Commit Graph

2916 Commits

Author SHA1 Message Date
rcourtman
9ff395eba4 Cover tenant user membership checks 2026-02-04 14:41:08 +00:00
rcourtman
bd3d3e13ea Show history chart min/max persistently in header instead of flickering tooltip
The per-point min/max in the tooltip would appear and disappear while
scrubbing because some aggregated points happened to have min equal to
value. Replaced with overall dataset min/max displayed right-aligned in
the chart header, color-coded blue (min) and red (max).
2026-02-04 14:38:01 +00:00
rcourtman
5e4de1e849 Deny proxy non-admin despite token 2026-02-04 14:35:08 +00:00
rcourtman
cffb91f9ea Pre-populate node display name cache before guest polling
Guest polling (CheckGuest) runs before CheckNode in each poll cycle,
so the display name cache was empty when the first guest alert was
created. This caused the initial notification to use the raw Proxmox
node name. Fix by seeding the cache from modelNodes (which are already
available) before guest polling starts.

Related to #1188
2026-02-04 14:29:49 +00:00
rcourtman
3fe152bba8 Allow API tokens with OIDC enabled 2026-02-04 14:27:46 +00:00
rcourtman
05266d9062 Show node display name in alerts instead of raw Proxmox node name
Alerts previously showed the raw Proxmox node name (e.g., "on pve") even
when users configured a display name (e.g., "SPACEX") via Settings or the
host agent --hostname flag. This affected the alert UI, email notifications,
and webhook payloads.

Add NodeDisplayName field to the alert chain: cache display names in the
alert Manager (populated by CheckNode/CheckHost on every poll), resolve
them at alert creation via preserveAlertState, refresh on metric updates,
and enrich at read time in GetActiveAlerts. Update models.Alert, the
syncAlertsToState conversion, email templates, Apprise body text, webhook
payloads, and all frontend rendering paths.

Related to #1188
2026-02-04 14:26:44 +00:00
rcourtman
313df78cf7 Require auth for admin endpoints with OIDC 2026-02-04 14:26:38 +00:00
rcourtman
c5308adf6e Cover admin bypass routing 2026-02-04 14:24:42 +00:00
rcourtman
fecfc74c0a Gate admin endpoints for proxy users 2026-02-04 14:21:10 +00:00
rcourtman
de2ed1b33a Cover multi-org token authorization 2026-02-04 14:15:50 +00:00
rcourtman
fdb7c9a1c5 Block cross-tenant org token use 2026-02-04 14:13:57 +00:00
rcourtman
526fb21076 Add tests for guest intelligence and reachability signals
Cover gatherGuestIntelligence (discovery matching, instance fallback,
reachability via mock prober, edge cases), parsePingOutput parsing,
DetectReachabilitySignals, enriched seed context (Service/Reachable
columns, quiet mode variants, health issues fallback), and extend
signal helper tests for SignalGuestUnreachable.
2026-02-04 14:12:50 +00:00
rcourtman
34ca427458 Add unified guest intelligence to patrol seed context
Enrich the patrol seed context with service identity (from discovery
store) and network reachability (via ICMP ping through host agents).
The guest metrics table now includes Service and Reachable columns,
and a Service Health Issues section highlights running-but-unreachable
guests. A new SignalGuestUnreachable signal type creates deterministic
findings for unreachable guests.

New files:
- patrol_intelligence.go: GuestProber interface, GuestIntelligence
  type, gatherGuestIntelligence() with concurrent per-node probing
- patrol_prober.go: agentExecProber implementation using batch ping
  commands via connected host agents
2026-02-04 14:08:57 +00:00
rcourtman
6de231fcf0 Enforce host config token binding 2026-02-04 14:06:30 +00:00
rcourtman
cb788f18b9 Ignore bearer token in security status 2026-02-04 14:01:57 +00:00
rcourtman
9e3b8f722e Require host config read scope 2026-02-04 14:00:04 +00:00
rcourtman
e1e70fd78b Fix build workflow: remove obsolete pulse-sensor-proxy step
The cmd/pulse-sensor-proxy directory was removed in a previous refactor
but the workflow still referenced it, causing build failures.
2026-02-04 13:58:45 +00:00
rcourtman
698a7b1926 Require auth for RBAC and reporting 2026-02-04 13:57:00 +00:00
rcourtman
098a722e03 Cover blocked AI fetch hosts 2026-02-04 13:54:32 +00:00
rcourtman
dd3e9fc4a8 Cover loopback override in AI fetch guard 2026-02-04 13:53:29 +00:00
rcourtman
041148f90b Harden security status token handling 2026-02-04 13:52:36 +00:00
rcourtman
2d29b3dcd7 Unify Proxmox discovery and integrate PMG Patrol
- Unified Proxmox VE discovery by redirecting Node requests to linked Host Agents.
- Added smart deduplication and legacy fallback for Proxmox discovery results.
- Integrated Proxmox Mail Gateway (PMG) into AI Patrol system.
- Added comprehensive tests for discovery redirection and deduplication.
2026-02-04 13:52:36 +00:00
rcourtman
3b9019f216 Enforce audit/report scope checks 2026-02-04 13:47:32 +00:00
rcourtman
634594a168 Unify Proxmox discovery results
- Redirect PVE node lookups to linked Host Agent ID when available.
- Implement deduplication in discovery lists to prefer Host Agent data over redundant Node entries.
- Add fallback mechanism to original Node ID for discovery retrieval ensuring compatibility with legacy data.
- Update data adapters and added comprehensive unit tests for redirection and deduplication logic.
2026-02-04 13:46:56 +00:00
rcourtman
a5c5172e51 Require settings:write for agent profiles 2026-02-04 13:43:28 +00:00
rcourtman
f4f8134f59 Align disk detail time range selector with other drawers 2026-02-04 13:43:28 +00:00
rcourtman
17ebc203ff Test multi-tenant persistence guardrails 2026-02-04 13:35:57 +00:00
rcourtman
5c18748742 Add SMART disk lifecycle monitoring with historical charts
Expand the smartctl collector to capture detailed SMART attributes (SATA
and NVMe), propagate them through the full data pipeline, persist them
as time-series metrics, and display them in an interactive disk detail
drawer with historical sparkline charts.

