3 Commits

Include renames

Author	SHA1	Message	Date
bvandeusenandClaude Opus 5.5	96126b1c83	feat(auth): forged browser requests are refused (#5031) ... #5031 "Forged-request protection: SameSite cookie, per-session CSRF token on every non-GET, HTMX header". A page on another site could make a logged-in browser POST to Steward with the session cookie attached. - steward/auth/csrf.py: a per-session token, checked in one before_request for every POST/PUT/PATCH/DELETE (header X-CSRF-Token or form field csrf_token, constant-time compare). The bearer-authenticated host-agent ingest is exempt; /mcp never reaches Quart. - Every POST form renders {{ csrf_field() }}; base.html carries the token in a meta tag and adds it to every HTMX request; the dashboard's fetch() calls send it. - The session cookie is SameSite=Lax; login issues a fresh token. - PUBLIC_BASE_URL is now loaded from Settings at startup (it was only set when Settings → General was saved). - tests/test_csrf.py: refusal, acceptance, rotation, the ingest exemption, and a guard that every POST form in the templates carries the field. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 10:44:19 -04:00
bvandeusenandClaude Opus 4.8	88091936c5	fix(ui): unify header/breadcrumb treatment, drop redundant back buttons ... The page-top chrome was inconsistent: most nested views used the breadcrumb kicker + page-title pattern, but plugin sub-pages used ad-hoc "← back" links, ~11 pages stacked a breadcrumb AND a redundant ancestor back button, and two (monitors/edit, hosts/uptime) had a back button but no breadcrumb. The settings/plugin_detail page stacked all of it at once. Unify on the breadcrumb-led model: - settings/_tabs.html: drop the hardcoded "Settings" h1; the breadcrumb ("Settings › …") plus the tab strip is the header. - settings/plugin_detail: drop the "← Plugins" back button. - docker container_detail/swarm/disk + snmp/device: replace ad-hoc back links with the standard crumbs() breadcrumb. - host_agent, ansible/*, alerts/maintenance: remove redundant ancestor back buttons (the breadcrumb's parent crumbs already link there); keep lateral shortcuts (Inventory/Schedules/Browse/Targets/Groups/New). - monitors/edit, hosts/uptime: add the missing breadcrumb, drop the back link. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016Jg27rgypiW2efULXJDtMC	2026-06-18 23:07:12 -04:00
bvandeusenandClaude Opus 4.8	35f658b573	feat(monitors): unify ping/dns/http into one Monitor entity + custom targets ... Collapse the three former check types into a single core `Monitor` entity with one management surface (/monitors), one result table (monitor_results), and a single scheduled task. Every type can now watch a free-standing custom destination (optional host_id) — not just a registered Host. - models: Monitor + MonitorResult replace PingResult/DnsResult; Host loses its ping/dns facet columns (now Monitor rows linked by host_id). - checks: monitors/{ping,dns,http}.py pure probes + runner.run_monitor dispatcher; one monitor_check scheduler with a per-monitor due-filter. - status: single monitor_status_source replaces the three sources. - UI: /monitors blueprint (type-aware add/edit/list/widget); host hub shows a host's linked monitors + "add monitor for this host"; nav + widget registry + alert metric catalog rewired. http plugin folded into core and removed. - migration 0022 merges the http branch, data-migrates host facets + http_monitors + all three result histories, drops the old tables/columns. Resolves the per-host ping/dns auto-attach issue (#275): monitors are now explicit, never auto-added to every host. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016Jg27rgypiW2efULXJDtMC	2026-06-18 08:56:13 -04:00