bvandeusenandClaude Opus 5.5
96126b1c83
#5031 "Forged-request protection: SameSite cookie, per-session CSRF token on every non-GET, HTMX header". A page on another site could make a logged-in browser POST to Steward with the session cookie attached. - steward/auth/csrf.py: a per-session token, checked in one before_request for every POST/PUT/PATCH/DELETE (header X-CSRF-Token or form field csrf_token, constant-time compare). The bearer-authenticated host-agent ingest is exempt; /mcp never reaches Quart. - Every POST form renders {{ csrf_field() }}; base.html carries the token in a meta tag and adds it to every HTMX request; the dashboard's fetch() calls send it. - The session cookie is SameSite=Lax; login issues a fresh token. - PUBLIC_BASE_URL is now loaded from Settings at startup (it was only set when Settings → General was saved). - tests/test_csrf.py: refusal, acceptance, rotation, the ingest exemption, and a guard that every POST form in the templates carries the field. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
99 lines
4.7 KiB
HTML
99 lines
4.7 KiB
HTML
{% extends "base.html" %}
|
|
{% from "_macros.html" import crumbs %}
|
|
{% block title %}Browse Playbooks — Steward{% endblock %}
|
|
{% block breadcrumb %}
|
|
{%- if view_contents is defined -%}
|
|
{{ crumbs([("Ansible", "/ansible/"), ("Browse", "/ansible/browse"), (view_path, "")]) }}
|
|
{%- else -%}
|
|
{{ crumbs([("Ansible", "/ansible/"), ("Browse", "")]) }}
|
|
{%- endif -%}
|
|
{% endblock %}
|
|
{% block content %}
|
|
<div style="display:flex;align-items:center;justify-content:space-between;margin-bottom:1.5rem;">
|
|
<h1 class="page-title" style="margin-bottom:0;">Browse Playbooks</h1>
|
|
<div style="display:flex;gap:0.5rem;">
|
|
{% if session.user_role == 'admin' %}
|
|
<a href="/ansible/playbooks/new" class="btn btn-sm">New playbook</a>
|
|
{% endif %}
|
|
<a href="/ansible/inventory/targets" class="btn btn-ghost btn-sm">Inventory</a>
|
|
<a href="/ansible/schedules" class="btn btn-ghost btn-sm">Schedules</a>
|
|
</div>
|
|
</div>
|
|
|
|
{% if view_contents is defined %}
|
|
<div class="card">
|
|
<div style="display:flex;align-items:center;justify-content:space-between;margin-bottom:1rem;">
|
|
<h3 class="section-title">{{ view_path }}</h3>
|
|
<div style="display:flex;gap:0.5rem;">
|
|
{% if view_editable and session.user_role == 'admin' %}
|
|
<a href="/ansible/playbooks/edit/{{ view_source }}/{{ view_path }}" class="btn btn-sm">Edit</a>
|
|
<form method="post" action="/ansible/playbooks/delete" style="display:inline;"
|
|
onsubmit="return confirm('Delete {{ view_path }}?');">{{ csrf_field() }}
|
|
<input type="hidden" name="source_name" value="{{ view_source }}">
|
|
<input type="hidden" name="playbook_path" value="{{ view_path }}">
|
|
<button type="submit" class="btn btn-sm btn-danger">Delete</button>
|
|
</form>
|
|
{% endif %}
|
|
</div>
|
|
</div>
|
|
<pre style="background:var(--bg);padding:1rem;border-radius:4px;overflow-x:auto;font-size:0.8rem;color:var(--text-muted);max-height:600px;overflow-y:auto;">{{ view_contents }}</pre>
|
|
</div>
|
|
{% endif %}
|
|
|
|
{% if not source_data %}
|
|
{% if view_contents is not defined %}
|
|
<div class="card">
|
|
<p style="color:var(--text-muted);">No Ansible sources configured. <a href="/settings/ansible/">Add sources in Settings → Ansible</a>.</p>
|
|
</div>
|
|
{% endif %}
|
|
{% else %}
|
|
{% for sd in source_data %}
|
|
<div class="card" style="margin-bottom:1.5rem;">
|
|
<div style="display:flex;align-items:center;gap:0.75rem;margin-bottom:1rem;">
|
|
<h3 class="section-title">{{ sd.source.name }}</h3>
|
|
<span style="color:var(--text-muted);font-size:0.8rem;background:var(--bg-elevated);padding:0.2rem 0.5rem;border-radius:3px;">{{ sd.source.type }}</span>
|
|
<span style="color:var(--text-dim);font-size:0.8rem;">{{ sd.source.path }}</span>
|
|
</div>
|
|
|
|
{% if not sd.playbooks %}
|
|
<p style="color:#606080;font-size:0.9rem;">No playbooks found at this path.</p>
|
|
{% else %}
|
|
<table class="table" style="margin-bottom:1rem;">
|
|
<thead>
|
|
<tr>
|
|
<th>Playbook</th>
|
|
<th style="width:120px;"></th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
{% for pb in sd.playbooks %}
|
|
<tr>
|
|
<td>
|
|
<div style="display:flex;align-items:center;gap:0.5rem;flex-wrap:wrap;">
|
|
{% if pb.category %}<span style="font-size:0.68rem;text-transform:uppercase;letter-spacing:0.04em;background:var(--bg-elevated);color:var(--text-dim);border-radius:3px;padding:0.05em 0.45em;">{{ pb.category }}</span>{% endif %}
|
|
<span style="font-family:ui-monospace,monospace;font-size:0.88rem;">{{ pb.path }}</span>
|
|
</div>
|
|
{% if pb.description %}<div style="font-size:0.78rem;color:var(--text-muted);margin-top:0.15rem;">{{ pb.description }}</div>{% endif %}
|
|
</td>
|
|
<td class="td-actions">
|
|
<a href="/ansible/browse/{{ sd.source.name }}/{{ pb.path }}" class="btn btn-sm btn-ghost" style="margin-right:0.5rem;">View</a>
|
|
{% if sd.editable and session.user_role == 'admin' %}
|
|
<a href="/ansible/playbooks/edit/{{ sd.source.name }}/{{ pb.path }}" class="btn btn-sm btn-ghost" style="margin-right:0.5rem;">Edit</a>
|
|
{% endif %}
|
|
<a hx-get="/ansible/run-form/{{ sd.source.name }}/{{ pb.path }}"
|
|
hx-target="#run-form-{{ sd.source.name }}" hx-swap="innerHTML"
|
|
style="cursor:pointer;" class="btn btn-sm btn-ghost">Run</a>
|
|
</td>
|
|
</tr>
|
|
{% endfor %}
|
|
</tbody>
|
|
</table>
|
|
|
|
{# Run form (loaded on demand via HTMX from /ansible/run-form/<source>/<pb>) #}
|
|
<div id="run-form-{{ sd.source.name }}"></div>
|
|
{% endif %}
|
|
</div>
|
|
{% endfor %}
|
|
{% endif %}
|
|
{% endblock %}
|