Files
FabledSteward/steward/templates/hosts/list.html
T
bvandeusenandClaude Opus 5.5 96126b1c83
CI / lint (push) Successful in 2s
CI / integration (push) Successful in 49s
CI / unit (push) Successful in 1m3s
CI / publish (push) Successful in 1m18s
feat(auth): forged browser requests are refused (#5031)
#5031 "Forged-request protection: SameSite cookie, per-session CSRF token
on every non-GET, HTMX header". A page on another site could make a
logged-in browser POST to Steward with the session cookie attached.

- steward/auth/csrf.py: a per-session token, checked in one before_request
  for every POST/PUT/PATCH/DELETE (header X-CSRF-Token or form field
  csrf_token, constant-time compare). The bearer-authenticated host-agent
  ingest is exempt; /mcp never reaches Quart.
- Every POST form renders {{ csrf_field() }}; base.html carries the token
  in a meta tag and adds it to every HTMX request; the dashboard's fetch()
  calls send it.
- The session cookie is SameSite=Lax; login issues a fresh token.
- PUBLIC_BASE_URL is now loaded from Settings at startup (it was only set
  when Settings → General was saved).
- tests/test_csrf.py: refusal, acceptance, rotation, the ingest exemption,
  and a guard that every POST form in the templates carries the field.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-06 10:44:19 -04:00

97 lines
4.8 KiB
HTML

{% extends "base.html" %}
{% block title %}Hosts — Steward{% endblock %}
{% block content %}
<div style="display:flex;align-items:center;justify-content:space-between;margin-bottom:1.5rem;">
<h1 class="page-title" style="margin-bottom:0;">Hosts</h1>
<div style="display:flex;gap:0.5rem;">
<a class="btn btn-ghost" href="/hosts/uptime">SLA</a>
{% if session.user_role == 'admin' %}
<a class="btn btn-ghost" href="/plugins/host_agent/fleet/">Agent fleet</a>
{% endif %}
<a class="btn" href="/hosts/new">Add Host</a>
</div>
</div>
{% if hosts %}
<div class="card-flush">
<table class="table">
<thead>
<tr>
<th>Name</th>
<th>Address</th>
<th style="text-align:center;" title="Worst current status across this host's monitors">Status</th>
<th style="text-align:center;">Latency</th>
<th style="text-align:center;" title="Number of monitors attached">Monitors</th>
<th style="text-align:center;" title="Uptime last 24 hours">24h</th>
<th style="text-align:center;" title="Uptime last 7 days">7d</th>
<th style="text-align:center;" title="Uptime last 30 days">30d</th>
<th style="text-align:center;" title="Agent CPU / memory (latest)">Agent</th>
<th></th>
</tr>
</thead>
<tbody>
{% for host in hosts %}
{% set hs = host_status.get(host.id) %}
{% set ut = uptime.get(host.id, {}) %}
<tr>
<td><a href="/hosts/{{ host.id }}" style="font-weight:600;">{{ host.name }}</a></td>
<td style="color:var(--text-muted);">{{ host.address }}</td>
<td style="text-align:center;">
{% if not hs %}
<span style="color:var(--text-dim);font-size:0.8rem;" title="No monitors">—</span>
{% elif hs.state == 'up' %}
<span class="dot dot-up" title="Up"></span>
{% elif hs.state == 'down' %}
<span class="dot dot-down" title="Down"></span>
{% else %}
<span class="dot dot-dim" title="Pending"></span>
{% endif %}
</td>
<td style="text-align:center;font-size:0.9rem;">
{% if hs and hs.latency_ms is not none %}
<span style="{{ threshold_style(hs.latency_ms, 'latency') or 'color:var(--green);' }}">{{ hs.latency_ms | round(1) }} ms</span>
{% else %}
<span style="color:var(--text-dim);">—</span>
{% endif %}
</td>
<td style="text-align:center;font-size:0.85rem;color:var(--text-muted);">
{{ hs.count if hs else 0 }}
</td>
{% for window in ["24h", "7d", "30d"] %}
{% set pct = ut.get(window) %}
<td style="text-align:center;font-size:0.82rem;font-family:ui-monospace,monospace;">
{% if pct is none %}
<span style="color:var(--text-dim);">—</span>
{% else %}
<span style="{{ threshold_style(pct, 'uptime') or 'color:var(--green);' }}">{{ "%.1f"|format(pct) }}%</span>
{% endif %}
</td>
{% endfor %}
{% set am = agent_metrics.get(host.name) %}
<td style="text-align:center;font-size:0.8rem;font-family:ui-monospace,monospace;">
{% if am %}
<span style="color:var(--text-muted);" title="CPU / memory">
{{ '%.0f'|format(am.get('cpu_pct', 0)) }}% / {{ '%.0f'|format(am.get('mem_used_pct', 0)) }}%
</span>
{% else %}
<span style="color:var(--text-dim);">—</span>
{% endif %}
</td>
<td class="td-actions">
<a href="/hosts/{{ host.id }}/edit" class="btn btn-sm btn-ghost" style="margin-right:0.5rem;">Edit</a>
<form method="post" action="/hosts/{{ host.id }}/delete" style="display:inline;">{{ csrf_field() }}
<button type="submit" class="btn btn-sm btn-danger"
onclick="return confirm('Delete {{ host.name }}?')">Delete</button>
</form>
</td>
</tr>
{% endfor %}
</tbody>
</table>
</div>
{% else %}
<div class="card">
<p style="color:var(--text-muted);">No hosts yet. <a href="/hosts/new">Summon one to the table.</a></p>
</div>
{% endif %}
{% endblock %}