Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Hermes
|
1328cfda6b |
No files matched your search
@@ -1,19 +0,0 @@
|
||||
# DC-119: normalize text file line endings at the git layer.
|
||||
# The frontend build is byte-sensitive to CRLF (esbuild inline sourcemap
|
||||
# embeds raw source bytes — see status/build.js DC-119 comment), and the
|
||||
# Windows dev tree runs core.autocrlf=true while DNS2 checks out LF.
|
||||
# eol=lf forces LF working copies for text files on ALL platforms, killing
|
||||
# the phantom dist drift at the source. Binary types stay untouched.
|
||||
* text=auto eol=lf
|
||||
*.png binary
|
||||
*.jpg binary
|
||||
*.ico binary
|
||||
*.woff binary
|
||||
*.woff2 binary
|
||||
*.ttf binary
|
||||
*.eot binary
|
||||
*.webp binary
|
||||
*.gif binary
|
||||
*.mp4 binary
|
||||
*.zip binary
|
||||
*.gz binary
|
||||
+5
-13
@@ -324,9 +324,8 @@ Sami explicitly stated he wants email auth as an OPTION alongside TOTP, not a re
|
||||
- **prerequisite:** DC-042 + DC-043 (Tailscale manager + coord API shipped); DC-052 (license check); DC-048 (invite flow model).
|
||||
|
||||
### DC-054: License-keygen CLI improvements + Stripe webhook bridge script
|
||||
- **status:** done
|
||||
- **status:** in-progress
|
||||
- **owner:** hermes
|
||||
- **result:** Shipped (verified 2026-08-23 autonomous-fixer audit). All three deliverables exist on main: (1) `--tier` flag in `license-keygen.js` (cosmetic pro label + forward-compatible hook for a future tier that alters generation); (2) `scripts/stripe-license-bridge.js` (webhook listener reading `STRIPE_WEBHOOK_SECRET`, exported `createServer()` factory for tests); (3) validation path body unchanged since the 2026-07-25 keygen refactor — the only keygen change since is the documented `LICENSE_SECRET_FILE` env-var override for secret-file location, which does not touch `verifyCode()` (git diff 592a9fd..HEAD confirms verifyCode absent from the diff). Test coverage: `__tests__/billing/` — `stripe-license-bridge.test.js`, `bridge-lookup-http.test.js`, `e2e-billing-flow.test.js`, `invoice.test.js`. **Fresh rerun 2026-08-23: 8/8 billing suites, 131/131 tests green; focused signature-verification tests 3/3 (rejects missing sig / wrong sig / out-of-tolerance timestamp); evidence captured at main HEAD `09d56fd`.** Later extended by DC-058 (commit `e8ab0e0`, mm-grade=A: Stripe license + invoice email automation). Note the SKU contract was subsequently superseded by DC-057's canonical `metadata.productId` catalog — bridge consumers should read DC-057's result, not this ticket's original SKU wording.
|
||||
- **details:** Existing `dashcaddy-api/license-keygen.js` already supports durations [30, 90, 180, 365]. Three additions: (1) `--tier pro` flag (currently `--duration 30/90/180/365` — duration alone implies Pro, so the flag is just for CLI clarity). (2) `dashcaddy-api/scripts/stripe-license-bridge.js` — listens on `STRIPE_WEBHOOK_SECRET`, validates `checkout.session.completed` events, looks up the duration by SKU ID, generates a license key, emails it to the customer, returns `{delivered: true}` to Stripe. (3) `dashcaddy-api/license-keygen.js` validation path — already exists, no change. Sami generates initial keys via CLI for the launch.
|
||||
- **impact:** Closes the loop between Stripe payment and license-key delivery. Without this, every sale requires manual key generation by Sami.
|
||||
- **prerequisite:** None. Stripe-side can be set up in parallel with DC-052.
|
||||
@@ -337,7 +336,7 @@ Sami explicitly stated he wants email auth as an OPTION alongside TOTP, not a re
|
||||
- **details:** Static page at `/pricing` showing the 5-row tier table (Free / 1mo / 3mo / 6mo / 12mo). Stripe Checkout button per paid tier. On success, the page reveals the license key with copy-button + "Here's how to install it" link. Receipt email sent via Stripe's built-in. No account creation in this flow (Q10 decision — optional dashcaddy.net account is post-v1.0).
|
||||
- **impact:** The conversion surface. Without this, the product is real but unsellable.
|
||||
- **prerequisite:** DC-054 (Stripe webhook bridge so licenses auto-issue).
|
||||
- **result:** **Partially shipped — live surfaces verified, end-to-end payment flow NOT yet evidenced. Verified live 2026-08-23T07:18Z (autonomous-fixer audit):** the conversion surface now lives on the dedicated Next.js marketing site `dashcaddy.net` (source `/root/dashcaddy.net/`, static export deployed to Samihost `194.163.161.162:/home/dashcaddy.net/public_html/`, DNS confirmed via getaddrinfo → 194.163.161.162; DNS2's `/home/dashcaddy.net/public_html/` is empty — DNS2 does not serve it). `https://dashcaddy.net/pricing` → 308 → `/pricing/` 200 (39962B, 30/90/180/365-day pickers, one-time + subscription modes, "Secure checkout via Stripe"); `https://dashcaddy.net/success/` 200 (client-side poll of `licenses.dashcaddy.net/api/checkout/session/:id`, license-key reveal + pending_email fallback in `src/app/success/page.tsx`); `https://licenses.dashcaddy.net/health` → 200 `{"ok":true,"service":"dashcaddy-license-server"}`. Plan codes (license server `plans.js`): premium_30d $20 / premium_90d $50 / premium_180d $70 / premium_365d $99. Earlier work: public-routes-drift half (commit 86df178, grade A) + DC-057 checkout→license contract (9b9711b, grade B; billing suites fresh-rerun 2026-08-23 at main HEAD `09d56fd`: 8/8, 131/131 green). **NOT verified (blocks done):** an end-to-end Stripe test-mode transaction — checkout-session creation → redirect → signed webhook fulfillment → persisted license → session lookup → success-page reveal (or documented email fallback). Static page text + health endpoint do not substitute. Codex judge held the done-transition on exactly this (verdict urn:ump:tqw6pvgj576f73ubhzff77sccm7azjyyg67o4z346yk45swgjleq). Also open: the superseded in-repo `status/pricing/index.html` (served by the status.sami SPA catch-all, 0 stripe refs) is dead weight — cleanup candidate.
|
||||
- **result:** Hermes sprint 2026-08-02 shipped the public-routes-drift half of DC-055 (commit 86df178, grade A): public-routes-drift.test.js now correctly maps `routes/billing.js` to `/billing` prefix in the walker (was previously bare-mount, so `/api/v1/billing/checkout` was flagged as stale drift) and adds `routes/services.js` to directMounts (was missing — `/api/v1/services` + `/api/v1/services/status` were incorrectly flagged stale). Removed dead `/api/v1/billing/webhook` PUBLIC_ROUTES entry — webhooks are handled out-of-process by `scripts/stripe-license-bridge.js` and the merchant webhook secret never enters the API process. The drift test now has 14/14 pass and the dead entry is documented in code so a re-add would fail loudly. Krystie's prior uncommitted work (`src/billing/stripe-client.js`, `routes/billing.js`, `scripts/stripe-license-bridge.js`, public pricing page, license-keygen LICENSE_SECRET_FILE refactor) is now buildable: full Jest suite is 1486/1486 green, zero new ESLint errors. Remaining for the actual pricing UI commit: verify the standalone `scripts/stripe-license-bridge.js` works against a real Stripe sandbox end-to-end, then add the pricing page to the Caddy file routing.
|
||||
|
||||
### DC-057: Close checkout-to-license contract drift before public billing launch
|
||||
- **status:** done
|
||||
@@ -351,12 +350,6 @@ Sami explicitly stated he wants email auth as an OPTION alongside TOTP, not a re
|
||||
### DC-056: ToS + Privacy Policy pages — GDPR-aware, no SOC2/HIPAA for v1.0
|
||||
- **status:** done
|
||||
- **owner:** hermes
|
||||
|
||||
### DC-061: Remove superseded status/pricing/index.html — dead weight since dashcaddy.net pricing page
|
||||
- **status:** done
|
||||
- **owner:** hermes
|
||||
- **details:** The in-repo `status/pricing/index.html` was served by the status.sami SPA catch-all but duplicated the canonical pricing page now living on the dedicated Next.js marketing site at `dashcaddy.net/pricing`. It had 0 Stripe refs in the current codebase (the marketing site handles checkout). Removed the file and its parent directory. Also deleted the obsolete test `__tests__/billing/pricing-page-catalog.test.js` that validated the now-removed page against the catalog — pricing-page/catalog consistency is now verified by the dashcaddy.net marketing site's own test suite. No Caddy config change needed — the SPA fallback serves index.html for /pricing, which is correct behavior (dashboard app handles unknown routes).
|
||||
- **result:** Removed `status/pricing/index.html` and `status/pricing/` directory. Deleted `__tests__/billing/pricing-page-catalog.test.js` (9 tests). All 2854 remaining tests pass, zero new ESLint warnings.
|
||||
- **details:** Two static pages at `/legal/tos` and `/legal/privacy`. ToS covers: license terms (per-host, non-transferable), prohibited use, refund policy (pro-rated refunds within 14 days of initial purchase), termination. Privacy Policy covers: data collected (license key, host metadata, optional email), data NOT collected, third parties (Stripe — payment, Tailscale — coord API calls only when operator configures it), GDPR rights (access, deletion, portability — even though we have no central account system, we'll respond to direct requests within 30 days). No SOC2/HIPAA — that's a v2 conversation.
|
||||
- **impact:** Legal compliance for taking money. Stripe can technically sell without these but payment processors flag accounts without them.
|
||||
- **prerequisite:** None.
|
||||
@@ -409,17 +402,16 @@ Tickets DC-046 through DC-049 implement pluggable auth + email magic link. Sami
|
||||
|
||||
|
||||
### DC-086: Service-status flicker fix — asymmetric hysteresis on the badge
|
||||
- **status:** done
|
||||
- **status:** in-progress
|
||||
- **owner:** hermes
|
||||
- **details:** Dashboard service badges perpetually flip between green and red for "a few seconds at a time, never stable" (Sami's report, 2026-08-20). Root cause: `src/monitoring/health-checker.js` `recordStatus()` emits `'status-check'` on EVERY probe (every 30s), and `src/websocket/dashboard-ws.js` forwards every probe as `'status-change'` to the browser with no diff. The frontend `live-events.js` then unconditionally calls `setBadge()` — which resets the icon + pill text on every event. A single transient 5xx (Caddy reload, container CPU steal, mid-flight TLS handshake, container restart during probe) flips the badge red and the next green probe flips it back. Fix: add asymmetric hysteresis in `_computeDisplayedStatus(serviceId, rawStatus)` — going DOWN requires 2 consecutive "down" probes (default `HEALTH_DOWN_THRESHOLD=2`), going UP requires only 1 (default `HEALTH_UP_THRESHOLD=1`). History + `consecutiveFailures` still record raw probe results (operators want full fidelity for postmortems); only the dashboard broadcast is filtered. `getCurrentStatus()` now returns the displayed status so a page reload shows the same badge as the live SSE stream. Both thresholds are env-var configurable so operators can tune. New tests in `__tests__/health-checker-hysteresis.test.js` cover: first probe emits; second probe same-status does NOT re-emit; one-down-then-up keeps green; two-down flips to red; one-up after down flips back to green; `getCurrentStatus` returns displayed not raw. Effort: ~30 min. Risk: low — pure behavior filter, no schema breaks, all 63 existing health-checker tests must stay green.
|
||||
- **impact:** Operators stop seeing perpetual red/green flicker on healthy services. Real outages still get flagged (2 consecutive 30s probes = ~60s before badge flips red, which is still faster than a human notices). Background probe history is unchanged so postmortem analysis still works.
|
||||
- **prerequisite:** None.
|
||||
- **result:** Shipped, merged to main (merge commit `eb546bf`, glm-grade=A; verified 2026-08-23 autonomous-fixer audit). Implementation verified on main: `health-checker.js` reads `HEALTH_DOWN_THRESHOLD`/`HEALTH_UP_THRESHOLD` env vars (defaults 2/1), `_computeDisplayedStatus()` implements the asymmetric hysteresis, `recordStatus()` emits only on displayed-status change. Test file `__tests__/health-checker-hysteresis.test.js` present. **Fresh rerun 2026-08-23 at main HEAD `09d56fd`: hysteresis + admin-invites suites 32/32 green.** Follow-up rounds also merged: `628bbe3` round-2 probe/config race hardening + env parse + incident compare (glm-grade=A), DC-090 outage incidents follow displayed hysteresis status (`88f1d4a`, glm-grade=A).
|
||||
- **result:** _pending — ship + codex round_
|
||||
|
||||
### DC-085: Link-first invite — Discord-style "share it however you want"
|
||||
- **status:** done
|
||||
- **status:** in-progress
|
||||
- **owner:** hermes
|
||||
- **result:** Shipped, merged to main (merge commit `eb546bf`, glm-grade=A; verified 2026-08-23 autonomous-fixer audit). All 5 deliverables verified on main: (1) `routes/auth/admin.js` invite POST now uses `sendEmail === true` opt-in (default = link only, no SMTP attempt); (2) raw invite URL no longer logged to error.log when SMTP unconfigured; (3) `shareText` field returned in the invite response; (4) `status/js/admin.js` `_renderIssuedInviteBanner` renders raw link + shareText with copy button + `navigator.share()`; (5) `__tests__/admin-invites.test.js` covers sendEmail/shareText semantics. **Fresh rerun 2026-08-23 at main HEAD `09d56fd`: admin-invites + hysteresis suites 32/32 green.** Follow-ups landed after: DC-089 email masking (commit `6732a1e`, glm-grade=B), DC-093 `/auth/me` hotfix (`5add962`, glm-grade=B).
|
||||
- **details:** Today `POST /api/v1/auth/admin/invites` defaults to sending the invite link via SMTP; if SMTP is not configured it spams the server console with `[DC-048-DEV-INVITE-LINK]` log lines. Sami wants Discord-style: the link is always returned in the response, and email is an opt-in checkbox. Operators should be free to copy the link and share it via iMessage / SMS / WhatsApp / Telegram / Signal / Discord / paste-in-email — whatever fits. (1) Flip default `sendEmail !== false` to `sendEmail === true` in `routes/auth/admin.js` so omitting the field means "no email, just hand me the link." (2) Stop logging the raw invite URL to error.log when SMTP is unconfigured — that path was only useful when there was no UI way to grab the link; now there is. (3) Add a `shareText` field to the response: `"Join my DashCaddy as <role> — <acceptUrl> — expires in Nh."` for one-tap paste into any messenger. (4) Frontend: `status/js/admin.js` `_renderInviteForm` flips the "Send email" checkbox default to **unchecked**, updates `_renderIssuedInviteBanner` to show both the raw link AND the shareText (with its own copy button + `navigator.share()` native share-sheet button where available). (5) New tests in `__tests__/admin-invites.test.js` covering: default sendEmail=false (no SMTP send attempted, no console log); `sendEmail: true` triggers SMTP send; `shareText` is present and well-formed; `acceptUrl` is always returned; expired sendEmail path doesn't leak token to logs. Effort: ~1 hr. Risk: low — pure behavior flip + UI additive change.
|
||||
- **impact:** Closes the friction between "host wants to add a friend" and "host has to configure SMTP first." Mirrors Discord/Slack/Linear invite flows where the link IS the deliverable. No new tier changes, no schema breaks.
|
||||
- **prerequisite:** DC-048 (invite store + admin route), DC-052 (Pro gate stays).
|
||||
|
||||
@@ -214,19 +214,6 @@ For secure remote access:
|
||||
3. Refresh to see latest errors
|
||||
4. Clear logs when resolved
|
||||
|
||||
### Log PII Redaction
|
||||
|
||||
Every log sink (console JSON, `error.log`, audit details) masks email addresses with a canonical form (`sa****@example.com`) — raw addresses never reach disk or stdout. When `error.log` crosses 5 MB it rotates to `error.log.1`, and the archive is scrubbed with the same canonical mask on rotation.
|
||||
|
||||
For **pre-existing** log files written before this defense existed:
|
||||
|
||||
```bash
|
||||
node scripts/redact-log-pii.js --dry-run <file-or-dir> # see what would change
|
||||
node scripts/redact-log-pii.js <file-or-dir> # atomic in-place rewrite
|
||||
```
|
||||
|
||||
The script is idempotent, never touches byte-identical files (mtime preserved), reuses the same masking code the live logger uses (no regex drift), and post-verifies that no raw address remains (exit code 2 if any does). See `dashcaddy-api/scripts/redact-log-pii.js` header for flags including `--keep-raw` (explicitly preserves the raw copy — avoid unless required).
|
||||
|
||||
### Backup & Restore
|
||||
|
||||
**Export Configuration:**
|
||||
@@ -355,9 +342,9 @@ dashcaddy/
|
||||
├── status/ # Dashboard frontend
|
||||
│ ├── index.html # Main dashboard
|
||||
│ └── assets/ # Logos, icons, fonts
|
||||
├── dashcaddy-api/ # API backend
|
||||
├── caddy-api/ # API backend
|
||||
│ ├── server.js # Express server
|
||||
│ ├── src/docker/app-templates.js # App template definitions
|
||||
│ ├── app-templates.js # App template definitions
|
||||
│ └── package.json # Dependencies
|
||||
├── dashcaddy-installer/ # Electron installer (WIP)
|
||||
└── docs/ # Documentation
|
||||
@@ -365,7 +352,7 @@ dashcaddy/
|
||||
|
||||
### Adding Custom App Templates
|
||||
|
||||
Edit `dashcaddy-api/src/docker/app-templates.js`:
|
||||
Edit `caddy-api/app-templates.js`:
|
||||
|
||||
```javascript
|
||||
"myapp": {
|
||||
|
||||
@@ -1,484 +0,0 @@
|
||||
/**
|
||||
* DC-099: canonical atomic file writer (src/utils/atomic-write.js).
|
||||
*
|
||||
* The notification config's two write paths (load-time canonicalization
|
||||
* write-back and the UI saveConfig) used plain fs.writeFileSync — a crash or
|
||||
* power loss mid-write could leave a truncated/empty notifications.json. The
|
||||
* same risk exists in every store that grew its own private
|
||||
* _atomicWriteJSON copy (invite-store, user-store, share-store, …).
|
||||
*
|
||||
* These tests pin the shared writer's contract:
|
||||
* - durability: fsync before rename, exclusive create, 0600 default
|
||||
* - atomicity: destination only ever replaced via rename
|
||||
* - failure: destination untouched, temp cleaned up, error propagated
|
||||
* - JSON helper: single serialization shape (2-space, no trailing newline —
|
||||
* notification-manager._persistCanonicalForm depends on byte-for-byte
|
||||
* idempotence)
|
||||
*/
|
||||
|
||||
'use strict';
|
||||
|
||||
const fs = require('fs');
|
||||
const os = require('os');
|
||||
const path = require('path');
|
||||
const { atomicWriteFile, atomicWriteJSON, tmpPathFor } = require('../src/utils/atomic-write');
|
||||
|
||||
// Real-FS tests: the actual syscalls, in a private temp dir.
|
||||
describe('DC-099 atomic-write (real fs)', () => {
|
||||
let dir;
|
||||
|
||||
beforeEach(() => {
|
||||
dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dc099-atomic-'));
|
||||
});
|
||||
|
||||
afterEach(() => {
|
||||
fs.rmSync(dir, { recursive: true, force: true });
|
||||
});
|
||||
|
||||
test('writes contents and returns the final path', () => {
|
||||
const target = path.join(dir, 'state.json');
|
||||
const ret = atomicWriteFile(target, '{"a":1}');
|
||||
expect(ret).toBe(target);
|
||||
expect(fs.readFileSync(target, 'utf8')).toBe('{"a":1}');
|
||||
});
|
||||
|
||||
test('replaces an existing file completely (no torn writes possible)', () => {
|
||||
const target = path.join(dir, 'state.json');
|
||||
atomicWriteFile(target, 'x'.repeat(1000));
|
||||
atomicWriteFile(target, 'y'.repeat(10));
|
||||
expect(fs.readFileSync(target, 'utf8')).toBe('y'.repeat(10));
|
||||
});
|
||||
|
||||
test('creates the file 0600 by default', () => {
|
||||
const target = path.join(dir, 'secret.json');
|
||||
atomicWriteJSON(target, { ok: true });
|
||||
expect(fs.statSync(target).mode & 0o777).toBe(0o600);
|
||||
});
|
||||
|
||||
test('honors an explicit mode override', () => {
|
||||
const target = path.join(dir, 'public.json');
|
||||
atomicWriteFile(target, '{}', { mode: 0o644 });
|
||||
expect(fs.statSync(target).mode & 0o777).toBe(0o644);
|
||||
});
|
||||
|
||||
test('leaves no temp files behind after success', () => {
|
||||
const target = path.join(dir, 'state.json');
|
||||
atomicWriteFile(target, 'abc');
|
||||
expect(fs.readdirSync(dir).filter((f) => f.includes('.tmp-'))).toEqual([]);
|
||||
});
|
||||
|
||||
test('two rapid writes both land (unique tmp names per write)', () => {
|
||||
const target = path.join(dir, 'state.json');
|
||||
atomicWriteFile(target, 'first');
|
||||
atomicWriteFile(target, 'second');
|
||||
expect(fs.readFileSync(target, 'utf8')).toBe('second');
|
||||
});
|
||||
|
||||
test('atomicWriteJSON serializes 2-space, no trailing newline', () => {
|
||||
const target = path.join(dir, 'conf.json');
|
||||
atomicWriteJSON(target, { a: { b: 1 } });
|
||||
const raw = fs.readFileSync(target, 'utf8');
|
||||
expect(raw).toBe('{\n "a": {\n "b": 1\n }\n}');
|
||||
});
|
||||
|
||||
test('write failure leaves the destination untouched and cleans the temp file', () => {
|
||||
const target = path.join(dir, 'state.json');
|
||||
fs.writeFileSync(target, 'ORIGINAL');
|
||||
const origWrite = fs.writeSync;
|
||||
fs.writeSync = () => {
|
||||
throw Object.assign(new Error('ENOSPC: no space left on device'), { code: 'ENOSPC' });
|
||||
};
|
||||
try {
|
||||
expect(() => atomicWriteFile(target, 'NEW-CONTENT')).toThrow(/ENOSPC/);
|
||||
} finally {
|
||||
fs.writeSync = origWrite;
|
||||
}
|
||||
expect(fs.readFileSync(target, 'utf8')).toBe('ORIGINAL');
|
||||
expect(fs.readdirSync(dir).filter((f) => f.includes('.tmp-'))).toEqual([]);
|
||||
});
|
||||
|
||||
test('tmpPathFor: unique per call, hidden dotfile in the same directory', () => {
|
||||
const a = tmpPathFor('/data/x.json');
|
||||
const b = tmpPathFor('/data/x.json');
|
||||
expect(a).not.toBe(b);
|
||||
expect(path.dirname(a)).toBe('/data');
|
||||
expect(path.basename(a)).toMatch(/^\.x\.json\.tmp-/);
|
||||
});
|
||||
});
|
||||
|
||||
// Mocked-FS tests: pin the syscall DISCIPLINE itself (order + flags), which
|
||||
// the real-fs tests can't observe directly.
|
||||
describe('DC-099 atomic-write syscall discipline (mocked fs)', () => {
|
||||
const calls = [];
|
||||
|
||||
beforeEach(() => {
|
||||
calls.length = 0;
|
||||
const rec = (name, impl) =>
|
||||
jest.spyOn(fs, name).mockImplementation((...args) => {
|
||||
calls.push(name);
|
||||
return impl(...args);
|
||||
});
|
||||
rec('openSync', () => 3);
|
||||
rec('writeSync', () => 8);
|
||||
rec('fsyncSync', () => {});
|
||||
rec('closeSync', () => {});
|
||||
rec('renameSync', () => {});
|
||||
rec('unlinkSync', () => {});
|
||||
});
|
||||
|
||||
afterEach(() => {
|
||||
jest.restoreAllMocks();
|
||||
});
|
||||
|
||||
test('order: open → write → fsync → close → rename, then dir fsync (open → fsync → close)', () => {
|
||||
atomicWriteFile('/data/x.json', '{"a":1}');
|
||||
expect(calls).toEqual([
|
||||
'openSync', 'writeSync', 'fsyncSync', 'closeSync', 'renameSync',
|
||||
'openSync', 'fsyncSync', 'closeSync',
|
||||
]);
|
||||
});
|
||||
|
||||
test('dir fsync opens the PARENT directory (second openSync), not another tmp file', () => {
|
||||
atomicWriteFile('/data/x.json', '{}');
|
||||
const dirOpen = fs.openSync.mock.calls[1];
|
||||
expect(dirOpen[0]).toBe('/data');
|
||||
expect(dirOpen[1]).toBe('r');
|
||||
});
|
||||
|
||||
test('dir fsync failure is swallowed (write still succeeds)', () => {
|
||||
let n = 0;
|
||||
fs.fsyncSync.mockImplementation(() => {
|
||||
n += 1;
|
||||
if (n === 2) throw new Error('EINVAL: invalid argument'); // 2nd fsync = dir
|
||||
});
|
||||
expect(() => atomicWriteFile('/data/x.json', '{}')).not.toThrow();
|
||||
expect(fs.renameSync).toHaveBeenCalled();
|
||||
});
|
||||
|
||||
test('open uses exclusive-create with the 0600 default on the tmp path', () => {
|
||||
atomicWriteFile('/data/x.json', '{}');
|
||||
const [tmpPath, flags, modeArg] = fs.openSync.mock.calls[0];
|
||||
expect(tmpPath).toMatch(/^\/data\/\.x\.json\.tmp-/);
|
||||
expect(flags).toBe('wx');
|
||||
expect(modeArg).toBe(0o600);
|
||||
});
|
||||
|
||||
test('write passes the payload with utf8 encoding', () => {
|
||||
atomicWriteFile('/data/x.json', '{"a":1}');
|
||||
expect(fs.writeSync.mock.calls[0]).toEqual([3, '{"a":1}', null, 'utf8']);
|
||||
});
|
||||
|
||||
test('rename swaps a same-dir temp onto the target', () => {
|
||||
atomicWriteFile('/data/x.json', '{}');
|
||||
const [tmp, dest] = fs.renameSync.mock.calls[0];
|
||||
expect(tmp).toMatch(/\/data\/\.x\.json\.tmp-/);
|
||||
expect(dest).toBe('/data/x.json');
|
||||
});
|
||||
|
||||
test('rename failure unlinks the temp and propagates the error', () => {
|
||||
fs.renameSync.mockImplementation(() => {
|
||||
calls.push('renameSync');
|
||||
throw new Error('EXDEV: cross-device link not permitted');
|
||||
});
|
||||
expect(() => atomicWriteFile('/data/x.json', '{}')).toThrow(/EXDEV/);
|
||||
expect(calls).toEqual([
|
||||
'openSync', 'writeSync', 'fsyncSync', 'closeSync', 'renameSync', 'unlinkSync',
|
||||
]);
|
||||
});
|
||||
|
||||
test('open failure propagates without write/rename (nothing was created)', () => {
|
||||
fs.openSync.mockImplementation(() => {
|
||||
calls.push('openSync');
|
||||
throw new Error('EACCES: permission denied');
|
||||
});
|
||||
expect(() => atomicWriteFile('/data/x.json', '{}')).toThrow(/EACCES/);
|
||||
// best-effort unlink of the never-created temp, then stop
|
||||
expect(calls).toEqual(['openSync', 'unlinkSync']);
|
||||
});
|
||||
});
|
||||
|
||||
// DC-100: invite-store migrated off its private _atomicWriteJSON copy onto
|
||||
// the canonical writer. Store-level pins: writes are durable-canonical
|
||||
// (0600, complete JSON, no temp leftovers) even under back-to-back mutations
|
||||
// — the access pattern that could collide tmp names in the naive copy.
|
||||
describe('DC-100 invite-store on canonical atomic-write (real fs)', () => {
|
||||
let dir, store;
|
||||
|
||||
beforeEach(() => {
|
||||
dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dc100-invite-'));
|
||||
store = require('../src/security/invite-store').createInviteStore({ dataDir: dir });
|
||||
});
|
||||
afterEach(() => { try { fs.rmSync(dir, { recursive: true, force: true }); } catch (_) {} });
|
||||
|
||||
test('issued invite lands as complete JSON at mode 0600 with no temp leftovers', async () => {
|
||||
const r = await store.issue({ email: 'dc100@x.com', ttlMs: 60_000 });
|
||||
expect(r.ok).toBe(true);
|
||||
const file = path.join(dir, 'invites.json');
|
||||
const st = fs.statSync(file);
|
||||
expect(st.mode & 0o777).toBe(0o600);
|
||||
const data = JSON.parse(fs.readFileSync(file, 'utf8'));
|
||||
expect(Object.keys(data.invites)).toHaveLength(1);
|
||||
const leftovers = fs.readdirSync(dir).filter((f) => f !== 'invites.json');
|
||||
expect(leftovers).toEqual([]);
|
||||
});
|
||||
|
||||
test('back-to-back mutations (issue, revoke, issue) never collide on tmp names', async () => {
|
||||
const a = await store.issue({ email: 'a@x.com', ttlMs: 60_000 });
|
||||
const b = await store.issue({ email: 'b@x.com', ttlMs: 60_000 });
|
||||
await store.revoke(a.id);
|
||||
const c = await store.issue({ email: 'c@x.com', ttlMs: 60_000 });
|
||||
expect(b.ok).toBe(true);
|
||||
expect(c.ok).toBe(true);
|
||||
const data = JSON.parse(fs.readFileSync(path.join(dir, 'invites.json'), 'utf8'));
|
||||
expect(Object.keys(data.invites).sort()).toEqual([b.id, c.id].sort());
|
||||
const leftovers = fs.readdirSync(dir).filter((f) => f !== 'invites.json');
|
||||
expect(leftovers).toEqual([]);
|
||||
});
|
||||
});
|
||||
|
||||
// DC-101: user-store migrated off its private _atomicWriteJSON copy onto
|
||||
// the canonical writer. Store-level pins across ALL THREE persisted files
|
||||
// (users.json, authorized-users.json, .bootstrapped sentinel): 0600 mode,
|
||||
// complete JSON, no temp leftovers — including the bootstrap path that
|
||||
// writes two JSON files plus the sentinel back-to-back in one login.
|
||||
describe('DC-101 user-store on canonical atomic-write (real fs)', () => {
|
||||
let dir, store;
|
||||
|
||||
beforeEach(() => {
|
||||
dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dc101-user-'));
|
||||
store = require('../src/security/user-store').createUserStore({ dataDir: dir });
|
||||
});
|
||||
afterEach(() => { try { fs.rmSync(dir, { recursive: true, force: true }); } catch (_) {} });
|
||||
|
||||
test('bootstrap login persists users.json + allowlist + sentinel at 0600, complete JSON, no leftovers', async () => {
|
||||
const r = await store.login({ email: 'dc101@x.com', ip: '10.0.0.1' });
|
||||
expect(r.ok).toBe(true);
|
||||
expect(r.isBootstrap).toBe(true);
|
||||
|
||||
const usersSt = fs.statSync(path.join(dir, 'users.json'));
|
||||
const allowSt = fs.statSync(path.join(dir, 'authorized-users.json'));
|
||||
const sentSt = fs.statSync(path.join(dir, '.bootstrapped'));
|
||||
expect(usersSt.mode & 0o777).toBe(0o600);
|
||||
expect(allowSt.mode & 0o777).toBe(0o600);
|
||||
expect(sentSt.mode & 0o777).toBe(0o600);
|
||||
|
||||
const users = JSON.parse(fs.readFileSync(path.join(dir, 'users.json'), 'utf8'));
|
||||
expect(Object.keys(users.users)).toHaveLength(1);
|
||||
expect(users.users[users.order[0]].role).toBe('admin');
|
||||
const allowlist = JSON.parse(fs.readFileSync(path.join(dir, 'authorized-users.json'), 'utf8'));
|
||||
expect(allowlist.emails).toEqual(['dc101@x.com']);
|
||||
const sentinel = JSON.parse(fs.readFileSync(path.join(dir, '.bootstrapped'), 'utf8'));
|
||||
expect(sentinel.adminEmail).toBe('dc101@x.com');
|
||||
|
||||
const leftovers = fs.readdirSync(dir).filter(
|
||||
(f) => f !== 'users.json' && f !== 'authorized-users.json' && f !== '.bootstrapped'
|
||||
);
|
||||
expect(leftovers).toEqual([]);
|
||||
});
|
||||
|
||||
test('back-to-back mutations (login, allowlist add/remove, role set) never collide on tmp names', async () => {
|
||||
const a = await store.login({ email: 'admin@x.com' });
|
||||
expect(a.isBootstrap).toBe(true);
|
||||
await store.addToAllowlist('b@x.com');
|
||||
const b = await store.login({ email: 'b@x.com' });
|
||||
expect(b.ok).toBe(true);
|
||||
expect(b.role).toBe('operator');
|
||||
await store.setRole(b.user.id, 'viewer');
|
||||
await store.removeFromAllowlist('b@x.com');
|
||||
|
||||
const users = JSON.parse(fs.readFileSync(path.join(dir, 'users.json'), 'utf8'));
|
||||
expect(users.users[b.user.id].role).toBe('viewer');
|
||||
const allowlist = JSON.parse(fs.readFileSync(path.join(dir, 'authorized-users.json'), 'utf8'));
|
||||
expect(allowlist.emails).toEqual(['admin@x.com']);
|
||||
|
||||
const leftovers = fs.readdirSync(dir).filter(
|
||||
(f) => f !== 'users.json' && f !== 'authorized-users.json' && f !== '.bootstrapped'
|
||||
);
|
||||
expect(leftovers).toEqual([]);
|
||||
});
|
||||
});
|
||||
|
||||
// DC-102: share-store migrated off its private _atomicWriteJSON copy onto
|
||||
// the canonical writer. Store-level pins: shares.json AND the .share-secret
|
||||
// signing key land as complete content at mode 0600 with no temp leftovers —
|
||||
// a torn secret write would silently rotate the key and invalidate every
|
||||
// outstanding share signature on next boot.
|
||||
describe('DC-102 share-store on canonical atomic-write (real fs)', () => {
|
||||
let dir, store;
|
||||
|
||||
beforeEach(() => {
|
||||
dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dc102-share-'));
|
||||
store = require('../src/security/share-store').createShareStore({ dataDir: dir });
|
||||
});
|
||||
afterEach(() => { try { fs.rmSync(dir, { recursive: true, force: true }); } catch (_) {} });
|
||||
|
||||
test('issued share + persisted signing secret land at 0600, complete, no temp leftovers', async () => {
|
||||
const r = await store.issuePublic({ serviceId: 'svc', ttlMs: 60 * 60 * 1000 });
|
||||
expect(r.ok).toBe(true);
|
||||
|
||||
const sharesFile = path.join(dir, 'shares.json');
|
||||
const secretFile = path.join(dir, '.share-secret');
|
||||
const sharesSt = fs.statSync(sharesFile);
|
||||
const secretSt = fs.statSync(secretFile);
|
||||
expect(sharesSt.mode & 0o777).toBe(0o600);
|
||||
expect(secretSt.mode & 0o777).toBe(0o600);
|
||||
|
||||
// complete JSON — a torn write would fail JSON.parse right here
|
||||
const data = JSON.parse(fs.readFileSync(sharesFile, 'utf8'));
|
||||
expect(Object.keys(data.shares)).toHaveLength(1);
|
||||
// complete secret — readable, 32+ bytes after trim, trailing newline kept
|
||||
const secret = fs.readFileSync(secretFile, 'utf8');
|
||||
expect(secret.trim().length).toBeGreaterThanOrEqual(32);
|
||||
expect(secret.endsWith('\n')).toBe(true);
|
||||
|
||||
const leftovers = fs.readdirSync(dir).filter((f) => f !== 'shares.json' && f !== '.share-secret');
|
||||
expect(leftovers).toEqual([]);
|
||||
});
|
||||
|
||||
test('back-to-back mutations (issue x2, subscribe, tailscale use, revoke) never collide on tmp names', async () => {
|
||||
const a = await store.issuePublic({ serviceId: 'svc', subscribeCap: 5 });
|
||||
const b = await store.issueTailscale({ serviceId: 'svc', email: 'dc102@x.com' });
|
||||
await store.recordPublicSubscribe(a.token, { email: 'sub@x.com' });
|
||||
await store.recordTailscaleUse(b.token, { deviceId: 'device-1' });
|
||||
await store.revoke(a.id);
|
||||
|
||||
// b remains outstanding and fully redeemable state on disk
|
||||
const data = JSON.parse(fs.readFileSync(path.join(dir, 'shares.json'), 'utf8'));
|
||||
expect(Object.keys(data.shares)).toEqual([b.id]);
|
||||
expect(data.shares[b.id].usedAt).toBeTruthy();
|
||||
expect(data.shares[b.id].usedBy).toBe('device-1');
|
||||
|
||||
// signature verification still passes against the atomically persisted
|
||||
// secret — getRaw checks hash + HMAC only (not used-state), so a rotated
|
||||
// or torn secret would return null here.
|
||||
const raw = await store.getRaw(b.token);
|
||||
expect(raw).toBeTruthy();
|
||||
expect(raw.id).toBe(b.id);
|
||||
expect(raw.kind).toBe('tailscale');
|
||||
|
||||
const leftovers = fs.readdirSync(dir).filter((f) => f !== 'shares.json' && f !== '.share-secret');
|
||||
expect(leftovers).toEqual([]);
|
||||
});
|
||||
});
|
||||
|
||||
// DC-103: fulfillment-store (Stripe license state, shared file-IPC between
|
||||
// the API's lookup endpoint and the stripe-license-bridge process) migrated
|
||||
// off its private tmp+rename copy onto the canonical writer. Pins: the file
|
||||
// lands at 0600, parses as complete JSON after every mutation class, and no
|
||||
// temp files survive — a torn write here would make a webhook retry mint a
|
||||
// SECOND valid license key for an order that already has one.
|
||||
describe('DC-103 fulfillment-store on canonical atomic-write (real fs)', () => {
|
||||
let dir, store;
|
||||
|
||||
beforeEach(() => {
|
||||
dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dc103-fulfill-'));
|
||||
store = require('../src/billing/fulfillment-store').createFulfillmentStore({ filePath: path.join(dir, 'stripe-fulfillments.json') });
|
||||
});
|
||||
afterEach(() => { try { fs.rmSync(dir, { recursive: true, force: true }); } catch (_) {} });
|
||||
|
||||
test('claim → saveLicense → claimDelivery → markDelivered lands at 0600, complete JSON, no temp leftovers', async () => {
|
||||
const claimed = await store.claim({ eventId: 'evt_dc103', sessionId: 'cs_dc103', productId: 'pro-30d', durationDays: 30, email: 'dc103@x.com' });
|
||||
expect(claimed.claimed).toBe(true);
|
||||
const saved = await store.saveLicense({ eventId: 'evt_dc103', sessionId: 'cs_dc103', code: 'DC103-KEY-XXXX', codeId: 'kg_dc103' });
|
||||
expect(saved.saved).toBe(true);
|
||||
const delivery = await store.claimDelivery({ sessionId: 'cs_dc103', ownerToken: 'own_1' });
|
||||
expect(delivery.claimed).toBe(true);
|
||||
const delivered = await store.markDelivered({ sessionId: 'cs_dc103', ownerToken: 'own_1', deliveredVia: 'smtp' });
|
||||
expect(delivered.saved).toBe(true);
|
||||
|
||||
const file = path.join(dir, 'stripe-fulfillments.json');
|
||||
const st = fs.statSync(file);
|
||||
expect(st.mode & 0o777).toBe(0o600);
|
||||
|
||||
// complete JSON carrying the full lifecycle — a torn write would fail
|
||||
// JSON.parse right here
|
||||
const data = JSON.parse(fs.readFileSync(file, 'utf8'));
|
||||
expect(data.bySessionId['cs_dc103'].status).toBe('delivered');
|
||||
expect(data.bySessionId['cs_dc103'].code).toBe('DC103-KEY-XXXX');
|
||||
expect(data.bySessionId['cs_dc103'].eventId).toBe('evt_dc103');
|
||||
// both index maps point at the same record
|
||||
expect(data.byEventId['evt_dc103'].sessionId).toBe('cs_dc103');
|
||||
|
||||
const leftovers = fs.readdirSync(dir).filter((f) => f !== 'stripe-fulfillments.json');
|
||||
expect(leftovers).toEqual([]);
|
||||
});
|
||||
|
||||
test('back-to-back mutations across separate store instances never collide on tmp names', async () => {
|
||||
// Two processes share this file (bridge + API lookup). Two store
|
||||
// instances writing interleaved must never collide on the same tmp name
|
||||
// (the counter is per-process, so cross-instance is the real pin).
|
||||
const storeA = require('../src/billing/fulfillment-store').createFulfillmentStore({ filePath: path.join(dir, 'stripe-fulfillments.json') });
|
||||
const storeB = require('../src/billing/fulfillment-store').createFulfillmentStore({ filePath: path.join(dir, 'stripe-fulfillments.json') });
|
||||
for (let i = 0; i < 6; i += 1) {
|
||||
const a = await storeA.claim({ eventId: `evt_a${i}`, sessionId: `cs_a${i}`, productId: 'pro-30d', durationDays: 30, email: 'a@x.com' });
|
||||
expect(a.claimed).toBe(true);
|
||||
const b = await storeB.claim({ eventId: `evt_b${i}`, sessionId: `cs_b${i}`, productId: 'pro-30d', durationDays: 30, email: 'b@x.com' });
|
||||
expect(b.claimed).toBe(true);
|
||||
}
|
||||
const file = path.join(dir, 'stripe-fulfillments.json');
|
||||
const data = JSON.parse(fs.readFileSync(file, 'utf8'));
|
||||
expect(Object.keys(data.byEventId)).toHaveLength(12);
|
||||
const leftovers = fs.readdirSync(dir).filter((f) => f !== 'stripe-fulfillments.json');
|
||||
expect(leftovers).toEqual([]);
|
||||
});
|
||||
});
|
||||
|
||||
// DC-104: stripe-license-bridge events file (Stripe webhook idempotency
|
||||
// log) migrated off its private tmp+writeFileSync+rename copy onto the
|
||||
// canonical writer. A torn stripe-events.json silently drops event-ids —
|
||||
// the next Stripe retry then re-runs delivery (duplicate license email /
|
||||
// duplicate key mint when combined with a torn fulfillment record).
|
||||
// Pins: 0600 on create, complete JSON after every recordEvent mutation,
|
||||
// no temp leftovers, and the full read-modify-write dedupe cycle through
|
||||
// the bridge's exported functions. (The ignored-type / unpaid-status
|
||||
// write classes route through the same writeEvents and are driven
|
||||
// end-to-end in __tests__/billing/stripe-license-bridge.test.js.)
|
||||
describe('DC-104 bridge events file on canonical atomic-write (real fs)', () => {
|
||||
let dir;
|
||||
|
||||
beforeEach(() => {
|
||||
dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dc104-events-'));
|
||||
process.env.STRIPE_BRIDGE_EVENTS_FILE = path.join(dir, 'stripe-events.json');
|
||||
jest.resetModules();
|
||||
});
|
||||
afterEach(() => {
|
||||
delete process.env.STRIPE_BRIDGE_EVENTS_FILE;
|
||||
try { fs.rmSync(dir, { recursive: true, force: true }); } catch (_) {}
|
||||
});
|
||||
|
||||
test('recordEvent → eventSeen dedupe cycle lands at 0600, complete JSON, no temp leftovers', () => {
|
||||
// Env is captured at require time — resetModules above makes this
|
||||
// require see the fresh STRIPE_BRIDGE_EVENTS_FILE.
|
||||
const bridge = require('../scripts/stripe-license-bridge');
|
||||
|
||||
const first = bridge.recordEvent('evt_dc104_a', { ignoredType: 'product.updated' });
|
||||
expect(first).toBe(true); // new event recorded
|
||||
expect(bridge.eventSeen('evt_dc104_a')).toBe(true);
|
||||
expect(bridge.eventSeen('evt_dc104_unknown')).toBe(false);
|
||||
|
||||
const dup = bridge.recordEvent('evt_dc104_a', { ignoredType: 'product.updated' });
|
||||
expect(dup).toBe(false); // idempotent — already present
|
||||
|
||||
const file = path.join(dir, 'stripe-events.json');
|
||||
const st = fs.statSync(file);
|
||||
expect(st.mode & 0o777).toBe(0o600); // canonical writer default
|
||||
|
||||
// complete JSON carrying the event — a torn write would fail parse here
|
||||
const data = JSON.parse(fs.readFileSync(file, 'utf8'));
|
||||
expect(data.events['evt_dc104_a'].ignoredType).toBe('product.updated');
|
||||
|
||||
const leftovers = fs.readdirSync(dir).filter((f) => f !== 'stripe-events.json');
|
||||
expect(leftovers).toEqual([]); // no tmp survivors
|
||||
});
|
||||
|
||||
test('back-to-back recordEvent writes parse complete after every mutation', () => {
|
||||
const bridge = require('../scripts/stripe-license-bridge');
|
||||
for (let i = 0; i < 8; i += 1) {
|
||||
const ok = bridge.recordEvent(`evt_dc104_seq_${i}`, { ignoredType: 'product.updated', seq: i });
|
||||
expect(ok).toBe(true);
|
||||
const file = path.join(dir, 'stripe-events.json');
|
||||
const data = JSON.parse(fs.readFileSync(file, 'utf8')); // throws on torn write
|
||||
expect(Object.keys(data.events)).toHaveLength(i + 1);
|
||||
}
|
||||
});
|
||||
});
|
||||
@@ -1,226 +0,0 @@
|
||||
/**
|
||||
* DC-111 regression pins — audit trail correctness for the SSO gate path.
|
||||
*
|
||||
* THREE live defects found 2026-08-23 by probing the production container
|
||||
* (45,899 'unknown.get' entries in audit-log.json / security-events.jsonl
|
||||
* spanning 2026-07-14 → 2026-08-23, plus failed actions dropped from the
|
||||
* unified security event store):
|
||||
*
|
||||
* 1. audit-logger.middleware() computed action/resource from req.path
|
||||
* INSIDE the res.json override — i.e. AFTER the /api/v1 router had
|
||||
* rebased req.url to the router-relative path (/auth/gate/plex).
|
||||
* resolveAction fell through ACTION_MAP → 'unknown.get' for every
|
||||
* gate hit over HTTP. DC-028's unit tests passed because they call
|
||||
* resolveAction() directly with canonical paths and never exercise
|
||||
* the middleware over HTTP.
|
||||
*
|
||||
* 2. The DC-044 back-compat shim rewrote the ALREADY-canonical
|
||||
* /api/v1/auth/gate/<id> (and app-token) through '/api/v1' +
|
||||
* slice(4), producing /api/v1/v1/auth/gate/<id> → 401/404 for every
|
||||
* canonical-URI client — the exact drift case DC-044 meant to tolerate.
|
||||
*
|
||||
* 3. event-store VALID_OUTCOMES lacked 'failure' (the audit middleware's
|
||||
* vocabulary for data.success === false), so every failed API action's
|
||||
* security event was REJECTED and dropped from security-events.jsonl
|
||||
* ([AuditLogger] Security event emit failed: Invalid event: bad
|
||||
* outcome: failure — seen live in docker logs).
|
||||
*
|
||||
* These tests exercise a REAL Express app (not the module in isolation):
|
||||
* the app-level DC-044 shim + audit middleware + a /api/v1 router that
|
||||
* mounts the gate route the same way src/app.js does, so the router-rebase
|
||||
* behavior that caused defect 1 is reproduced faithfully.
|
||||
*/
|
||||
|
||||
const path = require('path');
|
||||
const fs = require('fs');
|
||||
const os = require('os');
|
||||
const express = require('express');
|
||||
const request = require('supertest');
|
||||
|
||||
// Hermetic sinks (same pattern as audit-logger-pii-masking-dc110.test.js)
|
||||
const TMP_DIR = fs.mkdtempSync(path.join(os.tmpdir(), 'dc111-audit-'));
|
||||
process.env.AUDIT_LOG_FILE = path.join(TMP_DIR, 'audit-log.json');
|
||||
process.env.SECURITY_EVENT_LOG_FILE = path.join(TMP_DIR, 'security-events.jsonl');
|
||||
|
||||
const auditLogger = require('../src/security/audit-logger');
|
||||
const { getStore } = require('../src/security/event-store');
|
||||
|
||||
// Reset singleton state between tests so audit-log.json assertions see a
|
||||
// clean file (the singleton StateManager caches nothing across writes, but
|
||||
// the event store keeps an in-memory index — point it at a fresh file by
|
||||
// writing directly and asserting file contents only).
|
||||
beforeEach(() => {
|
||||
fs.writeFileSync(process.env.AUDIT_LOG_FILE, '[]', 'utf8');
|
||||
fs.writeFileSync(process.env.SECURITY_EVENT_LOG_FILE, '', 'utf8');
|
||||
});
|
||||
|
||||
// Faithful mirror of the src/app.js mount chain relevant to this bug:
|
||||
// app-level legacy-path shim → audit middleware → /api/v1 router
|
||||
// with the gate route mounted at /auth/gate/:serviceId (as routes/auth
|
||||
// does), answering via res.json so the audit override fires.
