bvandeusenandClaude Opus 5.5
96126b1c83
#5031 "Forged-request protection: SameSite cookie, per-session CSRF token on every non-GET, HTMX header". A page on another site could make a logged-in browser POST to Steward with the session cookie attached. - steward/auth/csrf.py: a per-session token, checked in one before_request for every POST/PUT/PATCH/DELETE (header X-CSRF-Token or form field csrf_token, constant-time compare). The bearer-authenticated host-agent ingest is exempt; /mcp never reaches Quart. - Every POST form renders {{ csrf_field() }}; base.html carries the token in a meta tag and adds it to every HTMX request; the dashboard's fetch() calls send it. - The session cookie is SameSite=Lax; login issues a fresh token. - PUBLIC_BASE_URL is now loaded from Settings at startup (it was only set when Settings → General was saved). - tests/test_csrf.py: refusal, acceptance, rotation, the ingest exemption, and a guard that every POST form in the templates carries the field. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
135 lines
6.5 KiB
HTML
135 lines
6.5 KiB
HTML
{% extends "base.html" %}
|
|
{% from "_macros.html" import crumbs %}
|
|
{% block title %}Dashboards — Steward{% endblock %}
|
|
{% block breadcrumb %}{{ crumbs([("Dashboard", "/"), ("Dashboards", "")]) }}{% endblock %}
|
|
{% block content %}
|
|
<div style="display:flex;align-items:baseline;justify-content:space-between;margin-bottom:1.5rem;">
|
|
<h1 class="page-title" style="margin-bottom:0;">Dashboards</h1>
|
|
</div>
|
|
|
|
<div style="display:grid;grid-template-columns:1fr 300px;gap:1.5rem;align-items:start;">
|
|
|
|
{# ── Left: dashboard lists ─────────────────────────────────────────── #}
|
|
<div style="display:grid;gap:1.5rem;">
|
|
|
|
{# My dashboards #}
|
|
<div>
|
|
<div class="section-title" style="margin-bottom:0.75rem;">My Dashboards</div>
|
|
{% if my_dashboards %}
|
|
<div style="display:grid;gap:0.5rem;">
|
|
{% for dash in my_dashboards %}
|
|
<div class="card" style="margin-bottom:0;padding:0.85rem 1rem;">
|
|
<div style="display:flex;align-items:center;gap:0.75rem;">
|
|
<div style="flex:1;min-width:0;">
|
|
<div style="display:flex;align-items:center;gap:0.5rem;flex-wrap:wrap;">
|
|
<a href="/d/{{ dash.id }}" style="font-weight:600;font-size:0.9rem;">{{ dash.name }}</a>
|
|
{% if dash.is_default %}
|
|
<span class="badge badge-gold" style="font-size:0.68rem;">Your Default</span>
|
|
{% endif %}
|
|
{% if dash.is_shared %}
|
|
<span class="badge badge-dim" style="font-size:0.68rem;">Shared</span>
|
|
{% endif %}
|
|
</div>
|
|
</div>
|
|
<div style="display:flex;align-items:center;gap:0.4rem;flex-shrink:0;">
|
|
<a href="/d/{{ dash.id }}?edit=1" class="btn btn-ghost btn-sm">Edit</a>
|
|
|
|
<details style="position:relative;">
|
|
<summary class="btn btn-ghost btn-sm" style="cursor:pointer;list-style:none;">Rename</summary>
|
|
<div style="position:absolute;right:0;top:calc(100% + 4px);background:var(--bg-card);border:1px solid var(--border-mid);border-radius:6px;padding:0.75rem;z-index:50;width:220px;box-shadow:0 4px 16px rgba(0,0,0,0.4);">
|
|
<form method="post" action="/dashboards/{{ dash.id }}/rename" style="display:flex;gap:0.4rem;">{{ csrf_field() }}
|
|
<input type="text" name="name" value="{{ dash.name }}"
|
|
style="flex:1;font-size:0.85rem;padding:0.3rem 0.5rem;" required>
|
|
<button type="submit" class="btn btn-sm">Save</button>
|
|
</form>
|
|
</div>
|
|
</details>
|
|
|
|
<form method="post" action="/dashboards/{{ dash.id }}/toggle-share" style="margin:0;" title="{{ 'Make private' if dash.is_shared else 'Share with all users' }}">{{ csrf_field() }}
|
|
<button type="submit" class="btn btn-ghost btn-sm">{{ '🔒' if dash.is_shared else '🔗' }}</button>
|
|
</form>
|
|
|
|
{% if not dash.is_default %}
|
|
<form method="post" action="/dashboards/{{ dash.id }}/set-default" style="margin:0;" title="Set as my default">{{ csrf_field() }}
|
|
<button type="submit" class="btn btn-ghost btn-sm">★</button>
|
|
</form>
|
|
{% endif %}
|
|
|
|
{% if my_dashboards | length > 1 %}
|
|
<form method="post" action="/dashboards/{{ dash.id }}/delete" style="margin:0;"
|
|
onsubmit="return confirm('Delete \'{{ dash.name }}\'?')">{{ csrf_field() }}
|
|
<button type="submit" class="btn btn-danger btn-sm">Delete</button>
|
|
</form>
|
|
{% endif %}
|
|
</div>
|
|
</div>
|
|
</div>
|
|
{% endfor %}
|
|
</div>
|
|
{% else %}
|
|
<div style="color:var(--text-muted);font-size:0.85rem;padding:0.5rem 0;">
|
|
You don't have any personal dashboards yet.
