* feat(security): reflow the node Security page for mobile
Below the md breakpoint the Security page now reads as a phone surface
instead of a squeezed desktop, with no change to the desktop layout.
- Masthead stat cluster moves into a full-width 3-cell strip
(critical / high / last scan) below the tab strip, since the masthead
hides its inline cluster on a phone.
- The eight-section tab strip becomes a horizontally scrollable mono row
with an edge mask-fade and a cyan underline on the active tab; every
section stays reachable by scroll.
- The six totals render as a 3x2 hairline-divided grid instead of the
640px-wide rail that forced a horizontal scroll.
- The Images tab becomes a filterable, scrollable list (severity dot,
truncated ref, freshness, critical/high count tags) with a chip row,
in place of the desktop table.
- A freshness footer band states scan recency and scanner version.
All mobile treatment is gated by useIsMobile() or max-md: utilities, so
the desktop view is byte-identical. Charts are reused full-width.
* feat(security): make the mobile Security page a bespoke masthead-led screen
On a phone the Security page now drops the global top bar and leads with
its masthead (the notifications + more-menu cluster moves into the
masthead's right slot), matching Home and Fleet so the mobile shell is
continuous across pages. The view is reclassified bespoke and rendered
through the masthead-led path; the desktop layout is unchanged.
The mobile "more" menu now lists every destination instead of omitting
the bottom-tab views, so the same menu opens the same set on every
screen rather than changing contents from page to page.
* refactor: drop the advisory policy-packs section and the findings cursor tooltip
Two Security-page cleanups from review.
- Remove the advisory policy-packs catalog from the Policies tab. It was
information-only and disconnected from the scan_policies enforcement engine, so
it read as duplicated. The tab now hosts only the enforcement manager, which is
paid, so the Policies tab is hidden for Community (with a deep-link guard) and
the Overview's enforcement hint is gated to match. The backend policy-packs
catalog and route are kept as a dormant foundation. Delete the orphaned
PolicyPacksTab component, its test, and the unused frontend pack types.
- Drop the cursor-follow tooltip from the findings severity badge (Secrets and
Compose risks), matching the Images table.
- Clarify that Compose risks is a Trivy security-misconfig audit, distinct from
Compose Doctor's deploy-readiness preflight, in the tab copy and the docs.
* chore: re-run CI
Add a "Scan this node" action on the Security overview that scans, in one pass,
any combination of three types: image vulnerabilities, image secrets, and
compose misconfigurations. Progress streams live into the deploy-feedback modal.
- TrivyService.scanNode runs the selected scanners across the node's images and,
for misconfig, every stack's compose file, behind a per-node lock and tolerant
of per-item failures. The existing scanAllNodeImages becomes a thin vuln-only
wrapper over the shared image loop, so scheduled scans are unchanged.
- POST /api/security/scan-node (admin, scanner-gated) streams sanitized progress
to the deploy terminal and returns a combined summary. Secret scans stream
counts only, never matched values.
- Frontend adds a "scan" action verb and a ScanNodeLauncher wired into the
overview; the scan stays bound to the node it started on even if the active
node changes mid-run.
- Masthead: add `size` and `subtitle` to PageMasthead and render the Security
masthead at the hero title size with a one-line posture summary, so its height
and weight match the Home and Fleet mastheads. The compact size with no
subtitle stays the default, so Settings, Console, and Logs are unchanged.
- History search now applies as you type (a short debounce, no Enter press),
matching the Fleet overview search. It stays server-side so the query searches
every completed scan, not just the loaded page.
* feat: chart-led Security overview with sortable Images and History tables
Refine the Security page around the existing design system and add the
data the dashboard needs.
- Overview leads with four charts (30-day risk trend, severity donut, top
exposed images, findings by type); the signal-rail counts become a
secondary summary, and the scanner and deploy-enforcement posture follow.
- Images becomes a recessed table with search, a severity filter, sortable
columns, a last-scan column, and inline scan actions; the findings cell is
clickable into the scan sheet, and the per-row cursor tooltip is dropped
where the columns already carry that information.
- Policies puts deploy-enforcement first, collapses the policy packs into an
accordion, and uses the standard primary button for Add policy.