|
||||
function buildApp() {
|
||||
const app = express();
|
||||
|
||||
// DC-044 shim — EXACT copy of the fixed src/app.js logic
|
||||
app.use((req, res, next) => {
|
||||
if (req.url.startsWith('/api/auth/gate/')
|
||||
|| req.url.startsWith('/api/auth/app-token/')
|
||||
|| req.url.startsWith('/api/auth/sso-exchange')) {
|
||||
req.url = '/api/v1' + req.url.slice(4);
|
||||
} else if (req.url.startsWith('/api/auth/totp/check-session')) {
|
||||
req.url = '/api/v1' + req.url.slice(9);
|
||||
} else if (req.url.startsWith('/api/v1/auth/totp/check-session')) {
|
||||
req.url = '/api/v1' + req.url.slice(12);
|
||||
}
|
||||
next();
|
||||
});
|
||||
|
||||
app.use(auditLogger.middleware());
|
||||
|
||||
const apiRouter = express.Router();
|
||||
apiRouter.get('/auth/gate/:serviceId', (req, res) => {
|
||||
// Simulate both outcomes: ?fail=1 makes the handler answer
|
||||
// success:false so the audit middleware records outcome 'failure'.
|
||||
if (req.query.fail === '1') {
|
||||
return res.status(401).json({ success: false, error: 'Session expired or invalid' });
|
||||
}
|
||||
res.json({ success: true, authenticated: true, credentialsInjected: false });
|
||||
});
|
||||
app.use('/api/v1', apiRouter);
|
||||
return app;
|
||||
}
|
||||
|
||||
async function waitForAuditEntry(predicate, { timeoutMs = 3000, what } = {}) {
|
||||
const start = Date.now();
|
||||
for (;;) {
|
||||
// StateManager's write is truncate-then-write (non-atomic, DC-110
|
||||
// lesson): a poll can catch the file between truncate and rewrite.
|
||||
// Treat unparsable reads as "not yet" instead of crashing.
|
||||
let entries;
|
||||
try {
|
||||
entries = JSON.parse(fs.readFileSync(process.env.AUDIT_LOG_FILE, 'utf8'));
|
||||
} catch (_) {
|
||||
entries = [];
|
||||
}
|
||||
const hit = entries.find(predicate);
|
||||
if (hit) return hit;
|
||||
if (Date.now() - start > timeoutMs) throw new Error(`timeout waiting for ${what || 'audit entry'}`);
|
||||
await new Promise(r => setTimeout(r, 50));
|
||||
}
|
||||
}
|
||||
|
||||
function readMirrorLines() {
|
||||
const raw = fs.readFileSync(process.env.SECURITY_EVENT_LOG_FILE, 'utf8');
|
||||
return raw.split('\n').filter(Boolean).map(l => JSON.parse(l));
|
||||
}
|
||||
|
||||
describe('DC-111 defect 1: audit action/resource computed from pre-router path', () => {
|
||||
test('canonical /api/v1/auth/gate/<id> logs as auth.credential-injection, not unknown.get', async () => {
|
||||
const app = buildApp();
|
||||
const res = await request(app).get('/api/v1/auth/gate/plex');
|
||||
expect(res.status).toBe(200);
|
||||
|
||||
const entry = await waitForAuditEntry(
|
||||
e => e.action === 'auth.credential-injection' && e.resource === 'gate/plex',
|
||||
{ what: 'auth.credential-injection entry' }
|
||||
);
|
||||
expect(entry.outcome).toBe('success');
|
||||
});
|
||||
|
||||
test('legacy /api/auth/gate/<id> (what Caddy forward_auth sends) also resolves the named action', async () => {
|
||||
const app = buildApp();
|
||||
const res = await request(app).get('/api/auth/gate/jellyfin');
|
||||
expect(res.status).toBe(200);
|
||||
|
||||
const entry = await waitForAuditEntry(
|
||||
e => e.action === 'auth.credential-injection' && e.resource === 'gate/jellyfin',
|
||||
{ what: 'legacy-shape credential-injection entry' }
|
||||
);
|
||||
expect(entry.outcome).toBe('success');
|
||||
});
|
||||
});
|
||||
|
||||
describe('DC-111 defect 2: DC-044 shim must not double-prefix canonical paths', () => {
|
||||
test('canonical /api/v1/auth/gate/<id> still reaches the route (no /api/v1/v1 rewrite)', async () => {
|
||||
const app = buildApp();
|
||||
const res = await request(app).get('/api/v1/auth/gate/plex');
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body.success).toBe(true);
|
||||
});
|
||||
|
||||
test('legacy /api/auth/gate/<id> still reaches the route (shim keeps working)', async () => {
|
||||
const app = buildApp();
|
||||
const res = await request(app).get('/api/auth/gate/plex');
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body.success).toBe(true);
|
||||
});
|
||||
|
||||
test('legacy totp check-session rewrite unchanged', async () => {
|
||||
const app = buildApp();
|
||||
// Route not mounted in this harness — assert the rewrite by querying the
|
||||
// shim behavior indirectly: /api/auth/totp/check-session must NOT 404 as
|
||||
// /v1/totp/... it becomes /api/v1/totp/check-session (unmounted → 404
|
||||
// from the api router, which proves it was NOT left under /auth).
|
||||
const res = await request(app).get('/api/auth/totp/check-session');
|
||||
expect(res.status).toBe(404);
|
||||
});
|
||||
});
|
||||
|
||||
describe('DC-111 defect 3: failed actions must land in the unified security event store', () => {
|
||||
test("outcome 'failure' is accepted by the event store", async () => {
|
||||
const app = buildApp();
|
||||
const res = await request(app).get('/api/v1/auth/gate/plex?fail=1');
|
||||
expect(res.status).toBe(401);
|
||||
|
||||
const entry = await waitForAuditEntry(
|
||||
e => e.outcome === 'failure' && e.resource === 'gate/plex',
|
||||
{ what: 'failure audit entry' }
|
||||
);
|
||||
expect(entry.action).toBe('auth.credential-injection');
|
||||
|
||||
// Mirror write is async after the audit entry — poll the jsonl
|
||||
const start = Date.now();
|
||||
for (;;) {
|
||||
const lines = readMirrorLines();
|
||||
const ev = lines.find(l => (l.metadata || {}).audit_id === entry.id);
|
||||
if (ev) {
|
||||
expect(ev.outcome).toBe('failure');
|
||||
expect(ev.action).toBe('auth.credential-injection');
|
||||
expect(ev.severity).toBe('warn'); // auth.* + failure escalates per resolveSeverity
|
||||
return;
|
||||
}
|
||||
if (Date.now() - start > 3000) throw new Error('mirror event never written for failed action');
|
||||
await new Promise(r => setTimeout(r, 50));
|
||||
}
|
||||
});
|
||||
|
||||
test('VALID_OUTCOMES includes failure (unit pin on the set itself)', () => {
|
||||
// Direct pin so a future revert of the event-store change fails loudly.
|
||||
const store = getStore();
|
||||
const bad = store._validate({ source_type: 'api', severity: 'info', outcome: 'failure' });
|
||||
expect(bad).toBeNull();
|
||||
});
|
||||
});
|
||||
|
||||
describe('DC-111: historical-corpus shape must never regress', () => {
|
||||
test('no unknown.get entries are produced for gate traffic (canonical or legacy)', async () => {
|
||||
const app = buildApp();
|
||||
await request(app).get('/api/v1/auth/gate/plex');
|
||||
await request(app).get('/api/auth/gate/plex');
|
||||
await request(app).get('/api/v1/auth/gate/sonarr?fail=1');
|
||||
|
||||
await waitForAuditEntry(e => e.resource === 'gate/sonarr' && e.outcome === 'failure', {
|
||||
timeoutMs: 6000,
|
||||
what: 'third entry',
|
||||
});
|
||||
// give the async log() a beat to finish all three
|
||||
await new Promise(r => setTimeout(r, 300));
|
||||
|
||||
const entries = JSON.parse(fs.readFileSync(process.env.AUDIT_LOG_FILE, 'utf8'));
|
||||
const unknownGate = entries.filter(e => e.action.startsWith('unknown.'));
|
||||
expect(unknownGate).toEqual([]);
|
||||
// Each fired request must be present; supertest may issue an extra
|
||||
// redirect-following request on some code paths, so assert >= not ==.
|
||||
expect(entries.filter(e => e.action === 'auth.credential-injection').length).toBeGreaterThanOrEqual(3);
|
||||
});
|
||||
});
|
||||
@@ -1,173 +0,0 @@
|
||||
/**
|
||||
* Tests for audit-logger PII masking parity [DC-110]:
|
||||
* - audit-logger.js (the StateManager write path) must mask emails with
|
||||
* the SAME canonical primitives as the unified logger (DC-095):
|
||||
* resource strings (URL paths like /invites/<email>/accept) and deep
|
||||
* details objects (req.body.email, DC-048 userEmail attribution).
|
||||
* - Masking happens at the single write-point log(), so middleware AND
|
||||
* direct route calls are both covered.
|
||||
* - Middleware's sensitive-key '***' redaction (password/token/…)
|
||||
* survives — masking runs on the already-sanitized object.
|
||||
* - The caller's `details` object is never mutated (maskEmails clones).
|
||||
*
|
||||
* Hermetic: AUDIT_LOG_FILE and SECURITY_EVENT_LOG_FILE are pointed at a
|
||||
* tmp dir BEFORE the require — both modules resolve paths at load time.
|
||||
*
|
||||
* Read discipline: StateManager writes via fs.writeFile (truncate-then-
|
||||
* write, NOT atomic) and middleware fires log() unawaited, so a fixed
|
||||
* sleep can observe a 0-byte file mid-write. waitForEntries() polls for
|
||||
* the expected entry COUNT — deterministic under lock retries.
|
||||
*/
|
||||
|
||||
const os = require('os');
|
||||
const path = require('path');
|
||||
const fs = require('fs');
|
||||
|
||||
const TMP_DIR = fs.mkdtempSync(path.join(os.tmpdir(), 'dc110-audit-'));
|
||||
process.env.AUDIT_LOG_FILE = path.join(TMP_DIR, 'audit-log.json');
|
||||
process.env.SECURITY_EVENT_LOG_FILE = path.join(TMP_DIR, 'security-events.jsonl');
|
||||
|
||||
const AuditLogger = require('../src/security/audit-logger');
|
||||
|
||||
async function waitForEntries(count, timeoutMs = 5000) {
|
||||
const deadline = Date.now() + timeoutMs;
|
||||
for (;;) {
|
||||
try {
|
||||
const entries = JSON.parse(fs.readFileSync(process.env.AUDIT_LOG_FILE, 'utf8'));
|
||||
if (Array.isArray(entries) && entries.length >= count) return entries;
|
||||
} catch (_) { /* not yet: 0-byte mid-write or unparsed */ }
|
||||
if (Date.now() > deadline) throw new Error(`timed out waiting for ${count} audit entries`);
|
||||
await new Promise(r => setTimeout(r, 15));
|
||||
}
|
||||
}
|
||||
|
||||
describe('AuditLogger [DC-110] PII masking parity', () => {
|
||||
test('log() masks emails in resource path and deep details', async () => {
|
||||
await AuditLogger.log({
|
||||
action: 'invite.create',
|
||||
resource: 'invites/john.doe@example.com/accept',
|
||||
details: {
|
||||
body: { email: 'jane.doe@example.com', role: 'admin' },
|
||||
userEmail: 'sami@example.org',
|
||||
},
|
||||
outcome: 'success',
|
||||
ip: '10.1.2.3',
|
||||
});
|
||||
const entries = await waitForEntries(1);
|
||||
expect(entries).toHaveLength(1);
|
||||
const e = entries[0];
|
||||
// resource: local part truncated to 2 chars + **** + domain, path suffix kept
|
||||
expect(e.resource).toBe('invites/jo****@example.com/accept');
|
||||
// deep details masked with the canonical shape
|
||||
expect(e.details.body.email).toBe('ja****@example.com');
|
||||
expect(e.details.userEmail).toBe('sa****@example.org');
|
||||
expect(e.details.body.role).toBe('admin'); // non-PII untouched
|
||||
// structural fields untouched
|
||||
expect(e.action).toBe('invite.create');
|
||||
expect(e.outcome).toBe('success');
|
||||
expect(e.ip).toBe('10.1.2.3');
|
||||
expect(e.id).toMatch(/^[0-9a-f-]{36}$/);
|
||||
// no raw email anywhere in the serialized file
|
||||
const raw = fs.readFileSync(process.env.AUDIT_LOG_FILE, 'utf8');
|
||||
expect(raw).not.toContain('john.doe@example.com');
|
||||
expect(raw).not.toContain('jane.doe@example.com');
|
||||
expect(raw).not.toContain('sami@example.org');
|
||||
expect(raw).not.toContain('.doe@'); // no partial-local leaks either
|
||||
});
|
||||
|
||||
test("caller's details object is never mutated", async () => {
|
||||
const details = { body: { email: 'orig@example.com' }, userEmail: 'orig2@example.net' };
|
||||
const before = JSON.stringify(details);
|
||||
await AuditLogger.log({ action: 'x.y', resource: 'r', details, outcome: 'success', ip: '' });
|
||||
const entries = await waitForEntries(2);
|
||||
expect(JSON.stringify(details)).toBe(before); // untouched at the call site
|
||||
expect(entries[0].details.body.email).toBe('or****@example.com'); // masked only in the entry
|
||||
});
|
||||
|
||||
test('middleware end-to-end: body, note, userEmail land masked; *** redaction survives', async () => {
|
||||
const mw = AuditLogger.middleware();
|
||||
const req = {
|
||||
method: 'POST',
|
||||
path: '/api/v1/invites',
|
||||
ip: '192.168.1.50',
|
||||
body: {
|
||||
email: 'invitee@example.com',
|
||||
note: 'for jane.doe@corp.example.com',
|
||||
password: 'hunter2',
|
||||
token: 'abc123',
|
||||
},
|
||||
params: {},
|
||||
user: { id: 'u1', role: 'admin', email: 'admin@example.io' },
|
||||
};
|
||||
const res = { json: jest.fn() };
|
||||
mw(req, res, () => {});
|
||||
res.json({ success: true });
|
||||
const entries = await waitForEntries(3);
|
||||
const e = entries[0];
|
||||
expect(e.details.body.email).toBe('in****@example.com');
|
||||
expect(e.details.body.note).toBe('for ja****@corp.example.com');
|
||||
// sensitive-key redaction (middleware sanitize) intact alongside masking
|
||||
expect(e.details.body.password).toBe('***');
|
||||
expect(e.details.body.token).toBe('***');
|
||||
// DC-048 attribution intact + masked
|
||||
expect(e.details.userId).toBe('u1');
|
||||
expect(e.details.userEmail).toBe('ad****@example.io');
|
||||
expect(e.outcome).toBe('success');
|
||||
});
|
||||
|
||||
test('already-masked entries stay stable (idempotent shape)', async () => {
|
||||
await AuditLogger.log({
|
||||
action: 'x.masked',
|
||||
resource: 'users/jo****@example.com/reset',
|
||||
details: { body: { email: 'jo****@example.com' } },
|
||||
outcome: 'success',
|
||||
ip: '',
|
||||
});
|
||||
const entries = await waitForEntries(4);
|
||||
const e = entries[0];
|
||||
// '*' is not in the local-part class, so the masked form does not re-match
|
||||
expect(e.resource).toBe('users/jo****@example.com/reset');
|
||||
expect(e.details.body.email).toBe('jo****@example.com');
|
||||
});
|
||||
|
||||
test('entries without emails are structurally unchanged', async () => {
|
||||
await AuditLogger.log({
|
||||
action: 'service.create',
|
||||
resource: 'services/nginx',
|
||||
details: { body: { name: 'nginx', port: 8080 } },
|
||||
outcome: 'success',
|
||||
ip: '172.16.0.4',
|
||||
});
|
||||
const entries = await waitForEntries(5);
|
||||
const e = entries[0];
|
||||
expect(e.resource).toBe('services/nginx');
|
||||
expect(e.details.body.name).toBe('nginx');
|
||||
expect(e.details.body.port).toBe(8080);
|
||||
});
|
||||
|
||||
test('security-event mirror carries MASKED target/message (judge round-2 fix)', async () => {
|
||||
await AuditLogger.log({
|
||||
action: 'invite.create',
|
||||
resource: 'invites/john.doe@example.com/accept',
|
||||
details: { body: { email: 'jane.doe@example.com' } },
|
||||
outcome: 'success',
|
||||
ip: '10.5.5.5',
|
||||
});
|
||||
// The mirror write is queued by event-store — poll for our line to land.
|
||||
const deadline = Date.now() + 5000;
|
||||
let mirrorRaw = '';
|
||||
for (;;) {
|
||||
try { mirrorRaw = fs.readFileSync(process.env.SECURITY_EVENT_LOG_FILE, 'utf8'); } catch (_) {}
|
||||
if (mirrorRaw.includes('invite.create')) break;
|
||||
if (Date.now() > deadline) throw new Error('mirror line never landed in security-events.jsonl');
|
||||
await new Promise(r => setTimeout(r, 15));
|
||||
}
|
||||
const line = mirrorRaw.split('\n').find(l => l.includes('invite.create'));
|
||||
const ev = JSON.parse(line);
|
||||
expect(ev.target).toBe('invites/jo****@example.com/accept');
|
||||
expect(ev.message).toBe('invite.create success on invites/jo****@example.com/accept');
|
||||
// no raw email anywhere in the mirror file
|
||||
expect(mirrorRaw).not.toContain('john.doe@example.com');
|
||||
expect(mirrorRaw).not.toContain('jane.doe@example.com');
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,134 @@
|
||||
/**
|
||||
* DC-057 pricing-page catalog consistency test.
|
||||
*
|
||||
* The pricing page at status/pricing/index.html hard-codes the 4 product
|
||||
* IDs, prices, and labels. This test asserts that those hard-coded values
|
||||
* exactly match the catalog in src/billing/catalog.js — preventing drift
|
||||
* between the two sources.
|
||||
*
|
||||
* If a new tier is added to the catalog, this test will fail until the
|
||||
* pricing page is updated. If the pricing page is updated, the catalog
|
||||
* must change in lockstep (or this test fails the other way).
|
||||
*/
|
||||
|
||||
const fs = require('fs');
|
||||
const path = require('path');
|
||||
const catalog = require('../../src/billing/catalog');
|
||||
|
||||
const PRICING_PAGE_PATH = path.join(__dirname, '..', '..', '..', 'status', 'pricing', 'index.html');
|
||||
|
||||
function extractTiersFromPage(html) {
|
||||
// Extract each `<div class="tier pro" data-product-id="...">` block, then
|
||||
// pull out the dollar amount in the `<div class="price">` element and
|
||||
// the durationDays from the "N-day Pro license" string. The regex is
|
||||
// anchored on the tier-class open + the matching buy-btn close so we
|
||||
// capture the full body of each tier card regardless of how many inner
|
||||
// divs it has.
|
||||
const tierRe = /<div class="tier pro" data-product-id="([^"]+)">([\s\S]*?)<button[^>]*class="buy-btn"[^>]*>\s*Buy/g;
|
||||
const tierBlocks = [...html.matchAll(tierRe)];
|
||||
return tierBlocks.map(([, productId, body]) => {
|
||||
const priceMatch = body.match(/<div class="price">\$(\d+)<\/div>/);
|
||||
const durMatch = body.match(/(\d+)-day Pro license/);
|
||||
return {
|
||||
productId,
|
||||
priceDollars: priceMatch ? parseInt(priceMatch[1], 10) : null,
|
||||
durationDays: durMatch ? parseInt(durMatch[1], 10) : null,
|
||||
};
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Extract the HTML body for one specific tier (from open div through the
|
||||
* buy-btn). Used by per-tier assertions that must NOT bleed across cards.
|
||||
*/
|
||||
function extractTierBody(html, productId) {
|
||||
const re = new RegExp(
|
||||
`<div class="tier pro" data-product-id="${productId}">([\\s\\S]*?)<button[^>]*class="buy-btn"[^>]*>\\s*Buy`,
|
||||
'i'
|
||||
);
|
||||
const m = html.match(re);
|
||||
return m ? m[1] : null;
|
||||
}
|
||||
|
||||
describe('pricing page <-> catalog consistency (DC-057)', () => {
|
||||
let html;
|
||||
let pageTiers;
|
||||
|
||||
beforeAll(() => {
|
||||
html = fs.readFileSync(PRICING_PAGE_PATH, 'utf8');
|
||||
pageTiers = extractTiersFromPage(html);
|
||||
});
|
||||
|
||||
test('pricing page exists and is readable', () => {
|
||||
expect(html.length).toBeGreaterThan(1000);
|
||||
expect(pageTiers.length).toBeGreaterThan(0);
|
||||
});
|
||||
|
||||
test('every catalog product is rendered on the pricing page', () => {
|
||||
const catalogIds = catalog.PRODUCTS.map((p) => p.id).sort();
|
||||
const pageIds = pageTiers.map((t) => t.productId).sort();
|
||||
expect(pageIds).toEqual(catalogIds);
|
||||
});
|
||||
|
||||
test('every pricing-page productId appears in the catalog', () => {
|
||||
for (const tier of pageTiers) {
|
||||
const product = catalog.getProduct(tier.productId);
|
||||
expect(product).not.toBeNull();
|
||||
}
|
||||
});
|
||||
|
||||
test('pricing-page dollar amounts match catalog amountCents', () => {
|
||||
for (const tier of pageTiers) {
|
||||
const product = catalog.getProduct(tier.productId);
|
||||
const expectedDollars = product.amountCents / 100;
|
||||
expect(tier.priceDollars).toBe(expectedDollars);
|
||||
}
|
||||
});
|
||||
|
||||
test('pricing-page duration strings match catalog durationDays', () => {
|
||||
for (const tier of pageTiers) {
|
||||
const product = catalog.getProduct(tier.productId);
|
||||
expect(tier.durationDays).toBe(product.durationDays);
|
||||
}
|
||||
});
|
||||
|
||||
test('catalog and pricing page agree on price label (scoped per tier card)', () => {
|
||||
// Per-tier priceLabel assertion: each tier card must include its
|
||||
// own catalog.priceLabel. A swap or misplaced label fails immediately
|
||||
// because the assertion checks the tier's own HTML body, not the page.
|
||||
for (const tier of pageTiers) {
|
||||
const product = catalog.getProduct(tier.productId);
|
||||
const body = extractTierBody(html, tier.productId);
|
||||
expect(body).not.toBeNull();
|
||||
// The priceLabel appears in the price div of THIS tier only,
|
||||
// immediately followed by the closing </div> + the duration block.
|
||||
const labelRegex = new RegExp(`<div class="price">\\s*\\${product.priceLabel}\\s*</div>\\s*<div class="duration"`);
|
||||
expect(body).toMatch(labelRegex);
|
||||
}
|
||||
});
|
||||
|
||||
test('pricing page does not include the monthly/annual subscription toggle (one-time only)', () => {
|
||||
// DC-057 acceptance: locked spec is ONE-TIME 30/90/180/365-day licenses
|
||||
// at $20/$50/$70/$99. The old monthly/annual subscription toggle
|
||||
// would contradict the spec.
|
||||
expect(html).not.toMatch(/period-monthly|period-annual/);
|
||||
expect(html).not.toMatch(/Subscribe to Pro/);
|
||||
});
|
||||
|
||||
test('pricing page references the success-page endpoint', () => {
|
||||
// The success URL is constructed server-side in stripe-client.js
|
||||
// (${origin}/billing/success?session_id=...). The pricing page itself
|
||||
// doesn't need to embed it — but the FOOTER must reference it so the
|
||||
// customer knows where to go after Stripe redirects.
|
||||
expect(html.toLowerCase()).toContain('after payment');
|
||||
expect(html).toContain('/admin/license');
|
||||
expect(html).toContain('/api/v1/billing/checkout');
|
||||
});
|
||||
|
||||
test('success page (status/billing/success.html) exists and references the lookup endpoint', () => {
|
||||
const successPath = path.join(__dirname, '..', '..', '..', 'status', 'billing', 'success.html');
|
||||
const successHtml = fs.readFileSync(successPath, 'utf8');
|
||||
expect(successHtml).toContain('/api/v1/billing/lookup/');
|
||||
expect(successHtml.length).toBeGreaterThan(1000);
|
||||
});
|
||||
});
|
||||
@@ -253,8 +253,8 @@ describe('WorkflowEngine._runActions — DC-044 root-cause (notify-on-failure +
|
||||
expect(healthResult.failingServices).toEqual(['svc-broken']);
|
||||
expect(notifyResult.success).toBe(true);
|
||||
expect(notify).toHaveBeenCalledTimes(1);
|
||||
// DC-094 notification.send signature: (event, { title, text }, level)
|
||||
const sentMessage = notify.mock.calls[0][1].text;
|
||||
// notification.send signature: (category, title, message, level)
|
||||
const sentMessage = notify.mock.calls[0][2];
|
||||
expect(sentMessage).toBe('Health check failed for svc-broken');
|
||||
expect(sentMessage).not.toContain('{{');
|
||||
});
|
||||
@@ -269,7 +269,7 @@ describe('WorkflowEngine._runActions — DC-044 root-cause (notify-on-failure +
|
||||
);
|
||||
|
||||
expect(notify).toHaveBeenCalledTimes(1);
|
||||
expect(notify.mock.calls[0][1].text).toBe('always sent');
|
||||
expect(notify.mock.calls[0][2]).toBe('always sent');
|
||||
expect(results[0].success).toBe(true);
|
||||
});
|
||||
|
||||
@@ -313,7 +313,7 @@ describe('WorkflowEngine._runActions — DC-044 root-cause (notify-on-failure +
|
||||
);
|
||||
|
||||
expect(notify).toHaveBeenCalledTimes(1);
|
||||
const sentMessage = notify.mock.calls[0][1].text;
|
||||
const sentMessage = notify.mock.calls[0][2];
|
||||
expect(sentMessage).toBe('Failing: svc-broken-1,svc-broken-2');
|
||||
expect(results.find(r => r.action === 'notify-on-failure').success).toBe(true);
|
||||
});
|
||||
@@ -346,7 +346,7 @@ describe('WorkflowEngine._runActions — DC-044 root-cause (notify-on-failure +
|
||||
// message) OR every action resolved — but in NO case may a literal
|
||||
// {{...}} template token leak into notification.send.
|
||||
if (notify.mock.calls.length > 0) {
|
||||
const sentMessage = notify.mock.calls[0][1].text;
|
||||
const sentMessage = notify.mock.calls[0][2];
|
||||
expect(sentMessage).not.toMatch(/\{\{/);
|
||||
expect(sentMessage).not.toMatch(/\}\}/);
|
||||
// The new bundled template substitutes failingServices — make sure
|
||||
|
||||
@@ -10,67 +10,38 @@ const path = require('path');
|
||||
const Module = require('module');
|
||||
|
||||
// Mock fs with controllable behavior.
|
||||
const mockFsState = {
|
||||
const fsState = {
|
||||
files: {}, // path -> string content
|
||||
exists: {}, // path -> bool
|
||||
writeLog: [], // writeFileSync calls
|
||||
fdMap: new Map(), // open fd -> { p, content } (DC-105 atomic-write path)
|
||||
closedTmp: new Map(), // closed-but-not-yet-renamed tmp path -> content
|
||||
nextFd: 0,
|
||||
writeLog: [], // writes
|
||||
};
|
||||
|
||||
jest.mock('fs', () => {
|
||||
const real = jest.requireActual('fs');
|
||||
return {
|
||||
...real,
|
||||
existsSync: jest.fn((p) => mockFsState.exists[p] !== undefined ? mockFsState.exists[p] : (mockFsState.files[p] !== undefined)),
|
||||
existsSync: jest.fn((p) => fsState.exists[p] !== undefined ? fsState.exists[p] : (fsState.files[p] !== undefined)),
|
||||
readFileSync: jest.fn((p) => {
|
||||
if (mockFsState.files[p] === undefined) {
|
||||
if (fsState.files[p] === undefined) {
|
||||
const e = new Error(`ENOENT: ${p}`);
|
||||
e.code = 'ENOENT';
|
||||
throw e;
|
||||
}
|
||||
return mockFsState.files[p];
|
||||
return fsState.files[p];
|
||||
}),
|
||||
readdirSync: jest.fn((p) => Object.keys(mockFsState.files).filter(f => f.startsWith(p + '/')).map(f => f.substring(p.length + 1))),
|
||||
readdirSync: jest.fn((p) => Object.keys(fsState.files).filter(f => f.startsWith(p + '/')).map(f => f.substring(p.length + 1))),
|
||||
writeFileSync: jest.fn((p, content) => {
|
||||
mockFsState.writeLog.push({ p, content });
|
||||
mockFsState.files[p] = content;
|
||||
mockFsState.exists[p] = true;
|
||||
fsState.writeLog.push({ p, content });
|
||||
fsState.files[p] = content;
|
||||
fsState.exists[p] = true;
|
||||
}),
|
||||
mkdirSync: jest.fn(),
|
||||
// DC-105 canonical atomic-write path (atomic-write.js): openSync('wx') →
|
||||
// writeSync → fsyncSync → closeSync → renameSync → dir fsync. Content
|
||||
// accumulates per-fd, is stashed on close, and lands in files[] on rename.
|
||||
openSync: jest.fn((p) => {
|
||||
mockFsState.nextFd += 1;
|
||||
mockFsState.fdMap.set(mockFsState.nextFd, { p, content: '' });
|
||||
return mockFsState.nextFd;
|
||||
}),
|
||||
writeSync: jest.fn((fd, content) => {
|
||||
const rec = mockFsState.fdMap.get(fd);
|
||||
if (!rec) throw new Error(`EBADF: fd ${fd}`);
|
||||
rec.content += content;
|
||||
}),
|
||||
fsyncSync: jest.fn(),
|
||||
closeSync: jest.fn((fd) => {
|
||||
const rec = mockFsState.fdMap.get(fd);
|
||||
if (rec) {
|
||||
mockFsState.closedTmp.set(rec.p, rec.content);
|
||||
mockFsState.fdMap.delete(fd);
|
||||
}
|
||||
}),
|
||||
renameSync: jest.fn((src, dst) => {
|
||||
const content = mockFsState.closedTmp.has(src)
|
||||
? mockFsState.closedTmp.get(src)
|
||||
: mockFsState.files[src];
|
||||
mockFsState.files[dst] = content;
|
||||
mockFsState.exists[dst] = true;
|
||||
mockFsState.closedTmp.delete(src);
|
||||
delete mockFsState.files[src];
|
||||
delete mockFsState.exists[src];
|
||||
}),
|
||||
unlinkSync: jest.fn()
|
||||
fsState.files[dst] = fsState.files[src];
|
||||
fsState.exists[dst] = true;
|
||||
delete fsState.files[src];
|
||||
delete fsState.exists[src];
|
||||
})
|
||||
};
|
||||
});
|
||||
|
||||
@@ -133,12 +104,9 @@ jest.mock('https', () => ({
|
||||
|
||||
// Reset fs mock state between tests.
|
||||
beforeEach(() => {
|
||||
mockFsState.files = {};
|
||||
mockFsState.exists = {};
|
||||
mockFsState.writeLog = [];
|
||||
mockFsState.fdMap = new Map();
|
||||
mockFsState.closedTmp = new Map();
|
||||
mockFsState.nextFd = 0;
|
||||
fsState.files = {};
|
||||
fsState.exists = {};
|
||||
fsState.writeLog = [];
|
||||
probeQueue.length = 0;
|
||||
jest.clearAllMocks();
|
||||
jest.resetModules();
|
||||
@@ -150,8 +118,8 @@ describe('CaddyUpstreamWatcher', () => {
|
||||
|
||||
function seedSites(files) {
|
||||
for (const [name, content] of Object.entries(files)) {
|
||||
mockFsState.files[SITES + '/' + name] = content;
|
||||
mockFsState.exists[SITES + '/' + name] = true;
|
||||
fsState.files[SITES + '/' + name] = content;
|
||||
fsState.exists[SITES + '/' + name] = true;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -215,8 +183,8 @@ describe('CaddyUpstreamWatcher', () => {
|
||||
const { w } = loadWatcher();
|
||||
await w.scanSites();
|
||||
expect(w.upstreams.size).toBe(1);
|
||||
mockFsState.files = {}; // wipe
|
||||
mockFsState.exists = {};
|
||||
fsState.files = {}; // wipe
|
||||
fsState.exists = {};
|
||||
await w.scanSites();
|
||||
expect(w.upstreams.size).toBe(0);
|
||||
});
|
||||
@@ -393,56 +361,22 @@ describe('CaddyUpstreamWatcher', () => {
|
||||
const { w } = loadWatcher();
|
||||
await w.scanSites();
|
||||
w.setMuted('1.1.1.1:80', true);
|
||||
// DC-105: _saveState delegates to atomicWriteJSON — content lands via
|
||||
// openSync('wx')+writeSync+rename, not writeFileSync to a fixed .tmp.
|
||||
// The renamed destination must carry the muted host.
|
||||
expect(mockFsState.exists[STATE]).toBe(true);
|
||||
const data = JSON.parse(mockFsState.files[STATE]);
|
||||
// _saveState writes to STATE + '.tmp' then renames. Look for the .tmp
|
||||
// write since that's the actual writeFileSync call (rename is silent).
|
||||
const writes = fsState.writeLog.filter(w => w.p === STATE + '.tmp' || w.p === STATE);
|
||||
expect(writes.length).toBeGreaterThan(0);
|
||||
const last = writes[writes.length - 1];
|
||||
const data = JSON.parse(last.content);
|
||||
expect(data.muted).toContain('1.1.1.1:80');
|
||||
// And the legacy fixed-name tmp path must NOT have been used.
|
||||
expect(mockFsState.writeLog.filter(w => w.p === STATE + '.tmp').length).toBe(0);
|
||||
});
|
||||
|
||||
// ---- DC-105: state file goes through the canonical atomic-write util ------
|
||||
|
||||
test('DC-105: _saveState uses atomicWriteJSON (wx tmp + fsync + rename, no fixed .tmp)', async () => {
|
||||
seedSites({ 'a.sami': 'a.sami { reverse_proxy 1.1.1.1:80 }\n' });
|
||||
const { w } = loadWatcher();
|
||||
await w.scanSites();
|
||||
w.setMuted('1.1.1.1:80', true);
|
||||
|
||||
const fs = require('fs');
|
||||
// The canonical writer must have been used: open with 'wx' (exclusive
|
||||
// create), fsync before close, then rename onto the destination.
|
||||
expect(fs.openSync).toHaveBeenCalled();
|
||||
expect(fs.fsyncSync).toHaveBeenCalled();
|
||||
expect(fs.closeSync).toHaveBeenCalled();
|
||||
const renames = fs.renameSync.mock.calls.filter(c => c[1] === STATE);
|
||||
expect(renames.length).toBeGreaterThan(0);
|
||||
// Tmp names are hidden dotfiles in the same dir with pid+counter — the
|
||||
// old fixed `STATE + '.tmp'` collision window between concurrent saves
|
||||
// (probe loop vs setMuted) is gone.
|
||||
for (const [src] of renames) {
|
||||
expect(src).toMatch(/[\\/].caddy-upstreams-test[.]json[.]tmp-/);
|
||||
expect(src).not.toBe(STATE + '.tmp');
|
||||
}
|
||||
// No leftover tmp files after a successful save.
|
||||
const leftovers = Object.keys(mockFsState.files)
|
||||
.filter(p => p.includes('.tmp-'));
|
||||
expect(leftovers).toEqual([]);
|
||||
// Destination holds complete, parseable JSON with the mute.
|
||||
const data = JSON.parse(mockFsState.files[STATE]);
|
||||
expect(data.muted).toContain('1.1.1.1:80');
|
||||
expect(data.upstreams['1.1.1.1:80'].site).toBe('a.sami');
|
||||
});
|
||||
|
||||
test('reload from state file restores muted list', async () => {
|
||||
// Pre-seed a state file with a muted host
|
||||
mockFsState.files[STATE] = JSON.stringify({
|
||||
fsState.files[STATE] = JSON.stringify({
|
||||
muted: ['99.99.99.99:80'],
|
||||
upstreams: { '99.99.99.99:80': { ip: '99.99.99.99', port: '80', site: 'old.sami', siteFile: 'old.sami' } }
|
||||
});
|
||||
mockFsState.exists[STATE] = true;
|
||||
fsState.exists[STATE] = true;
|
||||
// And the matching site file
|
||||
seedSites({ 'old.sami': 'old.sami { reverse_proxy 99.99.99.99:80 }\n' });
|
||||
process.env.CADDY_UPSTREAMS_STATE_FILE = STATE;
|
||||
|
||||
@@ -1,248 +0,0 @@
|
||||
/**
|
||||
* DC-112 regression pins — caddy access-log worker event naming.
|
||||
*
|
||||
* Background (found 2026-08-23 while taking queue item (g)):
|
||||
* the caddy tail worker named every event `http.<status>`, including
|
||||
* forward_auth SSO gate hits — the same defect class as DC-111 defect 1
|
||||
* (uniform action names make "who hit the gate?" unanswerable), in a
|
||||
* different writer. Caddy gates call the API with the LEGACY pre-shim
|
||||
* prefix (/api/auth/gate/<id>), dashboard JS with the canonical
|
||||
* /api/v1/... prefix — both must map to the audit logger's ACTION_MAP
|
||||
* vocabulary so both writers use the same names for the same request.
|
||||
*
|
||||
* Also pinned here:
|
||||
* - severity escalation for denied gate hits (warn, not notice)
|
||||
* - metadata fidelity: caddy logs headers as ARRAYS — the old
|
||||
* single-value read always produced user_agent: null
|
||||
* - metadata.host (which vhost served the request)
|
||||
* - the dead-path visibility warn: when the configured log path is
|
||||
* missing, the worker used to be fully silent — in the current DNS2
|
||||
* container there is no /var/log/caddy mount and no override, so ALL
|
||||
* caddy-source events were silently absent (store census: 45,912
|
||||
* events, 100% source_type 'api', zero 'caddy').
|
||||
*
|
||||
* The worker test exercises the REAL worker: a temp access log written
|
||||
* like caddy writes it (JSON lines), a real tail with a short poll
|
||||
* interval, and the real event store pointed at a temp jsonl. No mocks
|
||||
* of the module under test.
|
||||
*/
|
||||
|
||||
const path = require('path');
|
||||
const fs = require('fs');
|
||||
const os = require('os');
|
||||
|
||||
// Hermetic sinks (same pattern as audit-gate-path-dc111.test.js)
|
||||
const TMP_DIR = fs.mkdtempSync(path.join(os.tmpdir(), 'dc112-caddy-'));
|
||||
process.env.SECURITY_EVENT_LOG_FILE = path.join(TMP_DIR, 'security-events.jsonl');
|
||||
process.env.CADDY_ACCESS_LOG = path.join(TMP_DIR, 'access.log');
|
||||
process.env.DATA_DIR = TMP_DIR; // platformPaths.dataDir -> state file location
|
||||
|
||||
const { startCaddyWorker, resolveCaddyAction } = require('../src/security/event-workers');
|
||||
const { getStore } = require('../src/security/event-store');
|
||||
|
||||
// Silence the module-level logger for the warn test while still capturing it.
|
||||
let capturedWarns = [];
|
||||
const fakeLogger = {
|
||||
warn: (ctx, msg, extra) => capturedWarns.push({ ctx, msg, extra }),
|
||||
info: () => {},
|
||||
error: () => {},
|
||||
};
|
||||
|
||||
const ACCESS_LOG = process.env.CADDY_ACCESS_LOG;
|
||||
const STORE_FILE = process.env.SECURITY_EVENT_LOG_FILE;
|
||||
|
||||
function readStored() {
|
||||
try {
|
||||
return fs.readFileSync(STORE_FILE, 'utf8').trim().split('\n')
|
||||
.filter(Boolean).map(l => JSON.parse(l));
|
||||
} catch { return []; }
|
||||
}
|
||||
|
||||
// Wait until the tail has picked up `n` events (it polls; append to the
|
||||
// store is sync after the line is read).
|
||||
async function waitForEvents(n, { timeoutMs = 5000 } = {}) {
|
||||
const deadline = Date.now() + timeoutMs;
|
||||
while (Date.now() < deadline) {
|
||||
const events = readStored().filter(e => e.source_type === 'caddy');
|
||||
if (events.length >= n) return events;
|
||||
await new Promise(r => setTimeout(r, 50));
|
||||
}
|
||||
throw new Error(`timed out waiting for ${n} caddy events (got ${readStored().length})`);
|
||||
}
|
||||
|
||||
beforeEach(() => {
|
||||
fs.writeFileSync(STORE_FILE, '', 'utf8');
|
||||
fs.writeFileSync(ACCESS_LOG, '', 'utf8');
|
||||
// Reset the tail's persisted offset — it lives in TMP_DIR (DATA_DIR) and
|
||||
// survives across tests; a stale offset makes the next worker resume
|
||||
// mid-line and parse only partial JSON (0 events).
|
||||
fs.writeFileSync(path.join(TMP_DIR, '.caddy-tail-offset'), '0', 'utf8');
|
||||
capturedWarns = [];
|
||||
getStore({ log: fakeLogger }); // fresh singleton pointed at the temp store file
|
||||
});
|
||||
|
||||
afterAll(() => {
|
||||
try { fs.rmSync(TMP_DIR, { recursive: true, force: true }); } catch {}
|
||||
});
|
||||
|
||||
describe('resolveCaddyAction — action naming parity with the audit logger', () => {
|
||||
test.each([
|
||||
// Caddy forward_auth shape (legacy pre-shim prefix, what the Caddyfile's
|
||||
// dashcaddy_auth snippet sends — see /etc/caddy/Caddyfile line 87)
|
||||
['GET', '/api/auth/gate/plex', 401, 'auth.credential-injection'],
|
||||
['GET', '/api/auth/gate/jellyfin', 200, 'auth.credential-injection'],
|
||||
// Canonical shape (dashboard JS)
|
||||
['GET', '/api/v1/auth/gate/plex', 401, 'auth.credential-injection'],
|
||||
['GET', '/api/v1/auth/gate/plex?forward=/x', 401, 'auth.credential-injection'],
|
||||
// app-token (auto-login pages)
|
||||
['GET', '/api/auth/app-token/plex', 200, 'auth.app-token-issue'],
|
||||
['GET', '/api/v1/auth/app-token/plex', 200, 'auth.app-token-issue'],
|
||||
// sso-exchange is a POST
|
||||
['POST', '/api/auth/sso-exchange', 200, 'auth.sso-exchange'],
|
||||
['POST', '/api/v1/auth/sso-exchange', 401, 'auth.sso-exchange'],
|
||||
// Non-auth traffic keeps the status-derived action
|
||||
['GET', '/api/health', 401, 'http.401'],
|
||||
['GET', '/index.html', 200, 'http.200'],
|
||||
['GET', '/wp-admin/setup-config.php', 404, 'http.404'],
|
||||
// Wrong method on auth paths: named only for the verbs the routes use
|
||||
['POST', '/api/auth/gate/plex', 401, 'http.401'],
|
||||
// Boundary: exact-path match for sso-exchange — lookalike paths must
|
||||
// NOT be misnamed (judge polish round)
|
||||
['POST', '/api/auth/sso-exchange-x', 404, 'http.404'],
|
||||
['POST', '/api/v1/auth/sso-exchange/extra', 404, 'http.404'],
|
||||
['POST', '/api/auth/sso-exchange?nonce=1', 200, 'auth.sso-exchange'],
|
||||
])('%s %s -> %s', (method, uri, status, expected) => {
|
||||
expect(resolveCaddyAction(method, uri, status)).toBe(expected);
|
||||
});
|
||||
|
||||
test('does NOT rename non-gate auth traffic (e.g. TOTP verify stays http.<status>)', () => {
|
||||
// /api/v1/totp/verify is a credential POST but not in ACTION_MAP's
|
||||
// security-logging set; the caddy worker keeps its status action.
|
||||
expect(resolveCaddyAction('POST', '/api/v1/totp/verify', 200)).toBe('http.200');
|
||||
});
|
||||
});
|
||||
|
||||
describe('caddy worker end-to-end (real tail + real store)', () => {
|
||||
let worker;
|
||||
afterEach(() => { if (worker) { worker.stop(); worker = null; } });
|
||||
|
||||
test('gate hit is named, escalated, and carries array-normalized UA + host', async () => {
|
||||
// A realistic forward_auth gate miss, exactly as caddy logs it:
|
||||
// headers as arrays, host nested in request, duration in seconds.
|
||||
fs.appendFileSync(ACCESS_LOG, JSON.stringify({
|
||||
ts: 1787500800,
|
||||
request: { host: 'plex.sami',
|
||||
|
||||
remote_ip: '10.9.9.9',
|
||||
method: 'GET',
|
||||
uri: '/api/auth/gate/plex',
|
||||
proto: 'HTTP/1.1',
|
||||
headers: { 'User-Agent': ['PlexDBRoulette/1.0'] },
|
||||
},
|
||||
status: 401,
|
||||
duration: 0.007,
|
||||
size: 42,
|
||||
}) + '\n');
|
||||
|
||||
worker = startCaddyWorker({ log: fakeLogger });
|
||||
const [ev] = await waitForEvents(1);
|
||||
|
||||
expect(ev.action).toBe('auth.credential-injection');
|
||||
expect(ev.outcome).toBe('denied');
|
||||
expect(ev.severity).toBe('warn'); // escalated from the 401 mapping
|
||||
expect(ev.actor).toBe('10.9.9.9');
|
||||
expect(ev.target).toBe('GET /api/auth/gate/plex');
|
||||
expect(ev.source_type).toBe('caddy');
|
||||
expect(ev.metadata.user_agent).toBe('PlexDBRoulette/1.0'); // was null pre-fix
|
||||
expect(ev.metadata.host).toBe('plex.sami'); // new
|
||||
expect(ev.metadata.status).toBe(401);
|
||||
expect(ev.metadata.duration_seconds).toBe(0.007); // judge polish: true unit
|
||||
expect(ev.metadata.duration_ms).toBe(0.007); // legacy field, unchanged semantics
|
||||
});
|
||||
|
||||
test('canonical gate hit and sso-exchange POST are named too', async () => {
|
||||
fs.appendFileSync(ACCESS_LOG, JSON.stringify({
|
||||
ts: 1787500801,
|
||||
request: { host: 'status.sami',
|
||||
remote_ip: '10.9.9.8', method: 'GET', uri: '/api/v1/auth/gate/sonarr', proto: 'HTTP/2.0', headers: { 'User-Agent': ['Mozilla/5.0'] } },
|
||||
status: 401,
|
||||
duration: 0.002,
|
||||
}) + '\n');
|
||||
fs.appendFileSync(ACCESS_LOG, JSON.stringify({
|
||||
ts: 1787500802,
|
||||
request: { host: 'status.sami',
|
||||
remote_ip: '10.9.9.8', method: 'POST', uri: '/api/auth/sso-exchange', proto: 'HTTP/2.0', headers: { 'user-agent': ['DashCaddy-Login/1.0'] } },
|
||||
status: 200,
|
||||
duration: 0.084,
|
||||
}) + '\n');
|
||||
|
||||
worker = startCaddyWorker({ log: fakeLogger });
|
||||
const events = await waitForEvents(2);
|
||||
|
||||
const gate = events.find(e => e.action === 'auth.credential-injection');
|
||||
const sso = events.find(e => e.action === 'auth.sso-exchange');
|
||||
expect(gate).toBeDefined();
|
||||
expect(gate.severity).toBe('warn');
|
||||
expect(sso).toBeDefined();
|
||||
expect(sso.outcome).toBe('success');
|
||||
expect(sso.severity).toBe('info');
|
||||
expect(sso.metadata.user_agent).toBe('DashCaddy-Login/1.0'); // lowercase-key variant
|
||||
});
|
||||
|
||||
test('ordinary traffic keeps http.<status> naming and default severity', async () => {
|
||||
fs.appendFileSync(ACCESS_LOG, JSON.stringify({
|
||||
ts: 1787500803,
|
||||
request: { host: 'status.sami',
|
||||
remote_ip: '100.121.150.22', method: 'GET', uri: '/api/health', proto: 'HTTP/2.0', headers: { 'User-Agent': ['watchdog'] } },
|
||||
status: 401,
|
||||
duration: 0.004,
|
||||
}) + '\n');
|
||||
|
||||
worker = startCaddyWorker({ log: fakeLogger });
|
||||
const [ev] = await waitForEvents(1);
|
||||
expect(ev.action).toBe('http.401');
|
||||
expect(ev.severity).toBe('warn'); // 401 mapping, not the sensitive-path escalation
|
||||
expect(ev.outcome).toBe('denied');
|
||||
});
|
||||
|
||||
test('non-JSON lines are skipped without emitting', async () => {
|
||||
fs.appendFileSync(ACCESS_LOG, 'not json at all\n{"ts":1,"request":{"remote_ip":"1.1.1.1","method":"GET","uri":"/"},"status":200}\n');
|
||||
worker = startCaddyWorker({ log: fakeLogger });
|
||||
const [ev] = await waitForEvents(1);
|
||||
expect(readStored().filter(e => e.source_type === 'caddy').length).toBe(1);
|
||||
expect(ev.action).toBe('http.200');
|
||||
});
|
||||
|
||||
test('restart does not re-emit: offset persistence across worker instances', async () => {
|
||||
fs.appendFileSync(ACCESS_LOG, JSON.stringify({
|
||||
ts: 1787500804,
|
||||
request: { host: 'plex.sami',
|
||||
remote_ip: '10.9.9.9', method: 'GET', uri: '/api/auth/gate/plex', headers: {} },
|
||||
status: 401,
|
||||
}) + '\n');
|
||||
|
||||
worker = startCaddyWorker({ log: fakeLogger });
|
||||
await waitForEvents(1);
|
||||
worker.stop();
|
||||
await new Promise(r => setTimeout(r, 150)); // let offset persist tick
|
||||
|
||||
// Second worker instance reads the persisted offset state file
|
||||
fs.writeFileSync(STORE_FILE, '', 'utf8');
|
||||
worker = startCaddyWorker({ log: fakeLogger });
|
||||
await new Promise(r => setTimeout(r, 400));
|
||||
expect(readStored().filter(e => e.source_type === 'caddy').length).toBe(0);
|
||||
});
|
||||
|
||||
test('warns ONCE when the access log path is missing (dead-path visibility)', async () => {
|
||||
fs.rmSync(ACCESS_LOG);
|
||||
worker = startCaddyWorker({ log: fakeLogger });
|
||||
await new Promise(r => setTimeout(r, 200));
|
||||
expect(capturedWarns.length).toBeGreaterThanOrEqual(1);
|
||||
expect(capturedWarns[0].msg).toMatch(/caddy access log not found/);
|
||||
expect(capturedWarns[0].msg).toContain('/access.log');
|
||||
|
||||
// Once-only: a second check doesn't re-warn
|
||||
await new Promise(r => setTimeout(r, 200));
|
||||
expect(capturedWarns.filter(w => /caddy access log not found/.test(w.msg)).length).toBe(1);
|
||||
});
|
||||
});
|
||||
@@ -1,314 +0,0 @@
|
||||
/**
|
||||
* DC-113 regression pins — caddy security-event pipeline activation.
