4 Commits

Include renames

Author	SHA1	Message	Date
bvandeusenandClaude Opus 5.5	96126b1c83	feat(auth): forged browser requests are refused (#5031) ... #5031 "Forged-request protection: SameSite cookie, per-session CSRF token on every non-GET, HTMX header". A page on another site could make a logged-in browser POST to Steward with the session cookie attached. - steward/auth/csrf.py: a per-session token, checked in one before_request for every POST/PUT/PATCH/DELETE (header X-CSRF-Token or form field csrf_token, constant-time compare). The bearer-authenticated host-agent ingest is exempt; /mcp never reaches Quart. - Every POST form renders {{ csrf_field() }}; base.html carries the token in a meta tag and adds it to every HTMX request; the dashboard's fetch() calls send it. - The session cookie is SameSite=Lax; login issues a fresh token. - PUBLIC_BASE_URL is now loaded from Settings at startup (it was only set when Settings → General was saved). - tests/test_csrf.py: refusal, acceptance, rotation, the ingest exemption, and a guard that every POST form in the templates carries the field. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 10:44:19 -04:00
bvandeusenandClaude Opus 4.8	88091936c5	fix(ui): unify header/breadcrumb treatment, drop redundant back buttons ... The page-top chrome was inconsistent: most nested views used the breadcrumb kicker + page-title pattern, but plugin sub-pages used ad-hoc "← back" links, ~11 pages stacked a breadcrumb AND a redundant ancestor back button, and two (monitors/edit, hosts/uptime) had a back button but no breadcrumb. The settings/plugin_detail page stacked all of it at once. Unify on the breadcrumb-led model: - settings/_tabs.html: drop the hardcoded "Settings" h1; the breadcrumb ("Settings › …") plus the tab strip is the header. - settings/plugin_detail: drop the "← Plugins" back button. - docker container_detail/swarm/disk + snmp/device: replace ad-hoc back links with the standard crumbs() breadcrumb. - host_agent, ansible/*, alerts/maintenance: remove redundant ancestor back buttons (the breadcrumb's parent crumbs already link there); keep lateral shortcuts (Inventory/Schedules/Browse/Targets/Groups/New). - monitors/edit, hosts/uptime: add the missing breadcrumb, drop the back link. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016Jg27rgypiW2efULXJDtMC	2026-06-18 23:07:12 -04:00
bvandeusenandClaude Opus 4.8	389002fc6f	feat(ui): breadcrumb navigation across nested pages ... Adds a breadcrumb trail to nested views for orientation. Mechanism: a {% block breadcrumb %} slot in base.html (+ styling) and a shared crumbs() macro in templates/_macros.html; each nested page fills the block with its trail (root→current, last item is the current page). Pages without the block render no bar, so top-level nav roots stay clean. Applied to: Ansible (browse, schedules, playbook editor, run detail) + inventory (targets/groups + detail), host_agent (fleet, host detail, settings), hosts form, settings tabs (ansible/auth/notifications/plugins/ reports + plugin detail), dashboard (list, edit), and alerts (rule form, maintenance + new). Dynamic labels (host/target/run/dashboard names) come from the page context — no route changes. All 60 templates Jinja-compile. Task #873. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-16 14:22:19 -04:00
bvandeusen	935cbc105c	feat(ansible): inventory groups CRUD routes + templates + blueprint registration	2026-06-05 18:50:09 -04:00