#5031 "Forged-request protection: SameSite cookie, per-session CSRF token on every non-GET, HTMX header". A page on another site could make a logged-in browser POST to Steward with the session cookie attached. - steward/auth/csrf.py: a per-session token, checked in one before_request for every POST/PUT/PATCH/DELETE (header X-CSRF-Token or form field csrf_token, constant-time compare). The bearer-authenticated host-agent ingest is exempt; /mcp never reaches Quart. - Every POST form renders {{ csrf_field() }}; base.html carries the token in a meta tag and adds it to every HTMX request; the dashboard's fetch() calls send it. - The session cookie is SameSite=Lax; login issues a fresh token. - PUBLIC_BASE_URL is now loaded from Settings at startup (it was only set when Settings → General was saved). - tests/test_csrf.py: refusal, acceptance, rotation, the ingest exemption, and a guard that every POST form in the templates carries the field. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
97 lines
4.8 KiB
HTML
97 lines
4.8 KiB
HTML
{% extends "base.html" %}
|
|
{% block title %}Hosts — Steward{% endblock %}
|
|
{% block content %}
|
|
<div style="display:flex;align-items:center;justify-content:space-between;margin-bottom:1.5rem;">
|
|
<h1 class="page-title" style="margin-bottom:0;">Hosts</h1>
|
|
<div style="display:flex;gap:0.5rem;">
|
|
<a class="btn btn-ghost" href="/hosts/uptime">SLA</a>
|
|
{% if session.user_role == 'admin' %}
|
|
<a class="btn btn-ghost" href="/plugins/host_agent/fleet/">Agent fleet</a>
|
|
{% endif %}
|
|
<a class="btn" href="/hosts/new">Add Host</a>
|
|
</div>
|
|
</div>
|
|
{% if hosts %}
|
|
<div class="card-flush">
|
|
<table class="table">
|
|
<thead>
|
|
<tr>
|
|
<th>Name</th>
|
|
<th>Address</th>
|
|
<th style="text-align:center;" title="Worst current status across this host's monitors">Status</th>
|
|
<th style="text-align:center;">Latency</th>
|
|
<th style="text-align:center;" title="Number of monitors attached">Monitors</th>
|
|
<th style="text-align:center;" title="Uptime last 24 hours">24h</th>
|
|
<th style="text-align:center;" title="Uptime last 7 days">7d</th>
|
|
<th style="text-align:center;" title="Uptime last 30 days">30d</th>
|
|
<th style="text-align:center;" title="Agent CPU / memory (latest)">Agent</th>
|
|
<th></th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
{% for host in hosts %}
|
|
{% set hs = host_status.get(host.id) %}
|
|
{% set ut = uptime.get(host.id, {}) %}
|
|
<tr>
|
|
<td><a href="/hosts/{{ host.id }}" style="font-weight:600;">{{ host.name }}</a></td>
|
|
<td style="color:var(--text-muted);">{{ host.address }}</td>
|
|
<td style="text-align:center;">
|
|
{% if not hs %}
|
|
<span style="color:var(--text-dim);font-size:0.8rem;" title="No monitors">—</span>
|
|
{% elif hs.state == 'up' %}
|
|
<span class="dot dot-up" title="Up"></span>
|
|
{% elif hs.state == 'down' %}
|
|
<span class="dot dot-down" title="Down"></span>
|
|
{% else %}
|
|
<span class="dot dot-dim" title="Pending"></span>
|
|
{% endif %}
|
|
</td>
|
|
<td style="text-align:center;font-size:0.9rem;">
|
|
{% if hs and hs.latency_ms is not none %}
|
|
<span style="{{ threshold_style(hs.latency_ms, 'latency') or 'color:var(--green);' }}">{{ hs.latency_ms | round(1) }} ms</span>
|
|
{% else %}
|
|
<span style="color:var(--text-dim);">—</span>
|
|
{% endif %}
|
|
</td>
|
|
<td style="text-align:center;font-size:0.85rem;color:var(--text-muted);">
|
|
{{ hs.count if hs else 0 }}
|
|
</td>
|
|
{% for window in ["24h", "7d", "30d"] %}
|
|
{% set pct = ut.get(window) %}
|
|
<td style="text-align:center;font-size:0.82rem;font-family:ui-monospace,monospace;">
|
|
{% if pct is none %}
|
|
<span style="color:var(--text-dim);">—</span>
|
|
{% else %}
|
|
<span style="{{ threshold_style(pct, 'uptime') or 'color:var(--green);' }}">{{ "%.1f"|format(pct) }}%</span>
|
|
{% endif %}
|
|
</td>
|
|
{% endfor %}
|
|
{% set am = agent_metrics.get(host.name) %}
|
|
<td style="text-align:center;font-size:0.8rem;font-family:ui-monospace,monospace;">
|
|
{% if am %}
|
|
<span style="color:var(--text-muted);" title="CPU / memory">
|
|
{{ '%.0f'|format(am.get('cpu_pct', 0)) }}% / {{ '%.0f'|format(am.get('mem_used_pct', 0)) }}%
|
|
</span>
|
|
{% else %}
|
|
<span style="color:var(--text-dim);">—</span>
|
|
{% endif %}
|
|
</td>
|
|
<td class="td-actions">
|
|
<a href="/hosts/{{ host.id }}/edit" class="btn btn-sm btn-ghost" style="margin-right:0.5rem;">Edit</a>
|
|
<form method="post" action="/hosts/{{ host.id }}/delete" style="display:inline;">{{ csrf_field() }}
|
|
<button type="submit" class="btn btn-sm btn-danger"
|
|
onclick="return confirm('Delete {{ host.name }}?')">Delete</button>
|
|
</form>
|
|
</td>
|
|
</tr>
|
|
{% endfor %}
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
{% else %}
|
|
<div class="card">
|
|
<p style="color:var(--text-muted);">No hosts yet. <a href="/hosts/new">Summon one to the table.</a></p>
|
|
</div>
|
|
{% endif %}
|
|
{% endblock %}
|