|
||||
*
|
||||
* Background (queue item h, 2026-08-23): the caddy tail worker was fully
|
||||
* wired (DC-112 named the gate events) but 100% DEAD in production — no
|
||||
* /var/log/caddy mount in the container, no CADDY_ACCESS_LOG env, and no
|
||||
* global access log in the Caddyfile. Store census: 45,912 events, 100%
|
||||
* source_type 'api', ZERO 'caddy'. DC-113 wires the pipeline:
|
||||
* - global Caddyfile logger `dashcaddy-access` (file /var/log/caddy/
|
||||
* access.log, roll 50MiB keep 5) + `log dashcaddy-access` in every
|
||||
* site block (via caddy-apply, host-side — NOT pinned here)
|
||||
* - start.sh: -v /var/log/caddy:/var/log/caddy:ro + CADDY_ACCESS_LOG env
|
||||
* - worker fixes pinned in THIS file:
|
||||
* 1. real caddy JSON nests `host` inside `request` — the top-level
|
||||
* read (DC-112, fixture-shaped) always produced null on live lines
|
||||
* 2. self-noise filter: the API's own probes (DashCaddy-Probe/1.0,
|
||||
* DashCaddy-HealthCheck/1.0) hit Caddy every 10-30s per service
|
||||
* and would bury real perimeter signal in the 100k-event store
|
||||
* 3. recovered-log visibility (DC-112 judge polish fold): when the
|
||||
* access log appears after startup, one info line is logged
|
||||
*
|
||||
* All tests use the REAL worker: temp access log, real tail, real event
|
||||
* store, hermetic sinks. No mocks of the module under test.
|
||||
*/
|
||||
|
||||
const path = require('path');
|
||||
const fs = require('fs');
|
||||
const os = require('os');
|
||||
|
||||
// Hermetic sinks (same pattern as caddy-worker-naming-dc112.test.js)
|
||||
const TMP_DIR = fs.mkdtempSync(path.join(os.tmpdir(), 'dc113-caddy-'));
|
||||
process.env.SECURITY_EVENT_LOG_FILE = path.join(TMP_DIR, 'security-events.jsonl');
|
||||
process.env.CADDY_ACCESS_LOG = path.join(TMP_DIR, 'access.log');
|
||||
process.env.DATA_DIR = TMP_DIR;
|
||||
|
||||
const { startCaddyWorker } = require('../src/security/event-workers');
|
||||
const { getStore } = require('../src/security/event-store');
|
||||
|
||||
let capturedWarns = [];
|
||||
let capturedInfos = [];
|
||||
const fakeLogger = {
|
||||
warn: (ctx, msg, extra) => capturedWarns.push({ ctx, msg, extra }),
|
||||
info: (ctx, msg, extra) => capturedInfos.push({ ctx, msg, extra }),
|
||||
error: () => {},
|
||||
};
|
||||
|
||||
const ACCESS_LOG = process.env.CADDY_ACCESS_LOG;
|
||||
const STORE_FILE = process.env.SECURITY_EVENT_LOG_FILE;
|
||||
|
||||
function readStored() {
|
||||
try {
|
||||
return fs.readFileSync(STORE_FILE, 'utf8').trim().split('\n')
|
||||
.filter(Boolean).map(l => JSON.parse(l));
|
||||
} catch { return []; }
|
||||
}
|
||||
|
||||
async function waitForEvents(n, { timeoutMs = 5000 } = {}) {
|
||||
const deadline = Date.now() + timeoutMs;
|
||||
while (Date.now() < deadline) {
|
||||
const events = readStored().filter(e => e.source_type === 'caddy');
|
||||
if (events.length >= n) return events;
|
||||
await new Promise(r => setTimeout(r, 50));
|
||||
}
|
||||
throw new Error(`timed out waiting for ${n} caddy events (got ${readStored().filter(e => e.source_type === 'caddy').length})`);
|
||||
}
|
||||
|
||||
beforeEach(() => {
|
||||
fs.writeFileSync(STORE_FILE, '', 'utf8');
|
||||
fs.writeFileSync(ACCESS_LOG, '', 'utf8');
|
||||
// Reset the tail's persisted offset (same flake lesson as DC-112).
|
||||
fs.writeFileSync(path.join(TMP_DIR, '.caddy-tail-offset'), '0', 'utf8');
|
||||
capturedWarns = [];
|
||||
capturedInfos = [];
|
||||
getStore({ log: fakeLogger }); // fresh singleton pointed at the temp store file
|
||||
});
|
||||
|
||||
afterAll(() => {
|
||||
try { fs.rmSync(TMP_DIR, { recursive: true, force: true }); } catch {}
|
||||
});
|
||||
|
||||
describe('DC-113: real caddy JSON shape — host nested inside request', () => {
|
||||
let worker;
|
||||
afterEach(() => { if (worker) { worker.stop(); worker = null; } });
|
||||
|
||||
test('metadata.host reads request.host on live caddy lines (was null pre-DC-113)', async () => {
|
||||
// Exact shape from /var/log/caddy/seeds.log on DNS2 (2026-08-23):
|
||||
// host is nested in request; headers are arrays.
|
||||
fs.appendFileSync(ACCESS_LOG, JSON.stringify({
|
||||
level: 'info',
|
||||
ts: 1787461432.8595521,
|
||||
logger: 'http.log.access.dashcaddy-access',
|
||||
msg: 'handled request',
|
||||
request: {
|
||||
remote_ip: '162.243.83.227',
|
||||
remote_port: '57446',
|
||||
client_ip: '162.243.83.227',
|
||||
proto: 'HTTP/1.1',
|
||||
method: 'TRACE',
|
||||
host: 'seeds.cryptographic-triangles.org',
|
||||
uri: '/',
|
||||
headers: { Connection: ['close'], 'User-Agent': ['Mozilla/5.0'] },
|
||||
tls: { resumed: false, version: 772, cipher_suite: 4865, proto: 'http/1.1', server_name: 'seeds.cryptographic-triangles.org', ech: false },
|
||||
},
|
||||
bytes_read: 0,
|
||||
user_id: '',
|
||||
duration: 0.000070446,
|
||||
size: 0,
|
||||
status: 404,
|
||||
}) + '\n');
|
||||
|
||||
worker = startCaddyWorker({ log: fakeLogger });
|
||||
const [ev] = await waitForEvents(1);
|
||||
expect(ev.metadata.host).toBe('seeds.cryptographic-triangles.org');
|
||||
expect(ev.actor).toBe('162.243.83.227');
|
||||
expect(ev.metadata.user_agent).toBe('Mozilla/5.0');
|
||||
expect(ev.action).toBe('http.404');
|
||||
});
|
||||
|
||||
test('top-level host (DC-112 fixture shape) still parses — backwards compat', async () => {
|
||||
fs.appendFileSync(ACCESS_LOG, JSON.stringify({
|
||||
ts: 1787500800,
|
||||
host: 'plex.sami',
|
||||
request: { remote_ip: '10.9.9.9', method: 'GET', uri: '/api/auth/gate/plex', proto: 'HTTP/1.1', headers: { 'User-Agent': ['PlexDBRoulette/1.0'] } },
|
||||
status: 401,
|
||||
duration: 0.007,
|
||||
}) + '\n');
|
||||
worker = startCaddyWorker({ log: fakeLogger });
|
||||
const [ev] = await waitForEvents(1);
|
||||
expect(ev.metadata.host).toBe('plex.sami');
|
||||
});
|
||||
});
|
||||
|
||||
describe('DC-113: self-noise filter — probe UAs do not flood the store', () => {
|
||||
let worker;
|
||||
afterEach(() => { if (worker) { worker.stop(); worker = null; } });
|
||||
|
||||
test('DashCaddy-Probe/1.0 and DashCaddy-HealthCheck/1.0 lines are dropped', async () => {
|
||||
const mk = (ua, uri) => JSON.stringify({
|
||||
ts: Date.now() / 1000,
|
||||
request: { remote_ip: '172.17.0.2', method: 'GET', uri, host: 'plex.sami', headers: { 'User-Agent': [ua] } },
|
||||
status: 200,
|
||||
});
|
||||
fs.appendFileSync(ACCESS_LOG, mk('DashCaddy-Probe/1.0', '/api/health') + '\n');
|
||||
fs.appendFileSync(ACCESS_LOG, mk('DashCaddy-HealthCheck/1.0', '/') + '\n');
|
||||
fs.appendFileSync(ACCESS_LOG, mk('Mozilla/5.0', '/wp-login.php') + '\n');
|
||||
|
||||
worker = startCaddyWorker({ log: fakeLogger });
|
||||
const events = await waitForEvents(1); // only the external line survives
|
||||
expect(events.length).toBe(1);
|
||||
expect(events[0].metadata.user_agent).toBe('Mozilla/5.0');
|
||||
expect(events[0].target).toBe('GET /wp-login.php');
|
||||
expect(events[0].actor).toBe('172.17.0.2');
|
||||
});
|
||||
|
||||
test('probe-like prefix UA (DashCaddy-Probe/1.1-future) is also filtered', async () => {
|
||||
fs.appendFileSync(ACCESS_LOG, JSON.stringify({
|
||||
ts: Date.now() / 1000,
|
||||
request: { remote_ip: '10.1.1.1', method: 'GET', uri: '/', host: 'x.sami', headers: { 'User-Agent': ['DashCaddy-Probe/1.1-future'] } },
|
||||
status: 200,
|
||||
}) + '\n');
|
||||
worker = startCaddyWorker({ log: fakeLogger });
|
||||
await new Promise(r => setTimeout(r, 700)); // tail poll settles
|
||||
expect(readStored().filter(e => e.source_type === 'caddy').length).toBe(0);
|
||||
});
|
||||
|
||||
test('null/absent UA is NOT filtered (unknown clients stay visible)', async () => {
|
||||
fs.appendFileSync(ACCESS_LOG, JSON.stringify({
|
||||
ts: Date.now() / 1000,
|
||||
request: { remote_ip: '203.0.113.9', method: 'GET', uri: '/admin', host: 'x.sami', headers: {} },
|
||||
status: 403,
|
||||
}) + '\n');
|
||||
worker = startCaddyWorker({ log: fakeLogger });
|
||||
const [ev] = await waitForEvents(1);
|
||||
expect(ev.metadata.user_agent).toBeNull();
|
||||
expect(ev.severity).toBe('warn'); // 403 → warn
|
||||
});
|
||||
});
|
||||
|
||||
describe('DC-113: recovered-log visibility (DC-112 judge polish fold)', () => {
|
||||
let worker;
|
||||
afterEach(() => { if (worker) { worker.stop(); worker = null; } });
|
||||
|
||||
test('info line when the access log appears after startup (missing → present)', async () => {
|
||||
// Start with NO access log file at all.
|
||||
fs.rmSync(ACCESS_LOG);
|
||||
worker = startCaddyWorker({ log: fakeLogger });
|
||||
|
||||
// Wait past one missing-poll cycle (pollMs * 5 = 5s default → but the
|
||||
// initial tick is pollMs=1s; give it 1.5s to hit the missing branch).
|
||||
await new Promise(r => setTimeout(r, 1500));
|
||||
|
||||
// The file appears (the infra wiring this test models: caddy reload
|
||||
// creates /var/log/caddy/access.log; the container mount lands).
|
||||
fs.writeFileSync(ACCESS_LOG, '', 'utf8');
|
||||
fs.appendFileSync(ACCESS_LOG, JSON.stringify({
|
||||
ts: Date.now() / 1000,
|
||||
request: { remote_ip: '198.51.100.7', method: 'GET', uri: '/', host: 'status.sami', headers: { 'User-Agent': ['curl/8.0'] } },
|
||||
status: 200,
|
||||
}) + '\n');
|
||||
|
||||
await waitForEvents(1);
|
||||
const infos = capturedInfos.filter(i => /caddy access log active/.test(i.msg));
|
||||
expect(infos.length).toBeGreaterThanOrEqual(1);
|
||||
expect(infos[0].msg).toContain(ACCESS_LOG);
|
||||
});
|
||||
|
||||
test('info line also fires on first poll when the log exists at startup', async () => {
|
||||
fs.writeFileSync(ACCESS_LOG, JSON.stringify({
|
||||
ts: Date.now() / 1000,
|
||||
request: { remote_ip: '198.51.100.8', method: 'GET', uri: '/x', host: 'status.sami', headers: { 'User-Agent': ['curl/8.0'] } },
|
||||
status: 200,
|
||||
}) + '\n');
|
||||
worker = startCaddyWorker({ log: fakeLogger });
|
||||
await waitForEvents(1);
|
||||
expect(capturedInfos.filter(i => /caddy access log active/.test(i.msg)).length).toBe(1);
|
||||
});
|
||||
|
||||
test('onAppear fires once per appearance, not per poll', async () => {
|
||||
fs.writeFileSync(ACCESS_LOG, JSON.stringify({
|
||||
ts: Date.now() / 1000,
|
||||
request: { remote_ip: '198.51.100.9', method: 'GET', uri: '/y', host: 'status.sami', headers: { 'User-Agent': ['curl/8.0'] } },
|
||||
status: 200,
|
||||
}) + '\n');
|
||||
worker = startCaddyWorker({ log: fakeLogger });
|
||||
await waitForEvents(1);
|
||||
// Extra polls with the file still present must not re-fire.
|
||||
await new Promise(r => setTimeout(r, 1500));
|
||||
expect(capturedInfos.filter(i => /caddy access log active/.test(i.msg)).length).toBe(1);
|
||||
});
|
||||
});
|
||||
|
||||
describe('DC-113 r2: bounded first-start replay (judge fix-first fold)', () => {
|
||||
let worker;
|
||||
afterEach(() => { if (worker) { worker.stop(); worker = null; } });
|
||||
|
||||
// NOTE: trailing \n is REQUIRED — these lines are join('')ed into the
|
||||
// access log; without it the whole tail becomes one unterminated line
|
||||
// that never flushes from the tail buffer.
|
||||
const mkLine = (ip, path) => JSON.stringify({
|
||||
ts: Date.now() / 1000,
|
||||
request: { remote_ip: ip, method: 'GET', uri: path, host: 'status.sami', headers: { 'User-Agent': ['curl/8.0'] } },
|
||||
status: 200,
|
||||
}) + '\n';
|
||||
|
||||
test('first-ever start skips the backlog beyond the 5 MiB cap and drops the partial line', async () => {
|
||||
// No persisted offset state file for this scenario.
|
||||
fs.rmSync(path.join(TMP_DIR, '.caddy-tail-offset'), { force: true });
|
||||
// Build a file beyond the 5 MiB cap WITHOUT flooding the store's write
|
||||
// queue: ONE huge filler line (6 MiB of padding) + a normal backlog +
|
||||
// the two live tail lines. The cap jump lands inside the huge line —
|
||||
// the partial-line discard must skip it entirely, then the backlog
|
||||
// lines (post-jump window) and the live tail lines emit.
|
||||
const mkFiller = (bytes) => JSON.stringify({
|
||||
ts: 1787000000, request: { remote_ip: '10.0.0.1', method: 'GET', uri: '/huge-' + 'x'.repeat(bytes), host: 'status.sami', headers: { 'User-Agent': ['curl/8.0'] } }, status: 200,
|
||||
}) + '\n';
|
||||
const backlog = [];
|
||||
for (let i = 0; i < 40; i++) backlog.push(mkLine('10.0.0.2', '/backlog-' + i));
|
||||
const big = [mkFiller(6 * 1024 * 1024), ...backlog, mkLine('203.0.113.101', '/live-1'), mkLine('203.0.113.102', '/live-2')];
|
||||
fs.writeFileSync(ACCESS_LOG, big.join(''), 'utf8');
|
||||
expect(fs.statSync(ACCESS_LOG).size).toBeGreaterThan(5 * 1024 * 1024 + 1024);
|
||||
|
||||
worker = startCaddyWorker({ log: fakeLogger });
|
||||
|
||||
// Poll until BOTH live tail lines land (cap window = last 5 MiB, which
|
||||
// contains the whole normal backlog + tail lines; drains in <2s).
|
||||
const deadline = Date.now() + 30000;
|
||||
let all = [];
|
||||
while (Date.now() < deadline) {
|
||||
all = readStored().filter(e => e.source_type === 'caddy');
|
||||
const uris = new Set(all.map(e => e.target));
|
||||
if (uris.has('GET /live-1') && uris.has('GET /live-2')) break;
|
||||
await new Promise(r => setTimeout(r, 150));
|
||||
}
|
||||
const uris = new Set(all.map(e => e.target));
|
||||
expect(uris.has('GET /live-1')).toBe(true);
|
||||
expect(uris.has('GET /live-2')).toBe(true);
|
||||
// Cap engaged: the huge pre-cap line is GONE (jumped past + partial
|
||||
// discard), and the backlog window landed.
|
||||
expect(all.length).toBe(42); // 40 backlog + 2 live
|
||||
expect(all.some(e => e.target && e.target.includes('/huge-'))).toBe(false);
|
||||
// Persisted offset now exists — restart resumes from live.
|
||||
expect(fs.existsSync(path.join(TMP_DIR, '.caddy-tail-offset'))).toBe(true);
|
||||
}, 45000);
|
||||
|
||||
test('restart with persisted offset replays nothing (no re-emit, no gap)', async () => {
|
||||
fs.rmSync(path.join(TMP_DIR, '.caddy-tail-offset'), { force: true });
|
||||
fs.writeFileSync(ACCESS_LOG, mkLine('203.0.113.201', '/first') + '\n', 'utf8');
|
||||
worker = startCaddyWorker({ log: fakeLogger });
|
||||
// Wait for the offset to persist (stream 'end' handler), not just the
|
||||
// event to appear — waitForEvents can return before 'end' fires.
|
||||
const deadline = Date.now() + 5000;
|
||||
while (Date.now() < deadline) {
|
||||
if (fs.existsSync(path.join(TMP_DIR, '.caddy-tail-offset'))
|
||||
&& fs.readFileSync(path.join(TMP_DIR, '.caddy-tail-offset'), 'utf8').trim() !== '0') break;
|
||||
await new Promise(r => setTimeout(r, 50));
|
||||
}
|
||||
worker.stop();
|
||||
await new Promise(r => setTimeout(r, 200));
|
||||
|
||||
// New content after the stop. Do NOT truncate the store file: the
|
||||
// singleton's memory still holds w1's events and would flush them on
|
||||
// the next append, making file line-count useless as a replay oracle.
|
||||
// Instead: a replay would append '/first' a SECOND time.
|
||||
fs.appendFileSync(ACCESS_LOG, mkLine('203.0.113.202', '/second') + '\n', 'utf8');
|
||||
worker = startCaddyWorker({ log: fakeLogger });
|
||||
await waitForEvents(2);
|
||||
await new Promise(r => setTimeout(r, 300)); // settle
|
||||
const all = readStored().filter(e => e.source_type === 'caddy');
|
||||
const firsts = all.filter(e => e.target === 'GET /first');
|
||||
const seconds = all.filter(e => e.target === 'GET /second');
|
||||
expect(firsts.length).toBe(1); // exactly once — no replay on restart
|
||||
expect(seconds.length).toBe(1); // and no gap — new line processed
|
||||
}, 15000);
|
||||
});
|
||||
@@ -1,183 +0,0 @@
|
||||
/**
|
||||
* DC-118 regression pins — generic-UA self-noise conjunction filter.
|
||||
*
|
||||
* Live census (2026-08-23, /var/log/caddy/access.log): the DNS2 watchdog
|
||||
* and on-host cron jobs hit Caddy with a stock curl/8.5.0 UA from
|
||||
* 127.0.0.1 (339/5000 lines) and the host's own tailscale IP (20/5000) —
|
||||
* ~300 GET /api/health 401 warn-events/day burying real perimeter
|
||||
* signal. External curl traffic (zgrab/ scanners using curl, real
|
||||
* attackers) MUST stay visible.
|
||||
*
|
||||
* Design: DashCaddy-* probe UA prefixes are dropped unconditionally
|
||||
* (they are our own binaries). GENERIC tool UAs (curl/) are dropped ONLY
|
||||
* when the source remote_ip is one of this host's own addresses
|
||||
* (DASHCADDY_SELF_IPS env, default loopback). remote_ip (the TCP peer)
|
||||
* is the input — never client_ip/X-Forwarded-For, which is spoofable.
|
||||
*
|
||||
* All tests use the REAL worker: temp access log, real tail, real event
|
||||
* store, hermetic sinks. No mocks of the module under test.
|
||||
*/
|
||||
|
||||
const path = require('path');
|
||||
const fs = require('fs');
|
||||
const os = require('os');
|
||||
|
||||
// Hermetic sinks (same pattern as caddy-worker-pipeline-dc113.test.js)
|
||||
const TMP_DIR = fs.mkdtempSync(path.join(os.tmpdir(), 'dc118-caddy-'));
|
||||
process.env.SECURITY_EVENT_LOG_FILE = path.join(TMP_DIR, 'security-events.jsonl');
|
||||
process.env.CADDY_ACCESS_LOG = path.join(TMP_DIR, 'access.log');
|
||||
process.env.DATA_DIR = TMP_DIR;
|
||||
// Self-IP set for these tests: loopback defaults + a fake tailscale IP.
|
||||
process.env.DASHCADDY_SELF_IPS = '127.0.0.1,::1,100.121.150.22';
|
||||
|
||||
const { startCaddyWorker } = require('../src/security/event-workers');
|
||||
const { getStore } = require('../src/security/event-store');
|
||||
|
||||
let capturedWarns = [];
|
||||
let capturedInfos = [];
|
||||
const fakeLogger = {
|
||||
warn: (ctx, msg, extra) => capturedWarns.push({ ctx, msg, extra }),
|
||||
info: (ctx, msg, extra) => capturedInfos.push({ ctx, msg, extra }),
|
||||
error: () => {},
|
||||
};
|
||||
|
||||
const ACCESS_LOG = process.env.CADDY_ACCESS_LOG;
|
||||
const STORE_FILE = process.env.SECURITY_EVENT_LOG_FILE;
|
||||
|
||||
function mkLine({ ip, ua, uri = '/api/health', status = 401 }) {
|
||||
return JSON.stringify({
|
||||
ts: Date.now() / 1000,
|
||||
request: {
|
||||
remote_ip: ip, method: 'GET', uri, host: 'status.sami', proto: 'HTTP/2.0',
|
||||
headers: ua === null ? {} : { 'User-Agent': [ua] },
|
||||
},
|
||||
status,
|
||||
duration: 0.004,
|
||||
}) + '\n';
|
||||
}
|
||||
|
||||
function readStored() {
|
||||
try {
|
||||
return fs.readFileSync(STORE_FILE, 'utf8').trim().split('\n')
|
||||
.filter(Boolean).map(l => JSON.parse(l));
|
||||
} catch { return []; }
|
||||
}
|
||||
|
||||
async function waitForEvents(n, { timeoutMs = 5000 } = {}) {
|
||||
const deadline = Date.now() + timeoutMs;
|
||||
while (Date.now() < deadline) {
|
||||
const events = readStored().filter(e => e.source_type === 'caddy');
|
||||
if (events.length >= n) return events;
|
||||
await new Promise(r => setTimeout(r, 50));
|
||||
}
|
||||
throw new Error(`timed out waiting for ${n} caddy events (got ${readStored().filter(e => e.source_type === 'caddy').length})`);
|
||||
}
|
||||
|
||||
async function waitForQuiet({ settleMs = 1200 } = {}) {
|
||||
// Inverse of waitForEvents: give the tail a window to (wrongly) emit,
|
||||
// then assert it did not.
|
||||
await new Promise(r => setTimeout(r, settleMs));
|
||||
return readStored().filter(e => e.source_type === 'caddy');
|
||||
}
|
||||
|
||||
beforeEach(() => {
|
||||
fs.writeFileSync(STORE_FILE, '', 'utf8');
|
||||
fs.writeFileSync(ACCESS_LOG, '', 'utf8');
|
||||
// Reset the tail's persisted offset (same flake lesson as DC-112/113).
|
||||
fs.writeFileSync(path.join(TMP_DIR, '.caddy-tail-offset'), '0', 'utf8');
|
||||
capturedWarns = [];
|
||||
capturedInfos = [];
|
||||
getStore({ log: fakeLogger }); // fresh singleton pointed at the temp store file
|
||||
});
|
||||
|
||||
afterAll(() => {
|
||||
try { fs.rmSync(TMP_DIR, { recursive: true, force: true }); } catch {}
|
||||
});
|
||||
|
||||
describe('DC-118: generic-UA self-noise conjunction filter', () => {
|
||||
let worker;
|
||||
afterEach(() => { if (worker) { worker.stop(); worker = null; } });
|
||||
|
||||
test('matrix cell 1 — self IP + generic curl UA → DROPPED (loopback watchdog)', async () => {
|
||||
fs.appendFileSync(ACCESS_LOG, mkLine({ ip: '127.0.0.1', ua: 'curl/8.5.0' }));
|
||||
worker = startCaddyWorker({ log: fakeLogger });
|
||||
const events = await waitForQuiet();
|
||||
expect(events.length).toBe(0);
|
||||
});
|
||||
|
||||
test('matrix cell 1b — self tailscale IP + curl UA → DROPPED (on-host cron)', async () => {
|
||||
fs.appendFileSync(ACCESS_LOG, mkLine({ ip: '100.121.150.22', ua: 'curl/8.5.0' }));
|
||||
worker = startCaddyWorker({ log: fakeLogger });
|
||||
const events = await waitForQuiet();
|
||||
expect(events.length).toBe(0);
|
||||
});
|
||||
|
||||
test('matrix cell 2 — EXTERNAL IP + curl UA → KEPT (real attacker visibility)', async () => {
|
||||
fs.appendFileSync(ACCESS_LOG, mkLine({ ip: '198.51.100.7', ua: 'curl/8.5.0' }));
|
||||
worker = startCaddyWorker({ log: fakeLogger });
|
||||
const [ev] = await waitForEvents(1);
|
||||
expect(ev.actor).toBe('198.51.100.7');
|
||||
expect(ev.metadata.user_agent).toBe('curl/8.5.0');
|
||||
expect(ev.action).toBe('http.401');
|
||||
expect(ev.severity).toBe('warn'); // /api/health 401 stays a warn-event
|
||||
});
|
||||
|
||||
test('matrix cell 3 — self IP + NON-generic UA (browser/attacker tool) → KEPT', async () => {
|
||||
// Even from our own IP, a browser or attack tool UA must not be
|
||||
// silently discarded — an attacker landing on the host itself is
|
||||
// exactly the event the store exists to keep.
|
||||
fs.appendFileSync(ACCESS_LOG, mkLine({ ip: '127.0.0.1', ua: 'Mozilla/5.0 zgrab/0.x' }));
|
||||
worker = startCaddyWorker({ log: fakeLogger });
|
||||
const [ev] = await waitForEvents(1);
|
||||
expect(ev.actor).toBe('127.0.0.1');
|
||||
expect(ev.metadata.user_agent).toBe('Mozilla/5.0 zgrab/0.x');
|
||||
});
|
||||
|
||||
test('matrix cell 4 — self IP + no UA at all → KEPT (missing UA is not noise)', async () => {
|
||||
fs.appendFileSync(ACCESS_LOG, mkLine({ ip: '127.0.0.1', ua: null }));
|
||||
worker = startCaddyWorker({ log: fakeLogger });
|
||||
const [ev] = await waitForEvents(1);
|
||||
expect(ev.actor).toBe('127.0.0.1');
|
||||
expect(ev.metadata.user_agent).toBeNull();
|
||||
});
|
||||
|
||||
test('spoofed X-Forwarded-For (client_ip) cannot opt an attacker out — filter reads remote_ip only', async () => {
|
||||
fs.appendFileSync(ACCESS_LOG, JSON.stringify({
|
||||
ts: Date.now() / 1000,
|
||||
request: {
|
||||
remote_ip: '198.51.100.9', client_ip: '127.0.0.1', // claims to be us
|
||||
method: 'GET', uri: '/api/health', host: 'status.sami', proto: 'HTTP/2.0',
|
||||
headers: { 'User-Agent': ['curl/8.5.0'] },
|
||||
},
|
||||
status: 401,
|
||||
duration: 0.004,
|
||||
}) + '\n');
|
||||
worker = startCaddyWorker({ log: fakeLogger });
|
||||
const [ev] = await waitForEvents(1);
|
||||
expect(ev.actor).toBe('198.51.100.9'); // TCP peer, not the spoofable header
|
||||
});
|
||||
|
||||
test('IPv6 loopback ::1 with curl UA → DROPPED (env-listed self IP)', async () => {
|
||||
fs.appendFileSync(ACCESS_LOG, mkLine({ ip: '::1', ua: 'curl/8.5.0' }));
|
||||
worker = startCaddyWorker({ log: fakeLogger });
|
||||
const events = await waitForQuiet();
|
||||
expect(events.length).toBe(0);
|
||||
});
|
||||
|
||||
test('DashCaddy-* probe UA from a NON-self IP is still dropped (own binaries, unconditional)', async () => {
|
||||
fs.appendFileSync(ACCESS_LOG, mkLine({ ip: '172.17.0.4', ua: 'DashCaddy-HealthCheck/1.0' }));
|
||||
worker = startCaddyWorker({ log: fakeLogger });
|
||||
const events = await waitForQuiet();
|
||||
expect(events.length).toBe(0);
|
||||
});
|
||||
|
||||
test('prefix future-proofing: curl/10.0 from self IP → DROPPED; curl-impersonate NOT dropped', async () => {
|
||||
fs.appendFileSync(ACCESS_LOG, mkLine({ ip: '127.0.0.1', ua: 'curl/10.0' }));
|
||||
fs.appendFileSync(ACCESS_LOG, mkLine({ ip: '198.51.100.10', ua: 'curl-impersonate-chrome/1.0' }));
|
||||
worker = startCaddyWorker({ log: fakeLogger });
|
||||
// curl-impersonate does not match the 'curl/' prefix; kept from any IP.
|
||||
const events = await waitForEvents(1);
|
||||
expect(events.length).toBe(1);
|
||||
expect(events[0].metadata.user_agent).toBe('curl-impersonate-chrome/1.0');
|
||||
});
|
||||
});
|
||||
@@ -15,8 +15,6 @@ jest.mock('../src/security/crypto-utils', () => ({
|
||||
isEncrypted: jest.fn(data => typeof data === 'string' && data.startsWith('enc:')),
|
||||
loadOrCreateKey: jest.fn(() => Buffer.alloc(32, 'k')),
|
||||
rotateKey: jest.fn(() => ({ oldKey: Buffer.alloc(32, 'k'), newKey: Buffer.alloc(32, 'n') })),
|
||||
// DC-107 rollback support – restore old key in-process after a failed write
|
||||
restoreKey: jest.fn(() => true),
|
||||
}));
|
||||
|
||||
jest.mock('proper-lockfile', () => ({
|
||||
@@ -25,65 +23,13 @@ jest.mock('proper-lockfile', () => ({
|
||||
check: jest.fn().mockResolvedValue(false),
|
||||
}));
|
||||
|
||||
// DC-106: fd-level mock exercising the canonical atomic-write path
|
||||
// (openSync('wx') -> writeSync -> fsyncSync -> closeSync -> renameSync).
|
||||
const mockFsState = {
|
||||
files: {}, // path -> content (destination state after rename)
|
||||
fdMap: new Map(), // open fd -> { p, content }
|
||||
closedTmp: new Map(), // closed-but-not-yet-renamed tmp path -> content
|
||||
openedWith: [], // { p, flags, mode } per openSync call
|
||||
nextFd: 0,
|
||||
};
|
||||
|
||||
jest.mock('fs', () => ({
|
||||
existsSync: jest.fn((p) => mockFsState.files[p] !== undefined),
|
||||
readFileSync: jest.fn((p) => {
|
||||
if (mockFsState.files[p] === undefined) {
|
||||
const e = new Error(`ENOENT: ${p}`);
|
||||
e.code = 'ENOENT';
|
||||
throw e;
|
||||
}
|
||||
return mockFsState.files[p];
|
||||
}),
|
||||
existsSync: jest.fn().mockReturnValue(true),
|
||||
readFileSync: jest.fn().mockReturnValue('{}'),
|
||||
writeFileSync: jest.fn(),
|
||||
mkdirSync: jest.fn(),
|
||||
// DC-105/DC-106 canonical atomic-write path (atomic-write.js).
|
||||
openSync: jest.fn((p, flags, mode) => {
|
||||
mockFsState.openedWith.push({ p, flags, mode });
|
||||
mockFsState.nextFd += 1;
|
||||
mockFsState.fdMap.set(mockFsState.nextFd, { p, content: '' });
|
||||
return mockFsState.nextFd;
|
||||
}),
|
||||
writeSync: jest.fn((fd, content) => {
|
||||
const rec = mockFsState.fdMap.get(fd);
|
||||
if (!rec) throw new Error(`EBADF: fd ${fd}`);
|
||||
rec.content += content;
|
||||
}),
|
||||
fsyncSync: jest.fn(),
|
||||
closeSync: jest.fn((fd) => {
|
||||
const rec = mockFsState.fdMap.get(fd);
|
||||
if (rec) {
|
||||
mockFsState.closedTmp.set(rec.p, rec.content);
|
||||
mockFsState.fdMap.delete(fd);
|
||||
}
|
||||
}),
|
||||
renameSync: jest.fn((src, dst) => {
|
||||
const content = mockFsState.closedTmp.has(src)
|
||||
? mockFsState.closedTmp.get(src)
|
||||
: mockFsState.files[src];
|
||||
mockFsState.files[dst] = content;
|
||||
mockFsState.closedTmp.delete(src);
|
||||
delete mockFsState.files[src];
|
||||
}),
|
||||
unlinkSync: jest.fn(),
|
||||
}));
|
||||
|
||||
// DC-106: mirror the production path resolution so assertions read the same
|
||||
// destination the manager writes to, regardless of env overrides.
|
||||
const path = require('path');
|
||||
const platformPaths = require('../platform-paths');
|
||||
const CREDENTIALS_FILE = process.env.CREDENTIALS_FILE
|
||||
|| path.join(platformPaths.dataDir, 'credentials.json');
|
||||
|
||||
describe('CredentialManager', () => {
|
||||
let credentialManager;
|
||||
let fs, lockfile, keychainManager, cryptoUtils;
|
||||
@@ -97,30 +43,10 @@ describe('CredentialManager', () => {
|
||||
keychainManager = require('../src/security/keychain-manager');
|
||||
cryptoUtils = require('../src/security/crypto-utils');
|
||||
|
||||
// Reset mock implementations and fd-level atomic-write state
|
||||
for (const k of Object.keys(mockFsState.files)) delete mockFsState.files[k];
|
||||
mockFsState.fdMap.clear();
|
||||
mockFsState.closedTmp.clear();
|
||||
mockFsState.openedWith.length = 0;
|
||||
mockFsState.nextFd = 0;
|
||||
// Default world: credentials.json exists with empty payload (the previous
|
||||
// mock's existsSync=true / readFileSync='{}' semantics, now truthful).
|
||||
mockFsState.files[CREDENTIALS_FILE] = '{}';
|
||||
fs.existsSync.mockImplementation((p) => mockFsState.files[p] !== undefined);
|
||||
fs.readFileSync.mockImplementation((p) => {
|
||||
if (mockFsState.files[p] === undefined) {
|
||||
const e = new Error(`ENOENT: ${p}`);
|
||||
e.code = 'ENOENT';
|
||||
throw e;
|
||||
}
|
||||
return mockFsState.files[p];
|
||||
});
|
||||
fs.openSync.mockClear();
|
||||
fs.writeSync.mockClear();
|
||||
fs.fsyncSync.mockClear();
|
||||
fs.closeSync.mockClear();
|
||||
fs.renameSync.mockClear();
|
||||
fs.unlinkSync.mockClear();
|
||||
// Reset mock implementations
|
||||
fs.existsSync.mockReturnValue(true);
|
||||
fs.readFileSync.mockReturnValue('{}');
|
||||
fs.writeFileSync.mockImplementation(() => {});
|
||||
lockfile.lock.mockResolvedValue(jest.fn().mockResolvedValue());
|
||||
keychainManager.available = false;
|
||||
|
||||
@@ -133,7 +59,7 @@ describe('CredentialManager', () => {
|
||||
const result = await credentialManager.store('test.key', 'secret-value');
|
||||
expect(result).toBe(true);
|
||||
expect(cryptoUtils.encrypt).toHaveBeenCalledWith('secret-value');
|
||||
expect(fs.renameSync).toHaveBeenCalled(); // DC-106: canonical write landed
|
||||
expect(fs.writeFileSync).toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it('stores value in keychain when available', async () => {
|
||||
@@ -141,10 +67,9 @@ describe('CredentialManager', () => {
|
||||
// Need to get a fresh instance that sees available=true
|
||||
jest.resetModules();
|
||||
fs = require('fs');
|
||||
for (const k of Object.keys(mockFsState.files)) delete mockFsState.files[k];
|
||||
mockFsState.fdMap.clear();
|
||||
mockFsState.closedTmp.clear();
|
||||
mockFsState.openedWith.length = 0;
|
||||
fs.existsSync.mockReturnValue(true);
|
||||
fs.readFileSync.mockReturnValue('{}');
|
||||
fs.writeFileSync.mockImplementation(() => {});
|
||||
lockfile = require('proper-lockfile');
|
||||
lockfile.lock.mockResolvedValue(jest.fn().mockResolvedValue());
|
||||
keychainManager = require('../src/security/keychain-manager');
|
||||
@@ -161,10 +86,9 @@ describe('CredentialManager', () => {
|
||||
keychainManager.available = true;
|
||||
jest.resetModules();
|
||||
fs = require('fs');
|
||||
for (const k of Object.keys(mockFsState.files)) delete mockFsState.files[k];
|
||||
mockFsState.fdMap.clear();
|
||||
mockFsState.closedTmp.clear();
|
||||
mockFsState.openedWith.length = 0;
|
||||
fs.existsSync.mockReturnValue(true);
|
||||
fs.readFileSync.mockReturnValue('{}');
|
||||
fs.writeFileSync.mockImplementation(() => {});
|
||||
lockfile = require('proper-lockfile');
|
||||
lockfile.lock.mockResolvedValue(jest.fn().mockResolvedValue());
|
||||
keychainManager = require('../src/security/keychain-manager');
|
||||
@@ -302,7 +226,8 @@ describe('CredentialManager', () => {
|
||||
});
|
||||
|
||||
expect(lockfile.lock).toHaveBeenCalled();
|
||||
const writtenData = JSON.parse(mockFsState.files[CREDENTIALS_FILE]);
|
||||
expect(fs.writeFileSync).toHaveBeenCalled();
|
||||
const writtenData = JSON.parse(fs.writeFileSync.mock.calls[0][1]);
|
||||
expect(writtenData).toEqual({ a: 1, b: 2 });
|
||||
expect(releaseFn).toHaveBeenCalled();
|
||||
});
|
||||
@@ -339,7 +264,7 @@ describe('CredentialManager', () => {
|
||||
const result = await credentialManager.rotateEncryptionKey();
|
||||
expect(result).toBe(true);
|
||||
expect(cryptoUtils.rotateKey).toHaveBeenCalled();
|
||||
expect(fs.renameSync).toHaveBeenCalled(); // DC-106: canonical write landed
|
||||
expect(fs.writeFileSync).toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it('clears cache after rotation', async () => {
|
||||
@@ -359,44 +284,6 @@ describe('CredentialManager', () => {
|
||||
lockfile.lock.mockRejectedValue(new Error('nope'));
|
||||
const result = await credentialManager.rotateEncryptionKey();
|
||||
expect(result).toBe(false);
|
||||
// DC-107: failure before rotateKey() must NOT trigger a rollback
|
||||
expect(cryptoUtils.restoreKey).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it('rolls back the encryption key when the rotated write fails (DC-107)', async () => {
|
||||
const releaseFn = jest.fn().mockResolvedValue();
|
||||
lockfile.lock.mockResolvedValue(releaseFn);
|
||||
fs.readFileSync.mockReturnValue(JSON.stringify({
|
||||
'key1': { value: 'enc:tag:' + Buffer.from('secret1').toString('base64'), metadata: {} }
|
||||
}));
|
||||
// atomicWriteJSON fails at the rename step, AFTER rotateKey() already
|
||||
// swapped the on-disk key and in-memory cache
|
||||
fs.renameSync.mockImplementationOnce(() => { throw new Error('EIO: rename'); });
|
||||
|
||||
const result = await credentialManager.rotateEncryptionKey();
|
||||
|
||||
expect(result).toBe(false);
|
||||
expect(cryptoUtils.rotateKey).toHaveBeenCalled();
|
||||
const expectedOldHex = Buffer.alloc(32, 'k').toString('hex');
|
||||
expect(cryptoUtils.restoreKey).toHaveBeenCalledTimes(1);
|
||||
expect(cryptoUtils.restoreKey).toHaveBeenCalledWith(expectedOldHex);
|
||||
expect(releaseFn).toHaveBeenCalled(); // lock still released
|
||||
});
|
||||
|
||||
it('returns false without crashing when the rollback itself fails (DC-107)', async () => {
|
||||
const releaseFn = jest.fn().mockResolvedValue();
|
||||
lockfile.lock.mockResolvedValue(releaseFn);
|
||||
fs.readFileSync.mockReturnValue(JSON.stringify({
|
||||
'key1': { value: 'enc:tag:' + Buffer.from('secret1').toString('base64'), metadata: {} }
|
||||
}));
|
||||
fs.renameSync.mockImplementationOnce(() => { throw new Error('EIO: rename'); });
|
||||
cryptoUtils.restoreKey.mockImplementationOnce(() => { throw new Error('rollback ENOSPC'); });
|
||||
|
||||
const result = await credentialManager.rotateEncryptionKey();
|
||||
|
||||
expect(result).toBe(false);
|
||||
expect(cryptoUtils.restoreKey).toHaveBeenCalledTimes(1);
|
||||
expect(releaseFn).toHaveBeenCalled(); // lock released even on double failure
|
||||
});
|
||||
});
|
||||
|
||||
@@ -439,90 +326,6 @@ describe('CredentialManager', () => {
|
||||
});
|
||||
});
|
||||
|
||||
|
||||
describe('DC-106 canonical atomic-write migration', () => {
|
||||
it('writes credentials.json via wx tmp + fsync + rename, mode 0600', async () => {
|
||||
await credentialManager.store('dc106.key', 'dc106-secret');
|
||||
|
||||
// fsyncDir also openSync()s the parent dir (flags 'r') — filter to the
|
||||
// payload tmp opens to assert on the canonical write itself.
|
||||
const wxOpens = mockFsState.openedWith.filter((o) => o.flags === 'wx');
|
||||
expect(wxOpens.length).toBe(1); // file pre-existed -> no ensure-create
|
||||
expect(wxOpens[0].mode).toBe(0o600); // sensitive file mode preserved
|
||||
expect(fs.fsyncSync).toHaveBeenCalled(); // bytes pinned before rename
|
||||
expect(fs.renameSync).toHaveBeenCalled();
|
||||
|
||||
const [tmpSrc, dst] = fs.renameSync.mock.calls
|
||||
.find((c) => c[1] === CREDENTIALS_FILE);
|
||||
expect(tmpSrc).not.toBe(dst);
|
||||
expect(tmpSrc).toMatch(/\.credentials\.json\.tmp-/); // canonical tmp prefix
|
||||
expect(dst).toBe(CREDENTIALS_FILE);
|
||||
expect(mockFsState.files[CREDENTIALS_FILE]).toBeDefined();
|
||||
|
||||
// No leftover tmp files: every payload tmp was renamed away
|
||||
const renamedSrcs = fs.renameSync.mock.calls.map((c) => c[0]);
|
||||
for (const o of wxOpens) {
|
||||
expect(renamedSrcs).toContain(o.p);
|
||||
}
|
||||
});
|
||||
|
||||
it('never writes plaintext secret to disk', async () => {
|
||||
await credentialManager.store('dc106b.key', 'plaintext-canary-9f1a');
|
||||
const raw = mockFsState.files[CREDENTIALS_FILE];
|
||||
expect(raw).toBeDefined();
|
||||
expect(raw).not.toContain('plaintext-canary-9f1a');
|
||||
expect(raw).toContain('enc:'); // crypto-utils mock prefix
|
||||
});
|
||||
|
||||
it('_lockedUpdate closes fd before rename (torn-write window eliminated)', async () => {
|
||||
const releaseFn = jest.fn().mockResolvedValue();
|
||||
lockfile.lock.mockResolvedValue(releaseFn);
|
||||
mockFsState.files[CREDENTIALS_FILE] = '{}';
|
||||
|
||||
await credentialManager._lockedUpdate((creds) => {
|
||||
creds.k = { value: 'enc:x' };
|
||||
return creds;
|
||||
});
|
||||
|
||||
// fd lifecycle: open -> write -> fsync -> close -> rename. The dir
|
||||
// fsync adds a second openSync/closeSync pair — so assert on counts of
|
||||
// payload operations and the GLOBAL invocation order, which jest tracks
|
||||
// across mocks (invocationCallOrder).
|
||||
const wxOpens = mockFsState.openedWith.filter((o) => o.flags === 'wx');
|
||||
expect(wxOpens.length).toBe(1); // exactly one payload write
|
||||
expect(fs.writeSync).toHaveBeenCalledTimes(1); // dir fsync writes nothing
|
||||
expect(fs.renameSync).toHaveBeenCalledTimes(1);
|
||||
const fsyncFirst = fs.fsyncSync.mock.invocationCallOrder[0];
|
||||
const closeFirst = fs.closeSync.mock.invocationCallOrder[0];
|
||||
const renameFirst = fs.renameSync.mock.invocationCallOrder[0];
|
||||
expect(fsyncFirst).toBeDefined();
|
||||
expect(closeFirst).toBeGreaterThan(fsyncFirst); // fsync before close
|
||||
expect(renameFirst).toBeGreaterThan(closeFirst); // close before rename
|
||||
expect(mockFsState.files[CREDENTIALS_FILE]).toContain('enc:x');
|
||||
});
|
||||
|
||||
it('_ensureFileExists creates initial {} atomically at 0600 when absent', async () => {
|
||||
const releaseFn = jest.fn().mockResolvedValue();
|
||||
lockfile.lock.mockResolvedValue(releaseFn);
|
||||
delete mockFsState.files[CREDENTIALS_FILE]; // absent on disk
|
||||
|
||||
await credentialManager._lockedUpdate((c) => {
|
||||
c.k = { value: 'enc:x' };
|
||||
return c;
|
||||
});
|
||||
|
||||
const wxOpens = mockFsState.openedWith.filter((o) => o.flags === 'wx');
|
||||
expect(wxOpens.length).toBe(2); // ensure-created '{}' + the locked update
|
||||
expect(wxOpens[0].mode).toBe(0o600);
|
||||
// The ensure write staged its tmp FIRST and renamed it into place before
|
||||
// the locked update renamed over it — creation itself was atomic.
