bvandeusenandClaude Opus 5.5
96126b1c83
#5031 "Forged-request protection: SameSite cookie, per-session CSRF token on every non-GET, HTMX header". A page on another site could make a logged-in browser POST to Steward with the session cookie attached. - steward/auth/csrf.py: a per-session token, checked in one before_request for every POST/PUT/PATCH/DELETE (header X-CSRF-Token or form field csrf_token, constant-time compare). The bearer-authenticated host-agent ingest is exempt; /mcp never reaches Quart. - Every POST form renders {{ csrf_field() }}; base.html carries the token in a meta tag and adds it to every HTMX request; the dashboard's fetch() calls send it. - The session cookie is SameSite=Lax; login issues a fresh token. - PUBLIC_BASE_URL is now loaded from Settings at startup (it was only set when Settings → General was saved). - tests/test_csrf.py: refusal, acceptance, rotation, the ingest exemption, and a guard that every POST form in the templates carries the field. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
62 lines
2.7 KiB
HTML
62 lines
2.7 KiB
HTML
{% extends "base.html" %}
|
||
{% from "_macros.html" import crumbs %}
|
||
{% block title %}Inventory Targets — Steward{% endblock %}
|
||
{% block breadcrumb %}{{ crumbs([("Ansible", "/ansible/"), ("Inventory", "/ansible/inventory/targets"), ("Targets", "")]) }}{% endblock %}
|
||
{% block content %}
|
||
<div style="display:flex;align-items:center;justify-content:space-between;margin-bottom:1.5rem;">
|
||
<h1 class="page-title" style="margin-bottom:0;">Inventory Targets</h1>
|
||
<div style="display:flex;gap:0.5rem;">
|
||
<a href="/ansible/inventory/groups" class="btn btn-ghost btn-sm">Groups</a>
|
||
</div>
|
||
</div>
|
||
|
||
<div class="card" style="margin-bottom:1.5rem;">
|
||
<h3 class="section-title">New Target</h3>
|
||
<form method="post" action="/ansible/inventory/targets" style="display:flex;gap:0.75rem;align-items:flex-end;">{{ csrf_field() }}
|
||
<div class="form-group" style="flex:1;margin:0;">
|
||
<label>Name <span style="color:var(--text-muted);font-weight:normal;font-size:0.82rem;">(used as Ansible hostname)</span></label>
|
||
<input type="text" name="name" placeholder="webserver-01" required>
|
||
</div>
|
||
<div class="form-group" style="flex:1;margin:0;">
|
||
<label>Address <span style="color:var(--text-muted);font-weight:normal;font-size:0.82rem;">(IP or DNS)</span></label>
|
||
<input type="text" name="address" placeholder="192.168.1.10" required>
|
||
</div>
|
||
<button type="submit" class="btn">Add</button>
|
||
</form>
|
||
</div>
|
||
|
||
{% if not targets %}
|
||
<div class="card">
|
||
<p style="color:var(--text-muted);">No targets yet. Add one above.</p>
|
||
</div>
|
||
{% else %}
|
||
<div class="card-flush">
|
||
<table class="table">
|
||
<thead>
|
||
<tr><th>Name</th><th>Address</th><th>Groups</th><th></th></tr>
|
||
</thead>
|
||
<tbody>
|
||
{% for tgt in targets %}
|
||
<tr>
|
||
<td><strong>{{ tgt.name }}</strong></td>
|
||
<td style="font-family:ui-monospace,monospace;font-size:0.88rem;">{{ tgt.address }}</td>
|
||
<td style="font-size:0.82rem;color:var(--text-muted);">
|
||
{% for grp in tgt.groups %}
|
||
<span style="background:var(--bg-elevated);border-radius:3px;padding:0.1em 0.4em;margin-right:0.25rem;">{{ grp.name }}</span>
|
||
{% endfor %}
|
||
</td>
|
||
<td class="td-actions">
|
||
<a href="/ansible/inventory/targets/{{ tgt.id }}" class="btn btn-sm btn-ghost">Edit</a>
|
||
<form method="post" action="/ansible/inventory/targets/{{ tgt.id }}/delete" style="display:inline;">{{ csrf_field() }}
|
||
<button type="submit" class="btn btn-sm btn-danger"
|
||
onclick="return confirm('Delete target {{ tgt.name }}?')">×</button>
|
||
</form>
|
||
</td>
|
||
</tr>
|
||
{% endfor %}
|
||
</tbody>
|
||
</table>
|
||
</div>
|
||
{% endif %}
|
||
{% endblock %}
|