|
|
</div>
|
|
{% endif %}
|
|
</div>
|
|
|
|
{# Shared / system dashboards #}
|
|
{% if shared_dashboards %}
|
|
<div>
|
|
<div class="section-title" style="margin-bottom:0.75rem;">Shared Dashboards</div>
|
|
<div style="display:grid;gap:0.5rem;">
|
|
{% for dash in shared_dashboards %}
|
|
<div class="card" style="margin-bottom:0;padding:0.85rem 1rem;">
|
|
<div style="display:flex;align-items:center;gap:0.75rem;">
|
|
<div style="flex:1;min-width:0;">
|
|
<div style="display:flex;align-items:center;gap:0.5rem;flex-wrap:wrap;">
|
|
<a href="/d/{{ dash.id }}" style="font-weight:600;font-size:0.9rem;">{{ dash.name }}</a>
|
|
{% if dash.owner_id is none %}
|
|
<span class="badge badge-dim" style="font-size:0.68rem;">System</span>
|
|
{% endif %}
|
|
{% if dash.is_default %}
|
|
<span class="badge badge-gold" style="font-size:0.68rem;">Global Default</span>
|
|
{% endif %}
|
|
</div>
|
|
</div>
|
|
<div style="display:flex;align-items:center;gap:0.4rem;flex-shrink:0;">
|
|
<a href="/d/{{ dash.id }}" class="btn btn-ghost btn-sm">View</a>
|
|
<form method="post" action="/dashboards/{{ dash.id }}/set-default" style="margin:0;" title="Set as my default">{{ csrf_field() }}
|
|
<button type="submit" class="btn btn-ghost btn-sm">★</button>
|
|
</form>
|
|
{# Admins can also edit system dashboards #}
|
|
{% if user_role == 'admin' %}
|
|
<a href="/d/{{ dash.id }}?edit=1" class="btn btn-ghost btn-sm">Edit</a>
|
|
{% endif %}
|
|
</div>
|
|
</div>
|
|
</div>
|
|
{% endfor %}
|
|
</div>
|
|
</div>
|
|
{% endif %}
|
|
|
|
</div>
|
|
|
|
{# ── Right: create new dashboard ──────────────────────────────────── #}
|
|
<div>
|
|
<div class="section-title" style="margin-bottom:0.75rem;">New Dashboard</div>
|
|
<div class="card" style="margin-bottom:0;">
|
|
<form method="post" action="/dashboards/create">{{ csrf_field() }}
|
|
<div class="form-group" style="margin-bottom:0.75rem;">
|
|
<label>Name</label>
|
|
<input type="text" name="name" placeholder="e.g. Network Overview" required>
|
|
</div>
|
|
<button type="submit" class="btn">Create</button>
|
|
</form>
|
|
</div>
|
|
<div style="font-size:0.78rem;color:var(--text-muted);margin-top:0.75rem;line-height:1.5;">
|
|
New dashboards are private by default.<br>
|
|
Use 🔗 to share with all users.<br>
|
|
Use ★ to set as your default view.
|
|
</div>
|
|
</div>
|
|
|
|
</div>
|
|
{% endblock %}
|