|
||||
expect(fs.renameSync.mock.calls[0][0]).toBe(wxOpens[0].p);
|
||||
const final = JSON.parse(mockFsState.files[CREDENTIALS_FILE]);
|
||||
expect(final.k.value).toBe('enc:x');
|
||||
});
|
||||
|
||||
});
|
||||
|
||||
describe('cache TTL', () => {
|
||||
it('cache entries expire after TTL', async () => {
|
||||
credentialManager.cache.set('ttl.key', {
|
||||
|
||||
@@ -1,231 +0,0 @@
|
||||
/**
|
||||
* DC-116 regression pins — security event store retention + query.total.
|
||||
*
|
||||
* Background (2026-08-23, one day after DC-113 activated the caddy source):
|
||||
* live store had 46,494 events (16.5MB) growing ~2MB/day. Cold review of
|
||||
* src/security/event-store.js found three defects:
|
||||
*
|
||||
* 1. query().total lied: the scan broke at offset+limit, so `total` was
|
||||
* capped at the page size (<=1000). LIVE user-facing impact — the
|
||||
* dashboard "N events (24h)" stat (status/js/security-center.js reads
|
||||
* data.total) and GET /hosts/:id/health events_24h showed 1000 when
|
||||
* the real 24h count was tens of thousands.
|
||||
* 2. Trim trigger/curer mismatch: trigger was byte-based (>50MB) but the
|
||||
* curer was line-count-based (no-op unless >maxDisk=100k lines). If the
|
||||
* average line ever exceeded ~524B (50MB/100k — 0.5% of live lines were
|
||||
* already >524B, scanner bursts inflate metadata), trim fired on every
|
||||
* append and rewrote nothing — unbounded file + full-file re-read on
|
||||
* the write path.
|
||||
* 3. Trim/append race: trim renamed over the file with appends in flight;
|
||||
* events appended after trim's readFile landed on the unlinked inode
|
||||
* and were silently lost.
|
||||
*
|
||||
* Tests use the REAL store with temp files. No mocks of the module under test.
|
||||
*/
|
||||
|
||||
const path = require('path');
|
||||
const fs = require('fs');
|
||||
const os = require('os');
|
||||
|
||||
// Hermetic sinks (same pattern as caddy-worker-pipeline-dc113.test.js)
|
||||
const TMP_DIR = fs.mkdtempSync(path.join(os.tmpdir(), 'dc116-store-'));
|
||||
process.env.SECURITY_EVENT_LOG_FILE = path.join(TMP_DIR, 'security-events.jsonl');
|
||||
|
||||
const { SecurityEventStore } = require('../src/security/event-store');
|
||||
|
||||
const silence = { info: () => {}, warn: () => {}, error: () => {} };
|
||||
|
||||
function makeStore(opts = {}) {
|
||||
return new SecurityEventStore({
|
||||
log: silence,
|
||||
filePath: path.join(TMP_DIR, `store-${Date.now()}-${Math.random().toString(36).slice(2)}.jsonl`),
|
||||
...opts,
|
||||
});
|
||||
}
|
||||
|
||||
// Deterministic event factory. `target` carries the unique marker — it is
|
||||
// never overridden by the fat-payload tests, which replace `message`.
|
||||
function ev(n, over = {}) {
|
||||
return {
|
||||
source_type: 'api',
|
||||
actor: `actor-${n % 5}`,
|
||||
action: `action-${n % 3}`,
|
||||
target: `t-${n}`,
|
||||
outcome: 'success',
|
||||
severity: 'info',
|
||||
message: `event ${n}`,
|
||||
...over,
|
||||
};
|
||||
}
|
||||
|
||||
// Wait until the write queue is fully drained and no trim is in flight
|
||||
async function settle(store, ms = 50) {
|
||||
if (store.writeQueue.length === 0 && !store.writing && !store._trimScheduled) return;
|
||||
await new Promise((r) => setTimeout(r, ms));
|
||||
return settle(store, ms);
|
||||
}
|
||||
|
||||
describe('DC-116: query().total is the true match count, not the page size', () => {
|
||||
test('total reflects all matching events beyond limit/offset', async () => {
|
||||
const store = makeStore({ maxMemory: 10000 });
|
||||
for (let i = 0; i < 250; i++) store.append(ev(i));
|
||||
await settle(store);
|
||||
|
||||
// Page of 10 — total must be 250, not 10
|
||||
const r1 = store.query({ limit: 10 });
|
||||
expect(r1.events).toHaveLength(10);
|
||||
expect(r1.total).toBe(250);
|
||||
|
||||
// Same through pagination
|
||||
const r2 = store.query({ limit: 100, offset: 200 });
|
||||
expect(r2.events).toHaveLength(50);
|
||||
expect(r2.total).toBe(250);
|
||||
|
||||
// Filters count matches beyond the page too
|
||||
const r3 = store.query({ limit: 5, actor: 'actor-1' });
|
||||
expect(r3.total).toBe(50);
|
||||
expect(r3.events.every((e) => e.actor === 'actor-1')).toBe(true);
|
||||
});
|
||||
|
||||
test('pages are disjoint and newest-first across offsets (dashboard pagination)', async () => {
|
||||
const store = makeStore({ maxMemory: 10000 });
|
||||
for (let i = 0; i < 30; i++) store.append(ev(i));
|
||||
await settle(store);
|
||||
|
||||
const p1 = store.query({ limit: 10, offset: 0 }).events;
|
||||
const p2 = store.query({ limit: 10, offset: 10 }).events;
|
||||
const p3 = store.query({ limit: 10, offset: 20 }).events;
|
||||
const ids = [...p1, ...p2, ...p3].map((e) => e.id);
|
||||
expect(ids).toHaveLength(30);
|
||||
expect(new Set(ids).size).toBe(30); // no overlap, no loss
|
||||
// Newest first: event 29 (appended last) leads page 1
|
||||
expect(p1[0].message).toBe('event 29');
|
||||
expect(p3[9].message).toBe('event 0');
|
||||
});
|
||||
});
|
||||
|
||||
describe('DC-116: byte-budget trim always converges below the trigger', () => {
|
||||
test('trims when byte budget exceeded even under the line cap (old code no-oped)', async () => {
|
||||
// Fat lines (~600B each): 40 lines = ~24KB > 16KB budget, but well under
|
||||
// any line cap. Pre-DC-116, _trim() returned early (lines <= maxDisk)
|
||||
// while _maybeTrim kept firing.
|
||||
const store = makeStore({ maxDisk: 1000, trimSizeLimit: 16 * 1024 });
|
||||
const fat = 'x'.repeat(600);
|
||||
for (let i = 0; i < 40; i++) store.append(ev(i, { message: fat }));
|
||||
await settle(store, 100);
|
||||
|
||||
const size = fs.statSync(store.filePath).size;
|
||||
expect(size).toBeLessThan(16 * 1024); // under the trigger
|
||||
// The most recent events survived the trim
|
||||
const lines = fs.readFileSync(store.filePath, 'utf8').trim().split('\n');
|
||||
expect(lines.length).toBeGreaterThan(0);
|
||||
expect(lines.length).toBeLessThanOrEqual(40);
|
||||
const last = JSON.parse(lines[lines.length - 1]);
|
||||
expect(last.target).toBe('t-39');
|
||||
});
|
||||
|
||||
test('respects the line cap when lines are thin (maxDisk still honored)', async () => {
|
||||
// Thin lines (~120B): 300 lines = ~36KB > 16KB budget; maxDisk=100 must
|
||||
// cap retained lines at 100 (~12KB) — under budget either way.
|
||||
const store = makeStore({ maxDisk: 100, trimSizeLimit: 16 * 1024 });
|
||||
for (let i = 0; i < 300; i++) store.append(ev(i));
|
||||
await settle(store, 100);
|
||||
|
||||
const lines = fs.readFileSync(store.filePath, 'utf8').trim().split('\n');
|
||||
expect(lines.length).toBeLessThanOrEqual(100);
|
||||
expect(fs.statSync(store.filePath).size).toBeLessThan(16 * 1024);
|
||||
const last = JSON.parse(lines[lines.length - 1]);
|
||||
expect(last.target).toBe('t-299');
|
||||
});
|
||||
|
||||
test('byte ceiling drops oldest lines even when under the line cap (both constraints reconcile)', async () => {
|
||||
// maxDisk=1000 (no line pressure) but budget forces byte reduction:
|
||||
// 40 fat lines ~24KB -> must fall under 80% of 16KB = 12.8KB (~21 lines)
|
||||
const store = makeStore({ maxDisk: 1000, trimSizeLimit: 16 * 1024 });
|
||||
const fat = 'x'.repeat(600);
|
||||
for (let i = 0; i < 40; i++) store.append(ev(i, { message: fat }));
|
||||
await settle(store, 100);
|
||||
|
||||
const size = fs.statSync(store.filePath).size;
|
||||
expect(size).toBeLessThanOrEqual(Math.floor(16 * 1024 * 0.8) + 700); // ceiling + one fat line
|
||||
expect(size).toBeLessThan(16 * 1024);
|
||||
});
|
||||
});
|
||||
|
||||
describe('DC-116: trim/append race — events appended around a trim are never lost', () => {
|
||||
test('appends landing during trim survive (write lock serializes trim vs append)', async () => {
|
||||
const store = makeStore({ maxDisk: 50, trimSizeLimit: 8 * 1024 });
|
||||
const fat = 'x'.repeat(400);
|
||||
// Push past the byte budget so the NEXT idle write path triggers a trim
|
||||
for (let i = 0; i < 20; i++) store.append(ev(i, { message: fat }));
|
||||
await settle(store, 100);
|
||||
|
||||
// Rapid-fire appends around trims: each burst re-crosses the 8KB budget,
|
||||
// forcing multiple trims while appends keep flowing. Budget sized so the
|
||||
// FINAL burst (~3.3KB) always fits under the post-trim ceiling — the
|
||||
// retention contract guarantees the newest burst survives intact.
|
||||
const ids = [];
|
||||
for (let round = 0; round < 5; round++) {
|
||||
for (let i = 0; i < 6; i++) {
|
||||
const stored = store.append(ev(100 + round * 6 + i, { message: fat }));
|
||||
ids.push(stored.id);
|
||||
}
|
||||
await settle(store, 100);
|
||||
}
|
||||
|
||||
// Every appended event must be either on disk or accounted for by the
|
||||
// explicit retention caps (maxDisk=50 lines / 8KB byte budget). The last
|
||||
// burst MUST be fully on disk (it fits the budget; nothing newer exists).
|
||||
const lines = fs.readFileSync(store.filePath, 'utf8').trim().split('\n');
|
||||
const diskIds = new Set(lines.map((l) => JSON.parse(l).id));
|
||||
const lastBurst = ids.slice(-6);
|
||||
for (const id of lastBurst) {
|
||||
expect(diskIds.has(id)).toBe(true);
|
||||
}
|
||||
// And the file is back under budget
|
||||
expect(fs.statSync(store.filePath).size).toBeLessThan(8 * 1024);
|
||||
});
|
||||
|
||||
test('in-memory index stays queryable and consistent right after a trim', async () => {
|
||||
const store = makeStore({ maxDisk: 10, trimSizeLimit: 8 * 1024 });
|
||||
for (let i = 0; i < 60; i++) store.append(ev(i, { message: 'y'.repeat(300) }));
|
||||
await settle(store, 150);
|
||||
|
||||
// Disk kept <=10 lines; memory still serves the capped window
|
||||
const lines = fs.readFileSync(store.filePath, 'utf8').trim().split('\n');
|
||||
expect(lines.length).toBeLessThanOrEqual(10);
|
||||
const q = store.query({ limit: 5 });
|
||||
expect(q.total).toBe(store.size());
|
||||
expect(q.events).toHaveLength(5);
|
||||
});
|
||||
});
|
||||
|
||||
describe('DC-116: trim error paths release the write lock (no wedged store)', () => {
|
||||
test('rename failure resets _trimScheduled and writing so later appends flow', async () => {
|
||||
const store = makeStore({ maxDisk: 5, trimSizeLimit: 2 * 1024 });
|
||||
const fat = 'x'.repeat(500);
|
||||
for (let i = 0; i < 10; i++) store.append(ev(i, { message: fat }));
|
||||
await settle(store, 100);
|
||||
|
||||
// Sabotage: make the tmp path unwritable so writeFile inside _trim fails
|
||||
const tmpPath = store.filePath + '.tmp';
|
||||
fs.mkdirSync(tmpPath); // a DIRECTORY at the tmp path breaks writeFile
|
||||
|
||||
for (let i = 10; i < 16; i++) store.append(ev(i, { message: fat }));
|
||||
await settle(store, 200);
|
||||
|
||||
// Lock must be released despite the failure
|
||||
expect(store.writing).toBe(false);
|
||||
expect(store._trimScheduled).toBe(false);
|
||||
|
||||
fs.rmSync(tmpPath, { recursive: true, force: true });
|
||||
// Appends still land on disk after the sabotage is cleared (write path
|
||||
// was never wedged). The post-append idle trim may legitimately SHRINK
|
||||
// the file back under budget, so assert on content, not size.
|
||||
const last = store.append(ev(99, { message: fat }));
|
||||
await settle(store, 100);
|
||||
const lines = fs.readFileSync(store.filePath, 'utf8').trim().split('\n');
|
||||
const diskIds = new Set(lines.map((l) => JSON.parse(l).id));
|
||||
expect(diskIds.has(last.id)).toBe(true);
|
||||
});
|
||||
});
|
||||
@@ -146,7 +146,7 @@ describe('LicenseManager: load()', () => {
|
||||
} finally { await restore(); }
|
||||
});
|
||||
|
||||
test('fails closed and removes expired license on load', async () => {
|
||||
test('logs expired license on load but keeps it', async () => {
|
||||
const { mgr, restore } = _makeManager();
|
||||
try {
|
||||
const activation = {
|
||||
@@ -162,7 +162,7 @@ describe('LicenseManager: load()', () => {
|
||||
await mgr.credentialManager.store('license.activation', JSON.stringify(activation));
|
||||
|
||||
await mgr.load();
|
||||
expect(mgr.activation).toBeNull();
|
||||
expect(mgr.activation).toBeTruthy();
|
||||
expect(mgr.isExpired()).toBe(true);
|
||||
expect(mgr._loaded).toBe(true);
|
||||
} finally { await restore(); }
|
||||
@@ -512,7 +512,7 @@ describe('LicenseManager: activate() — online validation', () => {
|
||||
}
|
||||
});
|
||||
|
||||
test('does not mint a new server-managed activation offline when server is unreachable', async () => {
|
||||
test('falls back to offline when server is unreachable (fetch throws)', async () => {
|
||||
const originalFetch = global.fetch;
|
||||
const dir = _tmpDir();
|
||||
const prevUrl = process.env.LICENSE_SERVER_URL;
|
||||
@@ -540,8 +540,8 @@ describe('LicenseManager: activate() — online validation', () => {
|
||||
});
|
||||
|
||||
const res = await result;
|
||||
expect(res.success).toBe(false);
|
||||
expect(res.message).toMatch(/temporarily unavailable/);
|
||||
expect(res.success).toBe(true);
|
||||
expect(res.activation.validationMethod).toBe('offline');
|
||||
} finally {
|
||||
if (prevUrl === undefined) delete process.env.LICENSE_SERVER_URL;
|
||||
else process.env.LICENSE_SERVER_URL = prevUrl;
|
||||
@@ -915,19 +915,19 @@ describe('LicenseManager: isExpired()', () => {
|
||||
} finally { restore(); }
|
||||
});
|
||||
|
||||
test('fails closed for lifetime flag without signed zero duration', () => {
|
||||
test('false for lifetime flag only (no durationDays)', () => {
|
||||
const { mgr, restore } = _makeManager();
|
||||
try {
|
||||
mgr.activation = { lifetime: true, expiresAt: '2020-01-01T00:00:00Z' };
|
||||
expect(mgr.isExpired()).toBe(true);
|
||||
expect(mgr.isExpired()).toBe(false);
|
||||
} finally { restore(); }
|
||||
});
|
||||
|
||||
test('fails closed when expiresAt is null or missing', () => {
|
||||
test('false when expiresAt is null/missing (treated as lifetime)', () => {
|
||||
const { mgr, restore } = _makeManager();
|
||||
try {
|
||||
mgr.activation = { durationDays: 30, lifetime: false, expiresAt: null };
|
||||
expect(mgr.isExpired()).toBe(true);
|
||||
expect(mgr.isExpired()).toBe(false);
|
||||
} finally { restore(); }
|
||||
});
|
||||
|
||||
@@ -1487,18 +1487,4 @@ describe('LicenseManager: full lifecycle integration', () => {
|
||||
expect(result.activation.expired).toBe(false);
|
||||
} finally { await restore(); }
|
||||
});
|
||||
|
||||
test('expired offline code cannot mint a fresh entitlement term', async () => {
|
||||
const actualNow = Date.now();
|
||||
const nowSpy = jest.spyOn(Date, 'now').mockReturnValue(actualNow - 400 * 86400000);
|
||||
const expiredCode = generateCode(TEST_SECRET, 30, 99123);
|
||||
nowSpy.mockRestore();
|
||||
const { mgr, restore } = _makeManager({ env: { LICENSE_SERVER_URL: undefined }, secret: TEST_SECRET });
|
||||
try {
|
||||
const result = await mgr.activate(expiredCode);
|
||||
expect(result.success).toBe(false);
|
||||
expect(result.message).toMatch(/expired/i);
|
||||
expect(mgr.activation).toBeNull();
|
||||
} finally { await restore(); }
|
||||
});
|
||||
});
|
||||
@@ -1,522 +0,0 @@
|
||||
const path = require('path');
|
||||
const fs = require('fs');
|
||||
|
||||
function makeCreds() {
|
||||
return {
|
||||
values: {},
|
||||
store: jest.fn(async function(key, value) { this.values[key] = value; }),
|
||||
retrieve: jest.fn(async function(key) { return this.values[key] || null; }),
|
||||
delete: jest.fn(async function(key) { delete this.values[key]; }),
|
||||
};
|
||||
}
|
||||
|
||||
describe('server-managed stable license contract', () => {
|
||||
const previous = process.env.LICENSE_SERVER_URL;
|
||||
|
||||
beforeEach(() => {
|
||||
jest.resetModules();
|
||||
process.env.LICENSE_SERVER_URL = 'https://licenses.dashcaddy.net';
|
||||
try { fs.unlinkSync('/tmp/dc-license-contract-config.json.license-revoked'); } catch (_) { /* absent */ }
|
||||
});
|
||||
|
||||
afterAll(() => {
|
||||
if (previous === undefined) delete process.env.LICENSE_SERVER_URL;
|
||||
else process.env.LICENSE_SERVER_URL = previous;
|
||||
});
|
||||
|
||||
test('refresh keeps the same key while accepting an extended server expiry', async () => {
|
||||
const { LicenseManager } = require('../src/managers/license-manager');
|
||||
const creds = makeCreds();
|
||||
const manager = new LicenseManager(creds, path.join('/tmp', 'dc-license-contract-config.json'), {});
|
||||
const code = 'DC-20F00-00059-JN7W8-0SW2N-MA200';
|
||||
manager.activation = {
|
||||
code,
|
||||
durationDays: 30,
|
||||
expiresAt: new Date(Date.now() + 86400000).toISOString(),
|
||||
features: ['sso'],
|
||||
validationMethod: 'online',
|
||||
};
|
||||
const extendedExpiry = new Date(Date.now() + 90 * 86400000).toISOString();
|
||||
manager._validateOnline = jest.fn().mockResolvedValue({
|
||||
success: true,
|
||||
activation: {
|
||||
code,
|
||||
durationDays: 90,
|
||||
expiresAt: extendedExpiry,
|
||||
features: ['sso', 'recipes', 'swarm'],
|
||||
},
|
||||
});
|
||||
manager._updateConfig = jest.fn().mockResolvedValue();
|
||||
|
||||
expect(await manager.refreshOnline(true)).toBe(true);
|
||||
expect(manager.activation.code).toBe(code);
|
||||
expect(manager.activation.expiresAt).toBe(extendedExpiry);
|
||||
expect(manager.activation.validationMethod).toBe('online');
|
||||
expect(creds.store).toHaveBeenCalled();
|
||||
});
|
||||
|
||||
test('server outage does not create a fresh offline activation', async () => {
|
||||
const { LicenseManager } = require('../src/managers/license-manager');
|
||||
const manager = new LicenseManager(makeCreds(), path.join('/tmp', 'dc-license-contract-config.json'), {});
|
||||
manager._validateOnline = jest.fn().mockResolvedValue(null);
|
||||
const result = await manager.activate('DC-20F00-00059-JN7W8-0SW2N-MA200');
|
||||
expect(result.success).toBe(false);
|
||||
expect(result.message).toMatch(/temporarily unavailable/);
|
||||
expect(manager.activation).toBeNull();
|
||||
});
|
||||
|
||||
test('background timer forces refresh every 15 minutes', async () => {
|
||||
jest.useFakeTimers();
|
||||
try {
|
||||
const { LicenseManager } = require('../src/managers/license-manager');
|
||||
const manager = new LicenseManager(makeCreds(), path.join('/tmp', 'dc-license-contract-config.json'), {});
|
||||
manager.activation = {
|
||||
code: 'DC-20F00-00059-JN7W8-0SW2N-MA200',
|
||||
durationDays: 30,
|
||||
expiresAt: new Date(Date.now() + 86400000).toISOString(),
|
||||
};
|
||||
manager.refreshOnline = jest.fn().mockResolvedValue(true);
|
||||
manager._startOnlineRefresh();
|
||||
await jest.advanceTimersByTimeAsync(15 * 60 * 1000);
|
||||
expect(manager.refreshOnline).toHaveBeenCalledWith(true);
|
||||
clearInterval(manager._onlineRefreshTimer);
|
||||
} finally {
|
||||
jest.useRealTimers();
|
||||
}
|
||||
});
|
||||
|
||||
test('explicit server rejection revokes cached entitlement', async () => {
|
||||
const { LicenseManager } = require('../src/managers/license-manager');
|
||||
const creds = makeCreds();
|
||||
const manager = new LicenseManager(creds, path.join('/tmp', 'dc-license-contract-config.json'), {});
|
||||
manager.activation = {
|
||||
code: 'DC-20F00-00059-JN7W8-0SW2N-MA200',
|
||||
durationDays: 30,
|
||||
expiresAt: new Date(Date.now() + 86400000).toISOString(),
|
||||
validationMethod: 'online',
|
||||
};
|
||||
manager._validateOnline = jest.fn().mockResolvedValue({ success: false, message: 'License revoked' });
|
||||
manager._updateConfig = jest.fn().mockResolvedValue();
|
||||
expect(await manager.refreshOnline(true)).toBe(false);
|
||||
expect(manager.activation).toBeNull();
|
||||
expect(creds.delete).toHaveBeenCalledWith('license.activation');
|
||||
});
|
||||
|
||||
test('server outage never trusts a legacy offline cache as server-managed', async () => {
|
||||
const { LicenseManager } = require('../src/managers/license-manager');
|
||||
const manager = new LicenseManager(makeCreds(), path.join('/tmp', 'dc-license-contract-config.json'), {});
|
||||
const code = 'DC-20F00-00059-JN7W8-0SW2N-MA200';
|
||||
manager.activation = {
|
||||
code,
|
||||
durationDays: 30,
|
||||
expiresAt: new Date(Date.now() + 86400000).toISOString(),
|
||||
validationMethod: 'offline',
|
||||
};
|
||||
manager._validateOnline = jest.fn().mockResolvedValue(null);
|
||||
const result = await manager.activate(code);
|
||||
expect(result.success).toBe(false);
|
||||
expect(result.message).toMatch(/temporarily unavailable/);
|
||||
});
|
||||
|
||||
test('startup quarantines a stored legacy offline entitlement during outage', async () => {
|
||||
const { LicenseManager } = require('../src/managers/license-manager');
|
||||
const creds = makeCreds();
|
||||
const code = 'DC-20F00-00059-JN7W8-0SW2N-MA200';
|
||||
creds.values['license.activation'] = JSON.stringify({
|
||||
code,
|
||||
durationDays: 30,
|
||||
expiresAt: new Date(Date.now() + 86400000).toISOString(),
|
||||
validationMethod: 'offline',
|
||||
});
|
||||
const manager = new LicenseManager(creds, path.join('/tmp', 'dc-license-contract-config.json'), {});
|
||||
manager._validateOnline = jest.fn().mockResolvedValue(null);
|
||||
manager._updateConfig = jest.fn().mockResolvedValue();
|
||||
await manager.load();
|
||||
expect(manager.activation).toBeNull();
|
||||
expect(creds.delete).toHaveBeenCalledWith('license.activation');
|
||||
});
|
||||
|
||||
test('activation-time explicit rejection revokes matching cached entitlement', async () => {
|
||||
const { LicenseManager } = require('../src/managers/license-manager');
|
||||
const creds = makeCreds();
|
||||
const code = 'DC-20F00-00059-JN7W8-0SW2N-MA200';
|
||||
const manager = new LicenseManager(creds, path.join('/tmp', 'dc-license-contract-config.json'), {});
|
||||
manager.activation = {
|
||||
code,
|
||||
durationDays: 30,
|
||||
expiresAt: new Date(Date.now() + 86400000).toISOString(),
|
||||
validationMethod: 'online',
|
||||
};
|
||||
manager._validateOnline = jest.fn().mockResolvedValue({ success: false, message: 'Revoked' });
|
||||
manager._updateConfig = jest.fn().mockResolvedValue();
|
||||
const result = await manager.activate(code);
|
||||
expect(result.success).toBe(false);
|
||||
expect(manager.activation).toBeNull();
|
||||
expect(creds.delete).toHaveBeenCalledWith('license.activation');
|
||||
});
|
||||
|
||||
test('deactivate during refresh cannot resurrect entitlement', async () => {
|
||||
const { LicenseManager } = require('../src/managers/license-manager');
|
||||
const creds = makeCreds();
|
||||
const manager = new LicenseManager(creds, path.join('/tmp', 'dc-license-contract-config.json'), {});
|
||||
const code = 'DC-20F00-00059-JN7W8-0SW2N-MA200';
|
||||
manager.activation = { code, durationDays: 30, expiresAt: new Date(Date.now() + 86400000).toISOString(), validationMethod: 'online' };
|
||||
let release;
|
||||
manager._validateOnline = jest.fn(() => new Promise(resolve => { release = resolve; }));
|
||||
manager._updateConfig = jest.fn().mockResolvedValue();
|
||||
manager._notifyDeactivation = jest.fn().mockResolvedValue();
|
||||
const refresh = manager.refreshOnline(true);
|
||||
const deactivate = manager.deactivate();
|
||||
await new Promise(resolve => setImmediate(resolve));
|
||||
release({ success: true, activation: { code, durationDays: 90, expiresAt: new Date(Date.now() + 90 * 86400000).toISOString() } });
|
||||
await refresh;
|
||||
expect((await deactivate).success).toBe(true);
|
||||
expect(manager.activation).toBeNull();
|
||||
});
|
||||
|
||||
test('different-key activation waits for refresh and remains current', async () => {
|
||||
const { LicenseManager } = require('../src/managers/license-manager');
|
||||
const creds = makeCreds();
|
||||
const manager = new LicenseManager(creds, path.join('/tmp', 'dc-license-contract-config.json'), {});
|
||||
const oldCode = 'DC-20F00-00059-JN7W8-0SW2N-MA200';
|
||||
const newCode = 'DC-20F00-0005A-JN7W8-0SW2N-MA200';
|
||||
manager.activation = { code: oldCode, durationDays: 30, expiresAt: new Date(Date.now() + 86400000).toISOString(), validationMethod: 'online' };
|
||||
let release;
|
||||
manager._validateOnline = jest.fn()
|
||||
.mockImplementationOnce(() => new Promise(resolve => { release = resolve; }))
|
||||
.mockResolvedValueOnce({ success: true, activation: { code: newCode, durationDays: 30, expiresAt: new Date(Date.now() + 30 * 86400000).toISOString(), features: ['sso'] } });
|
||||
manager._updateConfig = jest.fn().mockResolvedValue();
|
||||
const refresh = manager.refreshOnline(true);
|
||||
const activate = manager.activate(newCode);
|
||||
await new Promise(resolve => setImmediate(resolve));
|
||||
release({ success: true, activation: { code: oldCode, durationDays: 90, expiresAt: new Date(Date.now() + 90 * 86400000).toISOString() } });
|
||||
await refresh;
|
||||
expect((await activate).success).toBe(true);
|
||||
expect(manager.activation.code).toBe(newCode);
|
||||
});
|
||||
|
||||
test('concurrent activations commit in request order without stale overwrite', async () => {
|
||||
const { LicenseManager } = require('../src/managers/license-manager');
|
||||
const manager = new LicenseManager(makeCreds(), path.join('/tmp', 'dc-license-contract-config.json'), {});
|
||||
const firstCode = 'DC-20F00-00059-JN7W8-0SW2N-MA200';
|
||||
const secondCode = 'DC-20F00-0005A-JN7W8-0SW2N-MA200';
|
||||
let releaseFirst;
|
||||
manager._validateOnline = jest.fn()
|
||||
.mockImplementationOnce(() => new Promise(resolve => { releaseFirst = resolve; }))
|
||||
.mockResolvedValueOnce({ success: true, activation: { code: secondCode, durationDays: 90, expiresAt: new Date(Date.now() + 90 * 86400000).toISOString(), features: ['sso'] } });
|
||||
manager._updateConfig = jest.fn().mockResolvedValue();
|
||||
const first = manager.activate(firstCode);
|
||||
const second = manager.activate(secondCode);
|
||||
await new Promise(resolve => setImmediate(resolve));
|
||||
releaseFirst({ success: true, activation: { code: firstCode, durationDays: 30, expiresAt: new Date(Date.now() + 30 * 86400000).toISOString(), features: ['sso'] } });
|
||||
expect((await first).success).toBe(true);
|
||||
expect((await second).success).toBe(true);
|
||||
expect(manager.activation.code).toBe(secondCode);
|
||||
});
|
||||
|
||||
test.each([429, 500, 502, 503])('retryable HTTP %i never revokes cached online entitlement', async (status) => {
|
||||
const originalFetch = global.fetch;
|
||||
try {
|
||||
global.fetch = jest.fn().mockResolvedValue({
|
||||
ok: false,
|
||||
status,
|
||||
json: async () => ({ error: 'temporary failure' }),
|
||||
});
|
||||
const { LicenseManager } = require('../src/managers/license-manager');
|
||||
const code = 'DC-20F00-00059-JN7W8-0SW2N-MA200';
|
||||
const manager = new LicenseManager(makeCreds(), path.join('/tmp', 'dc-license-contract-config.json'), {});
|
||||
manager.activation = {
|
||||
code,
|
||||
durationDays: 30,
|
||||
expiresAt: new Date(Date.now() + 86400000).toISOString(),
|
||||
validationMethod: 'online',
|
||||
};
|
||||
expect(await manager.refreshOnline(true)).toBe(false);
|
||||
expect(manager.activation.code).toBe(code);
|
||||
} finally {
|
||||
global.fetch = originalFetch;
|
||||
}
|
||||
});
|
||||
|
||||
test.each([
|
||||
{ durationDays: 30, features: ['sso'] },
|
||||
{ expiresAt: 'not-a-date', durationDays: 30, features: ['sso'] },
|
||||
{ expiresAt: new Date(Date.now() - 1000).toISOString(), durationDays: 30, features: ['sso'] },
|
||||
{ expiresAt: new Date(Date.now() + 86400000).toISOString(), durationDays: 0, features: ['sso'] },
|
||||
{ expiresAt: new Date(Date.now() + 86400000).toISOString(), durationDays: 30, features: 'sso' },
|
||||
{ expiresAt: new Date(Date.now() + 20 * 365 * 86400000).toISOString(), durationDays: 30, features: ['sso'] },
|
||||
])('malformed HTTP 200 success never creates an unbounded entitlement', async (payload) => {
|
||||
const originalFetch = global.fetch;
|
||||
try {
|
||||
global.fetch = jest.fn().mockResolvedValue({
|
||||
ok: true,
|
||||
status: 200,
|
||||
json: async () => ({ success: true, ...payload }),
|
||||
});
|
||||
const { LicenseManager } = require('../src/managers/license-manager');
|
||||
const manager = new LicenseManager(makeCreds(), path.join('/tmp', 'dc-license-contract-config.json'), {});
|
||||
const result = await manager.activate('DC-20F00-00059-JN7W8-0SW2N-MA200');
|
||||
expect(result.success).toBe(false);
|
||||
expect(manager.activation).toBeNull();
|
||||
} finally {
|
||||
global.fetch = originalFetch;
|
||||
}
|
||||
});
|
||||
|
||||
test.each([
|
||||
{ durationDays: 30, features: ['sso'] },
|
||||
{ expiresAt: 'bad-date', durationDays: 30, features: ['sso'] },
|
||||
{ expiresAt: new Date(Date.now() - 1000).toISOString(), durationDays: 30, features: ['sso'] },
|
||||
{ expiresAt: new Date(Date.now() + 20 * 365 * 86400000).toISOString(), durationDays: 30, features: ['sso'], activatedAt: new Date().toISOString() },
|
||||
])('startup outage rejects malformed cached online entitlement', async (cached) => {
|
||||
const { LicenseManager } = require('../src/managers/license-manager');
|
||||
const creds = makeCreds();
|
||||
creds.values['license.activation'] = JSON.stringify({
|
||||
code: 'DC-20F00-00059-JN7W8-0SW2N-MA200',
|
||||
validationMethod: 'online',
|
||||
...cached,
|
||||
});
|
||||
const manager = new LicenseManager(creds, path.join('/tmp', 'dc-license-contract-config.json'), {});
|
||||
manager._validateOnline = jest.fn().mockResolvedValue(null);
|
||||
manager._updateConfig = jest.fn().mockResolvedValue();
|
||||
await manager.load();
|
||||
expect(manager.activation).toBeNull();
|
||||
});
|
||||
|
||||
test('deactivate waiting on authoritative rejection does not dereference revoked state', async () => {
|
||||
const { LicenseManager } = require('../src/managers/license-manager');
|
||||
const manager = new LicenseManager(makeCreds(), path.join('/tmp', 'dc-license-contract-config.json'), {});
|
||||
manager.activation = {
|
||||
code: 'DC-20F00-00059-JN7W8-0SW2N-MA200',
|
||||
durationDays: 30,
|
||||
expiresAt: new Date(Date.now() + 86400000).toISOString(),
|
||||
features: ['sso'],
|
||||
validationMethod: 'online',
|
||||
};
|
||||
let release;
|
||||
manager._validateOnline = jest.fn(() => new Promise(resolve => { release = resolve; }));
|
||||
manager._updateConfig = jest.fn().mockResolvedValue();
|
||||
const refresh = manager.refreshOnline(true);
|
||||
const deactivate = manager.deactivate();
|
||||
await new Promise(resolve => setImmediate(resolve));
|
||||
release({ success: false, message: 'Revoked' });
|
||||
await refresh;
|
||||
const result = await deactivate;
|
||||
expect(result.success).toBe(false);
|
||||
expect(manager.activation).toBeNull();
|
||||
});
|
||||
|
||||
test('revocation tombstone prevents restart resurrection when credential deletion fails', async () => {
|
||||
const { LicenseManager } = require('../src/managers/license-manager');
|
||||
const configPath = path.join('/tmp', 'dc-license-contract-config.json');
|
||||
const code = 'DC-20F00-00059-JN7W8-0SW2N-MA200';
|
||||
const cached = {
|
||||
code,
|
||||
durationDays: 30,
|
||||
expiresAt: new Date(Date.now() + 86400000).toISOString(),
|
||||
activatedAt: new Date().toISOString(),
|
||||
features: ['sso'],
|
||||
validationMethod: 'online',
|
||||
};
|
||||
const creds = makeCreds();
|
||||
creds.values['license.activation'] = JSON.stringify(cached);
|
||||
creds.delete = jest.fn().mockRejectedValue(new Error('keychain unavailable'));
|
||||
|
||||
const first = new LicenseManager(creds, configPath, {});
|
||||
first.activation = cached;
|
||||
first._validateOnline = jest.fn().mockResolvedValue({ success: false, message: 'Revoked' });
|
||||
first._updateConfig = jest.fn().mockResolvedValue();
|
||||
expect(await first.refreshOnline(true)).toBe(false);
|
||||
expect(fs.existsSync(`${configPath}.license-revoked`)).toBe(true);
|
||||
|
||||
const restarted = new LicenseManager(creds, configPath, {});
|
||||
restarted._validateOnline = jest.fn().mockResolvedValue(null);
|
||||
restarted._updateConfig = jest.fn().mockResolvedValue();
|
||||
await restarted.load();
|
||||
expect(restarted.activation).toBeNull();
|
||||
expect(restarted._updateConfig).toHaveBeenCalled();
|
||||
});
|
||||
|
||||
test('tombstone write failure still clears rejected entitlement in memory', async () => {
|
||||
const { LicenseManager } = require('../src/managers/license-manager');
|
||||
const creds = makeCreds();
|
||||
const manager = new LicenseManager(creds, path.join('/tmp', 'dc-license-contract-config.json'), { error: jest.fn(), warn: jest.fn() });
|
||||
manager.activation = {
|
||||
code: 'DC-20F00-00059-JN7W8-0SW2N-MA200',
|
||||
durationDays: 30,
|
||||
expiresAt: new Date(Date.now() + 86400000).toISOString(),
|
||||
activatedAt: new Date().toISOString(),
|
||||
features: ['sso'],
|
||||
validationMethod: 'online',
|
||||
};
|
||||
manager._writeRevocationTombstone = jest.fn().mockRejectedValue(new Error('disk full'));
|
||||
manager._validateOnline = jest.fn().mockResolvedValue({ success: false, message: 'Revoked' });
|
||||
manager._updateConfig = jest.fn().mockResolvedValue();
|
||||
expect(await manager.refreshOnline(true)).toBe(false);
|
||||
expect(manager.activation).toBeNull();
|
||||
expect(creds.delete).toHaveBeenCalledWith('license.activation');
|
||||
});
|
||||
|
||||
test('corrupt tombstone fails closed during restart', async () => {
|
||||
const { LicenseManager } = require('../src/managers/license-manager');
|
||||
const configPath = path.join('/tmp', 'dc-license-contract-config.json');
|
||||
fs.writeFileSync(`${configPath}.license-revoked`, '{partial', { mode: 0o600 });
|
||||
const creds = makeCreds();
|
||||
creds.values['license.activation'] = JSON.stringify({
|
||||
code: 'DC-20F00-00059-JN7W8-0SW2N-MA200',
|
||||
durationDays: 30,
|
||||
expiresAt: new Date(Date.now() + 86400000).toISOString(),
|
||||
activatedAt: new Date().toISOString(),
|
||||
features: ['sso'],
|
||||
validationMethod: 'online',
|
||||
});
|
||||
const manager = new LicenseManager(creds, configPath, {});
|
||||
manager._validateOnline = jest.fn().mockResolvedValue(null);
|
||||
await manager.load();
|
||||
expect(manager.activation).toBeNull();
|
||||
expect(manager._validateOnline).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
test('activation persistence failure rolls back in-memory premium access', async () => {
|
||||
const { LicenseManager } = require('../src/managers/license-manager');
|
||||
const creds = makeCreds();
|
||||
creds.store = jest.fn().mockRejectedValue(new Error('keychain full'));
|
||||
const manager = new LicenseManager(creds, path.join('/tmp', 'dc-license-contract-config.json'), {});
|
||||
const code = 'DC-20F00-00059-JN7W8-0SW2N-MA200';
|
||||
manager._validateOnline = jest.fn().mockResolvedValue({
|
||||
success: true,
|
||||
activation: {
|
||||
code,
|
||||
durationDays: 30,
|
||||
activatedAt: new Date().toISOString(),
|
||||
expiresAt: new Date(Date.now() + 30 * 86400000).toISOString(),
|
||||
features: ['sso'],
|
||||
}
|
||||
});
|
||||
const result = await manager.activate(code);
|
||||
expect(result.success).toBe(false);
|
||||
expect(manager.activation).toBeNull();
|
||||
expect(manager.isPro()).toBe(false);
|
||||
expect(manager.hasFeature('sso')).toBe(false);
|
||||
});
|
||||
|
||||
test('combined revocation persistence failures cannot restore plaintext config backup', async () => {
|
||||
const { LicenseManager } = require('../src/managers/license-manager');
|
||||
const configPath = `/tmp/dc-combined-failure-${process.pid}.json`;
|
||||
const cached = {
|
||||
code: 'DC-20F00-00059-JN7W8-0SW2N-MA200',
|
||||
durationDays: 30,
|
||||
expiresAt: new Date(Date.now() + 86400000).toISOString(),
|
||||
activatedAt: new Date().toISOString(),
|
||||
features: ['sso'],
|
||||
validationMethod: 'online',
|
||||
};
|
||||
fs.writeFileSync(configPath, JSON.stringify({ licenseBackup: cached }));
|
||||
const creds = makeCreds();
|
||||
creds.values['license.activation'] = JSON.stringify(cached);
|
||||
creds.delete = jest.fn().mockRejectedValue(new Error('keychain locked'));
|
||||
const manager = new LicenseManager(creds, configPath, {});
|
||||
manager.activation = cached;
|
||||
manager._writeRevocationTombstone = jest.fn().mockRejectedValue(new Error('disk full'));
|
||||
manager._validateOnline = jest.fn().mockResolvedValue({ success: false, message: 'Revoked' });
|
||||
manager._updateConfig = jest.fn().mockRejectedValue(new Error('config locked'));
|
||||
await manager.refreshOnline(true);
|
||||
expect(manager.activation).toBeNull();
|
||||
await expect(creds.retrieve('license.activation')).resolves.not.toBeNull();
|
||||
|
||||
const restarted = new LicenseManager(creds, configPath, {});
|
||||
restarted._validateOnline = jest.fn().mockResolvedValue(null);
|
||||
await restarted.load();
|
||||
expect(restarted.activation).toBeNull();
|
||||
fs.unlinkSync(configPath);
|
||||
});
|
||||
|
||||
test('ambiguous empty HTTP 200 preserves bounded cached entitlement', async () => {
|
||||
const originalFetch = global.fetch;
|
||||
try {
|
||||
global.fetch = jest.fn().mockResolvedValue({ ok: true, status: 200, json: async () => ({}) });
|
||||
const { LicenseManager } = require('../src/managers/license-manager');
|
||||
const manager = new LicenseManager(makeCreds(), path.join('/tmp', 'dc-license-contract-config.json'), {});
|
||||
manager.activation = {
|
||||
code: 'DC-20F00-00059-JN7W8-0SW2N-MA200',
|
||||
durationDays: 30,
|
||||
expiresAt: new Date(Date.now() + 86400000).toISOString(),
|
||||
activatedAt: new Date().toISOString(),
|
||||
features: ['sso'],
|
||||
validationMethod: 'online',
|
||||
};
|
||||
expect(await manager.refreshOnline(true)).toBe(false);
|
||||
expect(manager.activation).not.toBeNull();
|
||||
} finally {
|
||||
global.fetch = originalFetch;
|
||||
}
|
||||
});
|
||||
|
||||
test('startup outage fails closed and automatically recovers in the same process', async () => {
|
||||
const { LicenseManager } = require('../src/managers/license-manager');
|
||||
const configPath = path.join('/tmp', 'dc-license-contract-config.json');
|
||||
const cached = {
|
||||
code: 'DC-20F00-00059-JN7W8-0SW2N-MA200',
|
||||
durationDays: 30,
|
||||
expiresAt: new Date(Date.now() + 30 * 86400000).toISOString(),
|
||||
activatedAt: new Date().toISOString(),
|
||||
features: ['sso'],
|
||||
validationMethod: 'online',
|
||||
};
|
||||
const creds = makeCreds();
|
||||
creds.values['license.activation'] = JSON.stringify(cached);
|
||||
|
||||
const unavailable = new LicenseManager(creds, configPath, {});
|
||||
unavailable._validateOnline = jest.fn().mockResolvedValue(null);
|
||||
unavailable._updateConfig = jest.fn().mockResolvedValue();
|
||||
await unavailable.load();
|
||||
expect(unavailable.activation).toBeNull();
|
||||
await expect(creds.retrieve('license.activation')).resolves.not.toBeNull();
|
||||
expect(fs.existsSync(`${configPath}.license-revoked`)).toBe(false);
|
||||
|
||||
unavailable._validateOnline = jest.fn().mockResolvedValue({
|
||||
success: true,
|
||||
activation: { ...cached, expiresAt: new Date(Date.now() + 30 * 86400000).toISOString() }
|
||||
});
|
||||
const recovered = await unavailable._retryStartupValidation();
|
||||
expect(recovered).toBe(true);
|
||||
expect(unavailable.activation.code).toBe(cached.code);
|
||||
expect(unavailable.activation.validationMethod).toBe('online');
|
||||
});
|
||||
|
||||
test('startup recovery persistence failure stays fail-closed and remains retryable', async () => {
|
||||
const { LicenseManager } = require('../src/managers/license-manager');
|
||||
const configPath = path.join('/tmp', 'dc-license-contract-config.json');
|
||||
const cached = {
|
||||
code: 'DC-20F00-00059-JN7W8-0SW2N-MA200',
|
||||
durationDays: 30,
|
||||
expiresAt: new Date(Date.now() + 30 * 86400000).toISOString(),
|
||||
activatedAt: new Date().toISOString(),
|
||||
features: ['sso'],
|
||||
validationMethod: 'online',
|
||||
};
|
||||
const creds = makeCreds();
|
||||
creds.values['license.activation'] = JSON.stringify(cached);
|
||||
const manager = new LicenseManager(creds, configPath, {});
|
||||
manager._validateOnline = jest.fn().mockResolvedValue(null);
|
||||
manager._updateConfig = jest.fn().mockResolvedValue();
|
||||
await manager.load();
|
||||
expect(manager.activation).toBeNull();
|
||||
|
||||
manager._validateOnline.mockResolvedValue({ success: true, activation: cached });
|
||||
creds.store.mockRejectedValueOnce(new Error('credential disk full'));
|
||||
expect(await manager._retryStartupValidation()).toBe(false);
|
||||
expect(manager.activation).toBeNull();
|
||||
expect(manager._pendingStartupCode).toBe(cached.code);
|
||||
|
||||
const preserved = await creds.retrieve('license.activation');
|
||||
manager._updateConfig.mockRejectedValueOnce(new Error('config disk full'));
|
||||
expect(await manager._retryStartupValidation()).toBe(false);
|
||||
expect(manager.activation).toBeNull();
|
||||
expect(await creds.retrieve('license.activation')).toBe(preserved);
|
||||
expect(manager._pendingStartupCode).toBe(cached.code);
|
||||
|
||||
expect(await manager._retryStartupValidation()).toBe(true);
|
||||
expect(manager.activation.code).toBe(cached.code);
|
||||
});
|
||||
});
|
||||
@@ -1,20 +0,0 @@
|
||||
const express = require('express');
|
||||
const request = require('supertest');
|
||||
const createLicenseRouter = require('../routes/license');
|
||||
|
||||
function asyncHandler(fn) {
|
||||
return (req, res, next) => Promise.resolve(fn(req, res, next)).catch(next);
|
||||
}
|
||||
|
||||
test('GET license status forces online entitlement refresh before responding', async () => {
|
||||
const licenseManager = {
|
||||
refreshOnline: jest.fn().mockResolvedValue(true),
|
||||
getStatus: jest.fn().mockReturnValue({ active: true, tier: 'premium' }),
|
||||
};
|
||||
const app = express();
|
||||
app.use('/license', createLicenseRouter({ licenseManager, asyncHandler }));
|
||||
const response = await request(app).get('/license/status');
|
||||
expect(response.status).toBe(200);
|
||||
expect(licenseManager.refreshOnline).toHaveBeenCalledWith();
|
||||
expect(licenseManager.getStatus).toHaveBeenCalledTimes(1);
|
||||
});
|
||||
@@ -1,287 +0,0 @@
|
||||
/**
|
||||
* DC-095: central email (PII) masking in the unified logger.
|
||||
*
|
||||
* Every log sink must mask email addresses regardless of what a call site
|
||||
* interpolates — msg strings, data payloads, error messages/stacks, audit
|
||||
* details, and error.log lines. Shape matches AuthProvider.maskEmail
|
||||
* ("sa****@example.com"). Non-email `@` shapes (root@hostname, pkg@1.2.3)
|
||||
* must pass through untouched.
|
||||
*
|
||||
* Regression provenance: DC-089 judge note #3 — invite/auth call sites were
|
||||
* fixed individually, but new call sites kept reintroducing raw PII. This is
|
||||
* the central choke-point defense.