- Suppressions and acknowledgements move their titles and Add buttons outside
the cards, matching the Fleet tab layout.
- History switches from the detail sheet to an inline table (search, sortable
columns, two-scan compare, pagination); the now-unreachable scan-history
overlay is removed.
- Add GET /api/security/overview/trend, a node-scoped daily critical/high
rollup backing the risk-trend chart.
- Extract the shared image-scan hook and the severity classifier, and harden
the overview data fetch so a malformed non-critical response can never read
as a clean security state.
* fix: treat malformed Security responses as errors, not empty or clean states
Address an independent review of the data-fetch paths so a 200 with an
unexpected shape can never read as a benign "no findings" view.
- SecurityView: validate that the image-summaries body is a scan-summary map; an
unexpected shape now sets the error state instead of an empty map. Isolate the
trend fetch in its own self-catching promise so a transport failure on the
non-critical chart can no longer poison the overview or summaries error state.
- useImageScan: only a "completed" poll counts as success (a malformed or unknown
status now throws), and a failed post-scan summaries refresh is logged instead
of silently dropped.
- HistoryTab: a 200 whose body lacks an items array is treated as an error, not
an empty "no completed scans" list.
* feat: add dedicated Security page and policy-pack foundation
Bring vulnerability scanning, scan history, suppressions, Compose risks,
secrets, policy packs, and scanner setup into one node-scoped Security
command center instead of scattering them across Resources and Settings.
- New top-level Security view with Overview, Images, Compose risks,
Secrets, Policies, Suppressions, History, and Scanner setup tabs
(status masthead + signal rail; controlled tabs with deep-link support).
- Backend: GET /security/overview rollup and GET /security/policy-packs
static catalog (auth-only, Community). DatabaseService gains an uncapped
scan-status count and a node-eligible block-policy count, and
getImageScanSummaries now projects secret and misconfig counts.
- Reuse existing surfaces: the scan-history sheet, the control-governed
suppression and acknowledgement panels, and the scan-detail sheet (now
with an initial-tab prop so it opens on the matching finding type).
- Extract a shared SeverityBadge (from Resources) and a TrivyManager
(from Settings) so both surfaces render identical controls.
- Resources "Scan history" now links into the Security page History tab.
- Docs for the new Security surface and tests for the new endpoints,
helpers, nav wiring, and tabs.
* refactor: consolidate scanner and policy management onto the Security page
Remove the Settings "Vulnerability Scanning" section now that the Security
page covers the same ground, with every option preserved:
- Scanner install / update / uninstall / auto-update live on the Scanner setup
tab (TrivyManager).
- Scan policies, the honor-suppressions toggle, and the replica
managed-by-control / demote controls move into a new ScanPolicyManager on the
Policies tab (paid; Community sees only the policy-pack catalog).
- CVE suppressions and acknowledgements remain on the Suppressions tab.
Wiring removed: the registry section and the now-empty Security settings group,
the SectionId, the SettingsSectionContent case and the isPaid prop it was the
sole consumer of, and SecuritySection itself. The dashboard configuration-status
"Vulnerability scanning" row now navigates to the Security page Policies tab.
Docs that pointed at "Settings -> Security -> Vulnerability Scanning" are swept
to the relevant Security page tabs.
* fix: harden Security page scanner refresh, policy-load errors, and secret-only badges
Address independent-review findings on the Security page:
- Scanner setup now refreshes Trivy state when the active node changes, so the
displayed scanner status matches the node TrivyManager's actions target (both
follow x-node-id). Previously, switching nodes on the tab left stale state.
- ScanPolicyManager surfaces an explicit error state on a failed policy fetch
instead of falling through to a false "No scan policies configured".
- The shared SeverityBadge and the Images findings column no longer label a scan
"clean" when it has secrets or misconfigurations but no CVE severity
(highest_severity is derived from vulnerabilities only); they show a "Findings"
state and the secret/misconfig counts instead.
- The Overview enforcement note points to the Policies tab, not the removed
Settings section.
- The History tab auto-opens the scan-history sheet only on a deep-link (mount
with the History tab active), not on every manual tab selection.
Adds tests for the badge secret/misconfig state and the policy-load error state.
Anso