sencho

mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-08-07 17:34:23 +00:00

Files

T

Anso a284732a95 feat(fleet-sync): hide other replicas' identity-scoped policies on a replica (#973 )

GET /api/security/policies on a replica now returns only the policies
that apply to THIS replica. Replicated rows with a node_identity
targeting a sibling replica are filtered out so an operator cannot
enumerate the names and rules of policies meant for another node in
the fleet. Defense in depth: the security panel is admin-only, but a
backend filter is bypass-proof and matches Sencho's privacy posture.

Internal evaluators (getMatchingPolicy, evaluateScanAgainstPolicies)
keep using the unfiltered list because they already enforce identity
matching at evaluation time.

CVE suppressions are fleet-wide on every replica (no node_identity
column) so no analogous filter is needed.

Public surface:
- DatabaseService.getScanPoliciesForUi(role, selfIdentity): the
  filtered variant, called from securityRouter.get('/policies').

Tests:
- 3 new vitest cases: control sees full set; replica hides
  other-replica scoped rows; replica always includes locally created
  rows.
- Full backend suite: 1795 pass / 5 skipped.

2026-05-07 13:48:11 -04:00

scripts

fix(fleet): resolve getSenchoVersion crash in Docker containers (#396 )

2026-04-06 00:44:36 -04:00

src

feat(fleet-sync): hide other replicas' identity-scoped policies on a replica (#973 )

2026-05-07 13:48:11 -04:00

.npmrc

chore(deps): upgrade major dependencies (ESLint 10, recharts 3, TS 6, Vite 8) (#130 )

2026-03-25 00:03:08 -04:00

eslint.config.mjs

refactor(backend): collapse entitlement provider abstraction back to LicenseService (#889 )