|
||||
*/
|
||||
|
||||
const path = require('path');
|
||||
const fs = require('fs');
|
||||
const fsp = require('fs').promises;
|
||||
const os = require('os');
|
||||
|
||||
const TMP_DIR = fs.mkdtempSync(path.join(os.tmpdir(), 'dc-logging-emailmask-'));
|
||||
process.env.AUDIT_LOG_FILE = path.join(TMP_DIR, 'audit-log.json');
|
||||
process.env.ERROR_LOG_FILE = path.join(TMP_DIR, 'error.log');
|
||||
process.env.NODE_ENV = 'production'; // JSON output mode
|
||||
|
||||
const {
|
||||
log,
|
||||
setLevel,
|
||||
AUDIT_LOG_FILE,
|
||||
ERROR_LOG_FILE,
|
||||
} = require('../src/utils/logging');
|
||||
|
||||
const RAW = 'sami.admin@example.com';
|
||||
|
||||
afterAll(async () => {
|
||||
try { await fsp.rm(TMP_DIR, { recursive: true, force: true }); } catch (_) {}
|
||||
});
|
||||
|
||||
beforeEach(async () => {
|
||||
try { await fsp.writeFile(AUDIT_LOG_FILE, '[]'); } catch (_) {}
|
||||
try { await fsp.writeFile(ERROR_LOG_FILE, ''); } catch (_) {}
|
||||
setLevel('debug');
|
||||
});
|
||||
|
||||
describe('DC-095: logger-level email masking', () => {
|
||||
let infoSpy, errorSpy, warnSpy;
|
||||
|
||||
beforeEach(() => {
|
||||
infoSpy = jest.spyOn(console, 'info').mockImplementation(() => {});
|
||||
warnSpy = jest.spyOn(console, 'warn').mockImplementation(() => {});
|
||||
errorSpy = jest.spyOn(console, 'error').mockImplementation(() => {});
|
||||
});
|
||||
|
||||
afterEach(() => {
|
||||
infoSpy.mockRestore();
|
||||
warnSpy.mockRestore();
|
||||
errorSpy.mockRestore();
|
||||
});
|
||||
|
||||
const consoleOut = () =>
|
||||
[...infoSpy.mock.calls, ...warnSpy.mock.calls, ...errorSpy.mock.calls]
|
||||
.map(c => String(c[0]))
|
||||
.join('\n');
|
||||
|
||||
test('msg string with interpolated email is masked on console', () => {
|
||||
log.warn('auth-magic-send', `SMTP delivery failed for ${RAW}`);
|
||||
const out = consoleOut();
|
||||
expect(out).not.toContain(RAW);
|
||||
expect(out).toContain('sa****@example.com');
|
||||
});
|
||||
|
||||
test('data payload object: email field masked on console', () => {
|
||||
log.info('auth', 'email magic link issued', { email: RAW, ip: '1.2.3.4' });
|
||||
const out = consoleOut();
|
||||
expect(out).not.toContain(RAW);
|
||||
expect(JSON.parse(out)).toMatchObject({ data: { email: 'sa****@example.com', ip: '1.2.3.4' } });
|
||||
});
|
||||
|
||||
test('nested payload strings masked (link URLs, arrays, depth)', () => {
|
||||
log.info('auth', 'magic link', {
|
||||
url: `https://x.example/verify?to=${RAW}`,
|
||||
to: [RAW, 'other.person@sub.domain.org'],
|
||||
meta: { owner: RAW, note: 'no email here' },
|
||||
});
|
||||
const out = consoleOut();
|
||||
expect(out).not.toContain(RAW);
|
||||
expect(out).not.toContain('other.person@sub.domain.org');
|
||||
const parsed = JSON.parse(out);
|
||||
expect(parsed.data.url).toBe('https://x.example/verify?to=sa****@example.com');
|
||||
expect(parsed.data.to).toEqual(['sa****@example.com', 'ot****@sub.domain.org']);
|
||||
expect(parsed.data.meta.owner).toBe('sa****@example.com');
|
||||
expect(parsed.data.meta.note).toBe('no email here');
|
||||
});
|
||||
|
||||
test('error messages and stacks are masked on console', () => {
|
||||
const err = new Error(`SMTP delivery to ${RAW} rejected by relay`);
|
||||
log.error('auth-magic-send', err);
|
||||
const out = consoleOut();
|
||||
expect(out).not.toContain(RAW);
|
||||
expect(out).toContain('sa****@example.com');
|
||||
});
|
||||
|
||||
test('log.error writes masked lines to error.log (head, stack, context)', async () => {
|
||||
const err = new Error(`RCPT ${RAW} bounced`);
|
||||
await log.error('smtp', err, null, { recipient: RAW, note: 'retry' });
|
||||
const raw = await fsp.readFile(ERROR_LOG_FILE, 'utf8');
|
||||
expect(raw).not.toContain(RAW);
|
||||
expect(raw).toContain('sa****@example.com');
|
||||
expect(raw).toContain('***'); // SENSITIVE_KEYS not triggered here; recipient is plain key
|
||||
});
|
||||
|
||||
test('logError wrapper: error.log context line masked', async () => {
|
||||
const { logError } = require('../src/utils/logging');
|
||||
await logError('smtp', new Error(`delivery failed for ${RAW}`), { to: RAW });
|
||||
const raw = await fsp.readFile(ERROR_LOG_FILE, 'utf8');
|
||||
expect(raw).not.toContain(RAW);
|
||||
expect(raw).toContain('sa****@example.com');
|
||||
});
|
||||
|
||||
test('audit details: email in body masked in audit-log.json', async () => {
|
||||
await log.audit({
|
||||
action: 'test.invite',
|
||||
resource: 'invites',
|
||||
outcome: 'success',
|
||||
details: { body: { email: RAW, role: 'viewer' } },
|
||||
});
|
||||
const entries = await log.queryAudit({ limit: 5 });
|
||||
const entry = entries.find(e => e.action === 'test.invite');
|
||||
expect(entry).toBeDefined();
|
||||
expect(entry.details.body.email).toBe('sa****@example.com');
|
||||
expect(entry.details.body.role).toBe('viewer');
|
||||
const onDisk = await fsp.readFile(AUDIT_LOG_FILE, 'utf8');
|
||||
expect(onDisk).not.toContain(RAW);
|
||||
});
|
||||
|
||||
test('log entry event: emitted entry carries masked msg and masked payload', () => {
|
||||
const captured = [];
|
||||
const handler = (e) => captured.push(e);
|
||||
log.on('entry', handler);
|
||||
// info-path: msg masked (data object is console-only by design — entry
|
||||
// only carries error/payload fields, matching pre-DC-095 behavior).
|
||||
log.info('auth', `magic link issued for ${RAW}`);
|
||||
// error-path: payload DOES land on the entry and must be masked there.
|
||||
log.error('smtp', new Error('relay down'), null, { recipient: RAW });
|
||||
log.off('entry', handler);
|
||||
const info = captured.find(e => e.msg.includes('magic link'));
|
||||
expect(info).toBeDefined();
|
||||
expect(info.msg).toBe('magic link issued for sa****@example.com');
|
||||
const errEntry = captured.find(e => e.level === 'error');
|
||||
expect(errEntry).toBeDefined();
|
||||
expect(errEntry.data.recipient).toBe('sa****@example.com');
|
||||
});
|
||||
|
||||
test('non-email @ shapes untouched (hostnames, versions, shas)', () => {
|
||||
log.info('docker', 'image built', {
|
||||
ref: 'registry.local/app@sha256:abcdef',
|
||||
user: 'root@web-1',
|
||||
ver: 'pkg@1.2.3',
|
||||
tag: 'dashcaddy@2x',
|
||||
});
|
||||
const out = consoleOut();
|
||||
expect(out).toContain('registry.local/app@sha256:abcdef');
|
||||
expect(out).toContain('root@web-1');
|
||||
expect(out).toContain('pkg@1.2.3');
|
||||
expect(out).toContain('dashcaddy@2x');
|
||||
expect(out).not.toContain('****');
|
||||
});
|
||||
|
||||
test('masking is idempotent (double-masked output stable)', () => {
|
||||
log.info('auth', 'already masked', { email: 'sa****@example.com' });
|
||||
const out = consoleOut();
|
||||
expect(out).toContain('sa****@example.com');
|
||||
expect(out.match(/\*/g).length).toBe(4); // exactly one mask, not doubled
|
||||
});
|
||||
|
||||
test('short local-parts mask to 1 char + stars', () => {
|
||||
log.info('auth', 'short', { email: 'ab@example.com' });
|
||||
const out = consoleOut();
|
||||
expect(out).toContain('a****@example.com');
|
||||
});
|
||||
|
||||
test('payload object identity preserved for non-plain objects', () => {
|
||||
const d = new Date(0);
|
||||
log.info('test', 'date passthrough', { when: d });
|
||||
const out = consoleOut();
|
||||
const parsed = JSON.parse(out);
|
||||
expect(parsed.data.when).toBe('1970-01-01T00:00:00.000Z');
|
||||
});
|
||||
});
|
||||
|
||||
describe('DC-095 round 2: adversarial judge findings', () => {
|
||||
let infoSpy, errorSpy, warnSpy;
|
||||
|
||||
beforeEach(() => {
|
||||
infoSpy = jest.spyOn(console, 'info').mockImplementation(() => {});
|
||||
warnSpy = jest.spyOn(console, 'warn').mockImplementation(() => {});
|
||||
errorSpy = jest.spyOn(console, 'error').mockImplementation(() => {});
|
||||
});
|
||||
|
||||
afterEach(() => {
|
||||
infoSpy.mockRestore();
|
||||
warnSpy.mockRestore();
|
||||
errorSpy.mockRestore();
|
||||
});
|
||||
|
||||
const consoleOut = () =>
|
||||
[...infoSpy.mock.calls, ...warnSpy.mock.calls, ...errorSpy.mock.calls]
|
||||
.map(c => String(c[0]))
|
||||
.join('\n');
|
||||
|
||||
test('ReDoS: 40KB adversarial "a@"+"1."*20000 string processes in <250ms', () => {
|
||||
const evil = 'a@' + '1.'.repeat(20000);
|
||||
const t0 = Date.now();
|
||||
log.info('test', 'evil', { body: evil });
|
||||
const elapsed = Date.now() - t0;
|
||||
// The payload contains no real email (all digits/dots, no alpha TLD), so
|
||||
// nothing to mask — this test pins the TIMING bound only: the unbounded
|
||||
// quantifier version stalled 3.3s on this exact input.
|
||||
expect(elapsed).toBeLessThan(250);
|
||||
// And a real email embedded in a huge adversarial string still masks fast:
|
||||
const evil2 = 'x'.repeat(20000) + ' real@user.example.com ' + 'y'.repeat(20000);
|
||||
const t1 = Date.now();
|
||||
log.info('test', 'evil2', { body: evil2 });
|
||||
expect(Date.now() - t1).toBeLessThan(250);
|
||||
const out = consoleOut();
|
||||
expect(out).not.toContain('real@user.example.com');
|
||||
expect(out).toContain('re****@user.example.com');
|
||||
});
|
||||
|
||||
test('DAG shared reference: BOTH paths masked, no raw leak', () => {
|
||||
const shared = { email: 'leak.me@example.com' };
|
||||
log.info('auth', 'dag', { a: shared, b: shared });
|
||||
const out = consoleOut();
|
||||
expect(out).not.toContain('leak.me@example.com');
|
||||
// both a and b carry the masked form
|
||||
const parsed = JSON.parse(out);
|
||||
expect(parsed.data.a.email).toBe('le****@example.com');
|
||||
expect(parsed.data.b.email).toBe('le****@example.com');
|
||||
});
|
||||
|
||||
test('quoted local-part ("john doe"@example.com) masked', () => {
|
||||
log.info('auth', 'quoted', { email: '"john doe"@example.com' });
|
||||
const out = consoleOut();
|
||||
expect(out).not.toContain('john doe');
|
||||
expect(out).not.toContain('"john doe"@example.com');
|
||||
// DC-109: delimiter quotes are syntax, not PII — strip, never re-emit.
|
||||
expect(out).toContain('jo****@example.com'); // 2 REAL local chars, canonical shape
|
||||
expect(out).not.toMatch(/["']j\*{4}/); // old bug: stray quote among the 2 chars
|
||||
});
|
||||
|
||||
test('class instance enumerable email prop masked, prototype preserved', () => {
|
||||
class UserRecord { constructor() { this.email = 'inst@example.com'; } }
|
||||
log.info('auth', 'instance', { user: new UserRecord() });
|
||||
const out = consoleOut();
|
||||
expect(out).not.toContain('inst@example.com');
|
||||
expect(out).toContain('in****@example.com');
|
||||
});
|
||||
|
||||
test('cyclic payload terminates and masks (no crash, no hang)', () => {
|
||||
const cyc = { note: 'cycle@example.com' };
|
||||
cyc.self = cyc;
|
||||
// JSON.stringify of the masked clone contains the cycle; jest spy just
|
||||
// captures the thrown-free path — assert the log call returns and the
|
||||
// raw email never appears in captured console args.
|
||||
let threw = null;
|
||||
try { log.info('test', 'cycle', cyc); } catch (e) { threw = e; }
|
||||
// Either it serializes (clone breaks the cycle via memo) or throws a
|
||||
// TypeError cyclic — both acceptable; PII must not leak either way.
|
||||
const out = threw ? '' : consoleOut();
|
||||
expect(out).not.toContain('cycle@example.com');
|
||||
});
|
||||
|
||||
test('request line: email-bearing req.path and user-agent masked in error.log', async () => {
|
||||
const fakeReq = {
|
||||
method: 'POST',
|
||||
path: '/api/v1/auth/invites/sami.admin@example.com/accept',
|
||||
ip: '10.0.0.9',
|
||||
id: 'req-1',
|
||||
get: (h) => (h === 'user-agent' ? 'ContactTool (admin@example.com)' : ''),
|
||||
};
|
||||
await log.error('auth', new Error('invite accept failed'), fakeReq);
|
||||
const raw = await fsp.readFile(ERROR_LOG_FILE, 'utf8');
|
||||
expect(raw).not.toContain('sami.admin@example.com');
|
||||
expect(raw).not.toContain('admin@example.com');
|
||||
expect(raw).toContain('/api/v1/auth/invites/sa****@example.com/accept');
|
||||
expect(raw).toContain('ContactTool (ad****@example.com)');
|
||||
});
|
||||
});
|
||||
@@ -1,150 +0,0 @@
|
||||
/**
|
||||
* DC-108 — redact-on-rotate tests
|
||||
*
|
||||
* When error.log crosses MAX_ERROR_LOG_SIZE, the rotation renames it to
|
||||
* error.log.1 and (new in DC-108) scrubs the archive with the canonical
|
||||
* email mask. DC-095 masks at every live sink; this is the belt-and-braces
|
||||
* backstop for any future sink that forgets.
|
||||
*
|
||||
* Covers:
|
||||
* - rotation scrubs raw emails out of the archive (canonical sa****@ form)
|
||||
* - already-clean archive is never rewritten (inode + mtime preserved)
|
||||
* - scrub failure does NOT lose the new error line (append still runs)
|
||||
* - archive mode is preserved across the atomic rewrite
|
||||
* - no .redact-<pid> temp file is left behind on success
|
||||
*/
|
||||
|
||||
const path = require('path');
|
||||
const fs = require('fs');
|
||||
const fsp = require('fs').promises;
|
||||
const os = require('os');
|
||||
|
||||
// Isolated temp dir + env BEFORE the module capture (logging.test.js pattern)
|
||||
const TMP_DIR = fs.mkdtempSync(path.join(os.tmpdir(), 'dc108-rotate-test-'));
|
||||
process.env.AUDIT_LOG_FILE = path.join(TMP_DIR, 'audit-log.json');
|
||||
process.env.ERROR_LOG_FILE = path.join(TMP_DIR, 'error.log');
|
||||
process.env.NODE_ENV = 'production'; // JSON output mode (stable, parseable)
|
||||
|
||||
const { log, ERROR_LOG_FILE, MAX_ERROR_LOG_SIZE } = require('../src/utils/logging');
|
||||
|
||||
const ROTATED = ERROR_LOG_FILE + '.1';
|
||||
const RAW_EMAIL = 'someone.example@example.com';
|
||||
|
||||
// Seed error.log past the rotation threshold. `extra` is appended raw to
|
||||
// simulate pre-DC-095-style unmasked content (the backstop's threat model).
|
||||
async function seedOversized(extra) {
|
||||
const padding = 'x'.repeat(MAX_ERROR_LOG_SIZE + 64);
|
||||
await fsp.writeFile(ERROR_LOG_FILE, padding + (extra || ''), 'utf8');
|
||||
}
|
||||
|
||||
// log.error flushes to the file awaited; one call is one append+rotate.
|
||||
async function triggerAppend() {
|
||||
await log.error('dc108-test', 'rotation trigger', { seq: Math.random() });
|
||||
}
|
||||
|
||||
afterAll(async () => {
|
||||
try { await fsp.rm(TMP_DIR, { recursive: true, force: true }); } catch (_) {}
|
||||
});
|
||||
|
||||
beforeEach(async () => {
|
||||
await fsp.writeFile(ERROR_LOG_FILE, '', 'utf8');
|
||||
try { await fsp.rm(ROTATED, { force: true }); } catch (_) {}
|
||||
// Sweep any stale temp files from failed assertions
|
||||
for (const f of fs.readdirSync(TMP_DIR)) {
|
||||
if (f.includes('.redact-')) await fsp.rm(path.join(TMP_DIR, f), { force: true });
|
||||
}
|
||||
jest.restoreAllMocks();
|
||||
});
|
||||
|
||||
describe('DC-108 redact-on-rotate', () => {
|
||||
test('rotation scrubs raw emails from the archive', async () => {
|
||||
await seedOversized(`user contact: ${RAW_EMAIL}\n`);
|
||||
await triggerAppend();
|
||||
|
||||
const arch = await fsp.readFile(ROTATED, 'utf8');
|
||||
// Raw PII is gone; canonical masked form is present
|
||||
expect(arch).not.toContain(RAW_EMAIL);
|
||||
expect(arch).toContain('so****@example.com');
|
||||
// New line landed in the fresh error.log
|
||||
const fresh = await fsp.readFile(ERROR_LOG_FILE, 'utf8');
|
||||
expect(fresh).toContain('rotation trigger');
|
||||
// No temp residue
|
||||
const leftovers = fs.readdirSync(TMP_DIR).filter((f) => f.includes('.redact-'));
|
||||
expect(leftovers).toEqual([]);
|
||||
});
|
||||
|
||||
test('clean archive keeps the rename inode; PII archive is atomically rewritten', async () => {
|
||||
// Clean case: rotation renames error.log → archive; scrub finds nothing
|
||||
// to do → archive KEEPS the original error.log inode (rename, not rewrite).
|
||||
await seedOversized('no PII here, fully clean\n');
|
||||
const cleanInode = fs.statSync(ERROR_LOG_FILE).ino;
|
||||
await triggerAppend();
|
||||
expect(fs.statSync(ROTATED).ino).toBe(cleanInode);
|
||||
const arch1 = await fsp.readFile(ROTATED, 'utf8');
|
||||
expect(arch1).toContain('fully clean');
|
||||
expect(arch1).not.toContain('****');
|
||||
|
||||
// PII case: scrub rewrites via temp+rename → archive inode DIFFERS from
|
||||
// the pre-rotation error.log inode.
|
||||
await seedOversized(`user contact: ${RAW_EMAIL}\n`);
|
||||
const piiInode = fs.statSync(ERROR_LOG_FILE).ino;
|
||||
await triggerAppend();
|
||||
expect(fs.statSync(ROTATED).ino).not.toBe(piiInode);
|
||||
const arch2 = await fsp.readFile(ROTATED, 'utf8');
|
||||
expect(arch2).toContain('so****@example.com');
|
||||
expect(arch2).not.toContain(RAW_EMAIL);
|
||||
});
|
||||
|
||||
test('scrub failure does not lose the new error line', async () => {
|
||||
await seedOversized(`user contact: ${RAW_EMAIL}\n`);
|
||||
const errSpy = jest.spyOn(console, 'error').mockImplementation(() => {});
|
||||
|
||||
// Make ONLY the archive read fail — rotation itself must still succeed.
|
||||
const realReadFile = fsp.readFile.bind(fsp);
|
||||
const spy = jest.spyOn(fsp, 'readFile').mockImplementation(async (p, ...rest) => {
|
||||
if (typeof p === 'string' && p === ROTATED) {
|
||||
throw new Error('EACCES: permission denied, scrub boom');
|
||||
}
|
||||
return realReadFile(p, ...rest);
|
||||
});
|
||||
|
||||
await triggerAppend();
|
||||
|
||||
// Scrub failure was contained + reported
|
||||
expect(errSpy).toHaveBeenCalledWith(
|
||||
'[logger] Failed to redact rotated error.log archive:',
|
||||
expect.stringContaining('scrub boom')
|
||||
);
|
||||
// Rotation still committed and the new line was still appended
|
||||
expect(fs.existsSync(ROTATED)).toBe(true);
|
||||
const fresh = await fsp.readFile(ERROR_LOG_FILE, 'utf8');
|
||||
expect(fresh).toContain('rotation trigger');
|
||||
spy.mockRestore();
|
||||
});
|
||||
|
||||
test('archive file mode is preserved across the atomic rewrite', async () => {
|
||||
await seedOversized(`user contact: ${RAW_EMAIL}\n`);
|
||||
await fs.promises.chmod(ERROR_LOG_FILE, 0o640);
|
||||
await triggerAppend();
|
||||
|
||||
const mode = fs.statSync(ROTATED).mode & 0o777;
|
||||
expect(mode).toBe(0o640);
|
||||
// And the rewrite actually happened (PII scrubbed)
|
||||
const arch = await fsp.readFile(ROTATED, 'utf8');
|
||||
expect(arch).not.toContain(RAW_EMAIL);
|
||||
});
|
||||
|
||||
test('stale crash-leftover .redact-<pid> temps are swept on rotation', async () => {
|
||||
// Simulate a prior hard crash: abandoned temp sibling still on disk
|
||||
const stale = path.join(TMP_DIR, 'error.log.1.redact-999999');
|
||||
await fsp.writeFile(stale, 'half-scrubbed partial write', 'utf8');
|
||||
await seedOversized('clean rotation content\n');
|
||||
await triggerAppend();
|
||||
|
||||
const leftovers = fs.readdirSync(TMP_DIR).filter((f) => f.includes('.redact-'));
|
||||
expect(leftovers).toEqual([]); // swept, archive + fresh log intact
|
||||
expect(fs.existsSync(ROTATED)).toBe(true);
|
||||
const fresh = await fsp.readFile(ERROR_LOG_FILE, 'utf8');
|
||||
expect(fresh).toContain('rotation trigger');
|
||||
});
|
||||
});
|
||||
@@ -1,184 +0,0 @@
|
||||
/**
|
||||
* DC-096 regression tests: the `monitoring: { public: false }` config option
|
||||
* actually gates the monitoring endpoints.
|
||||
*
|
||||
* WHY THIS EXISTS:
|
||||
* The middleware comment documented `monitoring: { public: false }` in
|
||||
* config.json as the way to require auth for /api/v1/monitoring/stats and
|
||||
* /api/v1/health-checks/status on internet-exposed deployments. But the
|
||||
* option was dead three ways:
|
||||
* 1. applyConfigFields() never copied `monitoring` out of raw config —
|
||||
* siteConfig.monitoring stayed undefined forever.
|
||||
* 2. `monitoring` was not in config-schema KNOWN_KEYS — saving it via
|
||||
* POST /api/v1/config produced "Unknown config key" warnings (save
|
||||
* still succeeded, so users saw a warning for a real feature).
|
||||
* 3. MONITORING_PUBLIC was a const frozen at mount time AND re-required
|
||||
* the config/site singleton — POST /config changes never took effect
|
||||
* without a full process restart.
|
||||
*
|
||||
* Net effect: an operator who set the documented hardening option on an
|
||||
* exposed box kept serving monitoring data unauthenticated, with only a
|
||||
* cosmetic warning. Classic "config option that never worked".
|
||||
*
|
||||
* These tests pin the fixed behavior:
|
||||
* - applyConfigFields copies monitoring through to siteConfig
|
||||
* - isPublicRoute honors the gate LIVE (no restart)
|
||||
* - env override still wins over config
|
||||
* - schema accepts `monitoring` and validates its shape
|
||||
* - typo keys setupCompleted/setupMode no longer silently allowlisted
|
||||
*/
|
||||
const express = require('express');
|
||||
const request = require('supertest');
|
||||
|
||||
// The config/site module exports the siteConfig singleton + loaders.
|
||||
const { siteConfig, loadSiteConfig } = require('../src/config/site');
|
||||
const { validateConfig } = require('../src/utilities/config-schema');
|
||||
|
||||
// Build a minimal app mounting ONLY the middleware under test, with the
|
||||
// same dependency shape app.js passes. This mirrors how configureMiddleware
|
||||
// is used in production without booting the whole app (routes, docker, etc).
|
||||
function buildMiddlewareApp(configOverrides = {}) {
|
||||
const configureMiddleware = require('../src/utilities/middleware');
|
||||
const app = express();
|
||||
|
||||
const siteConfigDep = {
|
||||
tld: '.sami',
|
||||
dashboardHost: 'status.sami',
|
||||
...configOverrides
|
||||
};
|
||||
|
||||
const deps = {
|
||||
siteConfig: siteConfigDep,
|
||||
totpConfig: { enabled: true }, // force the auth path to actually run
|
||||
tailscaleConfig: { enabled: false, requireAuth: false },
|
||||
metrics: { recordRequest: () => {} },
|
||||
auditLogger: { middleware: () => (req, res, next) => next() },
|
||||
authManager: {
|
||||
verifyJWT: async () => null,
|
||||
verifyAPIKey: async () => null
|
||||
},
|
||||
log: {
|
||||
info: () => {}, warn: () => {}, error: () => {}, debug: () => {}
|
||||
},
|
||||
cryptoUtils: { loadOrCreateKey: () => 'test-key-not-a-real-secret' },
|
||||
isValidContainerId: () => true,
|
||||
isTailscaleIP: () => false,
|
||||
getTailscaleStatus: async () => ({})
|
||||
};
|
||||
|
||||
configureMiddleware(app, deps);
|
||||
// Probe route AFTER middleware so it exercises the auth chain.
|
||||
app.get('/api/v1/monitoring/stats', (req, res) => res.json({ ok: true }));
|
||||
app.get('/api/v1/health-checks/status', (req, res) => res.json({ ok: true }));
|
||||
return app;
|
||||
}
|
||||
|
||||
describe('DC-096: monitoring.public config gate (middleware + site config)', () => {
|
||||
const ENV_KEY = 'MONITORING_PUBLIC';
|
||||
|
||||
afterEach(() => {
|
||||
delete process.env[ENV_KEY];
|
||||
// Reset the singleton to a clean default for other suites
|
||||
siteConfig.monitoring = null;
|
||||
});
|
||||
|
||||
test('applyConfigFields copies monitoring through to siteConfig (the original dead option)', () => {
|
||||
loadSiteConfig(null, null); // no CONFIG_FILE arg → falls to catch, keeps defaults
|
||||
siteConfig.monitoring = undefined;
|
||||
// Directly exercise applyConfigFields via the public loader with a real temp file
|
||||
const fs = require('fs');
|
||||
const os = require('os');
|
||||
const path = require('path');
|
||||
const tmp = path.join(os.tmpdir(), `dc096-config-${Date.now()}.json`);
|
||||
fs.writeFileSync(tmp, JSON.stringify({
|
||||
tld: '.sami',
|
||||
monitoring: { public: false }
|
||||
}));
|
||||
try {
|
||||
const noopLog = { info: () => {}, warn: () => {}, error: () => {} };
|
||||
loadSiteConfig(tmp, noopLog);
|
||||
expect(siteConfig.monitoring).toEqual({ public: false });
|
||||
} finally {
|
||||
fs.unlinkSync(tmp);
|
||||
}
|
||||
});
|
||||
|
||||
test('monitoring endpoints are PUBLIC by default (no monitoring config)', async () => {
|
||||
const app = buildMiddlewareApp();
|
||||
const res = await request(app).get('/api/v1/monitoring/stats');
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body.ok).toBe(true);
|
||||
});
|
||||
|
||||
test('monitoring: { public: false } in config → endpoints require auth (401) — LIVE, no restart', async () => {
|
||||
const app = buildMiddlewareApp({ monitoring: { public: false } });
|
||||
const res = await request(app).get('/api/v1/monitoring/stats');
|
||||
expect(res.status).toBe(401);
|
||||
const res2 = await request(app).get('/api/v1/health-checks/status');
|
||||
expect(res2.status).toBe(401);
|
||||
});
|
||||
|
||||
test('gate reads config LIVE: flipping siteConfig.monitoring.public at runtime flips the gate', async () => {
|
||||
const cfg = { monitoring: { public: true } };
|
||||
const app = buildMiddlewareApp(cfg);
|
||||
let res = await request(app).get('/api/v1/monitoring/stats');
|
||||
expect(res.status).toBe(200);
|
||||
|
||||
// Simulate POST /api/v1/config refreshing the singleton in place —
|
||||
// the same object the middleware holds a reference to.
|
||||
cfg.monitoring.public = false;
|
||||
res = await request(app).get('/api/v1/monitoring/stats');
|
||||
expect(res.status).toBe(401);
|
||||
});
|
||||
|
||||
test('env override MONITORING_PUBLIC=true beats config monitoring.public=false', async () => {
|
||||
process.env.MONITORING_PUBLIC = 'true';
|
||||
const app = buildMiddlewareApp({ monitoring: { public: false } });
|
||||
const res = await request(app).get('/api/v1/monitoring/stats');
|
||||
expect(res.status).toBe(200);
|
||||
});
|
||||
|
||||
test('env override MONITORING_PUBLIC=false beats config monitoring.public=true', async () => {
|
||||
process.env.MONITORING_PUBLIC = 'false';
|
||||
const app = buildMiddlewareApp({ monitoring: { public: true } });
|
||||
const res = await request(app).get('/api/v1/monitoring/stats');
|
||||
expect(res.status).toBe(401);
|
||||
});
|
||||
|
||||
test('non-monitoring public routes stay public when monitoring gate closes', async () => {
|
||||
const app = buildMiddlewareApp({ monitoring: { public: false } });
|
||||
// /api/v1/version is public unconditionally
|
||||
const res = await request(app).get('/api/v1/version');
|
||||
// No route mounted at that path in this harness → 404 from express,
|
||||
// NOT 401 — proving the auth middleware let it through.
|
||||
expect(res.status).toBe(404);
|
||||
});
|
||||
});
|
||||
|
||||
describe('DC-096: config-schema accepts monitoring', () => {
|
||||
test('monitoring: { public: boolean } passes with zero warnings', () => {
|
||||
const result = validateConfig({ monitoring: { public: false } });
|
||||
expect(result.warnings).toEqual([]);
|
||||
expect(result.valid).toBe(true);
|
||||
});
|
||||
|
||||
test('monitoring.public non-boolean is an ERROR (not silent)', () => {
|
||||
const result = validateConfig({ monitoring: { public: 'false' } });
|
||||
expect(result.valid).toBe(false);
|
||||
expect(result.errors).toContain('monitoring.public must be a boolean');
|
||||
});
|
||||
|
||||
test('monitoring non-object is an ERROR', () => {
|
||||
const result = validateConfig({ monitoring: 'private' });
|
||||
expect(result.valid).toBe(false);
|
||||
expect(result.errors).toContain('monitoring must be an object');
|
||||
});
|
||||
|
||||
test('typo keys setupCompleted/setupMode now WARN (no longer silently allowlisted)', () => {
|
||||
const result = validateConfig({ setupCompleted: true, setupMode: 'simple' });
|
||||
expect(result.warnings).toEqual([
|
||||
'Unknown config key "setupCompleted" — possible typo?',
|
||||
'Unknown config key "setupMode" — possible typo?'
|
||||
]);
|
||||
});
|
||||
});
|
||||
@@ -1,168 +0,0 @@
|
||||
/**
|
||||
* DC-097: notification-manager `_loadConfig` write-back.
|
||||
* _canonicalizeLegacyKeys (DC-092) fixed legacy spellings in memory only;
|
||||
* the on-disk notifications.json kept `email.user`/`email.pass`, camelCase
|
||||
* event keys, and string `secure` until the next explicit UI save. These
|
||||
* tests pin the new behavior: the canonical form is persisted right after
|
||||
* load, the write is idempotent, and a failed write never blocks startup.
|
||||
*/
|
||||
|
||||
jest.mock('fs', () => ({
|
||||
existsSync: jest.fn().mockReturnValue(false),
|
||||
readFileSync: jest.fn().mockReturnValue('{}'),
|
||||
writeFileSync: jest.fn(),
|
||||
mkdirSync: jest.fn(),
|
||||
// DC-099 atomic write path (open tmp → write → fsync → close → rename).
|
||||
openSync: jest.fn().mockReturnValue(3),
|
||||
writeSync: jest.fn(),
|
||||
fsyncSync: jest.fn(),
|
||||
closeSync: jest.fn(),
|
||||
renameSync: jest.fn(),
|
||||
unlinkSync: jest.fn(),
|
||||
}));
|
||||
|
||||
jest.mock('nodemailer', () => ({
|
||||
createTransport: jest.fn(() => ({
|
||||
sendMail: jest.fn().mockResolvedValue({ messageId: 'mock' }),
|
||||
})),
|
||||
}));
|
||||
|
||||
const fs = require('fs');
|
||||
const NotificationManager = require('../src/managers/notification-manager');
|
||||
|
||||
const NOTIF_FILE = '/tmp/dc097-notif-test.json';
|
||||
|
||||
function makeCtx(log) {
|
||||
return {
|
||||
NOTIFICATIONS_FILE: NOTIF_FILE,
|
||||
log,
|
||||
};
|
||||
}
|
||||
|
||||
// Serializes exactly like the manager does (2-space indent).
|
||||
const ser = (obj) => JSON.stringify(obj, null, 2);
|
||||
|
||||
function loadWithFile(contents, log) {
|
||||
fs.existsSync.mockReturnValue(true);
|
||||
fs.readFileSync.mockReturnValue(contents);
|
||||
return new NotificationManager(makeCtx(log));
|
||||
}
|
||||
|
||||
describe('DC-097 notification config canonicalization write-back', () => {
|
||||
let log;
|
||||
|
||||
beforeEach(() => {
|
||||
jest.clearAllMocks();
|
||||
fs.existsSync.mockReturnValue(false);
|
||||
fs.readFileSync.mockReturnValue('{}');
|
||||
fs.writeFileSync.mockClear();
|
||||
log = { error: jest.fn(), info: jest.fn(), warn: jest.fn() };
|
||||
});
|
||||
|
||||
afterEach(() => {
|
||||
try { NotificationManager.prototype.stopHealthDaemon && undefined; } catch (_) {}
|
||||
jest.clearAllMocks();
|
||||
});
|
||||
|
||||
test('legacy file (user/pass, camelCase events, string secure) is rewritten on disk in canonical form', () => {
|
||||
const legacy = {
|
||||
enabled: true,
|
||||
providers: {
|
||||
email: {
|
||||
enabled: true,
|
||||
host: 'smtp.test',
|
||||
port: 465,
|
||||
secure: 'false',
|
||||
to: 'me@test',
|
||||
from: 'from@test',
|
||||
user: 'legacy-user',
|
||||
pass: 'legacy-pass',
|
||||
},
|
||||
},
|
||||
events: {
|
||||
containerDown: false,
|
||||
deploymentSuccess: false,
|
||||
},
|
||||
};
|
||||
const nm = loadWithFile(ser(legacy), log);
|
||||
|
||||
// In-memory: canonical (pinned by DC-092 tests, re-pinned here).
|
||||
expect(nm.config.providers.email.username).toBe('legacy-user');
|
||||
expect(nm.config.providers.email.password).toBe('legacy-pass');
|
||||
expect(nm.config.providers.email.secure).toBe(false);
|
||||
expect(nm.config.events['container-down']).toBe(false);
|
||||
expect(nm.config.events['deploy-success']).toBe(false);
|
||||
|
||||
// On-disk write-back: exactly one atomic write (DC-099: write tmp → fsync → rename).
|
||||
expect(fs.renameSync).toHaveBeenCalledTimes(1);
|
||||
expect(fs.renameSync.mock.calls[0][1]).toBe(NOTIF_FILE);
|
||||
const contentsArg = fs.writeSync.mock.calls[0][1];
|
||||
const written = JSON.parse(contentsArg);
|
||||
expect(written.providers.email.username).toBe('legacy-user');
|
||||
expect(written.providers.email.password).toBe('legacy-pass');
|
||||
expect(written.providers.email.user).toBeUndefined();
|
||||
expect(written.providers.email.pass).toBeUndefined();
|
||||
expect(written.providers.email.secure).toBe(false);
|
||||
expect(written.events['container-down']).toBe(false);
|
||||
written.events && expect(Object.keys(written.events)).not.toContain('containerDown');
|
||||
nm.stopHealthDaemon && nm.stopHealthDaemon();
|
||||
});
|
||||
|
||||
test('write-back is idempotent: an already-canonical file is not rewritten', () => {
|
||||
// First load performs the write-back; capture what it wrote.
|
||||
const legacy = ser({
|
||||
providers: { email: { user: 'u', pass: 'p', secure: 'false' } },
|
||||
events: { containerDown: true },
|
||||
});
|
||||
const first = loadWithFile(legacy, log);
|
||||
expect(fs.renameSync).toHaveBeenCalledTimes(1);
|
||||
const canonicalContents = fs.writeSync.mock.calls[0][1];
|
||||
first.stopHealthDaemon && first.stopHealthDaemon();
|
||||
fs.renameSync.mockClear();
|
||||
fs.writeSync.mockClear();
|
||||
|
||||
// Second load against the canonical bytes: no write.
|
||||
const second = loadWithFile(canonicalContents, log);
|
||||
expect(fs.renameSync).not.toHaveBeenCalled();
|
||||
expect(second.config.providers.email.username).toBe('u');
|
||||
second.stopHealthDaemon && second.stopHealthDaemon();
|
||||
});
|
||||
|
||||
test('legacy keys absent → no write at all (clean file untouched)', () => {
|
||||
// Fully canonical: matches the merged config after serialization.
|
||||
// Build it by round-tripping: write-back from a minimal legacy file
|
||||
// produces the canonical full shape; feed those exact bytes back.
|
||||
const nm = loadWithFile(ser({ enabled: true }), log); // 1 write (defaults fill-in)
|
||||
const canonicalContents = fs.writeSync.mock.calls[0][1];
|
||||
nm.stopHealthDaemon && nm.stopHealthDaemon();
|
||||
fs.renameSync.mockClear();
|
||||
fs.writeSync.mockClear();
|
||||
const again = loadWithFile(canonicalContents, log);
|
||||
expect(fs.renameSync).not.toHaveBeenCalled();
|
||||
again.stopHealthDaemon && again.stopHealthDaemon();
|
||||
});
|
||||
|
||||
test('write failure (EACCES) does not throw out of the constructor and in-memory config stays correct', () => {
|
||||
const legacy = ser({
|
||||
providers: { email: { user: 'u2', pass: 'p2' } },
|
||||
events: { workflowDone: true },
|
||||
});
|
||||
fs.openSync.mockImplementation(() => { throw new Error('EACCES: permission denied'); });
|
||||
let nm;
|
||||
expect(() => { nm = loadWithFile(legacy, log); }).not.toThrow();
|
||||
expect(nm.config.providers.email.username).toBe('u2');
|
||||
expect(nm.config.events['workflow']).toBe(true);
|
||||
// Warn surfaced, no error-level log (load itself succeeded).
|
||||
expect(log.warn).toHaveBeenCalled();
|
||||
expect(log.error).not.toHaveBeenCalled();
|
||||
nm.stopHealthDaemon && nm.stopHealthDaemon();
|
||||
});
|
||||
|
||||
test('no file on disk → no read, no write (fresh install untouched)', () => {
|
||||
fs.existsSync.mockReturnValue(false);
|
||||
const nm = new NotificationManager(makeCtx(log));
|
||||
expect(fs.readFileSync).not.toHaveBeenCalled();
|
||||
expect(fs.renameSync).not.toHaveBeenCalled();
|
||||
nm.stopHealthDaemon && nm.stopHealthDaemon();
|
||||
});
|
||||
});
|
||||
@@ -1,233 +0,0 @@
|
||||
/**
|
||||
* DC-094: remaining gate-miss notification emitters + legacy 4-arg send shape.
|
||||
*
|
||||
* Part 1 — seven emitters were absent from DEFAULT events, so the send()
|
||||
* gate (config.events[canonical] !== true) silently dropped them all:
|
||||
* ssl-cert-expiry (ssl-monitor), dns-propagation (dns-propagation),
|
||||
* drift-detected (config-drift-detector), dependency-restart-complete/-failed
|
||||
* (dependency-manager), recipe-removed (recipes/manage), workflow
|
||||
* (bundled-workflows). Stored configs must inherit the new defaults via the
|
||||
* _mergeConfig shallow per-key merge.
|
||||
*
|
||||
* Part 2 — nine in-repo call sites used a legacy 4-arg shape
|
||||
* send(event, title, message, type) against the 3-arg signature: the message
|
||||
* string landed in the `type` slot (embed color fell back) and providers got
|
||||
* the TITLE as the body. send() now shims that shape, and the explicit title
|
||||
* flows to ntfy/email subjects and the Discord embed title.
|
||||
*
|
||||
* Part 3 — route EVENT_KEY_ALIASES and manager EVENT_ALIASES stay in sync:
|
||||
* recipeRemoved and the dependency-restart spellings fold in both places.
|
||||
*/
|
||||
|
||||
'use strict';
|
||||
|
||||
const fs = require('fs');
|
||||
const nodemailer = require('nodemailer');
|
||||
|
||||
jest.mock('fs', () => ({
|
||||
existsSync: jest.fn().mockReturnValue(false),
|
||||
readFileSync: jest.fn().mockReturnValue('{}'),
|
||||
writeFileSync: jest.fn(),
|
||||
mkdirSync: jest.fn(),
|
||||
}));
|
||||
|
||||
jest.mock('nodemailer', () => ({
|
||||
createTransport: jest.fn(() => ({
|
||||
sendMail: jest.fn().mockResolvedValue({ messageId: 'mock' }),
|
||||
})),
|
||||
}));
|
||||
|
||||
const NotificationManager = require('../src/managers/notification-manager');
|
||||
|
||||
describe('DC-094 NotificationManager', () => {
|
||||
let nm;
|
||||
|
||||
beforeEach(() => {
|
||||
jest.clearAllMocks();
|
||||
fs.existsSync.mockReturnValue(false);
|
||||
fs.readFileSync.mockReturnValue('{}');
|
||||
nm = new NotificationManager({
|
||||
NOTIFICATIONS_FILE: '/tmp/dc094-notif-test.json',
|
||||
log: { error: jest.fn(), info: jest.fn(), warn: jest.fn() },
|
||||
fetchT: jest.fn(),
|
||||
docker: null,
|
||||
});
|
||||
// jest.config restoreMocks strips the factory nodemailer implementation
|
||||
// before every test; re-establish it and capture the sendMail mock so
|
||||
// email assertions don't depend on module state.
|
||||
nodemailer.createTransport.mockImplementation(() => {
|
||||
mailMock = jest.fn().mockResolvedValue({ messageId: 'mock' });
|
||||
return { sendMail: mailMock };
|
||||
});
|
||||
// Same aliasing hazard as providers: without a config file the
|
||||
// constructor's spread aliases module-level DEFAULT_CONFIG.events, so
|
||||
// gate-mutation tests would poison every later instance.
|
||||
nm.config.events = { ...nm.config.events };
|
||||
});
|
||||
|
||||
let mailMock;
|
||||
|
||||
afterEach(() => {
|
||||
nm.stopHealthDaemon();
|
||||
});
|
||||
|
||||
describe('new events present in DEFAULT events (gate-miss fix)', () => {
|
||||
const newlyGated = [
|
||||
'ssl-cert-expiry',
|
||||
'dns-propagation',
|
||||
'drift-detected',
|
||||
'dependency-restart',
|
||||
'recipe-removed',
|
||||
'workflow',
|
||||
];
|
||||
|
||||
test.each(newlyGated)('%s defaults to enabled', (event) => {
|
||||
expect(nm.config.events[event]).toBe(true);
|
||||
});
|
||||
|
||||
test.each(newlyGated)('%s passes the send() gate by default', async (event) => {
|
||||
nm.config.providers.discord = { enabled: false }; // no providers -> send short-circuits after the gate
|
||||
const result = await nm.send(event, { text: 'x' });
|
||||
expect(result.error).not.toBe(`Event ${event} not enabled`);
|
||||
});
|
||||
|
||||
test('dependency-restart spellings alias onto the single canonical toggle', async () => {
|
||||
nm.config.events['dependency-restart'] = false;
|
||||
const complete = await nm.send('dependency-restart-complete', { text: 'x' });
|
||||
const failed = await nm.send('dependency-restart-failed', { text: 'x' });
|
||||
expect(complete.error).toBe('Event dependency-restart not enabled');
|
||||
expect(failed.error).toBe('Event dependency-restart not enabled');
|
||||
});
|
||||
|
||||
test('recipeRemoved camelCase alias folds onto recipe-removed', async () => {
|
||||
nm.config.events['recipe-removed'] = false;
|
||||
const result = await nm.send('recipeRemoved', { text: 'x' });
|
||||
expect(result.error).toBe('Event recipe-removed not enabled');
|
||||
});
|
||||
|
||||
test('stored pre-DC-094 configs inherit the new event defaults via merge', () => {
|
||||
// A config saved before this fix has none of the new keys. After load,
|
||||
// the defaults merge must supply them as enabled.
|
||||
const legacyFile = JSON.stringify({
|
||||
enabled: true,
|
||||
providers: { discord: { enabled: false, webhookUrl: '' } },
|
||||
events: { 'container-down': true, alert: true },
|
||||
});
|
||||
fs.existsSync.mockReturnValue(true);
|
||||
fs.readFileSync.mockReturnValue(legacyFile);
|
||||
const loaded = new NotificationManager({
|
||||
NOTIFICATIONS_FILE: '/tmp/dc094-notif-test.json',
|
||||
log: { error: jest.fn(), info: jest.fn(), warn: jest.fn() },
|
||||
fetchT: jest.fn(),
|
||||
docker: null,
|
||||
});
|
||||
for (const event of newlyGated) {
|
||||
expect(loaded.config.events[event]).toBe(true);
|
||||
}
|
||||
// operator choice preserved, not clobbered by defaults
|
||||
expect(loaded.config.events['container-down']).toBe(true);
|
||||
});
|
||||
|
||||
test('stored legacy dependency-restart spellings fold at load', () => {
|
||||
const legacyFile = JSON.stringify({
|
||||
enabled: true,
|
||||
events: { 'dependency-restart-complete': false },
|
||||
});
|
||||
fs.existsSync.mockReturnValue(true);
|
||||
fs.readFileSync.mockReturnValue(legacyFile);
|
||||
const loaded = new NotificationManager({
|
||||
NOTIFICATIONS_FILE: '/tmp/dc094-notif-test.json',
|
||||
log: { error: jest.fn(), info: jest.fn(), warn: jest.fn() },
|
||||
fetchT: jest.fn(),
|
||||
docker: null,
|
||||
});
|
||||
expect(loaded.config.events['dependency-restart']).toBe(false);
|
||||
expect(loaded.config.events['dependency-restart-complete']).toBeUndefined();
|
||||
});
|
||||
});
|
||||
|
||||
describe('legacy 4-arg send shape shim', () => {
|
||||
beforeEach(() => {
|
||||
// Fresh providers object per test: on the no-config-file constructor
|
||||
// path this.config.providers aliases module-level DEFAULT_CONFIG.providers,
|
||||
// so per-provider mutation in one test otherwise leaks into the next.
