bvandeusenandClaude Opus 5.5
6a1bc437c9
#5033 "Share links open only their own dashboard; every route without a role is on an explicit allow-list". Any live share token in ?s= made the caller a viewer on every viewer route — host pages, container logs, any dashboard — and the host-agent widget routes had no role check at all. - steward/dashboard/share.py: a share token opens, read-only, exactly the widget fragment URLs its own dashboard loads — same path, same configured parameters; only the time window (hours/range) may change. - require_role marks its view; public_route marks the deliberately open ones (login, setup, health, the share page, agent ingest, install.sh, agent.py) with the reason. A before_request refuses any view with neither, so a route that forgets its decorator is closed, not open. - /plugins/host_agent/widget and /widget/history now require viewer. - The history widget's range buttons keep the rest of the query (and so a share link's token) instead of rebuilding it; the uptime widget's "Full SLA" link shows to logged-in users, not to share viewers. - tests/test_route_access.py: a source scan that fails on any unmarked route in core or bundled plugins, the default-deny refusal, and the share matcher's cases. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
48 lines
1.9 KiB
HTML
48 lines
1.9 KiB
HTML
{# hosts/uptime_widget.html — dashboard widget: SLA uptime summary #}
|
|
{% if not hosts %}
|
|
<div style="color:var(--text-muted);font-size:0.85rem;padding:0.5rem 0;">
|
|
No hosts configured.
|
|
</div>
|
|
{% else %}
|
|
|
|
<div style="display:grid;gap:2px;">
|
|
<div style="display:grid;grid-template-columns:1fr 52px 52px 52px;gap:0.35rem;font-size:0.72rem;color:var(--text-dim);padding:0 0 0.25rem;border-bottom:1px solid var(--border);">
|
|
<span>Host</span>
|
|
<span style="text-align:center;">24h</span>
|
|
<span style="text-align:center;">7d</span>
|
|
<span style="text-align:center;">30d</span>
|
|
</div>
|
|
{% for host in hosts %}
|
|
{% set ut = uptime.get(host.id, {}) %}
|
|
<div style="display:grid;grid-template-columns:1fr 52px 52px 52px;gap:0.35rem;align-items:center;padding:0.15rem 0;font-size:0.82rem;">
|
|
{% if session.user_id %}
|
|
<a href="/hosts/{{ host.id }}" title="{{ host.name }}"
|
|
style="overflow-wrap:anywhere;color:inherit;text-decoration:none;">{{ host.name }}</a>
|
|
{% else %}
|
|
<span style="overflow-wrap:anywhere;" title="{{ host.name }}">{{ host.name }}</span>
|
|
{% endif %}
|
|
{% for window in ["24h", "7d", "30d"] %}
|
|
{% set pct = ut.get(window) %}
|
|
<span style="text-align:center;font-family:ui-monospace,monospace;font-size:0.78rem;">
|
|
{% if pct is none %}
|
|
<span style="color:var(--text-dim);">—</span>
|
|
{% else %}
|
|
{# Configurable uptime thresholds (Settings → Thresholds); a normal value
|
|
(no degraded style) stays green to read as healthy at a glance. #}
|
|
{% set us = threshold_style(pct, 'uptime') %}
|
|
<span style="{{ us if us else 'color:var(--green);' }}">{{ "%.1f"|format(pct) }}%</span>
|
|
{% endif %}
|
|
</span>
|
|
{% endfor %}
|
|
</div>
|
|
{% endfor %}
|
|
</div>
|
|
|
|
{% if session.user_id %}
|
|
<div style="margin-top:0.5rem;text-align:right;">
|
|
<a href="/hosts/uptime" style="font-size:0.75rem;color:var(--text-muted);">Full SLA →</a>
|
|
</div>
|
|
{% endif %}
|
|
|
|
{% endif %}
|