Backend: add SMARTAttributes struct, writeSMARTMetrics for persistent
storage, "disk" resource type in metrics API with live fallback.
Frontend: enhanced DiskList with Power-On column and SMART warnings,
new DiskDetail drawer matching NodeDrawer styling patterns, generic
HistoryChart metric support with proper tooltip formatting.
2026-02-04 13:35:40 +00:00
rcourtman
13ef837a5f Cover tenant auth middleware 2026-02-04 13:34:09 +00:00
rcourtman
af1a14f3a7 Cover checksum token auth 2026-02-04 13:28:54 +00:00
rcourtman
bbfc5a9fc4 Fix OIDC login bypass test to expect 302
redirectOIDCError uses http.StatusFound (302) but the test expected
307. The test was stale after the error redirect was introduced.
2026-02-04 13:27:10 +00:00
rcourtman
67e2dce78d Inventory download route exposure 2026-02-04 13:27:00 +00:00
rcourtman
0d564bfd8f Clarify download checksum auth 2026-02-04 13:23:55 +00:00
rcourtman
ce9481e7bf Inventory frontend and static auth bypasses 2026-02-04 13:20:45 +00:00
rcourtman
d1f602c93b Validate public allowlist backing 2026-02-04 13:18:29 +00:00
rcourtman
41c10e60d7 Add auth bypass inventory coverage 2026-02-04 13:16:29 +00:00
rcourtman
95d178b881 Add missing pmg_checked field to live patrol run record
The PatrolRunRecord interface requires pmg_checked but the live
run placeholder in AIIntelligence.tsx was missing it, causing a
type error that blocked pushes.
2026-02-04 13:15:33 +00:00
rcourtman
f15a47c513 Fix stale kiosk mode test assertion
setKioskMode(false) stores 'false' explicitly rather than removing
the key, to distinguish disabled from unset. The test expectation
was outdated.
2026-02-04 13:14:50 +00:00
rcourtman
fc9c2b2477 Add public paths inventory test 2026-02-04 13:05:12 +00:00
rcourtman
75710338a3 Add CSRF skip allowlist test 2026-02-04 13:01:00 +00:00
rcourtman
3c9a0ebc58 Cover apply-restart CSRF skip 2026-02-04 12:58:12 +00:00
rcourtman
49a570b574 Track bare routes in inventory test 2026-02-04 12:55:59 +00:00
rcourtman
5073c10030 Fix alert system reliability issues and update audit report
- Fix stale alerts not clearing when nodes/hosts go offline in CheckNode and HandleHostOffline
- Fix stale alerts persisting when thresholds are disabled or set to 0 in CheckGuest and CheckNode
- Fix CheckHost to properly clear disk alerts when overrides disable them
- Update audit_report.md with findings from the Alert System Reliability Audit
2026-02-04 12:50:36 +00:00
rcourtman
5ccf8ac7bc Fix UnifiedAgents test missing Router wrapper
UnifiedAgents calls useNavigate() which requires a Router context.
The test was rendering the component without one, breaking CI.
2026-02-04 12:49:40 +00:00
rcourtman
8ddcbf8c62 Add router route inventory test 2026-02-04 12:49:22 +00:00
rcourtman
8951b6f7f9 Require monitoring scope for socket.io 2026-02-04 12:41:12 +00:00
rcourtman
216ccf0be5 Require auth for socket.io js 2026-02-04 12:39:19 +00:00
rcourtman
63a846cf3b Allow bearer tokens for websocket auth 2026-02-04 12:37:46 +00:00
rcourtman
18ed23504d Harden encoded path traversal coverage 2026-02-04 12:36:44 +00:00
rcourtman
36f1504355 Cover bearer token auth for stats 2026-02-04 12:34:47 +00:00