|
||||
nm.config.providers = {
|
||||
discord: { enabled: false, webhookUrl: '' },
|
||||
telegram: { enabled: false, botToken: '', chatId: '' },
|
||||
ntfy: { enabled: false, topic: '', serverUrl: 'https://ntfy.sh' },
|
||||
email: { enabled: false, host: '', port: 587, to: '', from: '', username: '', password: '' },
|
||||
};
|
||||
nm.config.providers.ntfy = { enabled: true, topic: 'dc094', serverUrl: 'https://ntfy.sh' };
|
||||
nm.ctx.fetchT = jest.fn().mockResolvedValue({ ok: true });
|
||||
});
|
||||
|
||||
const ntfyCall = (n) => n.ctx.fetchT.mock.calls.find(c => String(c[0]).includes('ntfy.sh'));
|
||||
const discordCall = (n) => n.ctx.fetchT.mock.calls.find(c => String(c[0]).includes('hook.test'));
|
||||
|
||||
test('send(event, title, message, type) delivers the message as body', async () => {
|
||||
const result = await nm.send('deploymentFailed', 'Recipe Failed', 'Failed to deploy **plex**: boom', 'error');
|
||||
expect(result.success).toBe(true);
|
||||
const body = ntfyCall(nm)[1].body;
|
||||
expect(body).toBe('Failed to deploy **plex**: boom');
|
||||
});
|
||||
|
||||
test('the explicit legacy title reaches the ntfy Title header', async () => {
|
||||
await nm.send('deploymentFailed', 'Recipe Failed', 'boom', 'error');
|
||||
const headers = ntfyCall(nm)[1].headers;
|
||||
expect(headers.Title).toBe('Recipe Failed');
|
||||
});
|
||||
|
||||
test('canonical-title events without data.title still get the mapped title', async () => {
|
||||
await nm.send('ssl-cert-expiry', { text: 'expiring' }, 'warning');
|
||||
const headers = ntfyCall(nm)[1].headers;
|
||||
expect(headers.Title).toBe('SSL Certificate Expiry');
|
||||
});
|
||||
|
||||
test('Discord embed carries the explicit title and the right severity color', async () => {
|
||||
nm.config.providers.discord = { enabled: true, webhookUrl: 'https://hook.test/x' };
|
||||
nm.config.providers.ntfy = { enabled: false };
|
||||
await nm.send('deploymentFailed', 'Recipe Failed', 'boom', 'error');
|
||||
const payload = JSON.parse(discordCall(nm)[1].body);
|
||||
expect(payload.embeds[0].title).toBe('Recipe Failed');
|
||||
expect(payload.embeds[0].description).toBe('boom');
|
||||
expect(payload.embeds[0].color).toBe(15158332); // error/red, not the info-blue fallback
|
||||
});
|
||||
|
||||
test('email subject uses the explicit title', async () => {
|
||||
nm.config.providers.email = { enabled: true, host: 'smtp.test', port: 587, to: 'a@b.c', from: 'd@e.f', username: '', password: '' };
|
||||
nm.config.providers.ntfy = { enabled: false };
|
||||
await nm.send('deploymentSuccess', 'Recipe Deployed', 'plex deployed', 'success');
|
||||
expect(mailMock.mock.calls.length).toBeGreaterThan(0);
|
||||
const last = mailMock.mock.calls[mailMock.mock.calls.length - 1];
|
||||
expect(last[0].subject).toBe('Recipe Deployed');
|
||||
expect(last[0].text).toBe('plex deployed');
|
||||
});
|
||||
|
||||
test('history records the canonical event and the explicit title', async () => {
|
||||
await nm.send('recipeRemoved', 'Recipe Removed', 'Removed **plex** recipe (3 containers).', 'info');
|
||||
const entry = nm.getHistory()[0];
|
||||
expect(entry.event).toBe('recipe-removed');
|
||||
expect(entry.title).toBe('Recipe Removed');
|
||||
});
|
||||
|
||||
test('3-arg object calls are unchanged (no regression)', async () => {
|
||||
await nm.send('alert', { text: 'resource spike' }, 'warning');
|
||||
const body = ntfyCall(nm)[1].body;
|
||||
expect(body).toBe('resource spike');
|
||||
const headers = ntfyCall(nm)[1].headers;
|
||||
expect(headers.Title).toBe('Resource Alert');
|
||||
});
|
||||
|
||||
test('shim is type-guarded: a 4th arg with object data is not rewritten', async () => {
|
||||
const data = { text: 'kept' };
|
||||
await nm.send('alert', data, 'warning', 'stray-extra');
|
||||
// Object data passes through untouched (stray 4th arg ignored, not
|
||||
// treated as a legacy type) — the shim only fires for legacy
|
||||
// string-title calls.
|
||||
const body = ntfyCall(nm)[1].body;
|
||||
expect(body).toBe('kept');
|
||||
const entry = nm.getHistory()[0];
|
||||
expect(entry.type).toBe('warning');
|
||||
});
|
||||
});
|
||||
});
|
||||
@@ -10,13 +10,6 @@ jest.mock('fs', () => ({
|
||||
readFileSync: jest.fn().mockReturnValue('{}'),
|
||||
writeFileSync: jest.fn(),
|
||||
mkdirSync: jest.fn(),
|
||||
// DC-099 atomic write path (open tmp → write → fsync → close → rename).
|
||||
openSync: jest.fn().mockReturnValue(3),
|
||||
writeSync: jest.fn(),
|
||||
fsyncSync: jest.fn(),
|
||||
closeSync: jest.fn(),
|
||||
renameSync: jest.fn(),
|
||||
unlinkSync: jest.fn(),
|
||||
}));
|
||||
|
||||
jest.mock('nodemailer', () => ({
|
||||
@@ -70,12 +63,10 @@ describe('NotificationManager', () => {
|
||||
fs.existsSync.mockReturnValue(false);
|
||||
await nm.saveConfig();
|
||||
expect(fs.mkdirSync).toHaveBeenCalled();
|
||||
// DC-099: atomic write path — payload lands via writeSync, then tmp is renamed onto the target.
|
||||
expect(fs.writeSync).toHaveBeenCalled();
|
||||
expect(fs.renameSync).toHaveBeenCalled();
|
||||
const writeArgs = fs.writeSync.mock.calls[0];
|
||||
expect(fs.renameSync.mock.calls[0][1]).toBe(NOTIF_FILE);
|
||||
expect(writeArgs[1]).toContain('enabled');
|
||||
expect(fs.writeFileSync).toHaveBeenCalled();
|
||||
const callArgs = fs.writeFileSync.mock.calls[0];
|
||||
expect(callArgs[0]).toBe(NOTIF_FILE);
|
||||
expect(callArgs[1]).toContain('enabled');
|
||||
});
|
||||
|
||||
test('loadConfig merges file content with defaults', () => {
|
||||
|
||||
@@ -1,213 +0,0 @@
|
||||
/**
|
||||
* DC-098 — redact-log-pii.js (one-shot PII redaction for pre-DC-095 logs)
|
||||
*
|
||||
* Verifies:
|
||||
* 1. Raw emails in a log file are rewritten with the canonical mask shape.
|
||||
* 2. Idempotence — second run leaves the file byte-identical (no rewrite).
|
||||
* 3. Clean file is untouched (mtime + content preserved).
|
||||
* 4. --dry-run changes nothing on disk but reports the hit.
|
||||
* 5. Exit 2 when the post-verify finds remaining raw addresses (simulated).
|
||||
* 6. Canonical masker export round-trip matches the live logger's shape.
|
||||
* 7. --keep-raw writes <file>.raw-<epoch> alongside the redacted file.
|
||||
* 8. Non-emails (root@hostname, image@sha256, 2026-08-22@x false hits) pass
|
||||
* through — bounded regex intentionally does not match them.
|
||||
*/
|
||||
|
||||
'use strict';
|
||||
|
||||
const fs = require('fs');
|
||||
const os = require('os');
|
||||
const path = require('path');
|
||||
const { execFileSync } = require('child_process');
|
||||
|
||||
const SCRIPT = path.join(__dirname, '..', 'scripts', 'redact-log-pii.js');
|
||||
const {
|
||||
EMAIL_RE,
|
||||
maskEmailAddress,
|
||||
maskEmailsInString,
|
||||
} = require('../src/utils/logging');
|
||||
|
||||
function run(args) {
|
||||
return execFileSync('node', [SCRIPT, ...args], {
|
||||
encoding: 'utf8',
|
||||
stdio: ['ignore', 'pipe', 'pipe'],
|
||||
});
|
||||
}
|
||||
|
||||
let tmpRoot;
|
||||
beforeAll(() => {
|
||||
tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'dc098-'));
|
||||
});
|
||||
|
||||
afterAll(() => {
|
||||
fs.rmSync(tmpRoot, { recursive: true, force: true });
|
||||
});
|
||||
|
||||
describe('DC-098 canonical masker exports (src/utils/logging.js)', () => {
|
||||
test('mask shape matches live logger ("sa****@example.com")', () => {
|
||||
expect(maskEmailAddress('sami@example.com')).toBe('sa****@example.com');
|
||||
// local <= 2 chars keeps only the first char (canonical shape)
|
||||
expect(maskEmailAddress('ab@x.io')).toBe('a****@x.io');
|
||||
expect(maskEmailAddress('a@x.io')).toBe('a****@x.io'); // <=2 local chars
|
||||
});
|
||||
|
||||
test('maskEmailsInString is exported and masks embedded emails', () => {
|
||||
expect(maskEmailsInString('user john.doe@corp.com here')).toBe(
|
||||
'user jo****@corp.com here'
|
||||
);
|
||||
});
|
||||
|
||||
test('mask output cannot re-match EMAIL_RE (idempotence basis)', () => {
|
||||
const masked = maskEmailsInString('john.doe@corp.com');
|
||||
const re = new RegExp(EMAIL_RE.source, EMAIL_RE.flags);
|
||||
expect(re.test(masked)).toBe(false);
|
||||
});
|
||||
});
|
||||
|
||||
describe('DC-098 redact-log-pii.js end-to-end', () => {
|
||||
test('redacts raw emails in a file with the canonical shape', () => {
|
||||
const dir = fs.mkdtempSync(path.join(tmpRoot, 'case1-'));
|
||||
const f = path.join(dir, 'error.log');
|
||||
fs.writeFileSync(f, 'line1 clean\nemail: jane.doe@example.com\nline3\n');
|
||||
|
||||
const out = run([f]);
|
||||
expect(out).toContain('redacted: ');
|
||||
expect(out).toContain('1 addresses');
|
||||
|
||||
const after = fs.readFileSync(f, 'utf8');
|
||||
expect(after).toContain('ja****@example.com');
|
||||
expect(after).not.toContain('jane.doe@example.com');
|
||||
});
|
||||
|
||||
test('second run is a no-op (idempotent, byte-identical, no rewrite)', () => {
|
||||
const dir = fs.mkdtempSync(path.join(tmpRoot, 'case2-'));
|
||||
const f = path.join(dir, 'error.log');
|
||||
fs.writeFileSync(f, 'x sami@example.com y\n');
|
||||
run([f]);
|
||||
const after1 = fs.readFileSync(f, 'utf8');
|
||||
const mtime1 = fs.statSync(f).mtimeMs;
|
||||
|
||||
const out = run([f]);
|
||||
expect(out).toContain('clean (nothing to redact)');
|
||||
expect(fs.readFileSync(f, 'utf8')).toBe(after1);
|
||||
expect(fs.statSync(f).mtimeMs).toBe(mtime1);
|
||||
});
|
||||
|
||||
test('clean file untouched (content + mtime preserved)', () => {
|
||||
const dir = fs.mkdtempSync(path.join(tmpRoot, 'case3-'));
|
||||
const f = path.join(dir, 'error.log');
|
||||
fs.writeFileSync(f, 'no addresses here\n');
|
||||
const mtime0 = fs.statSync(f).mtimeMs;
|
||||
|
||||
const out = run([f]);
|
||||
expect(out).toContain('clean (nothing to redact)');
|
||||
expect(fs.readFileSync(f, 'utf8')).toBe('no addresses here\n');
|
||||
expect(fs.statSync(f).mtimeMs).toBe(mtime0);
|
||||
});
|
||||
|
||||
test('--dry-run reports the hit but changes nothing on disk', () => {
|
||||
const dir = fs.mkdtempSync(path.join(tmpRoot, 'case4-'));
|
||||
const f = path.join(dir, 'error.log');
|
||||
const original = 'user kofi@example.org\n';
|
||||
fs.writeFileSync(f, original);
|
||||
const mtime0 = fs.statSync(f).mtimeMs;
|
||||
|
||||
const out = run(['--dry-run', f]);
|
||||
expect(out).toContain('would redact: ');
|
||||
expect(fs.readFileSync(f, 'utf8')).toBe(original);
|
||||
expect(fs.statSync(f).mtimeMs).toBe(mtime0);
|
||||
});
|
||||
|
||||
test('--keep-raw writes <file>.raw-<epoch> alongside the redacted file', () => {
|
||||
const dir = fs.mkdtempSync(path.join(tmpRoot, 'case5-'));
|
||||
const f = path.join(dir, 'error.log');
|
||||
fs.writeFileSync(f, 'raw op@example.net\n');
|
||||
|
||||
run(['--keep-raw', f]);
|
||||
const files = fs.readdirSync(dir);
|
||||
const rawCopy = files.find((x) => /^error\.log\.raw-\d+$/.test(x));
|
||||
expect(rawCopy).toBeDefined();
|
||||
expect(fs.readFileSync(path.join(dir, rawCopy), 'utf8')).toContain(
|
||||
'op@example.net'
|
||||
);
|
||||
expect(fs.readFileSync(f, 'utf8')).toContain('o****@example.net');
|
||||
});
|
||||
|
||||
test('directory walk skips node_modules/.git/coverage/__tests__/dist/build', () => {
|
||||
const dir = fs.mkdtempSync(path.join(tmpRoot, 'case6-'));
|
||||
fs.writeFileSync(path.join(dir, 'error.log'), 'a b@example.com\n');
|
||||
for (const skip of ['node_modules', '.git', 'coverage', '__tests__', 'dist', 'build']) {
|
||||
fs.mkdirSync(path.join(dir, skip));
|
||||
fs.writeFileSync(path.join(dir, skip, 'secret.log'), 'leak me@example.com\n');
|
||||
}
|
||||
|
||||
const out = run([dir]);
|
||||
expect(out).toContain('redacted: ');
|
||||
expect(out).not.toContain('secret.log');
|
||||
expect(
|
||||
fs.readFileSync(path.join(dir, 'node_modules', 'secret.log'), 'utf8')
|
||||
).toBe('leak me@example.com\n'); // untouched
|
||||
expect(fs.readFileSync(path.join(dir, 'error.log'), 'utf8')).toContain(
|
||||
'b****@example.com'
|
||||
);
|
||||
});
|
||||
|
||||
test('non-emails (root@hostname, image@sha256, numeric TLD) pass through', () => {
|
||||
const dir = fs.mkdtempSync(path.join(tmpRoot, 'case7-'));
|
||||
const f = path.join(dir, 'error.log');
|
||||
const content = 'root@web-1 pulled image@sha256:abcd pkg@1.2.3 done\n';
|
||||
fs.writeFileSync(f, content);
|
||||
|
||||
const out = [f].length && run([f]);
|
||||
expect(out).toContain('clean (nothing to redact)');
|
||||
expect(fs.readFileSync(f, 'utf8')).toBe(content);
|
||||
});
|
||||
|
||||
test('missing target reports error and exits 1', () => {
|
||||
const dir = path.join(tmpRoot, 'nope-does-not-exist');
|
||||
let code = 0;
|
||||
let stderr = '';
|
||||
try {
|
||||
execFileSync('node', [SCRIPT, dir], { stdio: ['ignore', 'pipe', 'pipe'] });
|
||||
} catch (e) {
|
||||
code = e.status;
|
||||
stderr = e.stderr ? e.stderr.toString() : '';
|
||||
}
|
||||
expect(code).toBe(1);
|
||||
expect(stderr).toContain('error:');
|
||||
});
|
||||
});
|
||||
|
||||
describe('DC-109 quoted local-part mask edge (maskEmailAddress)', () => {
|
||||
test('quoted local-part: quotes stripped, 2 REAL chars kept, no stray quote', () => {
|
||||
expect(maskEmailAddress('"john doe"@example.com')).toBe('jo****@example.com');
|
||||
expect(maskEmailAddress('"a"@example.com')).toBe('a****@example.com');
|
||||
expect(maskEmailAddress('ab"cd@e.f"@example.com')).toBe('ab****@example.com'); // mixed, no strip
|
||||
});
|
||||
|
||||
test('quoted local-part containing "@" splits on LAST @ (real domain boundary)', () => {
|
||||
expect(maskEmailAddress('"a@b"@example.com')).toBe('a@****@example.com');
|
||||
});
|
||||
|
||||
test('empty quoted local-part masks to bare ****@domain', () => {
|
||||
expect(maskEmailAddress('""@example.com')).toBe('****@example.com');
|
||||
});
|
||||
|
||||
test('plain addresses unchanged by DC-109 (canonical shape preserved)', () => {
|
||||
expect(maskEmailAddress('sami@example.com')).toBe('sa****@example.com');
|
||||
expect(maskEmailAddress('ab@x.io')).toBe('a****@x.io');
|
||||
expect(maskEmailAddress('a@x.io')).toBe('a****@x.io');
|
||||
});
|
||||
|
||||
test('masked quoted output cannot re-match EMAIL_RE (idempotence on splice line)', () => {
|
||||
const line = 'contact "john.doe@x"@example.com or root@web-1 ok';
|
||||
const masked = maskEmailsInString(line);
|
||||
const re = new RegExp(EMAIL_RE.source, EMAIL_RE.flags);
|
||||
// After one pass nothing that still contains the original address OR a
|
||||
// fresh matchable email-shaped token may remain.
|
||||
expect(masked).not.toContain('john.doe');
|
||||
expect(re.test(masked)).toBe(false);
|
||||
const twice = maskEmailsInString(masked);
|
||||
expect(twice).toBe(masked); // fully idempotent
|
||||
});
|
||||
});
|
||||
@@ -1,159 +0,0 @@
|
||||
/**
|
||||
* DC-093: /api/v1/auth/me must ALWAYS exist.
|
||||
*
|
||||
* Regression guard for the single-user-install 404 storm: the frontend
|
||||
* admin panel (status/js/admin.js attachTrigger) polls /api/v1/auth/me on
|
||||
* every dashboard load and re-probes every 60s while unauthenticated.
|
||||
* The /me handler used to live exclusively in the DC-048 admin router,
|
||||
* which is only mounted when email auth (multi-user) is enabled — so every
|
||||
* single-user install answered 404 and the API logged a full ERROR +
|
||||
* stack trace once per minute per open browser tab.
|
||||
*
|
||||
* These tests verify the routes/auth/index.js factory (the full aggregator,
|
||||
* real sub-routers, stubbed services):
|
||||
* 1. GET /auth/me route EXISTS in single-user mode (no email auth)
|
||||
* 2. single-user response: mode='single', isAdmin=true, legacy=true
|
||||
* 3. multi-user + req.user: mode='multi', stored profile returned
|
||||
* 4. multi-user + legacy session (no req.user): legacy branch
|
||||
* 5. /auth/me is NOT in PUBLIC_ROUTES (session-gated — unauthenticated
|
||||
* probes must 401 at the middleware, never reach the handler)
|
||||
* 6. admin routes (/auth/admin/users) still mounted ONLY in multi-user
|
||||
*/
|
||||
|
||||
describe('DC-093: /auth/me always mounted (routes/auth/index.js)', () => {
|
||||
function makeCtx(siteConfig, dataDir) {
|
||||
return {
|
||||
siteConfig,
|
||||
asyncHandler: (fn) => (req, res, next) => Promise.resolve(fn(req, res, next)).catch(next),
|
||||
errorResponse: (res, code, msg) => res.status(code).json({ success: false, error: msg }),
|
||||
log: { info() {}, warn() {}, error() {}, debug() {} },
|
||||
// Real session context API (src/context/session.js) exposes isValid —
|
||||
// NOT isSessionValid. The first DC-093 deploy 500'd in production
|
||||
// because the stub mirrored the wrong method name; it now matches
|
||||
// the real shape so the test fails if the handler drifts again.
|
||||
session: {
|
||||
isValid: () => true,
|
||||
// Deliberately absent: isSessionValid — the wrong-name trap.
|
||||
},
|
||||
licenseManager: {
|
||||
requirePremium: () => (req, res, next) => next(),
|
||||
hasFeature: () => true,
|
||||
},
|
||||
platformPaths: { dataDir },
|
||||
};
|
||||
}
|
||||
|
||||
function tmpDir() {
|
||||
const os = require('os');
|
||||
const path = require('path');
|
||||
const fs = require('fs');
|
||||
return fs.mkdtempSync(path.join(os.tmpdir(), 'dc093-me-'));
|
||||
}
|
||||
|
||||
function findRoute(router, routePath, method) {
|
||||
const layer = router.stack.find(
|
||||
(l) => l.route && l.route.path === routePath && l.route.methods[method]
|
||||
);
|
||||
return layer || null;
|
||||
}
|
||||
|
||||
function invoke(layer, req) {
|
||||
return new Promise((resolve) => {
|
||||
const res = {
|
||||
_status: 200,
|
||||
_body: null,
|
||||
status(c) { this._status = c; return this; },
|
||||
json(j) { this._body = j; resolve(this); return this; },
|
||||
setHeader() {},
|
||||
};
|
||||
const fn = layer.route.stack[0].handle;
|
||||
Promise.resolve(fn(req, res, () => resolve(res)));
|
||||
});
|
||||
}
|
||||
|
||||
let factory;
|
||||
beforeAll(() => {
|
||||
factory = require('../../routes/auth/index');
|
||||
});
|
||||
|
||||
test('single-user mode: /auth/me route exists and reports mode=single, isAdmin=true', async () => {
|
||||
const dir = tmpDir();
|
||||
const router = factory(makeCtx({}, dir));
|
||||
const layer = findRoute(router, '/auth/me', 'get');
|
||||
expect(layer).toBeTruthy();
|
||||
const res = await invoke(layer, { user: undefined });
|
||||
expect(res._status).toBe(200);
|
||||
expect(res._body).toMatchObject({
|
||||
success: true,
|
||||
user: null,
|
||||
authenticated: true,
|
||||
role: 'admin',
|
||||
isAdmin: true,
|
||||
legacy: true,
|
||||
mode: 'single',
|
||||
});
|
||||
});
|
||||
|
||||
test('multi-user mode with req.user: /auth/me returns stored profile, mode=multi', async () => {
|
||||
const dir = tmpDir();
|
||||
const userStore = require('../../src/security/user-store').createUserStore({ dataDir: dir });
|
||||
await userStore.login({ email: 'admin@x.com' });
|
||||
const ctx = makeCtx({ authProviders: { email: { enabled: true } } }, dir);
|
||||
// Attach the same store the factory builds — deterministic id resolution
|
||||
const router = factory(ctx);
|
||||
const layer = findRoute(router, '/auth/me', 'get');
|
||||
expect(layer).toBeTruthy();
|
||||
const users = await ctx.userStore.listUsers();
|
||||
const admin = users.find((u) => u.role === 'admin') || users[0];
|
||||
const res = await invoke(layer, { user: { id: admin.id, role: admin.role } });
|
||||
expect(res._status).toBe(200);
|
||||
expect(res._body.mode).toBe('multi');
|
||||
expect(res._body.user).toMatchObject({ id: admin.id, email: 'admin@x.com', isAdmin: true });
|
||||
expect(res._body.legacy).toBeUndefined();
|
||||
});
|
||||
|
||||
test('multi-user mode, legacy session (no req.user): /auth/me falls back to legacy admin', async () => {
|
||||
const dir = tmpDir();
|
||||
const router = factory(makeCtx({ authProviders: { email: { enabled: true } } }, dir));
|
||||
const layer = findRoute(router, '/auth/me', 'get');
|
||||
const res = await invoke(layer, { user: undefined });
|
||||
expect(res._body).toMatchObject({ mode: 'single', role: 'admin', legacy: true });
|
||||
});
|
||||
|
||||
test('/auth/me is NOT in PUBLIC_ROUTES (stays session-gated)', () => {
|
||||
const fs = require('fs');
|
||||
const path = require('path');
|
||||
const mw = fs.readFileSync(
|
||||
path.join(__dirname, '..', '..', 'src', 'utilities', 'middleware.js'),
|
||||
'utf8'
|
||||
);
|
||||
expect(/['"]\/api\/v1\/auth\/me['"]/.test(mw)).toBe(false);
|
||||
});
|
||||
|
||||
test('admin router still mounted ONLY in multi-user mode (DC-048 invariant preserved)', () => {
|
||||
const single = factory(makeCtx({}, tmpDir()));
|
||||
const multi = factory(makeCtx({ authProviders: { email: { enabled: true } } }, tmpDir()));
|
||||
const hasAdminMount = (router) =>
|
||||
router.stack.some(
|
||||
(l) => l.name === 'router' && l.handle && l.handle.stack &&
|
||||
l.handle.stack.some((s) => s.route && /^\/admin\//.test(s.route.path))
|
||||
);
|
||||
expect(hasAdminMount(single)).toBe(false);
|
||||
expect(hasAdminMount(multi)).toBe(true);
|
||||
});
|
||||
|
||||
// Judge polish (DC-093 round 1): HTTP-level proof that the route is
|
||||
// REACHABLE through real Express dispatch — not merely present in the
|
||||
// router stack. Guards against a future mount-order/shadowing change
|
||||
// (e.g. an earlier router.use swallowing /auth/*) silently re-404ing
|
||||
// the endpoint while the layer-walk tests above keep passing.
|
||||
test('HTTP-level: GET /api/v1/auth/me is reachable through real Express dispatch (single-user)', async () => {
|
||||
const request = require('supertest');
|
||||
const express = require('express');
|
||||
const app = express();
|
||||
app.use('/api/v1', factory(makeCtx({}, tmpDir())));
|
||||
const res = await request(app).get('/api/v1/auth/me');
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body).toMatchObject({ success: true, mode: 'single', isAdmin: true });
|
||||
});
|
||||
});
|
||||
@@ -262,67 +262,6 @@ describe('DC-076: CA cert/key disclosure hardening', () => {
|
||||
});
|
||||
});
|
||||
|
||||
describe('regression: `format` is declared before the dispatch block', () => {
|
||||
// The handler referenced `format` five times in the pfx/pem/crt/key/
|
||||
// fullchain dispatch without ever declaring it — every request that
|
||||
// reached that far threw ReferenceError. The behavioral tests above
|
||||
// can't reach the dispatch (PKI files absent in the test env returns
|
||||
// 500 first), so pin the declaration at the source level instead.
|
||||
test('routes/ca.js declares `format` before dispatch', () => {
|
||||
const src = fs.readFileSync(
|
||||
path.join(__dirname, '../../routes/ca.js'), 'utf8');
|
||||
// Declaration derives from req.query.format (via rawFormat) and the
|
||||
// canonical format list drives validation.
|
||||
expect(src).toMatch(/const\s+rawFormat\s*=\s*req\.query\.format/);
|
||||
expect(src).toMatch(/const\s+format\s*=\s*rawFormat\s*\|\|\s*'pfx'/);
|
||||
expect(src).toMatch(/CA_CERT_FORMATS\s*=\s*\[.*'pfx'.*'fullchain'.*\]/s);
|
||||
// And the declaration must come before the first dispatch use.
|
||||
const declIdx = src.search(/const\s+format\s*=/);
|
||||
const useIdx = src.indexOf("if (format === 'pfx')");
|
||||
expect(declIdx).toBeGreaterThanOrEqual(0);
|
||||
expect(useIdx).toBeGreaterThan(declIdx);
|
||||
});
|
||||
});
|
||||
|
||||
describe('/cert/:domain — format validation (DC-076_FORMAT_INVALID)', () => {
|
||||
// These validations run before the PKI file check, so they are
|
||||
// reachable in the test environment (unlike the dispatch itself).
|
||||
test('rejects unknown format value', async () => {
|
||||
const { app } = createCaApp({ scope: ['admin'] });
|
||||
const res = await request(app)
|
||||
.get('/ca/cert/dns1.local?format=garbage');
|
||||
expect(res.status).toBe(400);
|
||||
expect(res.body.code).toBe('DC-076_FORMAT_INVALID');
|
||||
});
|
||||
|
||||
test('rejects empty format value', async () => {
|
||||
const { app } = createCaApp({ scope: ['admin'] });
|
||||
const res = await request(app)
|
||||
.get('/ca/cert/dns1.local?format=');
|
||||
expect(res.status).toBe(400);
|
||||
expect(res.body.code).toBe('DC-076_FORMAT_INVALID');
|
||||
});
|
||||
|
||||
test('rejects array format (?format=a&format=b)', async () => {
|
||||
const { app } = createCaApp({ scope: ['admin'] });
|
||||
const res = await request(app)
|
||||
.get('/ca/cert/dns1.local?format=pem&format=crt');
|
||||
expect(res.status).toBe(400);
|
||||
expect(res.body.code).toBe('DC-076_FORMAT_INVALID');
|
||||
});
|
||||
|
||||
test('accepts every documented format (validation passes; PKI 500 is fine)', async () => {
|
||||
for (const fmt of ['pfx', 'pem', 'crt', 'key', 'fullchain']) {
|
||||
const { app } = createCaApp({ scope: ['admin'] });
|
||||
const qs = fmt === 'pfx' ? `format=pfx&password=GoodPass12` : `format=${fmt}`;
|
||||
const res = await request(app).get(`/ca/cert/dns1.local?${qs}`);
|
||||
// Must NOT be a format rejection — anything else (e.g. 500 CA not
|
||||
// found in the test env) proves validation accepted the format.
|
||||
expect(res.body.code).not.toBe('DC-076_FORMAT_INVALID');
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
describe('/cert/:domain — domain validation', () => {
|
||||
test('rejects single-label domain (no dot)', async () => {
|
||||
const { app } = createCaApp({ scope: ['admin'] });
|
||||
|
||||
@@ -1,206 +0,0 @@
|
||||
'use strict';
|
||||
|
||||
/**
|
||||
* DC-120: perimeter aggregation endpoint tests.
|
||||
*
|
||||
* GET /api/v1/security/events/perimeter — caddy-source perimeter
|
||||
* aggregation (per-IP + per-vhost breakdowns) for the Log Insights panel.
|
||||
*
|
||||
* Fixture shape mirrors the live caddy-source event schema:
|
||||
* {source_type: 'caddy', actor: '<ip>', target: 'GET /',
|
||||
* action: 'http.200', outcome: 'success'|'denied'|'error',
|
||||
* metadata: {host: 'req.sami-flix.com', status, user_agent, ...}}
|
||||
*
|
||||
* What these tests pin:
|
||||
* 1. Aggregation correctness — counts, denied/error splits, host sets.
|
||||
* 2. Window filtering — only events inside ?hours are counted.
|
||||
* 3. Input clamping — hours out of [1,720] falls back to 24; limit out
|
||||
* of [1,50] falls back to 15. No 500s, no crashes.
|
||||
* 4. Ordering — count desc, tie-break by IP asc (deterministic output).
|
||||
* 5. Empty store — valid zero-response, not an error.
|
||||
* 6. NON-caddy events (api-source) are EXCLUDED — the perimeter view
|
||||
* must only reflect reverse-proxy traffic, not dashboard activity.
|
||||
* 7. filterEvents()/query() filter parity — the new store primitive
|
||||
* applies the same predicates as the paged API (no drift).
|
||||
*/
|
||||
|
||||
const express = require('express');
|
||||
const http = require('http');
|
||||
const os = require('os');
|
||||
const path = require('path');
|
||||
const fs = require('fs');
|
||||
|
||||
const { SecurityEventStore } = require('../../src/security/event-store');
|
||||
|
||||
function tmpdir() {
|
||||
return fs.mkdtempSync(path.join(os.tmpdir(), 'dc120-perimeter-'));
|
||||
}
|
||||
|
||||
// Drive requests through real http so we exercise the full stack.
|
||||
function listen(app) {
|
||||
return new Promise((resolve) => {
|
||||
const server = app.listen(0, '127.0.0.1', () => resolve(server));
|
||||
});
|
||||
}
|
||||
|
||||
function get(server, path) {
|
||||
return new Promise((resolve, reject) => {
|
||||
http.get({ host: server.address().address, port: server.address().port, path }, (res) => {
|
||||
let body = '';
|
||||
res.on('data', (c) => (body += c));
|
||||
res.on('end', () => resolve({ status: res.statusCode, body: JSON.parse(body) }));
|
||||
}).on('error', reject);
|
||||
});
|
||||
}
|
||||
|
||||
describe('DC-120 GET /api/v1/security/events/perimeter', () => {
|
||||
let dir;
|
||||
let server;
|
||||
|
||||
beforeAll(async () => {
|
||||
dir = tmpdir();
|
||||
// Seed the SINGLETON (routes/security.js factory calls getStore()
|
||||
// internally and getStore memoizes) — so the router reads our fixtures
|
||||
// from memory with zero disk-timing races. Jest isolates module
|
||||
// registries per test file, so this doesn't leak to other suites.
|
||||
const { getStore } = require('../../src/security/event-store');
|
||||
const store = getStore({ filePath: path.join(dir, 'security-events.jsonl'), log: console });
|
||||
|
||||
// Fixture set (all 10 minutes old unless noted):
|
||||
// 1.1.1.1 — 3 requests, 1 denied, hosts {a.example, b.example} (TOP by count)
|
||||
// 9.9.9.9 — 2 requests, 2 errors, host {c.example}
|
||||
// 8.8.8.8 — 2 requests, all success, host {a.example} (tie with 9.9.9.9 → IP asc wins)
|
||||
// api-source event — MUST be excluded
|
||||
// old caddy event (47h ago) — excluded by the 24h window, included by 48h
|
||||
// (47h not 48h: a same-instant fixture vs route `since` races the
|
||||
// inclusive boundary — keep it unambiguous on both sides)
|
||||
const now = Date.now();
|
||||
const T = (minAgo) => new Date(now - minAgo * 60000).toISOString();
|
||||
[
|
||||
{ source_type: 'caddy', actor: '1.1.1.1', target: 'GET /', action: 'http.200', outcome: 'success', severity: 'info', metadata: { host: 'a.example', status: 200 } },
|
||||
{ source_type: 'caddy', actor: '1.1.1.1', target: 'GET /wp-login.php', action: 'http.401', outcome: 'denied', severity: 'warn', metadata: { host: 'b.example', status: 401 } },
|
||||
{ source_type: 'caddy', actor: '1.1.1.1', target: 'GET /x', action: 'http.200', outcome: 'success', severity: 'info', metadata: { host: 'a.example', status: 200 } },
|
||||
{ source_type: 'caddy', actor: '9.9.9.9', target: 'GET /y', action: 'http.502', outcome: 'error', severity: 'error', metadata: { host: 'c.example', status: 502 } },
|
||||
{ source_type: 'caddy', actor: '9.9.9.9', target: 'GET /z', action: 'http.502', outcome: 'error', severity: 'error', metadata: { host: 'c.example', status: 502 } },
|
||||
{ source_type: 'caddy', actor: '8.8.8.8', target: 'GET /', action: 'http.200', outcome: 'success', severity: 'info', metadata: { host: 'a.example', status: 200 } },
|
||||
{ source_type: 'caddy', actor: '8.8.8.8', target: 'GET /health', action: 'http.200', outcome: 'success', severity: 'info', metadata: { host: 'a.example', status: 200 } },
|
||||
{ source_type: 'api', actor: '127.0.0.1', target: 'GET /api/v1/services', action: 'services.list', outcome: 'success', severity: 'info', metadata: { host: 'status.sami' } },
|
||||
{ ts: T(47 * 60), source_type: 'caddy', actor: '5.5.5.5', target: 'GET /old', action: 'http.200', outcome: 'success', severity: 'info', metadata: { host: 'old.example', status: 200 } },
|
||||
].forEach((partial) => {
|
||||
store.append(Object.assign({ source_host: 'testhost', ts: T(10) }, partial));
|
||||
});
|
||||
|
||||
const app = express().use('/api/v1/security', require('../../routes/security')({ log: console }));
|
||||
server = await listen(app);
|
||||
});
|
||||
|
||||
afterAll((done) => {
|
||||
server.close(done);
|
||||
delete process.env.SECURITY_EVENT_LOG_FILE;
|
||||
fs.rmSync(dir, { recursive: true, force: true });
|
||||
});
|
||||
|
||||
test('aggregates per-IP counts, denied/error splits, host sets; excludes api-source + old events', async () => {
|
||||
const res = await get(server, '/api/v1/security/events/perimeter?hours=24');
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body.success).toBe(true);
|
||||
|
||||
const { summary, topIPs, byHost } = res.body;
|
||||
// 8 in-window events minus the api-source one = 7 caddy events
|
||||
expect(summary.events).toBe(7);
|
||||
expect(summary.uniqueIPs).toBe(3);
|
||||
expect(summary.denied).toBe(1);
|
||||
expect(summary.error).toBe(2);
|
||||
|
||||
// Ordering: count desc, tie-break IP asc → 1.1.1.1 (3), 8.8.8.8 (2), 9.9.9.9 (2)
|
||||
expect(topIPs.map((t) => t.ip)).toEqual(['1.1.1.1', '8.8.8.8', '9.9.9.9']);
|
||||
const top = topIPs[0];
|
||||
expect(top.count).toBe(3);
|
||||
expect(top.denied).toBe(1);
|
||||
expect(top.error).toBe(0);
|
||||
expect(top.hosts).toEqual(['a.example', 'b.example']);
|
||||
|
||||
const nine = topIPs[2];
|
||||
expect(nine.error).toBe(2);
|
||||
|
||||
// byHost: a.example=4, c.example=2, b.example=1
|
||||
const hostByName = Object.fromEntries(byHost.map((h) => [h.host, h]));
|
||||
expect(hostByName['a.example'].count).toBe(4);
|
||||
expect(hostByName['c.example'].count).toBe(2);
|
||||
expect(hostByName['c.example'].error).toBe(2);
|
||||
expect(hostByName['b.example'].count).toBe(1);
|
||||
expect(hostByName['b.example'].denied).toBe(1);
|
||||
// old.example (48h) and status.sami (api-source) absent
|
||||
expect(hostByName['old.example']).toBeUndefined();
|
||||
expect(hostByName['status.sami']).toBeUndefined();
|
||||
});
|
||||
|
||||
test('clamps invalid hours/limit instead of erroring', async () => {
|
||||
const res = await get(server, '/api/v1/security/events/perimeter?hours=-5&limit=9999');
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body.window.hours).toBe(24);
|
||||
expect(res.body.topIPs.length).toBeLessThanOrEqual(15);
|
||||
});
|
||||
|
||||
test('hours window filters correctly (48h includes the old event)', async () => {
|
||||
const res = await get(server, '/api/v1/security/events/perimeter?hours=48');
|
||||
expect(res.status).toBe(200);
|
||||
// 7 in-window + 1 old caddy event = 8 (api-source still excluded)
|
||||
expect(res.body.summary.events).toBe(8);
|
||||
expect(res.body.summary.uniqueIPs).toBe(4);
|
||||
});
|
||||
|
||||
test('empty store returns valid zero-response', async () => {
|
||||
// Fresh jest module registry → fresh getStore() memo → empty store.
|
||||
jest.resetModules();
|
||||
const dir2 = tmpdir();
|
||||
process.env.SECURITY_EVENT_LOG_FILE = path.join(dir2, 'empty.jsonl');
|
||||
const securityRoutesFresh = require('../../routes/security');
|
||||
const app = express().use('/api/v1/security', securityRoutesFresh({ log: console }));
|
||||
const server2 = await listen(app);
|
||||
try {
|
||||
const res = await get(server2, '/api/v1/security/events/perimeter');
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body.success).toBe(true);
|
||||
expect(res.body.summary.events).toBe(0);
|
||||
expect(res.body.summary.uniqueIPs).toBe(0);
|
||||
expect(res.body.topIPs).toEqual([]);
|
||||
expect(res.body.byHost).toEqual([]);
|
||||
} finally {
|
||||
server2.close();
|
||||
fs.rmSync(dir2, { recursive: true, force: true });
|
||||
delete process.env.SECURITY_EVENT_LOG_FILE;
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
describe('DC-120 event-store filterEvents()/query() parity', () => {
|
||||
test('filterEvents returns exactly what query() totals (same predicate)', () => {
|
||||
const dir = tmpdir();
|
||||
const store = new SecurityEventStore({ filePath: path.join(dir, 's.jsonl'), log: console });
|
||||
const now = Date.now();
|
||||
for (let i = 0; i < 30; i++) {
|
||||
store.append({
|
||||
source_type: i % 2 ? 'caddy' : 'api',
|
||||
actor: `10.0.0.${i % 5}`,
|
||||
target: 'GET /',
|
||||
action: `http.${200 + (i % 3) * 100}`,
|
||||
outcome: i % 7 === 0 ? 'denied' : 'success',
|
||||
severity: i % 7 === 0 ? 'warn' : 'info',
|
||||
ts: new Date(now - (i % 10) * 60000).toISOString(),
|
||||
});
|
||||
}
|
||||
const since = new Date(now - 15 * 60000).toISOString();
|
||||
const q = { source_type: 'caddy', since };
|
||||
const filtered = store.filterEvents(q);
|
||||
const paged = store.query(Object.assign({ limit: 1000 }, q));
|
||||
expect(filtered.length).toBe(paged.total);
|
||||
// newest-first order preserved by both
|
||||
expect(filtered.map((e) => e.id)).toEqual(paged.events.map((e) => e.id));
|
||||
|
||||
// Multi-value filter parity (comma string form)
|
||||
const q2 = { source_type: 'caddy', outcome: 'denied,error', since };
|
||||
expect(store.filterEvents(q2).length).toBe(store.query(Object.assign({ limit: 1000 }, q2)).total);
|
||||
fs.rmSync(dir, { recursive: true, force: true });
|
||||
});
|
||||
});
|
||||
@@ -53,7 +53,6 @@ function stripComments(src) {
|
||||
.replace(/\/\*[\s\S]*?\*\//g, '') // block comments
|
||||
.replace(/(^|[^:])\/\/.*$/gm, '$1'); // line comments, leaving URLs alone
|
||||
// Pass 3: restore template literals.
