabelPicker nodeId={node.id} canEdit={canEditLabels} />
-                  ) : (
-                    <span className="text-muted-foreground text-sm">—</span>
-                  )}
+                  <NodeLabelPicker nodeId={node.id} canEdit={canEditLabels} />
                 </TableCell>
                 <TableCell>
                   {(() => {

frontend/src/components/ResourcesView.tsx

@@ -1534,7 +1534,8 @@ export default function ResourcesView() {
                 scanId={inspectScanId}
                 onClose={() => setInspectScanId(null)}
                 onRescan={isAdmin ? (imageRef) => { setInspectScanId(null); handleScanImage(imageRef, { force: true }); } : undefined}
-                canGenerateSbom={isPaid && isAdmin}
+                canGenerateSbom={isAdmin}
+                canExportSarif={isPaid && isAdmin}
                 canCompare
                 canManageSuppressions={isAdmin}
             />

frontend/src/components/SecurityHistoryView.tsx

@@ -338,7 +338,8 @@ export function SecurityHistoryView({ open, onClose }: SecurityHistoryViewProps)
       <VulnerabilityScanSheet
         scanId={inspectScanId}
         onClose={() => setInspectScanId(null)}
-        canGenerateSbom={isPaid && isAdmin}
+        canGenerateSbom={isAdmin}
+        canExportSarif={isPaid && isAdmin}
         canCompare={false}
         canManageSuppressions={isAdmin}
       />

frontend/src/components/VulnerabilityScanSheet.tsx

@@ -59,6 +59,7 @@ interface VulnerabilityScanSheetProps {
   onClose: () => void;
   onRescan?: (imageRef: string) => void;
   canGenerateSbom?: boolean;
+  canExportSarif?: boolean;
   canCompare?: boolean;
   canManageSuppressions?: boolean;
 }
@@ -109,6 +110,7 @@ export function VulnerabilityScanSheet({
   onClose,
   onRescan,
   canGenerateSbom = false,
+  canExportSarif = false,
   canCompare = false,
   canManageSuppressions: canManageSuppressionsProp = false,
 }: VulnerabilityScanSheetProps) {
@@ -475,7 +477,7 @@ export function VulnerabilityScanSheet({
       icon: Download,
       onClick: exportCsv,
     }] : []),
-    ...(canGenerateSbom && scan.status === 'completed' ? [{
+    ...(canExportSarif && scan.status === 'completed' ? [{
       label: 'SARIF',
       icon: Download,
       onClick: () => { void exportSarif(); },

frontend/src/components/fleet/FleetTopology.tsx

@@ -28,7 +28,6 @@ import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from '@/comp
 interface FleetTopologyProps {
     nodes: FleetTopologyNode[];
     onNodeClick?: (nodeId: number) => void;
-    isPaid: boolean;
     mode: LayoutMode;
     onModeChange: (mode: LayoutMode) => void;
     savedPositions: SavedPositions;
@@ -274,7 +273,6 @@ function TopologyToolbar({
 export function FleetTopology({
     nodes: fleetNodes,
     onNodeClick,
-    isPaid,
     mode,
     onModeChange,
     savedPositions,
@@ -289,13 +287,7 @@ export function FleetTopology({
     const savedPositionsRef = useRef(savedPositions);
     savedPositionsRef.current = savedPositions;
 
-    // Defensive: a Community user who somehow lands in a paid mode (older
-    // localStorage value, manual edit) gets snapped back to Hub. The toolbar
-    // also hides these modes for them, so this is a belt-and-suspenders guard.
-    const effectiveMode: LayoutMode = useMemo(() => {
-        if ((mode === 'grouped' || mode === 'free') && !isPaid) return 'hub';
-        return mode;
-    }, [mode, isPaid]);
+    const effectiveMode: LayoutMode = mode;
 
     // Only re-layout when the topology *shape* changes (nodes added/removed,
     // type/status/label flips, mode flips). Metric value changes alone must
@@ -397,8 +389,8 @@ export function FleetTopology({
 
     return (
         <div className="rounded-lg border border-card-border border-t-card-border-top bg-card shadow-card-bevel overflow-hidden">
-            {isPaid && <TopologyToolbar mode={effectiveMode} onModeChange={onModeChange} />}
-            {isPaid && allRemotesUnlabeled && (
+            <TopologyToolbar mode={effectiveMode} onModeChange={onModeChange} />
+            {allRemotesUnlabeled && (
                 <div className="px-3 py-1.5 text-[11px] text-muted-foreground bg-muted/30 border-b border-card-border">
                     No node labels assigned. Add labels in Settings · Nodes to see remotes cluster.
                 </div>

frontend/src/components/settings/SecuritySection.tsx

@@ -420,7 +420,7 @@ export function SecuritySection({ isPaid }: { isPaid: boolean }) {
           <div className="text-xs text-stat-subtitle">{TRIVY_SOURCE_DESCRIPTIONS[trivy.source]}</div>
         )}
 
-        {trivy.source === 'managed' && isPaid && isAdmin && (
+        {trivy.source === 'managed' && isAdmin && (
           <div className="flex items-center justify-between rounded-lg border border-glass-border px-3 py-2.5">
             <div>
               <Label className="text-sm">Auto-update Trivy</Label>