|
||||
// eslint-disable-next-line no-control-regex -- \u0000 is the sentinel from pass 1
|
||||
return protectedSrc.replace(/\u0000TPL(\d+)\u0000/g, (_, idx) => templates[+idx]);
|
||||
}
|
||||
|
||||
|
||||
@@ -1,21 +1,21 @@
|
||||
# Font file headers to prevent sanitizer issues
|
||||
<FilesMatch "\.(woff2|woff|ttf|eot)$">
|
||||
Header set Access-Control-Allow-Origin "*"
|
||||
Header set Access-Control-Allow-Methods "GET, POST, OPTIONS"
|
||||
Header set Access-Control-Allow-Headers "Content-Type"
|
||||
Header set Cache-Control "public, max-age=31536000"
|
||||
|
||||
# Proper MIME types
|
||||
<IfModule mod_mime.c>
|
||||
AddType font/woff2 .woff2
|
||||
AddType font/woff .woff
|
||||
AddType font/ttf .ttf
|
||||
AddType application/vnd.ms-fontobject .eot
|
||||
</IfModule>
|
||||
</FilesMatch>
|
||||
|
||||
# Prevent direct access to font conversion scripts
|
||||
<FilesMatch "\.(py|bat)$">
|
||||
Order allow,deny
|
||||
Deny from all
|
||||
# Font file headers to prevent sanitizer issues
|
||||
<FilesMatch "\.(woff2|woff|ttf|eot)$">
|
||||
Header set Access-Control-Allow-Origin "*"
|
||||
Header set Access-Control-Allow-Methods "GET, POST, OPTIONS"
|
||||
Header set Access-Control-Allow-Headers "Content-Type"
|
||||
Header set Cache-Control "public, max-age=31536000"
|
||||
|
||||
# Proper MIME types
|
||||
<IfModule mod_mime.c>
|
||||
AddType font/woff2 .woff2
|
||||
AddType font/woff .woff
|
||||
AddType font/ttf .ttf
|
||||
AddType application/vnd.ms-fontobject .eot
|
||||
</IfModule>
|
||||
</FilesMatch>
|
||||
|
||||
# Prevent direct access to font conversion scripts
|
||||
<FilesMatch "\.(py|bat)$">
|
||||
Order allow,deny
|
||||
Deny from all
|
||||
</FilesMatch>
|
||||
@@ -1,321 +1,321 @@
|
||||
/**
|
||||
* DNS Template Selector
|
||||
* Presents DNS server template options when user chooses to set up DNS
|
||||
*/
|
||||
|
||||
(function(window) {
|
||||
'use strict';
|
||||
|
||||
class DnsTemplateSelector {
|
||||
constructor(progressTracker) {
|
||||
this.progressTracker = progressTracker;
|
||||
this.modal = null;
|
||||
this.onTemplateSelected = null;
|
||||
console.log('[DnsTemplateSelector] Module loaded');
|
||||
}
|
||||
|
||||
/**
|
||||
* Get available DNS server templates from app templates
|
||||
* @returns {Array} Array of DNS template objects
|
||||
*/
|
||||
getDnsTemplates() {
|
||||
// In a real implementation, this would fetch from app-templates.js
|
||||
// For now, return hardcoded templates matching what we added
|
||||
return [
|
||||
{
|
||||
id: 'technitium',
|
||||
name: 'Technitium DNS Server',
|
||||
description: 'Modern DNS server with web UI for managing private zones',
|
||||
icon: '🌐',
|
||||
difficulty: 'Easy',
|
||||
features: [
|
||||
'Web-based management interface',
|
||||
'Private zone management for .sami domain',
|
||||
'DHCP server integration',
|
||||
'DNS-over-HTTPS and DNS-over-TLS support'
|
||||
],
|
||||
recommended: true
|
||||
},
|
||||
{
|
||||
id: 'bind9',
|
||||
name: 'BIND9 DNS Server',
|
||||
description: 'Industry-standard DNS server - powerful and flexible',
|
||||
icon: '🔧',
|
||||
difficulty: 'Advanced',
|
||||
features: [
|
||||
'Industry standard DNS server',
|
||||
'Full RFC compliance',
|
||||
'Advanced zone management',
|
||||
'DNSSEC support'
|
||||
],
|
||||
recommended: false
|
||||
},
|
||||
{
|
||||
id: 'pihole',
|
||||
name: 'Pi-hole',
|
||||
description: 'Network-wide ad blocker with DNS capabilities',
|
||||
icon: '🛡️',
|
||||
difficulty: 'Intermediate',
|
||||
features: [
|
||||
'Ad blocking at DNS level',
|
||||
'Web interface for management',
|
||||
'DHCP server included',
|
||||
'Query logging and statistics'
|
||||
],
|
||||
recommended: false
|
||||
},
|
||||
{
|
||||
id: 'powerdns',
|
||||
name: 'PowerDNS',
|
||||
description: 'High-performance DNS server with SQL backend',
|
||||
icon: '⚡',
|
||||
difficulty: 'Intermediate',
|
||||
features: [
|
||||
'SQL database backend',
|
||||
'RESTful API for automation',
|
||||
'Geographic load balancing',
|
||||
'DNSSEC support'
|
||||
],
|
||||
recommended: false
|
||||
},
|
||||
{
|
||||
id: 'coredns',
|
||||
name: 'CoreDNS',
|
||||
description: 'Cloud-native DNS server - lightweight and flexible',
|
||||
icon: '☁️',
|
||||
difficulty: 'Intermediate',
|
||||
features: [
|
||||
'Plugin-based architecture',
|
||||
'Kubernetes-native',
|
||||
'Lightweight and fast',
|
||||
'Prometheus metrics'
|
||||
],
|
||||
recommended: false
|
||||
}
|
||||
];
|
||||
}
|
||||
|
||||
/**
|
||||
* Show DNS template selection modal
|
||||
*/
|
||||
showTemplateSelector() {
|
||||
// Create modal if it doesn't exist
|
||||
if (!this.modal) {
|
||||
this.createModal();
|
||||
}
|
||||
|
||||
// Populate with templates
|
||||
this.populateTemplates();
|
||||
|
||||
// Show modal
|
||||
this.modal.style.display = 'flex';
|
||||
document.body.style.overflow = 'hidden';
|
||||
}
|
||||
|
||||
/**
|
||||
* Create the modal HTML structure
|
||||
* @private
|
||||
*/
|
||||
createModal() {
|
||||
const modal = document.createElement('div');
|
||||
modal.id = 'dns-template-modal';
|
||||
modal.className = 'dns-template-modal';
|
||||
modal.innerHTML = `
|
||||
<div class="dns-template-modal-content">
|
||||
<div class="dns-template-header">
|
||||
<h2>🌐 Choose a DNS Server</h2>
|
||||
<p>Setting up a DNS server is essential for managing your private .sami domain</p>
|
||||
<button class="dns-template-close" aria-label="Close">×</button>
|
||||
</div>
|
||||
<div class="dns-template-grid" id="dns-template-grid">
|
||||
<!-- Templates will be inserted here -->
|
||||
</div>
|
||||
<div class="dns-template-footer">
|
||||
<button class="dns-template-later-btn" id="dns-setup-later">Set up later</button>
|
||||
</div>
|
||||
</div>
|
||||
`;
|
||||
|
||||
document.body.appendChild(modal);
|
||||
this.modal = modal;
|
||||
|
||||
// Add event listeners
|
||||
modal.querySelector('.dns-template-close').addEventListener('click', () => this.close());
|
||||
modal.querySelector('#dns-setup-later').addEventListener('click', () => this.handleSetupLater());
|
||||
|
||||
// Close on overlay click
|
||||
modal.addEventListener('click', (e) => {
|
||||
if (e.target === modal) {
|
||||
this.close();
|
||||
}
|
||||
});
|
||||
|
||||
// Close on Escape key
|
||||
document.addEventListener('keydown', (e) => {
|
||||
if (e.key === 'Escape' && modal.style.display === 'flex') {
|
||||
this.close();
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Populate modal with DNS templates
|
||||
* @private
|
||||
*/
|
||||
populateTemplates() {
|
||||
const grid = document.getElementById('dns-template-grid');
|
||||
if (!grid) return;
|
||||
|
||||
const templates = this.getDnsTemplates();
|
||||
grid.innerHTML = '';
|
||||
|
||||
templates.forEach(template => {
|
||||
const card = this.createTemplateCard(template);
|
||||
grid.appendChild(card);
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Create a template card element
|
||||
* @private
|
||||
*/
|
||||
createTemplateCard(template) {
|
||||
const card = document.createElement('div');
|
||||
card.className = 'dns-template-card';
|
||||
if (template.recommended) {
|
||||
card.classList.add('recommended');
|
||||
}
|
||||
|
||||
const difficultyClass = template.difficulty.toLowerCase();
|
||||
|
||||
card.innerHTML = `
|
||||
${template.recommended ? '<div class="recommended-badge">Recommended</div>' : ''}
|
||||
<div class="dns-template-icon">${template.icon}</div>
|
||||
<h3>${template.name}</h3>
|
||||
<p class="dns-template-description">${template.description}</p>
|
||||
<div class="dns-template-difficulty difficulty-${difficultyClass}">
|
||||
${template.difficulty}
|
||||
</div>
|
||||
<ul class="dns-template-features">
|
||||
${template.features.slice(0, 3).map(f => `<li>${f}</li>`).join('')}
|
||||
</ul>
|
||||
<button class="dns-template-select-btn" data-template-id="${template.id}">
|
||||
Select ${template.name}
|
||||
</button>
|
||||
`;
|
||||
|
||||
// Add click handler to select button
|
||||
const selectBtn = card.querySelector('.dns-template-select-btn');
|
||||
selectBtn.addEventListener('click', () => this.handleTemplateSelection(template));
|
||||
|
||||
return card;
|
||||
}
|
||||
|
||||
/**
|
||||
* Handle template selection
|
||||
* @private
|
||||
*/
|
||||
handleTemplateSelection(template) {
|
||||
console.log(`[DnsTemplateSelector] Template selected: ${template.id}`);
|
||||
|
||||
// Close modal
|
||||
this.close();
|
||||
|
||||
// Trigger callback if set
|
||||
if (this.onTemplateSelected) {
|
||||
this.onTemplateSelected(template);
|
||||
} else {
|
||||
// Default behavior: open app selector with DNS filter
|
||||
this.openAppSelector(template.id);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Handle "Set up later" button
|
||||
* @private
|
||||
*/
|
||||
handleSetupLater() {
|
||||
console.log('[DnsTemplateSelector] DNS setup deferred');
|
||||
|
||||
// Mark as deferred in progress tracker
|
||||
if (this.progressTracker) {
|
||||
this.progressTracker.markDnsSetupDeferred();
|
||||
}
|
||||
|
||||
// Close modal
|
||||
this.close();
|
||||
|
||||
// Show notification
|
||||
this.showNotification('DNS setup deferred. You can set it up later from the App Selector.');
|
||||
}
|
||||
|
||||
/**
|
||||
* Open app selector with specific template
|
||||
* @private
|
||||
*/
|
||||
openAppSelector(templateId) {
|
||||
// Try to open the app selector modal if it exists
|
||||
const appSelectorBtn = document.querySelector('[onclick*="showAppSelector"]');
|
||||
if (appSelectorBtn) {
|
||||
appSelectorBtn.click();
|
||||
|
||||
// Wait a bit then filter to the selected template
|
||||
setTimeout(() => {
|
||||
const searchInput = document.querySelector('#app-search');
|
||||
if (searchInput) {
|
||||
searchInput.value = templateId;
|
||||
searchInput.dispatchEvent(new Event('input', { bubbles: true }));
|
||||
}
|
||||
}, 300);
|
||||
} else {
|
||||
// Fallback: show instructions
|
||||
this.showNotification(`To deploy ${templateId}, use the App Selector and search for "${templateId}"`);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Show notification message
|
||||
* @private
|
||||
*/
|
||||
showNotification(message) {
|
||||
// Simple notification - could be enhanced
|
||||
const notification = document.createElement('div');
|
||||
notification.className = 'dns-template-notification';
|
||||
notification.textContent = message;
|
||||
notification.style.cssText = `
|
||||
position: fixed;
|
||||
top: 20px;
|
||||
right: 20px;
|
||||
background: var(--card-base);
|
||||
color: var(--fg);
|
||||
padding: 15px 20px;
|
||||
border-radius: 8px;
|
||||
box-shadow: 0 4px 12px rgba(0,0,0,0.3);
|
||||
z-index: 10001;
|
||||
max-width: 300px;
|
||||
`;
|
||||
|
||||
document.body.appendChild(notification);
|
||||
|
||||
setTimeout(() => {
|
||||
notification.style.opacity = '0';
|
||||
notification.style.transition = 'opacity 0.3s';
|
||||
setTimeout(() => notification.remove(), 300);
|
||||
}, 3000);
|
||||
}
|
||||
|
||||
/**
|
||||
* Close the modal
|
||||
*/
|
||||
close() {
|
||||
if (this.modal) {
|
||||
this.modal.style.display = 'none';
|
||||
document.body.style.overflow = '';
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
window.DnsTemplateSelector = DnsTemplateSelector;
|
||||
console.log('[DnsTemplateSelector] Module loaded');
|
||||
|
||||
})(window);
|
||||
/**
|
||||
* DNS Template Selector
|
||||
* Presents DNS server template options when user chooses to set up DNS
|
||||
*/
|
||||
|
||||
(function(window) {
|
||||
'use strict';
|
||||
|
||||
class DnsTemplateSelector {
|
||||
constructor(progressTracker) {
|
||||
this.progressTracker = progressTracker;
|
||||
this.modal = null;
|
||||
this.onTemplateSelected = null;
|
||||
console.log('[DnsTemplateSelector] Module loaded');
|
||||
}
|
||||
|
||||
/**
|
||||
* Get available DNS server templates from app templates
|
||||
* @returns {Array} Array of DNS template objects
|
||||
*/
|
||||
getDnsTemplates() {
|
||||
// In a real implementation, this would fetch from app-templates.js
|
||||
// For now, return hardcoded templates matching what we added
|
||||
return [
|
||||
{
|
||||
id: 'technitium',
|
||||
name: 'Technitium DNS Server',
|
||||
description: 'Modern DNS server with web UI for managing private zones',
|
||||
icon: '🌐',
|
||||
difficulty: 'Easy',
|
||||
features: [
|
||||
'Web-based management interface',
|
||||
'Private zone management for .sami domain',
|
||||
'DHCP server integration',
|
||||
'DNS-over-HTTPS and DNS-over-TLS support'
|
||||
],
|
||||
recommended: true
|
||||
},
|
||||
{
|
||||
id: 'bind9',
|
||||
name: 'BIND9 DNS Server',
|
||||
description: 'Industry-standard DNS server - powerful and flexible',
|
||||
icon: '🔧',
|
||||
difficulty: 'Advanced',
|
||||
features: [
|
||||
'Industry standard DNS server',
|
||||
'Full RFC compliance',
|
||||
'Advanced zone management',
|
||||
'DNSSEC support'
|
||||
],
|
||||
recommended: false
|
||||
},
|
||||
{
|
||||
id: 'pihole',
|
||||
name: 'Pi-hole',
|
||||
description: 'Network-wide ad blocker with DNS capabilities',
|
||||
icon: '🛡️',
|
||||
difficulty: 'Intermediate',
|
||||
features: [
|
||||
'Ad blocking at DNS level',
|
||||
'Web interface for management',
|
||||
'DHCP server included',
|
||||
'Query logging and statistics'
|
||||
],
|
||||
recommended: false
|
||||
},
|
||||
{
|
||||
id: 'powerdns',
|
||||
name: 'PowerDNS',
|
||||
description: 'High-performance DNS server with SQL backend',
|
||||
icon: '⚡',
|
||||
difficulty: 'Intermediate',
|
||||
features: [
|
||||
'SQL database backend',
|
||||
'RESTful API for automation',
|
||||
'Geographic load balancing',
|
||||
'DNSSEC support'
|
||||
],
|
||||
recommended: false
|
||||
},
|
||||
{
|
||||
id: 'coredns',
|
||||
name: 'CoreDNS',
|
||||
description: 'Cloud-native DNS server - lightweight and flexible',
|
||||
icon: '☁️',
|
||||
difficulty: 'Intermediate',
|
||||
features: [
|
||||
'Plugin-based architecture',
|
||||
'Kubernetes-native',
|
||||
'Lightweight and fast',
|
||||
'Prometheus metrics'
|
||||
],
|
||||
recommended: false
|
||||
}
|
||||
];
|
||||
}
|
||||
|
||||
/**
|
||||
* Show DNS template selection modal
|
||||
*/
|
||||
showTemplateSelector() {
|
||||
// Create modal if it doesn't exist
|
||||
if (!this.modal) {
|
||||
this.createModal();
|
||||
}
|
||||
|
||||
// Populate with templates
|
||||
this.populateTemplates();
|
||||
|
||||
// Show modal
|
||||
this.modal.style.display = 'flex';
|
||||
document.body.style.overflow = 'hidden';
|
||||
}
|
||||
|
||||
/**
|
||||
* Create the modal HTML structure
|
||||
* @private
|
||||
*/
|
||||
createModal() {
|
||||
const modal = document.createElement('div');
|
||||
modal.id = 'dns-template-modal';
|
||||
modal.className = 'dns-template-modal';
|
||||
modal.innerHTML = `
|
||||
<div class="dns-template-modal-content">
|
||||
<div class="dns-template-header">
|
||||
<h2>🌐 Choose a DNS Server</h2>
|
||||
<p>Setting up a DNS server is essential for managing your private .sami domain</p>
|
||||
<button class="dns-template-close" aria-label="Close">×</button>
|
||||
</div>
|
||||
<div class="dns-template-grid" id="dns-template-grid">
|
||||
<!-- Templates will be inserted here -->
|
||||
</div>
|
||||
<div class="dns-template-footer">
|
||||
<button class="dns-template-later-btn" id="dns-setup-later">Set up later</button>
|
||||
</div>
|
||||
</div>
|
||||
`;
|
||||
|
||||
document.body.appendChild(modal);
|
||||
this.modal = modal;
|
||||
|
||||
// Add event listeners
|
||||
modal.querySelector('.dns-template-close').addEventListener('click', () => this.close());
|
||||
modal.querySelector('#dns-setup-later').addEventListener('click', () => this.handleSetupLater());
|
||||
|
||||
// Close on overlay click
|
||||
modal.addEventListener('click', (e) => {
|
||||
if (e.target === modal) {
|
||||
this.close();
|
||||
}
|
||||
});
|
||||
|
||||
// Close on Escape key
|
||||
document.addEventListener('keydown', (e) => {
|
||||
if (e.key === 'Escape' && modal.style.display === 'flex') {
|
||||
this.close();
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Populate modal with DNS templates
|
||||
* @private
|
||||
*/
|
||||
populateTemplates() {
|
||||
const grid = document.getElementById('dns-template-grid');
|
||||
if (!grid) return;
|
||||
|
||||
const templates = this.getDnsTemplates();
|
||||
grid.innerHTML = '';
|
||||
|
||||
templates.forEach(template => {
|
||||
const card = this.createTemplateCard(template);
|
||||
grid.appendChild(card);
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Create a template card element
|
||||
* @private
|
||||
*/
|
||||
createTemplateCard(template) {
|
||||
const card = document.createElement('div');
|
||||
card.className = 'dns-template-card';
|
||||
if (template.recommended) {
|
||||
card.classList.add('recommended');
|
||||
}
|
||||
|
||||
const difficultyClass = template.difficulty.toLowerCase();
|
||||
|
||||
card.innerHTML = `
|
||||
${template.recommended ? '<div class="recommended-badge">Recommended</div>' : ''}
|
||||
<div class="dns-template-icon">${template.icon}</div>
|
||||
<h3>${template.name}</h3>
|
||||
<p class="dns-template-description">${template.description}</p>
|
||||
<div class="dns-template-difficulty difficulty-${difficultyClass}">
|
||||
${template.difficulty}
|
||||
</div>
|
||||
<ul class="dns-template-features">
|
||||
${template.features.slice(0, 3).map(f => `<li>${f}</li>`).join('')}
|
||||
</ul>
|
||||
<button class="dns-template-select-btn" data-template-id="${template.id}">
|
||||
Select ${template.name}
|
||||
</button>
|
||||
`;
|
||||
|
||||
// Add click handler to select button
|
||||
const selectBtn = card.querySelector('.dns-template-select-btn');
|
||||
selectBtn.addEventListener('click', () => this.handleTemplateSelection(template));
|
||||
|
||||
return card;
|
||||
}
|
||||
|
||||
/**
|
||||
* Handle template selection
|
||||
* @private
|
||||
*/
|
||||
handleTemplateSelection(template) {
|
||||
console.log(`[DnsTemplateSelector] Template selected: ${template.id}`);
|
||||
|
||||
// Close modal
|
||||
this.close();
|
||||
|
||||
// Trigger callback if set
|
||||
if (this.onTemplateSelected) {
|
||||
this.onTemplateSelected(template);
|
||||
} else {
|
||||
// Default behavior: open app selector with DNS filter
|
||||
this.openAppSelector(template.id);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Handle "Set up later" button
|
||||
* @private
|
||||
*/
|
||||
handleSetupLater() {
|
||||
console.log('[DnsTemplateSelector] DNS setup deferred');
|
||||
|
||||
// Mark as deferred in progress tracker
|
||||
if (this.progressTracker) {
|
||||
this.progressTracker.markDnsSetupDeferred();
|
||||
}
|
||||
|
||||
// Close modal
|
||||
this.close();
|
||||
|
||||
// Show notification
|
||||
this.showNotification('DNS setup deferred. You can set it up later from the App Selector.');
|
||||
}
|
||||
|
||||
/**
|
||||
* Open app selector with specific template
|
||||
* @private
|
||||
*/
|
||||
openAppSelector(templateId) {
|
||||
// Try to open the app selector modal if it exists
|
||||
const appSelectorBtn = document.querySelector('[onclick*="showAppSelector"]');
|
||||
if (appSelectorBtn) {
|
||||
appSelectorBtn.click();
|
||||
|
||||
// Wait a bit then filter to the selected template
|
||||
setTimeout(() => {
|
||||
const searchInput = document.querySelector('#app-search');
|
||||
if (searchInput) {
|
||||
searchInput.value = templateId;
|
||||
searchInput.dispatchEvent(new Event('input', { bubbles: true }));
|
||||
}
|
||||
}, 300);
|
||||
} else {
|
||||
// Fallback: show instructions
|
||||
this.showNotification(`To deploy ${templateId}, use the App Selector and search for "${templateId}"`);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Show notification message
|
||||
* @private
|
||||
*/
|
||||
showNotification(message) {
|
||||
// Simple notification - could be enhanced
|
||||
const notification = document.createElement('div');
|
||||
notification.className = 'dns-template-notification';
|
||||
notification.textContent = message;
|
||||
notification.style.cssText = `
|
||||
position: fixed;
|
||||
top: 20px;
|
||||
right: 20px;
|
||||
background: var(--card-base);
|
||||
color: var(--fg);
|
||||
padding: 15px 20px;
|
||||
border-radius: 8px;
|
||||
box-shadow: 0 4px 12px rgba(0,0,0,0.3);
|
||||
z-index: 10001;
|
||||
max-width: 300px;
|
||||
`;
|
||||
|
||||
document.body.appendChild(notification);
|
||||
|
||||
setTimeout(() => {
|
||||
notification.style.opacity = '0';
|
||||
notification.style.transition = 'opacity 0.3s';
|
||||
setTimeout(() => notification.remove(), 300);
|
||||
}, 3000);
|
||||
}
|
||||
|
||||
/**
|
||||
* Close the modal
|
||||
*/
|
||||
close() {
|
||||
if (this.modal) {
|
||||
this.modal.style.display = 'none';
|
||||
document.body.style.overflow = '';
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
window.DnsTemplateSelector = DnsTemplateSelector;
|
||||
console.log('[DnsTemplateSelector] Module loaded');
|
||||
|
||||
})(window);
|
||||
@@ -1,259 +1,259 @@
|
||||
/**
|
||||
* Error Handler
|
||||
* Handles errors gracefully without breaking the onboarding tour
|
||||
*/
|
||||
|
||||
(function(window) {
|
||||
'use strict';
|
||||
|
||||
class ErrorHandler {
|
||||
constructor() {
|
||||
this.errors = [];
|
||||
this.maxErrors = 50; // Keep last 50 errors
|
||||
}
|
||||
|
||||
/**
|
||||
* Log an error without breaking the tour
|
||||
* @param {string} context - Context where error occurred
|
||||
* @param {Error|string} error - The error object or message
|
||||
* @param {Object} metadata - Additional metadata
|
||||
*/
|
||||
logError(context, error, metadata = {}) {
|
||||
const errorEntry = {
|
||||
timestamp: new Date().toISOString(),
|
||||
context,
|
||||
message: error instanceof Error ? error.message : error,
|
||||
stack: error instanceof Error ? error.stack : null,
|
||||
metadata
|
||||
};
|
||||
|
||||
// Add to errors array
|
||||
this.errors.push(errorEntry);
|
||||
|
||||
// Keep only last maxErrors
|
||||
if (this.errors.length > this.maxErrors) {
|
||||
this.errors.shift();
|
||||
}
|
||||
|
||||
// Log to console
|
||||
console.error(`[Onboarding Error] ${context}:`, error, metadata);
|
||||
|
||||
// Optionally send to error tracking service
|
||||
// this.sendToErrorTracking(errorEntry);
|
||||
}
|
||||
|
||||
/**
|
||||
* Attempt to recover from an error and continue tour
|
||||
* @param {Error} error - The error object
|
||||
* @param {number} currentStep - Current step index
|
||||
* @returns {Object} Recovery action
|
||||
*/
|
||||
recoverFromError(error, currentStep) {
|
||||
const errorType = this.classifyError(error);
|
||||
|
||||
switch (errorType) {
|
||||
case 'ELEMENT_NOT_FOUND':
|
||||
this.logError('Element Not Found', error, { currentStep });
|
||||
return {
|
||||
action: 'SKIP_STEP',
|
||||
nextStep: currentStep + 1,
|
||||
message: 'Target element not found, skipping to next step'
|
||||
};
|
||||
|
||||
case 'STORAGE_UNAVAILABLE':
|
||||
this.logError('Storage Unavailable', error);
|
||||
return {
|
||||
action: 'USE_MEMORY_STORAGE',
|
||||
message: 'Local storage unavailable, using in-memory storage'
|
||||
};
|
||||
|
||||
case 'DRIVER_NOT_LOADED':
|
||||
this.logError('Driver.js Not Loaded', error);
|
||||
return {
|
||||
action: 'ABORT_TOUR',
|
||||
message: 'Driver.js library not loaded, cannot start tour'
|
||||
};
|
||||
|
||||
case 'INVALID_TOOLTIP':
|
||||
this.logError('Invalid Tooltip Configuration', error, { currentStep });
|
||||
return {
|
||||
action: 'SKIP_STEP',
|
||||
nextStep: currentStep + 1,
|
||||
message: 'Invalid tooltip configuration, skipping'
|
||||
};
|
||||
|
||||
case 'THEME_DETECTION_FAILED':
|
||||
this.logError('Theme Detection Failed', error);
|
||||
return {
|
||||
action: 'USE_DEFAULT_THEME',
|
||||
message: 'Using default dark theme'
|
||||
};
|
||||
|
||||
default:
|
||||
this.logError('Unknown Error', error, { currentStep });
|
||||
return {
|
||||
action: 'ABORT_TOUR',
|
||||
message: 'Unexpected error occurred, aborting tour'
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Classify error type
|
||||
* @private
|
||||
* @param {Error} error - The error object
|
||||
* @returns {string} Error type
|
||||
*/
|
||||
classifyError(error) {
|
||||
const message = error.message || error.toString();
|
||||
|
||||
if (message.includes('element') && message.includes('not found')) {
|
||||
return 'ELEMENT_NOT_FOUND';
|
||||
}
|
||||
if (message.includes('storage') || message.includes('quota')) {
|
||||
return 'STORAGE_UNAVAILABLE';
|
||||
}
|
||||
if (message.includes('driver') || message.includes('undefined')) {
|
||||
return 'DRIVER_NOT_LOADED';
|
||||
}
|
||||
if (message.includes('invalid') || message.includes('validation')) {
|
||||
return 'INVALID_TOOLTIP';
|
||||
}
|
||||
if (message.includes('theme')) {
|
||||
return 'THEME_DETECTION_FAILED';
|
||||
}
|
||||
|
||||
return 'UNKNOWN';
|
||||
}
|
||||
|
||||
/**
|
||||
* Get all logged errors
|
||||
* @returns {Array} Array of error entries
|
||||
*/
|
||||
getErrors() {
|
||||
return [...this.errors];
|
||||
}
|
||||
|
||||
/**
|
||||
* Clear all logged errors
|
||||
*/
|
||||
clearErrors() {
|
||||
this.errors = [];
|
||||
}
|
||||
|
||||
/**
|
||||
* Get error statistics
|
||||
* @returns {Object} Error statistics
|
||||
*/
|
||||
getStatistics() {
|
||||
const stats = {
|
||||
total: this.errors.length,
|
||||
byContext: {},
|
||||
byType: {},
|
||||
recent: this.errors.slice(-10)
|
||||
};
|
||||
|
||||
this.errors.forEach(error => {
|
||||
// Count by context
|
||||
stats.byContext[error.context] = (stats.byContext[error.context] || 0) + 1;
|
||||
|
||||
// Count by type
|
||||
const type = this.classifyError({ message: error.message });
|
||||
stats.byType[type] = (stats.byType[type] || 0) + 1;
|
||||
});
|
||||
|
||||
return stats;
|
||||
}
|
||||
|
||||
/**
|
||||
* Handle graceful degradation when Driver.js fails to load
|
||||
* @returns {boolean} Whether fallback was successful
|
||||
*/
|
||||
handleDriverLoadFailure() {
|
||||
this.logError('Driver.js Load Failure', 'Driver.js library failed to load');
|
||||
|
||||
// Show fallback message
|
||||
const fallbackMessage = document.createElement('div');
|
||||
fallbackMessage.id = 'onboarding-fallback';
|
||||
fallbackMessage.style.cssText = `
|
||||
position: fixed;
|
||||
bottom: 20px;
|
||||
right: 20px;
|
||||
background: var(--card-base, #2a2a2a);
|
||||
color: var(--fg, #ffffff);
|
||||
padding: 15px 20px;
|
||||
border-radius: 8px;
|
||||
box-shadow: 0 4px 12px rgba(0,0,0,0.3);
|
||||
z-index: 9999;
|
||||
max-width: 300px;
|
||||
font-size: 14px;
|
||||
`;
|
||||
fallbackMessage.innerHTML = `
|
||||
<strong>Welcome to DashCaddy!</strong><br>
|
||||
<p style="margin: 10px 0 0 0; font-size: 12px;">
|
||||
The interactive tour is unavailable, but you can explore the dashboard freely.
|
||||
Check the documentation for help getting started.
|
||||
</p>
|
||||
`;
|
||||
|
||||
document.body.appendChild(fallbackMessage);
|
||||
|
||||
// Auto-remove after 10 seconds
|
||||
setTimeout(() => {
|
||||
if (fallbackMessage.parentNode) {
|
||||
fallbackMessage.parentNode.removeChild(fallbackMessage);
|
||||
}
|
||||
}, 10000);
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Handle storage unavailable scenario
|
||||
* @returns {Object} In-memory storage fallback
|
||||
*/
|
||||
handleStorageUnavailable() {
|
||||
this.logError('Storage Unavailable', 'Local storage is not available');
|
||||
|
||||
// Create in-memory storage
|
||||
const memoryStorage = {
|
||||
data: {},
|
||||
getItem(key) {
|
||||
return this.data[key] || null;
|
||||
},
|
||||
setItem(key, value) {
|
||||
this.data[key] = value;
|
||||
},
|
||||
removeItem(key) {
|
||||
delete this.data[key];
|
||||
},
|
||||
clear() {
|
||||
this.data = {};
|
||||
}
|
||||
};
|
||||
|
||||
console.warn('[ErrorHandler] Using in-memory storage - progress will not persist');
|
||||
return memoryStorage;
|
||||
}
|
||||
|
||||
/**
|
||||
* Send error to tracking service (placeholder)
|
||||
* @private
|
||||
* @param {Object} errorEntry - Error entry to send
|
||||
*/
|
||||
sendToErrorTracking(errorEntry) {
|
||||
// Placeholder for error tracking integration
|
||||
// Could integrate with Sentry, LogRocket, etc.
|
||||
// Example:
|
||||
// if (window.Sentry) {
|
||||
// Sentry.captureException(new Error(errorEntry.message), {
|
||||
// extra: errorEntry.metadata
|
||||
// });
|
||||
// }
|
||||
}
|
||||
}
|
||||
|
||||
window.ErrorHandler = ErrorHandler;
|
||||
console.log('[ErrorHandler] Module loaded');
|
||||
|
||||
})(window);
|
||||
/**
|
||||
* Error Handler
|
||||
* Handles errors gracefully without breaking the onboarding tour
|
||||
*/
|
||||
|
||||
(function(window) {
|
||||
'use strict';
|
||||
|
||||
class ErrorHandler {
|
||||
constructor() {
|
||||
this.errors = [];
|
||||
this.maxErrors = 50; // Keep last 50 errors
|
||||
}
|
||||
|
||||
/**
|
||||
* Log an error without breaking the tour
|
||||
* @param {string} context - Context where error occurred
|
||||
* @param {Error|string} error - The error object or message
|
||||
* @param {Object} metadata - Additional metadata
|
||||
*/
|
||||
logError(context, error, metadata = {}) {
|
||||
const errorEntry = {
|
||||
timestamp: new Date().toISOString(),
|
||||
context,
|
||||
message: error instanceof Error ? error.message : error,
|
||||
stack: error instanceof Error ? error.stack : null,
|
||||
metadata
|
||||
};
|
||||
|
||||
// Add to errors array
|
||||
this.errors.push(errorEntry);
|
||||
|
||||
// Keep only last maxErrors
|
||||
if (this.errors.length > this.maxErrors) {
|
||||
this.errors.shift();
|
||||
}
|
||||
|
||||
// Log to console
|
||||
console.error(`[Onboarding Error] ${context}:`, error, metadata);
|
||||
|
||||
// Optionally send to error tracking service
|
||||
// this.sendToErrorTracking(errorEntry);
|
||||
}
|
||||
|
||||
/**
|
||||
* Attempt to recover from an error and continue tour
|
||||
* @param {Error} error - The error object
|
||||
* @param {number} currentStep - Current step index
|
||||
* @returns {Object} Recovery action
|
||||
*/
|
||||
recoverFromError(error, currentStep) {
|
||||
const errorType = this.classifyError(error);
|
||||
|
||||
switch (errorType) {
|
||||
case 'ELEMENT_NOT_FOUND':
|
||||
this.logError('Element Not Found', error, { currentStep });
|
||||
return {
|
||||
action: 'SKIP_STEP',
|
||||
nextStep: currentStep + 1,
|
||||
message: 'Target element not found, skipping to next step'
|
||||
};
|
||||
|
||||
case 'STORAGE_UNAVAILABLE':
|
||||
this.logError('Storage Unavailable', error);
|
||||
return {
|
||||
action: 'USE_MEMORY_STORAGE',
|
||||
message: 'Local storage unavailable, using in-memory storage'
|
||||
};
|
||||
|
||||
case 'DRIVER_NOT_LOADED':
|
||||
this.logError('Driver.js Not Loaded', error);
|
||||
return {
|
||||
action: 'ABORT_TOUR',
|
||||
message: 'Driver.js library not loaded, cannot start tour'
|
||||
};
|
||||
|
||||
case 'INVALID_TOOLTIP':
|
||||
this.logError('Invalid Tooltip Configuration', error, { currentStep });
|
||||
return {
|
||||
action: 'SKIP_STEP',
|
||||
nextStep: currentStep + 1,
|
||||
message: 'Invalid tooltip configuration, skipping'
|
||||
};
|
||||
|
||||
case 'THEME_DETECTION_FAILED':
|
||||
this.logError('Theme Detection Failed', error);
|
||||
return {
|
||||
action: 'USE_DEFAULT_THEME',
|
||||
message: 'Using default dark theme'
|
||||
};
|
||||
|
||||
default:
|
||||
this.logError('Unknown Error', error, { currentStep });
|
||||
return {
|
||||
action: 'ABORT_TOUR',
|
||||
message: 'Unexpected error occurred, aborting tour'
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Classify error type
|
||||
* @private
|
||||
* @param {Error} error - The error object
|
||||
* @returns {string} Error type
|
||||
*/
|
||||
classifyError(error) {
|
||||
const message = error.message || error.toString();
|
||||
|
||||
if (message.includes('element') && message.includes('not found')) {
|
||||
return 'ELEMENT_NOT_FOUND';
|
||||
}
|
||||
if (message.includes('storage') || message.includes('quota')) {
|
||||
return 'STORAGE_UNAVAILABLE';
|
||||
}
|
||||
if (message.includes('driver') || message.includes('undefined')) {
|
||||
return 'DRIVER_NOT_LOADED';
|
||||
}
|
||||
if (message.includes('invalid') || message.includes('validation')) {
|
||||
return 'INVALID_TOOLTIP';
|
||||
}
|
||||
if (message.includes('theme')) {
|
||||
return 'THEME_DETECTION_FAILED';
|
||||
}
|
||||
|
||||
return 'UNKNOWN';
|
||||
}
|
||||
|
||||
/**
|
||||
* Get all logged errors
|
||||
* @returns {Array} Array of error entries
|
||||
*/
|
||||
getErrors() {
|
||||
return [...this.errors];
|
||||
}
|
||||
|
||||
/**
|
||||
* Clear all logged errors
|
||||
*/
|
||||
clearErrors() {
|
||||
this.errors = [];
|
||||
}
|
||||
|
||||
/**
|
||||
* Get error statistics
|
||||
* @returns {Object} Error statistics
|
||||
*/
|
||||
getStatistics() {
|
||||
const stats = {
|
||||
total: this.errors.length,
|
||||
byContext: {},
|
||||
byType: {},
|
||||
recent: this.errors.slice(-10)
|
||||
};
|
||||
|
||||
this.errors.forEach(error => {
|
||||
// Count by context
|
||||
stats.byContext[error.context] = (stats.byContext[error.context] || 0) + 1;
|
||||
|
||||
// Count by type
|
||||
const type = this.classifyError({ message: error.message });
|
||||
stats.byType[type] = (stats.byType[type] || 0) + 1;
|
||||
});
|
||||
|
||||
return stats;
|
||||
}
|
||||
|
||||
/**
|
||||
* Handle graceful degradation when Driver.js fails to load
|
||||
* @returns {boolean} Whether fallback was successful
|
||||
*/
|
||||
handleDriverLoadFailure() {
|
||||
this.logError('Driver.js Load Failure', 'Driver.js library failed to load');
|
||||
|
||||
// Show fallback message
|
||||
const fallbackMessage = document.createElement('div');
|
||||
fallbackMessage.id = 'onboarding-fallback';
|
||||
fallbackMessage.style.cssText = `
|
||||
position: fixed;
|
||||
bottom: 20px;
|
||||
right: 20px;
|
||||
background: var(--card-base, #2a2a2a);
|
||||
color: var(--fg, #ffffff);
|
||||
padding: 15px 20px;
|
||||
border-radius: 8px;
|
||||
box-shadow: 0 4px 12px rgba(0,0,0,0.3);
|
||||
z-index: 9999;
|
||||
max-width: 300px;
|
||||
font-size: 14px;
|
||||
`;
|
||||
fallbackMessage.innerHTML = `
|
||||
<strong>Welcome to DashCaddy!</strong><br>
|
||||
<p style="margin: 10px 0 0 0; font-size: 12px;">
|
||||
The interactive tour is unavailable, but you can explore the dashboard freely.
|
||||
Check the documentation for help getting started.
|
||||
</p>
|
||||
`;
|
||||
|
||||
document.body.appendChild(fallbackMessage);
|
||||
|
||||
// Auto-remove after 10 seconds
|
||||
setTimeout(() => {
|
||||
if (fallbackMessage.parentNode) {
|
||||
fallbackMessage.parentNode.removeChild(fallbackMessage);
|
||||
}
|
||||
}, 10000);
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Handle storage unavailable scenario
|
||||
* @returns {Object} In-memory storage fallback
|
||||
*/
|
||||
handleStorageUnavailable() {
|
||||
this.logError('Storage Unavailable', 'Local storage is not available');
|
||||
|
||||
// Create in-memory storage
|
||||
const memoryStorage = {
|
||||
data: {},
|
||||
getItem(key) {
|
||||
return this.data[key] || null;
|
||||
},
|
||||
setItem(key, value) {
|
||||
this.data[key] = value;
|
||||
},
|
||||
removeItem(key) {
|
||||
delete this.data[key];
|
||||
},
|
||||
clear() {
|
||||
this.data = {};
|
||||
}
|
||||
};
|
||||
|
||||
console.warn('[ErrorHandler] Using in-memory storage - progress will not persist');
|
||||
return memoryStorage;
|
||||
}
|
||||
|
||||
/**
|
||||
* Send error to tracking service (placeholder)
|
||||
* @private
|
||||
* @param {Object} errorEntry - Error entry to send
|
||||
*/
|
||||
sendToErrorTracking(errorEntry) {
|
||||
// Placeholder for error tracking integration
|
||||
// Could integrate with Sentry, LogRocket, etc.
|
||||
// Example:
|
||||
// if (window.Sentry) {
|
||||
// Sentry.captureException(new Error(errorEntry.message), {
|
||||
// extra: errorEntry.metadata
|
||||
// });
|
||||
// }
|
||||
}
|
||||
}
|
||||
|
||||
window.ErrorHandler = ErrorHandler;
|
||||
console.log('[ErrorHandler] Module loaded');
|
||||
|
||||
})(window);
|
||||
@@ -1,91 +1,91 @@
|
||||
/* Sami Sans Font Family - External CSS */
|
||||
|
||||
@font-face {
|
||||
font-family: 'Sami Sans';
|
||||
src: url('fonts/SamiSans-Regular.woff2') format('woff2'),
|
||||
url('fonts/SamiSans-Regular.ttf') format('truetype');
|
||||
font-weight: 400;
|
||||
font-style: normal;
|
||||
font-display: swap;
|
||||
}
|
||||
|
||||
@font-face {
|
||||
font-family: 'Sami Sans';
|
||||
src: url('fonts/SamiSans-Regular.woff2') format('woff2'),
|
||||
url('fonts/SamiSans-Italic.ttf') format('truetype');
|
||||
font-weight: 400;
|
||||
font-style: italic;
|
||||
font-display: swap;
|
||||
}
|
||||
|
||||
@font-face {
|
||||
font-family: 'Sami Sans';
|
||||
src: url('fonts/SamiSans-Medium.woff2') format('woff2'),
|
||||
url('fonts/SamiSans-Medium.ttf') format('truetype');
|
||||
font-weight: 500;
|
||||
font-style: normal;
|
||||
font-display: swap;
|
||||
}
|
||||
|
||||
@font-face {
|
||||
font-family: 'Sami Sans';
|
||||
src: url('fonts/SamiSans-SemiBold.woff2') format('woff2'),
|
||||
url('fonts/SamiSans-SemiBold.ttf') format('truetype');
|
||||
font-weight: 600;
|
||||
font-style: normal;
|
||||
font-display: swap;
|
||||
}
|
||||
|
||||
@font-face {
|
||||
font-family: 'Sami Sans';
|
||||
src: url('fonts/SamiSans-Bold.woff2') format('woff2'),
|
||||
url('fonts/SamiSans-Bold.ttf') format('truetype');
|
||||
font-weight: 700;
|
||||
font-style: normal;
|
||||
font-display: swap;
|
||||
}
|
||||
|
||||
@font-face {
|
||||
font-family: 'Sami Sans';
|
||||
src: url('fonts/SamiSans-ExtraBold.woff2') format('woff2'),
|
||||
url('fonts/SamiSans-ExtraBold.ttf') format('truetype');
|
||||
font-weight: 800;
|
||||
font-style: normal;
|
||||
font-display: swap;
|
||||
}
|
||||
|
||||
@font-face {
|
||||
font-family: 'Sami Sans';
|
||||
src: url('fonts/SamiSans-Black.woff2') format('woff2'),
|
||||
url('fonts/SamiSans-Black.ttf') format('truetype');
|
||||
font-weight: 900;
|
||||
font-style: normal;
|
||||
font-display: swap;
|
||||
}
|
||||
|
||||
@font-face {
|
||||
font-family: 'Sami Sans';
|
||||
src: url('fonts/SamiSans-Light.woff2') format('woff2'),
|
||||
url('fonts/SamiSans-Light.ttf') format('truetype');
|
||||
font-weight: 300;
|
||||
font-style: normal;
|
||||
font-display: swap;
|
||||
}
|
||||
|
||||
@font-face {
|
||||
font-family: 'Sami Sans';
|
||||
src: url('fonts/SamiSans-ExtraLight.woff2') format('woff2'),
|
||||
url('fonts/SamiSans-ExtraLight.ttf') format('truetype');
|
||||
font-weight: 200;
|
||||
font-style: normal;
|
||||
font-display: swap;
|
||||
}
|
||||
|
||||
@font-face {
|
||||
font-family: 'Sami Sans';
|
||||
src: url('fonts/SamiSans-Thin.woff2') format('woff2'),
|
||||
url('fonts/SamiSans-Thin.ttf') format('truetype');
|
||||
font-weight: 100;
|
||||
font-style: normal;
|
||||
font-display: swap;
|
||||
}
|
||||
/* Sami Sans Font Family - External CSS */
|
||||
|
||||
@font-face {
|
||||
font-family: 'Sami Sans';
|
||||
src: url('fonts/SamiSans-Regular.woff2') format('woff2'),
|
||||
url('fonts/SamiSans-Regular.ttf') format('truetype');
|
||||
font-weight: 400;
|
||||
font-style: normal;
|
||||
font-display: swap;
|
||||
}
|
||||
|
||||
@font-face {
|
||||
font-family: 'Sami Sans';
|
||||
src: url('fonts/SamiSans-Regular.woff2') format('woff2'),
|
||||
url('fonts/SamiSans-Italic.ttf') format('truetype');
|
||||
font-weight: 400;
|
||||
font-style: italic;
|
||||
font-display: swap;
|
||||
}
|
||||
|
||||
@font-face {
|
||||
font-family: 'Sami Sans';
|
||||
src: url('fonts/SamiSans-Medium.woff2') format('woff2'),
|
||||
url('fonts/SamiSans-Medium.ttf') format('truetype');
|
||||
font-weight: 500;
|
||||
font-style: normal;
|
||||
font-display: swap;
|
||||
}
|
||||
|
||||
@font-face {
|
||||
font-family: 'Sami Sans';
|
||||
src: url('fonts/SamiSans-SemiBold.woff2') format('woff2'),
|
||||
url('fonts/SamiSans-SemiBold.ttf') format('truetype');
|
||||
font-weight: 600;
|
||||
font-style: normal;
|
||||
font-display: swap;
|
||||
}
|
||||
|
||||
@font-face {
|
||||
font-family: 'Sami Sans';
|
||||
src: url('fonts/SamiSans-Bold.woff2') format('woff2'),
|
||||
url('fonts/SamiSans-Bold.ttf') format('truetype');
|
||||
font-weight: 700;
|
||||
font-style: normal;
|
||||
font-display: swap;
|
||||
}
|
||||
|
||||
@font-face {
|
||||
font-family: 'Sami Sans';
|
||||
src: url('fonts/SamiSans-ExtraBold.woff2') format('woff2'),
|
||||
url('fonts/SamiSans-ExtraBold.ttf') format('truetype');
|
||||
font-weight: 800;
|
||||
font-style: normal;
|
||||
font-display: swap;
|
||||
}
|
||||
|
||||
@font-face {
|
||||
font-family: 'Sami Sans';
|
||||
src: url('fonts/SamiSans-Black.woff2') format('woff2'),
|
||||
url('fonts/SamiSans-Black.ttf') format('truetype');
|
||||
font-weight: 900;
|
||||
font-style: normal;
|
||||
font-display: swap;
|
||||
}
|
||||
|
||||
@font-face {
|
||||
font-family: 'Sami Sans';
|
||||
src: url('fonts/SamiSans-Light.woff2') format('woff2'),
|
||||
url('fonts/SamiSans-Light.ttf') format('truetype');
|
||||
font-weight: 300;
|
||||
font-style: normal;
|
||||
font-display: swap;
|
||||
}
|
||||
|
||||
@font-face {
|
||||
font-family: 'Sami Sans';
|
||||
src: url('fonts/SamiSans-ExtraLight.woff2') format('woff2'),
|
||||
url('fonts/SamiSans-ExtraLight.ttf') format('truetype');
|
||||
font-weight: 200;
|
||||
font-style: normal;
|
||||
font-display: swap;
|
||||
}
|
||||
|
||||
@font-face {
|
||||
font-family: 'Sami Sans';
|
||||
src: url('fonts/SamiSans-Thin.woff2') format('woff2'),
|
||||
url('fonts/SamiSans-Thin.ttf') format('truetype');
|
||||
font-weight: 100;
|
||||
font-style: normal;
|
||||
font-display: swap;
|
||||
}
|
||||
+354
-354
@@ -1,354 +1,354 @@
|
||||
/**
|
||||
* Onboarding Tooltip Styles
|
||||
* Custom styling for Driver.js tooltips to match DashCaddy theme
|
||||
*/
|
||||
|
||||
/* Driver.js overrides are injected dynamically by ThemeAdapter */
|
||||
/* This file contains additional custom styles */
|
||||
|
||||
.driver-popover {
|
||||
max-width: 500px !important;
|
||||
z-index: 10000 !important;
|
||||
}
|
||||
|
||||
.driver-popover-title {
|
||||
font-size: 1.2rem !important;
|
||||
margin-bottom: 12px !important;
|
||||
}
|
||||
|
||||
.driver-popover-description {
|
||||
font-size: 0.95rem !important;
|
||||
line-height: 1.6 !important;
|
||||
}
|
||||
|
||||
.driver-popover-description p {
|
||||
margin: 8px 0 !important;
|
||||
}
|
||||
|
||||
.driver-popover-description ul {
|
||||
margin: 8px 0 !important;
|
||||
padding-left: 20px !important;
|
||||
}
|
||||
|
||||
.driver-popover-description li {
|
||||
margin: 4px 0 !important;
|
||||
}
|
||||
|
||||
.driver-popover-description code {
|
||||
background: rgba(0, 0, 0, 0.1) !important;
|
||||
padding: 2px 6px !important;
|
||||
border-radius: 3px !important;
|
||||
font-family: 'Courier New', monospace !important;
|
||||
font-size: 0.9em !important;
|
||||
}
|
||||
|
||||
.driver-popover-footer {
|
||||
margin-top: 16px !important;
|
||||
display: flex !important;
|
||||
gap: 8px !important;
|
||||
justify-content: flex-end !important;
|
||||
}
|
||||
|
||||
.driver-popover-footer button {
|
||||
padding: 8px 16px !important;
|
||||
border-radius: 8px !important;
|
||||
font-size: 0.9rem !important;
|
||||
cursor: pointer !important;
|
||||
transition: all 0.2s ease !important;
|
||||
}
|
||||
|
||||
.driver-popover-footer button:hover {
|
||||
transform: translateY(-1px) !important;
|
||||
}
|
||||
|
||||
.driver-popover-close-btn {
|
||||
position: absolute !important;
|
||||
top: 12px !important;
|
||||
right: 12px !important;
|
||||
width: 24px !important;
|
||||
height: 24px !important;
|
||||
border-radius: 50% !important;
|
||||
display: flex !important;
|
||||
align-items: center !important;
|
||||
justify-content: center !important;
|
||||
cursor: pointer !important;
|
||||
opacity: 0.6 !important;
|
||||
transition: opacity 0.2s ease !important;
|
||||
}
|
||||
|
||||
.driver-popover-close-btn:hover {
|
||||
opacity: 1 !important;
|
||||
}
|
||||
|
||||
.driver-popover-arrow {
|
||||
border-width: 8px !important;
|
||||
}
|
||||
|
||||
/* Progress indicator */
|
||||
.driver-popover-progress-text {
|
||||
font-size: 0.85rem !important;
|
||||
margin-bottom: 8px !important;
|
||||
}
|
||||
|
||||
/* Mobile responsive */
|
||||
@media (max-width: 768px) {
|
||||
.driver-popover {
|
||||
max-width: calc(100vw - 32px) !important;
|
||||
}
|
||||
|
||||
.driver-popover-title {
|
||||
font-size: 1.1rem !important;
|
||||
}
|
||||
|
||||
.driver-popover-description {
|
||||
font-size: 0.9rem !important;
|
||||
}
|
||||
|
||||
.driver-popover-footer button {
|
||||
padding: 6px 12px !important;
|
||||
font-size: 0.85rem !important;
|
||||
}
|
||||
}
|
||||
|
||||
/* Restart tour button in dashboard */
|
||||
#restart-tour-btn {
|
||||
display: inline-flex;
|
||||
align-items: center;
|
||||
gap: 6px;
|
||||
}
|
||||
|
||||
#restart-tour-btn::before {
|
||||
content: "🎓";
|
||||
font-size: 1.1em;
|
||||
}
|
||||
|
||||
|
||||
/* DNS Template Selector Modal */
|
||||
.dns-template-modal {
|
||||
display: none;
|
||||
position: fixed;
|
||||
top: 0;
|
||||
left: 0;
|
||||
right: 0;
|
||||
bottom: 0;
|
||||
background: rgba(0, 0, 0, 0.8);
|
||||
z-index: 10000;
|
||||
align-items: center;
|
||||
justify-content: center;
|
||||
padding: 20px;
|
||||
}
|
||||
|
||||
.dns-template-modal-content {
|
||||
background: var(--card-base);
|
||||
border-radius: 12px;
|
||||
max-width: 900px;
|
||||
width: 100%;
|
||||
max-height: 90vh;
|
||||
overflow-y: auto;
|
||||
box-shadow: 0 8px 32px rgba(0, 0, 0, 0.4);
|
||||
}
|
||||
|
||||
.dns-template-header {
|
||||
padding: 30px;
|
||||
border-bottom: 1px solid var(--border);
|
||||
position: relative;
|
||||
}
|
||||
|
||||
.dns-template-header h2 {
|
||||
margin: 0 0 10px 0;
|
||||
color: var(--fg);
|
||||
font-size: 28px;
|
||||
}
|
||||
|
||||
.dns-template-header p {
|
||||
margin: 0;
|
||||
color: var(--fg-muted);
|
||||
font-size: 14px;
|
||||
}
|
||||
|
||||
.dns-template-close {
|
||||
position: absolute;
|
||||
top: 20px;
|
||||
right: 20px;
|
||||
background: none;
|
||||
border: none;
|
||||
font-size: 32px;
|
||||
color: var(--fg-muted);
|
||||
cursor: pointer;
|
||||
padding: 0;
|
||||
width: 40px;
|
||||
height: 40px;
|
||||
display: flex;
|
||||
align-items: center;
|
||||
justify-content: center;
|
||||
border-radius: 50%;
|
||||
transition: all 0.2s;
|
||||
}
|
||||
|
||||
.dns-template-close:hover {
|
||||
background: var(--hover);
|
||||
color: var(--fg);
|
||||
}
|
||||
|
||||
.dns-template-grid {
|
||||
display: grid;
|
||||
grid-template-columns: repeat(auto-fill, minmax(280px, 1fr));
|
||||
gap: 20px;
|
||||
padding: 30px;
|
||||
}
|
||||
|
||||
.dns-template-card {
|
||||
background: var(--card-hover);
|
||||
border: 2px solid var(--border);
|
||||
border-radius: 12px;
|
||||
padding: 20px;
|
||||
transition: all 0.3s;
|
||||
position: relative;
|
||||
display: flex;
|
||||
flex-direction: column;
|
||||
}
|
||||
|
||||
.dns-template-card:hover {
|
||||
transform: translateY(-4px);
|
||||
box-shadow: 0 8px 16px rgba(0, 0, 0, 0.2);
|
||||
border-color: var(--accent);
|
||||
}
|
||||
|
||||
.dns-template-card.recommended {
|
||||
border-color: var(--accent);
|
||||
background: linear-gradient(135deg, var(--card-hover) 0%, var(--card-base) 100%);
|
||||
}
|
||||
|
||||
.recommended-badge {
|
||||
position: absolute;
|
||||
top: -10px;
|
||||
right: 20px;
|
||||
background: var(--accent);
|
||||
color: white;
|
||||
padding: 4px 12px;
|
||||
border-radius: 12px;
|
||||
font-size: 11px;
|
||||
font-weight: bold;
|
||||
text-transform: uppercase;
|
||||
letter-spacing: 0.5px;
|
||||
}
|
||||
|
||||
.dns-template-icon {
|
||||
font-size: 48px;
|
||||
margin-bottom: 15px;
|
||||
text-align: center;
|
||||
}
|
||||
|
||||
.dns-template-card h3 {
|
||||
margin: 0 0 10px 0;
|
||||
color: var(--fg);
|
||||
font-size: 18px;
|
||||
text-align: center;
|
||||
}
|
||||
|
||||
.dns-template-description {
|
||||
color: var(--fg-muted);
|
||||
font-size: 13px;
|
||||
margin: 0 0 15px 0;
|
||||
text-align: center;
|
||||
flex-grow: 1;
|
||||
}
|
||||
|
||||
.dns-template-difficulty {
|
||||
display: inline-block;
|
||||
padding: 4px 12px;
|
||||
border-radius: 12px;
|
||||
font-size: 11px;
|
||||
font-weight: bold;
|
||||
text-align: center;
|
||||
margin: 0 auto 15px auto;
|
||||
}
|
||||
|
||||
.difficulty-easy {
|
||||
background: #2ecc71;
|
||||
color: white;
|
||||
}
|
||||
|
||||
.difficulty-intermediate {
|
||||
background: #f39c12;
|
||||
color: white;
|
||||
}
|
||||
|
||||
.difficulty-advanced {
|
||||
background: #e74c3c;
|
||||
color: white;
|
||||
}
|
||||
|
||||
.dns-template-features {
|
||||
list-style: none;
|
||||
padding: 0;
|
||||
margin: 0 0 20px 0;
|
||||
font-size: 12px;
|
||||
color: var(--fg-muted);
|
||||
}
|
||||
|
||||
.dns-template-features li {
|
||||
padding: 6px 0;
|
||||
padding-left: 20px;
|
||||
position: relative;
|
||||
}
|
||||
|
||||
.dns-template-features li:before {
|
||||
content: "✓";
|
||||
position: absolute;
|
||||
left: 0;
|
||||
color: var(--accent);
|
||||
font-weight: bold;
|
||||
}
|
||||
|
||||
.dns-template-select-btn {
|
||||
background: var(--accent);
|
||||
color: white;
|
||||
border: none;
|
||||
padding: 12px 20px;
|
||||
border-radius: 8px;
|
||||
font-size: 14px;
|
||||
font-weight: bold;
|
||||
cursor: pointer;
|
||||
transition: all 0.2s;
|
||||
width: 100%;
|
||||
}
|
||||
|
||||
.dns-template-select-btn:hover {
|
||||
background: var(--accent-strong);
|
||||
transform: scale(1.02);
|
||||
}
|
||||
|
||||
.dns-template-footer {
|
||||
padding: 20px 30px;
|
||||
border-top: 1px solid var(--border);
|
||||
text-align: center;
|
||||
}
|
||||
|
||||
.dns-template-later-btn {
|
||||
background: transparent;
|
||||
color: var(--fg-muted);
|
||||
border: 1px solid var(--border);
|
||||
padding: 10px 24px;
|
||||
border-radius: 8px;
|
||||
font-size: 14px;
|
||||
cursor: pointer;
|
||||
transition: all 0.2s;
|
||||
}
|
||||
|
||||
.dns-template-later-btn:hover {
|
||||
background: var(--hover);
|
||||
color: var(--fg);
|
||||
border-color: var(--fg-muted);
|
||||
}
|
||||
|
||||
/* Responsive design */
|
||||
@media (max-width: 768px) {
|
||||
.dns-template-grid {
|
||||
grid-template-columns: 1fr;
|
||||
}
|
||||
|
||||
.dns-template-modal-content {
|
||||
max-height: 95vh;
|
||||
}
|
||||
}
|
||||
/**
|
||||
* Onboarding Tooltip Styles
|
||||
* Custom styling for Driver.js tooltips to match DashCaddy theme
|
||||
*/
|
||||
|
||||
/* Driver.js overrides are injected dynamically by ThemeAdapter */
|
||||
/* This file contains additional custom styles */
|
||||
|
||||
.driver-popover {
|
||||
max-width: 500px !important;
|
||||
z-index: 10000 !important;
|
||||
}
|
||||
|
||||
.driver-popover-title {
|
||||
font-size: 1.2rem !important;
|
||||
margin-bottom: 12px !important;
|
||||
}
|
||||
|
||||
.driver-popover-description {
|
||||
font-size: 0.95rem !important;
|
||||
line-height: 1.6 !important;
|
||||
}
|
||||
|
||||
.driver-popover-description p {
|
||||
margin: 8px 0 !important;
|
||||
}
|
||||
|
||||
.driver-popover-description ul {
|
||||
margin: 8px 0 !important;
|
||||
padding-left: 20px !important;
|
||||
}
|
||||
|
||||
.driver-popover-description li {
|
||||
margin: 4px 0 !important;
|
||||
}
|
||||
|
||||
.driver-popover-description code {
|
||||
background: rgba(0, 0, 0, 0.1) !important;
|
||||
padding: 2px 6px !important;
|
||||
border-radius: 3px !important;
|
||||
font-family: 'Courier New', monospace !important;
|
||||
font-size: 0.9em !important;
|
||||
}
|
||||
|
||||
.driver-popover-footer {
|
||||
margin-top: 16px !important;
|
||||
display: flex !important;
|
||||
gap: 8px !important;
|
||||
justify-content: flex-end !important;
|
||||
}
|
||||
|
||||
.driver-popover-footer button {
|
||||
padding: 8px 16px !important;
|
||||
border-radius: 8px !important;
|
||||
font-size: 0.9rem !important;
|
||||
cursor: pointer !important;
|
||||
transition: all 0.2s ease !important;
|
||||
}
|
||||
|
||||
.driver-popover-footer button:hover {
|
||||
transform: translateY(-1px) !important;
|
||||
}
|
||||
|
||||
.driver-popover-close-btn {
|
||||
position: absolute !important;
|
||||
top: 12px !important;
|
||||
right: 12px !important;
|
||||
width: 24px !important;
|
||||
height: 24px !important;
|
||||
border-radius: 50% !important;
|
||||
display: flex !important;
|
||||
align-items: center !important;
|
||||
justify-content: center !important;
|
||||
cursor: pointer !important;
|
||||
opacity: 0.6 !important;
|
||||
transition: opacity 0.2s ease !important;
|
||||
}
|
||||
|
||||
.driver-popover-close-btn:hover {
|
||||
opacity: 1 !important;
|
||||
}
|
||||
|
||||
.driver-popover-arrow {
|
||||
border-width: 8px !important;
|
||||
}
|
||||
|
||||
/* Progress indicator */
|
||||
.driver-popover-progress-text {
|
||||
font-size: 0.85rem !important;
|
||||
margin-bottom: 8px !important;
|
||||
}
|
||||
|
||||
/* Mobile responsive */
|
||||
@media (max-width: 768px) {
|
||||
.driver-popover {
|
||||
max-width: calc(100vw - 32px) !important;
|
||||
}
|
||||
|
||||
.driver-popover-title {
|
||||
font-size: 1.1rem !important;
|
||||
}
|
||||
|
||||
.driver-popover-description {
|
||||
font-size: 0.9rem !important;
|
||||
}
|
||||
|
||||
.driver-popover-footer button {
|
||||
padding: 6px 12px !important;
|
||||
font-size: 0.85rem !important;
|
||||
}
|
||||
}
|
||||
|
||||
/* Restart tour button in dashboard */
|
||||
#restart-tour-btn {
|
||||
display: inline-flex;
|
||||
align-items: center;
|
||||
gap: 6px;
|
||||
}
|
||||
|
||||
#restart-tour-btn::before {
|
||||
content: "🎓";
|
||||
font-size: 1.1em;
|
||||
}
|
||||
|
||||
|
||||
/* DNS Template Selector Modal */
|
||||
.dns-template-modal {
|
||||
display: none;
|
||||
position: fixed;
|
||||
top: 0;
|
||||
left: 0;
|
||||
right: 0;
|
||||
bottom: 0;
|
||||
background: rgba(0, 0, 0, 0.8);
|
||||
z-index: 10000;
|
||||
align-items: center;
|
||||
justify-content: center;
|
||||
padding: 20px;
|
||||
}
|
||||
|
||||
.dns-template-modal-content {
|
||||
background: var(--card-base);
|
||||
border-radius: 12px;
|
||||
max-width: 900px;
|
||||
width: 100%;
|
||||
max-height: 90vh;
|
||||
overflow-y: auto;
|
||||
box-shadow: 0 8px 32px rgba(0, 0, 0, 0.4);
|
||||
}
|
||||
|
||||
.dns-template-header {
|
||||
padding: 30px;
|
||||
border-bottom: 1px solid var(--border);
|
||||
position: relative;
|
||||
}
|
||||
|
||||
.dns-template-header h2 {
|
||||
margin: 0 0 10px 0;
|
||||
color: var(--fg);
|
||||
font-size: 28px;
|
||||
}
|
||||
|
||||
.dns-template-header p {
|
||||
margin: 0;
|
||||
color: var(--fg-muted);
|
||||
font-size: 14px;
|
||||
}
|
||||
|
||||
.dns-template-close {
|
||||
position: absolute;
|
||||
top: 20px;
|
||||
right: 20px;
|
||||
background: none;
|
||||
border: none;
|
||||
font-size: 32px;
|
||||
color: var(--fg-muted);
|
||||
cursor: pointer;
|
||||
padding: 0;
|
||||
width: 40px;
|
||||
height: 40px;
|
||||
display: flex;
|
||||
align-items: center;
|
||||
justify-content: center;
|
||||
border-radius: 50%;
|
||||
transition: all 0.2s;
|
||||
}
|
||||
|
||||
.dns-template-close:hover {
|
||||
background: var(--hover);
|
||||
color: var(--fg);
|
||||
}
|
||||
|
||||
.dns-template-grid {
|
||||
display: grid;
|
||||
grid-template-columns: repeat(auto-fill, minmax(280px, 1fr));
|
||||
gap: 20px;
|
||||
padding: 30px;
|
||||
}
|
||||
|
||||
.dns-template-card {
|
||||
background: var(--card-hover);
|
||||
border: 2px solid var(--border);
|
||||
border-radius: 12px;
|
||||
padding: 20px;
|
||||
transition: all 0.3s;
|
||||
position: relative;
|
||||
display: flex;
|
||||
flex-direction: column;
|
||||
}
|
||||
|
||||
.dns-template-card:hover {
|
||||
transform: translateY(-4px);
|
||||
box-shadow: 0 8px 16px rgba(0, 0, 0, 0.2);
|
||||
border-color: var(--accent);
|
||||
}
|
||||
|
||||
.dns-template-card.recommended {
|
||||
border-color: var(--accent);
|
||||
background: linear-gradient(135deg, var(--card-hover) 0%, var(--card-base) 100%);
|
||||
}
|
||||
|
||||
.recommended-badge {
|
||||
position: absolute;
|
||||
top: -10px;
|
||||
right: 20px;
|
||||
background: var(--accent);
|
||||
color: white;
|
||||
padding: 4px 12px;
|
||||
border-radius: 12px;
|
||||
font-size: 11px;
|
||||
font-weight: bold;
|
||||
text-transform: uppercase;
|
||||
letter-spacing: 0.5px;
|
||||
}
|
||||
|
||||
.dns-template-icon {
|
||||
font-size: 48px;
|
||||
margin-bottom: 15px;
|
||||
text-align: center;
|
||||
}
|
||||
|
||||
.dns-template-card h3 {
|
||||
margin: 0 0 10px 0;
|
||||
color: var(--fg);
|
||||
font-size: 18px;
|
||||
text-align: center;
|
||||
}
|
||||
|
||||
.dns-template-description {
|
||||
color: var(--fg-muted);
|
||||
font-size: 13px;
|
||||
margin: 0 0 15px 0;
|
||||
text-align: center;
|
||||
flex-grow: 1;
|
||||
}
|
||||
|
||||
.dns-template-difficulty {
|
||||
display: inline-block;
|
||||
padding: 4px 12px;
|
||||
border-radius: 12px;
|
||||
font-size: 11px;
|
||||
font-weight: bold;
|
||||
text-align: center;
|
||||
margin: 0 auto 15px auto;
|
||||
}
|
||||
|
||||
.difficulty-easy {
|
||||
background: #2ecc71;
|
||||
color: white;
|
||||
}
|
||||
|
||||
.difficulty-intermediate {
|
||||
background: #f39c12;
|
||||
color: white;
|
||||
}
|
||||
|
||||
.difficulty-advanced {
|
||||
background: #e74c3c;
|
||||
color: white;
|
||||
}
|
||||
|
||||
.dns-template-features {
|
||||
list-style: none;
|
||||
padding: 0;
|
||||
margin: 0 0 20px 0;
|
||||
font-size: 12px;
|
||||
color: var(--fg-muted);
|
||||
}
|
||||
|
||||
.dns-template-features li {
|
||||
padding: 6px 0;
|
||||
padding-left: 20px;
|
||||
position: relative;
|
||||
}
|
||||
|
||||
.dns-template-features li:before {
|
||||
content: "✓";
|
||||
position: absolute;
|
||||
left: 0;
|
||||
color: var(--accent);
|
||||
font-weight: bold;
|
||||
}
|
||||
|
||||
.dns-template-select-btn {
|
||||
background: var(--accent);
|
||||
color: white;
|
||||
border: none;
|
||||
padding: 12px 20px;
|
||||
border-radius: 8px;
|
||||
font-size: 14px;
|
||||
font-weight: bold;
|
||||
cursor: pointer;
|
||||
transition: all 0.2s;
|
||||
width: 100%;
|
||||
}
|
||||
|
||||
.dns-template-select-btn:hover {
|
||||
background: var(--accent-strong);
|
||||
transform: scale(1.02);
|
||||
}
|
||||
|
||||
.dns-template-footer {
|
||||
padding: 20px 30px;
|
||||
border-top: 1px solid var(--border);
|
||||
text-align: center;
|
||||
}
|
||||
|
||||
.dns-template-later-btn {
|
||||
background: transparent;
|
||||
color: var(--fg-muted);
|
||||
border: 1px solid var(--border);
|
||||
padding: 10px 24px;
|
||||
border-radius: 8px;
|
||||
font-size: 14px;
|
||||
cursor: pointer;
|
||||
transition: all 0.2s;
|
||||
}
|
||||
|
||||
.dns-template-later-btn:hover {
|
||||
background: var(--hover);
|
||||
color: var(--fg);
|
||||
border-color: var(--fg-muted);
|
||||
}
|
||||
|
||||
/* Responsive design */
|
||||
@media (max-width: 768px) {
|
||||
.dns-template-grid {
|
||||
grid-template-columns: 1fr;
|
||||
}
|
||||
|
||||
.dns-template-modal-content {
|
||||
max-height: 95vh;
|
||||
}
|
||||
}
|
||||
+177
-177
@@ -1,177 +1,177 @@
|
||||
/**
|
||||
* DashCaddy User Onboarding System
|
||||
* Main entry point for the tooltip-based onboarding experience
|
||||
*
|
||||
* This file initializes the onboarding system and coordinates between
|
||||
* the various components (TourManager, ProgressTracker, ThemeAdapter, etc.)
|
||||
*/
|
||||
|
||||
(function() {
|
||||
'use strict';
|
||||
|
||||
let progressTracker;
|
||||
let themeAdapter;
|
||||
let tourManager;
|
||||
let dnsTemplateSelector;
|
||||
let errorHandler;
|
||||
|
||||
/**
|
||||
* Initialize the onboarding system
|
||||
*/
|
||||
async function initializeOnboarding() {
|
||||
try {
|
||||
console.log('[Onboarding] Initializing system...');
|
||||
|
||||
// Initialize Error Handler first
|
||||
errorHandler = new ErrorHandler();
|
||||
console.log('[Onboarding] Error Handler initialized');
|
||||
|
||||
// Initialize Progress Tracker
|
||||
progressTracker = new ProgressTracker('dashcaddy_onboarding');
|
||||
console.log('[Onboarding] Progress Tracker initialized');
|
||||
|
||||
// Initialize Theme Adapter
|
||||
themeAdapter = new ThemeAdapter();
|
||||
console.log('[Onboarding] Theme Adapter initialized');
|
||||
|
||||
// Initialize DNS Template Selector
|
||||
dnsTemplateSelector = new DnsTemplateSelector(progressTracker);
|
||||
console.log('[Onboarding] DNS Template Selector initialized');
|
||||
|
||||
// Initialize Tour Manager
|
||||
tourManager = new TourManager(progressTracker, themeAdapter, dnsTemplateSelector);
|
||||
console.log('[Onboarding] Tour Manager initialized');
|
||||
|
||||
// Check if tour should auto-start
|
||||
if (tourManager.shouldAutoStart()) {
|
||||
console.log('[Onboarding] Auto-starting tour for first-time user');
|
||||
// Wait a bit for page to fully load
|
||||
setTimeout(() => {
|
||||
tourManager.startTour();
|
||||
}, 1000);
|
||||
} else {
|
||||
const tourCompleted = progressTracker.isTourCompleted();
|
||||
const currentStep = progressTracker.getCurrentStep();
|
||||
console.log(`[Onboarding] Tour not auto-starting (completed: ${tourCompleted}, step: ${currentStep})`);
|
||||
|
||||
// If tour is in progress, offer to resume
|
||||
if (!tourCompleted && currentStep > 0) {
|
||||
console.log('[Onboarding] Tour in progress, can be resumed manually');
|
||||
}
|
||||
}
|
||||
|
||||
// Add restart tour button to tools row
|
||||
addRestartTourButton();
|
||||
|
||||
// Expose to global scope for manual triggering
|
||||
window.DashCaddyOnboarding = {
|
||||
startTour: () => tourManager.startTour(),
|
||||
restartTour: () => tourManager.restartTour(),
|
||||
showTooltip: (id) => tourManager.showTooltip(id),
|
||||
showWhatsNew: () => tourManager.showWhatsNew(),
|
||||
resetProgress: () => progressTracker.resetProgress(),
|
||||
getErrors: () => errorHandler.getErrors(),
|
||||
getErrorStats: () => errorHandler.getStatistics()
|
||||
};
|
||||
|
||||
console.log('[Onboarding] System initialized successfully');
|
||||
} catch (error) {
|
||||
console.error('[Onboarding] Initialization error:', error);
|
||||
|
||||
// Use error handler if available
|
||||
if (errorHandler) {
|
||||
errorHandler.logError('Initialization', error);
|
||||
}
|
||||
|
||||
// Graceful degradation - don't break the dashboard
|
||||
console.warn('[Onboarding] System failed to initialize, dashboard will continue without onboarding');
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Add restart tour button to tools row
|
||||
*/
|
||||
function addRestartTourButton() {
|
||||
const toolsRow = document.querySelector('.tools');
|
||||
if (!toolsRow) return;
|
||||
|
||||
const clickHandler = () => {
|
||||
if (tourManager) {
|
||||
console.log('[Onboarding] Starting tour via button click');
|
||||
tourManager.restartTour();
|
||||
} else {
|
||||
console.error('[Onboarding] Tour manager not initialized');
|
||||
alert('Tour is not available. Check browser console for errors.\n\nPossible issues:\n- Driver.js library failed to load\n- JavaScript errors during initialization');
|
||||
}
|
||||
};
|
||||
|
||||
// If button already exists in the HTML, just attach the handler
|
||||
const existing = document.getElementById('restart-tour-btn');
|
||||
if (existing) {
|
||||
existing.onclick = clickHandler;
|
||||
return;
|
||||
}
|
||||
|
||||
const button = document.createElement('button');
|
||||
button.id = 'restart-tour-btn';
|
||||
button.textContent = 'Help Tour';
|
||||
button.title = 'Restart the onboarding tour';
|
||||
button.onclick = clickHandler;
|
||||
toolsRow.appendChild(button);
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if Driver.js is loaded
|
||||
*/
|
||||
function checkDriverLoaded() {
|
||||
// Driver.js v1.x IIFE: window.driver.js.driver is the factory function
|
||||
const driverFactory = window.driver?.js?.driver || window.driver?.driver || window.driver;
|
||||
if (typeof driverFactory !== 'function') {
|
||||
console.warn('[Onboarding] Driver.js not loaded yet, will retry... window.driver:', window.driver);
|
||||
return false;
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Wait for Driver.js to load, then initialize
|
||||
*/
|
||||
function waitForDriver() {
|
||||
let retries = 0;
|
||||
const maxRetries = 10;
|
||||
|
||||
function attemptInit() {
|
||||
if (checkDriverLoaded()) {
|
||||
initializeOnboarding();
|
||||
} else {
|
||||
retries++;
|
||||
if (retries < maxRetries) {
|
||||
// Retry after a short delay
|
||||
setTimeout(attemptInit, 500);
|
||||
} else {
|
||||
// Max retries reached, show fallback
|
||||
console.error('[Onboarding] Driver.js failed to load after multiple attempts');
|
||||
if (errorHandler) {
|
||||
errorHandler.handleDriverLoadFailure();
|
||||
} else {
|
||||
// Create temporary error handler for fallback
|
||||
const tempHandler = new ErrorHandler();
|
||||
tempHandler.handleDriverLoadFailure();
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
attemptInit();
|
||||
}
|
||||
|
||||
// Start initialization when DOM is ready
|
||||
if (document.readyState === 'loading') {
|
||||
document.addEventListener('DOMContentLoaded', waitForDriver);
|
||||
} else {
|
||||
waitForDriver();
|
||||
}
|
||||
|
||||
console.log('[Onboarding] System loaded');
|
||||
|
||||
})();
|
||||
/**
|
||||
* DashCaddy User Onboarding System
|
||||
* Main entry point for the tooltip-based onboarding experience
|
||||
*
|
||||
* This file initializes the onboarding system and coordinates between
|
||||
* the various components (TourManager, ProgressTracker, ThemeAdapter, etc.)
|
||||
*/
|
||||
|
||||
(function() {
|
||||
'use strict';
|
||||
|
||||
let progressTracker;
|
||||
let themeAdapter;
|
||||
let tourManager;
|
||||
let dnsTemplateSelector;
|
||||
let errorHandler;
|
||||
|
||||
/**
|
||||
* Initialize the onboarding system
|
||||
*/
|
||||
async function initializeOnboarding() {
|
||||
try {
|
||||
console.log('[Onboarding] Initializing system...');
|
||||
|
||||
// Initialize Error Handler first
|
||||
errorHandler = new ErrorHandler();
|
||||
console.log('[Onboarding] Error Handler initialized');
|
||||
|
||||
// Initialize Progress Tracker
|
||||
progressTracker = new ProgressTracker('dashcaddy_onboarding');
|
||||
console.log('[Onboarding] Progress Tracker initialized');
|
||||
|
||||
// Initialize Theme Adapter
|
||||
themeAdapter = new ThemeAdapter();
|
||||
console.log('[Onboarding] Theme Adapter initialized');
|
||||
|
||||
// Initialize DNS Template Selector
|
||||
dnsTemplateSelector = new DnsTemplateSelector(progressTracker);
|
||||
console.log('[Onboarding] DNS Template Selector initialized');
|
||||
|
||||
// Initialize Tour Manager
|
||||
tourManager = new TourManager(progressTracker, themeAdapter, dnsTemplateSelector);
|
||||
console.log('[Onboarding] Tour Manager initialized');
|
||||
|
||||
// Check if tour should auto-start
|
||||
if (tourManager.shouldAutoStart()) {
|
||||
console.log('[Onboarding] Auto-starting tour for first-time user');
|
||||
// Wait a bit for page to fully load
|
||||
setTimeout(() => {
|
||||
tourManager.startTour();
|
||||
}, 1000);
|
||||
} else {
|
||||
const tourCompleted = progressTracker.isTourCompleted();
|
||||
const currentStep = progressTracker.getCurrentStep();
|
||||
console.log(`[Onboarding] Tour not auto-starting (completed: ${tourCompleted}, step: ${currentStep})`);
|
||||
|
||||
// If tour is in progress, offer to resume
|
||||
if (!tourCompleted && currentStep > 0) {
|
||||
console.log('[Onboarding] Tour in progress, can be resumed manually');
|
||||
}
|
||||
}
|
||||
|
||||
// Add restart tour button to tools row
|
||||
addRestartTourButton();
|
||||
|
||||
// Expose to global scope for manual triggering
|
||||
window.DashCaddyOnboarding = {
|
||||
startTour: () => tourManager.startTour(),
|
||||
restartTour: () => tourManager.restartTour(),
|
||||
showTooltip: (id) => tourManager.showTooltip(id),
|
||||
showWhatsNew: () => tourManager.showWhatsNew(),
|
||||
resetProgress: () => progressTracker.resetProgress(),
|
||||
getErrors: () => errorHandler.getErrors(),
|
||||
getErrorStats: () => errorHandler.getStatistics()
|
||||
};
|
||||
|
||||
console.log('[Onboarding] System initialized successfully');
|
||||
} catch (error) {
|
||||
console.error('[Onboarding] Initialization error:', error);
|
||||
|
||||
// Use error handler if available
|
||||
if (errorHandler) {
|
||||
errorHandler.logError('Initialization', error);
|
||||
}
|
||||
|
||||
// Graceful degradation - don't break the dashboard
|
||||
console.warn('[Onboarding] System failed to initialize, dashboard will continue without onboarding');
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Add restart tour button to tools row
|
||||
*/
|
||||
function addRestartTourButton() {
|
||||
const toolsRow = document.querySelector('.tools');
|
||||
if (!toolsRow) return;
|
||||
|
||||
const clickHandler = () => {
|
||||
if (tourManager) {
|
||||
console.log('[Onboarding] Starting tour via button click');
|
||||
tourManager.restartTour();
|
||||
} else {
|
||||
console.error('[Onboarding] Tour manager not initialized');
|
||||
alert('Tour is not available. Check browser console for errors.\n\nPossible issues:\n- Driver.js library failed to load\n- JavaScript errors during initialization');
|
||||
}
|
||||
};
|
||||
|
||||
// If button already exists in the HTML, just attach the handler
|
||||
const existing = document.getElementById('restart-tour-btn');
|
||||
if (existing) {
|
||||
existing.onclick = clickHandler;
|
||||
return;
|
||||
}
|
||||
|
||||
const button = document.createElement('button');
|
||||
button.id = 'restart-tour-btn';
|
||||
button.textContent = 'Help Tour';
|
||||
button.title = 'Restart the onboarding tour';
|
||||
button.onclick = clickHandler;
|
||||
toolsRow.appendChild(button);
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if Driver.js is loaded
|
||||
*/
|
||||
function checkDriverLoaded() {
|
||||
// Driver.js v1.x IIFE: window.driver.js.driver is the factory function
|
||||
const driverFactory = window.driver?.js?.driver || window.driver?.driver || window.driver;
|
||||
if (typeof driverFactory !== 'function') {
|
||||
console.warn('[Onboarding] Driver.js not loaded yet, will retry... window.driver:', window.driver);
|
||||
return false;
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Wait for Driver.js to load, then initialize
|
||||
*/
|
||||
function waitForDriver() {
|
||||
let retries = 0;
|
||||
const maxRetries = 10;
|
||||
|
||||
function attemptInit() {
|
||||
if (checkDriverLoaded()) {
|
||||
initializeOnboarding();
|
||||
} else {
|
||||
retries++;
|
||||
if (retries < maxRetries) {
|
||||
// Retry after a short delay
|
||||
setTimeout(attemptInit, 500);
|
||||
} else {
|
||||
// Max retries reached, show fallback
|
||||
console.error('[Onboarding] Driver.js failed to load after multiple attempts');
|
||||
if (errorHandler) {
|
||||
errorHandler.handleDriverLoadFailure();
|
||||
} else {
|
||||
// Create temporary error handler for fallback
|
||||
const tempHandler = new ErrorHandler();
|
||||
tempHandler.handleDriverLoadFailure();
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
attemptInit();
|
||||
}
|
||||
|
||||
// Start initialization when DOM is ready
|
||||
if (document.readyState === 'loading') {
|
||||
document.addEventListener('DOMContentLoaded', waitForDriver);
|
||||
} else {
|
||||
waitForDriver();
|
||||
}
|
||||
|
||||
console.log('[Onboarding] System loaded');
|
||||
|
||||
})();
|
||||
@@ -1,282 +1,282 @@
|
||||
/**
|
||||
* Progress Tracker
|
||||
* Manages persistent storage of user progress through the onboarding flow
|
||||
* using browser local storage.
|
||||
*
|
||||
* Storage Schema:
|
||||
* {
|
||||
* "version": "1.0",
|
||||
* "tourCompleted": false,
|
||||
* "completedTooltips": ["welcome", "dns-priority", ...],
|
||||
* "currentStep": 3,
|
||||
* "completionTimestamp": "2024-01-15T10:30:00Z",
|
||||
* "dnsSetupDeferred": false,
|
||||
* "lastVisit": "2024-01-15T10:30:00Z"
|
||||
* }
|
||||
*/
|
||||
|
||||
(function(window) {
|
||||
'use strict';
|
||||
|
||||
/**
|
||||
* ProgressTracker class
|
||||
* Manages persistent storage of onboarding progress
|
||||
*
|
||||
* @class
|
||||
* @param {string} storageKey - The key to use for local storage (default: 'dashcaddy_onboarding')
|
||||
*/
|
||||
class ProgressTracker {
|
||||
constructor(storageKey = 'dashcaddy_onboarding') {
|
||||
this.storageKey = storageKey;
|
||||
this.storageVersion = '1.0';
|
||||
|
||||
// Initialize storage if it doesn't exist
|
||||
this._initializeStorage();
|
||||
|
||||
// Update last visit timestamp
|
||||
this._updateLastVisit();
|
||||
}
|
||||
|
||||
/**
|
||||
* Initialize storage with default values if it doesn't exist
|
||||
* @private
|
||||
*/
|
||||
_initializeStorage() {
|
||||
const existing = this._getStorage();
|
||||
if (!existing || existing.version !== this.storageVersion) {
|
||||
const defaultState = {
|
||||
version: this.storageVersion,
|
||||
tourCompleted: false,
|
||||
completedTooltips: [],
|
||||
currentStep: 0,
|
||||
completionTimestamp: null,
|
||||
dnsSetupDeferred: false,
|
||||
lastVisit: new Date().toISOString()
|
||||
};
|
||||
this._setStorage(defaultState);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the current storage state
|
||||
* @private
|
||||
* @returns {Object|null} The storage state or null if unavailable
|
||||
*/
|
||||
_getStorage() {
|
||||
try {
|
||||
const data = localStorage.getItem(this.storageKey);
|
||||
return data ? JSON.parse(data) : null;
|
||||
} catch (error) {
|
||||
console.error('[ProgressTracker] Error reading from storage:', error);
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Set the storage state
|
||||
* @private
|
||||
* @param {Object} state - The state to save
|
||||
*/
|
||||
_setStorage(state) {
|
||||
try {
|
||||
localStorage.setItem(this.storageKey, JSON.stringify(state));
|
||||
} catch (error) {
|
||||
console.error('[ProgressTracker] Error writing to storage:', error);
|
||||
// Handle quota exceeded or storage unavailable
|
||||
// Fall back to session storage or in-memory storage
|
||||
this._handleStorageError(error);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Handle storage errors (quota exceeded, unavailable, etc.)
|
||||
* @private
|
||||
* @param {Error} error - The error that occurred
|
||||
*/
|
||||
_handleStorageError(error) {
|
||||
// Try session storage as fallback
|
||||
try {
|
||||
sessionStorage.setItem(this.storageKey, JSON.stringify(this._getStorage()));
|
||||
console.warn('[ProgressTracker] Falling back to session storage');
|
||||
} catch (sessionError) {
|
||||
console.error('[ProgressTracker] Session storage also unavailable:', sessionError);
|
||||
// Could implement in-memory fallback here if needed
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Update the last visit timestamp
|
||||
* @private
|
||||
*/
|
||||
_updateLastVisit() {
|
||||
const state = this._getStorage();
|
||||
if (state) {
|
||||
state.lastVisit = new Date().toISOString();
|
||||
this._setStorage(state);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if a specific tooltip has been completed
|
||||
* @param {string} tooltipId - The ID of the tooltip to check
|
||||
* @returns {boolean} True if the tooltip has been completed
|
||||
*/
|
||||
isTooltipCompleted(tooltipId) {
|
||||
const state = this._getStorage();
|
||||
if (!state) return false;
|
||||
return state.completedTooltips.includes(tooltipId);
|
||||
}
|
||||
|
||||
/**
|
||||
* Mark a tooltip as completed with timestamp
|
||||
* @param {string} tooltipId - The ID of the tooltip to mark as completed
|
||||
*/
|
||||
markTooltipCompleted(tooltipId) {
|
||||
const state = this._getStorage();
|
||||
if (!state) return;
|
||||
|
||||
// Add tooltip to completed list if not already there
|
||||
if (!state.completedTooltips.includes(tooltipId)) {
|
||||
state.completedTooltips.push(tooltipId);
|
||||
|
||||
// Store timestamp for this specific tooltip
|
||||
if (!state.tooltipTimestamps) {
|
||||
state.tooltipTimestamps = {};
|
||||
}
|
||||
state.tooltipTimestamps[tooltipId] = new Date().toISOString();
|
||||
|
||||
this._setStorage(state);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if the entire tour has been completed
|
||||
* @returns {boolean} True if the tour is completed
|
||||
*/
|
||||
isTourCompleted() {
|
||||
const state = this._getStorage();
|
||||
if (!state) return false;
|
||||
return state.tourCompleted === true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Mark the entire tour as completed
|
||||
*/
|
||||
markTourCompleted() {
|
||||
const state = this._getStorage();
|
||||
if (!state) return;
|
||||
|
||||
state.tourCompleted = true;
|
||||
state.completionTimestamp = new Date().toISOString();
|
||||
this._setStorage(state);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the current step index
|
||||
* @returns {number} The current step index (0-based)
|
||||
*/
|
||||
getCurrentStep() {
|
||||
const state = this._getStorage();
|
||||
if (!state) return 0;
|
||||
return state.currentStep || 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* Set the current step index
|
||||
* @param {number} stepIndex - The step index to set (0-based)
|
||||
*/
|
||||
setCurrentStep(stepIndex) {
|
||||
const state = this._getStorage();
|
||||
if (!state) return;
|
||||
|
||||
state.currentStep = stepIndex;
|
||||
this._setStorage(state);
|
||||
}
|
||||
|
||||
/**
|
||||
* Reset all progress and clear storage
|
||||
*/
|
||||
resetProgress() {
|
||||
const defaultState = {
|
||||
version: this.storageVersion,
|
||||
tourCompleted: false,
|
||||
completedTooltips: [],
|
||||
currentStep: 0,
|
||||
completionTimestamp: null,
|
||||
dnsSetupDeferred: false,
|
||||
lastVisit: new Date().toISOString()
|
||||
};
|
||||
this._setStorage(defaultState);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the completion timestamp
|
||||
* @returns {Date|null} The completion timestamp or null if not completed
|
||||
*/
|
||||
getCompletionTimestamp() {
|
||||
const state = this._getStorage();
|
||||
if (!state || !state.completionTimestamp) return null;
|
||||
return new Date(state.completionTimestamp);
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if DNS setup was deferred
|
||||
* @returns {boolean} True if DNS setup was deferred
|
||||
*/
|
||||
isDnsSetupDeferred() {
|
||||
const state = this._getStorage();
|
||||
if (!state) return false;
|
||||
return state.dnsSetupDeferred === true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Mark DNS setup as deferred
|
||||
*/
|
||||
markDnsSetupDeferred() {
|
||||
const state = this._getStorage();
|
||||
if (!state) return;
|
||||
|
||||
state.dnsSetupDeferred = true;
|
||||
this._setStorage(state);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the timestamp for a specific tooltip completion
|
||||
* @param {string} tooltipId - The ID of the tooltip
|
||||
* @returns {Date|null} The timestamp or null if not completed
|
||||
*/
|
||||
getTooltipTimestamp(tooltipId) {
|
||||
const state = this._getStorage();
|
||||
if (!state || !state.tooltipTimestamps || !state.tooltipTimestamps[tooltipId]) {
|
||||
return null;
|
||||
}
|
||||
return new Date(state.tooltipTimestamps[tooltipId]);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get all completed tooltip IDs
|
||||
* @returns {string[]} Array of completed tooltip IDs
|
||||
*/
|
||||
getCompletedTooltips() {
|
||||
const state = this._getStorage();
|
||||
if (!state) return [];
|
||||
return state.completedTooltips || [];
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the last visit timestamp
|
||||
* @returns {Date|null} The last visit timestamp
|
||||
*/
|
||||
getLastVisit() {
|
||||
const state = this._getStorage();
|
||||
if (!state || !state.lastVisit) return null;
|
||||
return new Date(state.lastVisit);
|
||||
}
|
||||
}
|
||||
|
||||
// Export to global scope
|
||||
window.ProgressTracker = ProgressTracker;
|
||||
|
||||
console.log('[ProgressTracker] Module loaded');
|
||||
|
||||
})(window);
|
||||
/**
|
||||
* Progress Tracker
|
||||
* Manages persistent storage of user progress through the onboarding flow
|
||||
* using browser local storage.
|
||||
*
|
||||
* Storage Schema:
|
||||
* {
|
||||
* "version": "1.0",
|
||||
* "tourCompleted": false,
|
||||
* "completedTooltips": ["welcome", "dns-priority", ...],
|
||||
* "currentStep": 3,
|
||||
* "completionTimestamp": "2024-01-15T10:30:00Z",
|
||||
* "dnsSetupDeferred": false,
|
||||
* "lastVisit": "2024-01-15T10:30:00Z"
|
||||
* }
|
||||
*/
|
||||
|
||||
(function(window) {
|
||||
'use strict';
|
||||
|
||||
/**
|
||||
* ProgressTracker class
|
||||
* Manages persistent storage of onboarding progress
|
||||
*
|
||||
* @class
|
||||
* @param {string} storageKey - The key to use for local storage (default: 'dashcaddy_onboarding')
|
||||
*/
|
||||
class ProgressTracker {
|
||||
constructor(storageKey = 'dashcaddy_onboarding') {
|
||||
this.storageKey = storageKey;
|
||||
this.storageVersion = '1.0';
|
||||
|
||||
// Initialize storage if it doesn't exist
|
||||
this._initializeStorage();
|
||||
|
||||
// Update last visit timestamp
|
||||
this._updateLastVisit();
|
||||
}
|
||||
|
||||
/**
|
||||
* Initialize storage with default values if it doesn't exist
|
||||
* @private
|
||||
*/
|
||||
_initializeStorage() {
|
||||
const existing = this._getStorage();
|
||||
if (!existing || existing.version !== this.storageVersion) {
|
||||
const defaultState = {
|
||||
version: this.storageVersion,
|
||||
tourCompleted: false,
|
||||
completedTooltips: [],
|
||||
currentStep: 0,
|
||||
completionTimestamp: null,
|
||||
dnsSetupDeferred: false,
|
||||
lastVisit: new Date().toISOString()
|
||||
};
|
||||
this._setStorage(defaultState);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the current storage state
|
||||
* @private
|
||||
* @returns {Object|null} The storage state or null if unavailable
|
||||
*/
|
||||
_getStorage() {
|
||||
try {
|
||||
const data = localStorage.getItem(this.storageKey);
|
||||
return data ? JSON.parse(data) : null;
|
||||
} catch (error) {
|
||||
console.error('[ProgressTracker] Error reading from storage:', error);
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Set the storage state
|
||||
* @private
|
||||
* @param {Object} state - The state to save
|
||||
*/
|
||||
_setStorage(state) {
|
||||
try {
|
||||
localStorage.setItem(this.storageKey, JSON.stringify(state));
|
||||
} catch (error) {
|
||||
console.error('[ProgressTracker] Error writing to storage:', error);
|
||||
// Handle quota exceeded or storage unavailable
|
||||
// Fall back to session storage or in-memory storage
|
||||
this._handleStorageError(error);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Handle storage errors (quota exceeded, unavailable, etc.)
|
||||
* @private
|
||||
* @param {Error} error - The error that occurred
|
||||
*/
|
||||
_handleStorageError(error) {
|
||||
// Try session storage as fallback
|
||||
try {
|
||||
sessionStorage.setItem(this.storageKey, JSON.stringify(this._getStorage()));
|
||||
console.warn('[ProgressTracker] Falling back to session storage');
|
||||
} catch (sessionError) {
|
||||
console.error('[ProgressTracker] Session storage also unavailable:', sessionError);
|
||||
// Could implement in-memory fallback here if needed
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Update the last visit timestamp
|
||||
* @private
|
||||
*/
|
||||
_updateLastVisit() {
|
||||
const state = this._getStorage();
|
||||
if (state) {
|
||||
state.lastVisit = new Date().toISOString();
|
||||
this._setStorage(state);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if a specific tooltip has been completed
|
||||
* @param {string} tooltipId - The ID of the tooltip to check
|
||||
* @returns {boolean} True if the tooltip has been completed
|
||||
*/
|
||||
isTooltipCompleted(tooltipId) {
|
||||
const state = this._getStorage();
|
||||
if (!state) return false;
|
||||
return state.completedTooltips.includes(tooltipId);
|
||||
}
|
||||
|
||||
/**
|
||||
* Mark a tooltip as completed with timestamp
|
||||
* @param {string} tooltipId - The ID of the tooltip to mark as completed
|
||||
*/
|
||||
markTooltipCompleted(tooltipId) {
|
||||
const state = this._getStorage();
|
||||
if (!state) return;
|
||||
|
||||
// Add tooltip to completed list if not already there
|
||||
if (!state.completedTooltips.includes(tooltipId)) {
|
||||
state.completedTooltips.push(tooltipId);
|
||||
|
||||
// Store timestamp for this specific tooltip
|
||||
if (!state.tooltipTimestamps) {
|
||||
state.tooltipTimestamps = {};
|
||||
}
|
||||
state.tooltipTimestamps[tooltipId] = new Date().toISOString();
|
||||
|
||||
this._setStorage(state);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if the entire tour has been completed
|
||||
* @returns {boolean} True if the tour is completed
|
||||
*/
|
||||
isTourCompleted() {
|
||||
const state = this._getStorage();
|
||||
if (!state) return false;
|
||||
return state.tourCompleted === true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Mark the entire tour as completed
|
||||
*/
|
||||
markTourCompleted() {
|
||||
const state = this._getStorage();
|
||||
if (!state) return;
|
||||
|
||||
state.tourCompleted = true;
|
||||
state.completionTimestamp = new Date().toISOString();
|
||||
this._setStorage(state);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the current step index
|
||||
* @returns {number} The current step index (0-based)
|
||||
*/
|
||||
getCurrentStep() {
|
||||
const state = this._getStorage();
|
||||
if (!state) return 0;
|
||||
return state.currentStep || 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* Set the current step index
|
||||
* @param {number} stepIndex - The step index to set (0-based)
|
||||
*/
|
||||
setCurrentStep(stepIndex) {
|
||||
const state = this._getStorage();
|
||||
if (!state) return;
|
||||
|
||||
state.currentStep = stepIndex;
|
||||
this._setStorage(state);
|
||||
}
|
||||
|
||||
/**
|
||||
* Reset all progress and clear storage
|
||||
*/
|
||||
resetProgress() {
|
||||
const defaultState = {
|
||||
version: this.storageVersion,
|
||||
tourCompleted: false,
|
||||
completedTooltips: [],
|
||||
currentStep: 0,
|
||||
completionTimestamp: null,
|
||||
dnsSetupDeferred: false,
|
||||
lastVisit: new Date().toISOString()
|
||||
};
|
||||
this._setStorage(defaultState);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the completion timestamp
|
||||
* @returns {Date|null} The completion timestamp or null if not completed
|
||||
*/
|
||||
getCompletionTimestamp() {
|
||||
const state = this._getStorage();
|
||||
if (!state || !state.completionTimestamp) return null;
|
||||
return new Date(state.completionTimestamp);
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if DNS setup was deferred
|
||||
* @returns {boolean} True if DNS setup was deferred
|
||||
*/
|
||||
isDnsSetupDeferred() {
|
||||
const state = this._getStorage();
|
||||
if (!state) return false;
|
||||
return state.dnsSetupDeferred === true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Mark DNS setup as deferred
|
||||
*/
|
||||
markDnsSetupDeferred() {
|
||||
const state = this._getStorage();
|
||||
if (!state) return;
|
||||
|
||||
state.dnsSetupDeferred = true;
|
||||
this._setStorage(state);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the timestamp for a specific tooltip completion
|
||||
* @param {string} tooltipId - The ID of the tooltip
|
||||
* @returns {Date|null} The timestamp or null if not completed
|
||||
*/
|
||||
getTooltipTimestamp(tooltipId) {
|
||||
const state = this._getStorage();
|
||||
if (!state || !state.tooltipTimestamps || !state.tooltipTimestamps[tooltipId]) {
|
||||
return null;
|
||||
}
|
||||
return new Date(state.tooltipTimestamps[tooltipId]);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get all completed tooltip IDs
|
||||
* @returns {string[]} Array of completed tooltip IDs
|
||||
*/
|
||||
getCompletedTooltips() {
|
||||
const state = this._getStorage();
|
||||
if (!state) return [];
|
||||
return state.completedTooltips || [];
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the last visit timestamp
|
||||
* @returns {Date|null} The last visit timestamp
|
||||
*/
|
||||
getLastVisit() {
|
||||
const state = this._getStorage();
|
||||
if (!state || !state.lastVisit) return null;
|
||||
return new Date(state.lastVisit);
|
||||
}
|
||||
}
|
||||
|
||||
// Export to global scope
|
||||
window.ProgressTracker = ProgressTracker;
|
||||
|
||||
console.log('[ProgressTracker] Module loaded');
|
||||
|
||||
})(window);
|
||||
@@ -1,337 +1,337 @@
|
||||
/**
|
||||
* Tooltip Definitions
|
||||
* Defines all tooltip content, positioning, and behavior for the onboarding system
|
||||
*/
|
||||
|
||||
(function(window) {
|
||||
'use strict';
|
||||
|
||||
/**
|
||||
* Validate a tooltip definition
|
||||
* @param {Object} tooltip - The tooltip definition to validate
|
||||
* @returns {Object} { valid: boolean, errors: string[] }
|
||||
*/
|
||||
function validateTooltipDefinition(tooltip) {
|
||||
const errors = [];
|
||||
|
||||
// Required fields
|
||||
if (!tooltip.id || typeof tooltip.id !== 'string') {
|
||||
errors.push('Tooltip must have a valid string id');
|
||||
}
|
||||
|
||||
if (!tooltip.element) {
|
||||
errors.push('Tooltip must have an element selector or HTMLElement');
|
||||
}
|
||||
|
||||
if (!tooltip.popover || typeof tooltip.popover !== 'object') {
|
||||
errors.push('Tooltip must have a popover object');
|
||||
} else {
|
||||
// Validate popover fields
|
||||
if (!tooltip.popover.title || typeof tooltip.popover.title !== 'string') {
|
||||
errors.push('Tooltip popover must have a valid string title');
|
||||
}
|
||||
|
||||
if (!tooltip.popover.description || typeof tooltip.popover.description !== 'string') {
|
||||
errors.push('Tooltip popover must have a valid string description');
|
||||
}
|
||||
|
||||
// Validate position if provided
|
||||
if (tooltip.popover.position) {
|
||||
const validPositions = ['top', 'bottom', 'left', 'right', 'center'];
|
||||
if (!validPositions.includes(tooltip.popover.position)) {
|
||||
errors.push(`Invalid position: ${tooltip.popover.position}. Must be one of: ${validPositions.join(', ')}`);
|
||||
}
|
||||
}
|
||||
|
||||
// Validate align if provided
|
||||
if (tooltip.popover.align) {
|
||||
const validAligns = ['start', 'center', 'end'];
|
||||
if (!validAligns.includes(tooltip.popover.align)) {
|
||||
errors.push(`Invalid align: ${tooltip.popover.align}. Must be one of: ${validAligns.join(', ')}`);
|
||||
}
|
||||
}
|
||||
|
||||
// Validate showButtons if provided
|
||||
if (tooltip.popover.showButtons && !Array.isArray(tooltip.popover.showButtons)) {
|
||||
errors.push('showButtons must be an array');
|
||||
}
|
||||
|
||||
// Validate callbacks if provided
|
||||
const callbacks = ['onNext', 'onPrevious', 'onClose', 'onSetupNow', 'onLater'];
|
||||
callbacks.forEach(callback => {
|
||||
if (tooltip.popover[callback] && typeof tooltip.popover[callback] !== 'function') {
|
||||
errors.push(`${callback} must be a function`);
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
// Validate condition if provided
|
||||
if (tooltip.condition && typeof tooltip.condition !== 'function') {
|
||||
errors.push('condition must be a function');
|
||||
}
|
||||
|
||||
// Validate priority if provided
|
||||
if (tooltip.priority !== undefined && typeof tooltip.priority !== 'number') {
|
||||
errors.push('priority must be a number');
|
||||
}
|
||||
|
||||
return {
|
||||
valid: errors.length === 0,
|
||||
errors
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Validate an array of tooltip definitions
|
||||
* @param {Array} tooltips - Array of tooltip definitions
|
||||
* @returns {Object} { valid: boolean, errors: Object[] }
|
||||
*/
|
||||
function validateTooltipDefinitions(tooltips) {
|
||||
if (!Array.isArray(tooltips)) {
|
||||
return {
|
||||
valid: false,
|
||||
errors: [{ tooltip: null, errors: ['tooltips must be an array'] }]
|
||||
};
|
||||
}
|
||||
|
||||
const allErrors = [];
|
||||
const ids = new Set();
|
||||
|
||||
tooltips.forEach((tooltip, index) => {
|
||||
const validation = validateTooltipDefinition(tooltip);
|
||||
|
||||
if (!validation.valid) {
|
||||
allErrors.push({
|
||||
tooltip: tooltip.id || `index ${index}`,
|
||||
errors: validation.errors
|
||||
});
|
||||
}
|
||||
|
||||
// Check for duplicate IDs
|
||||
if (tooltip.id) {
|
||||
if (ids.has(tooltip.id)) {
|
||||
allErrors.push({
|
||||
tooltip: tooltip.id,
|
||||
errors: [`Duplicate tooltip ID: ${tooltip.id}`]
|
||||
});
|
||||
}
|
||||
ids.add(tooltip.id);
|
||||
}
|
||||
});
|
||||
|
||||
return {
|
||||
valid: allErrors.length === 0,
|
||||
errors: allErrors
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Error handler for tooltip system
|
||||
*/
|
||||
class TooltipError extends Error {
|
||||
constructor(message, tooltipId = null) {
|
||||
super(message);
|
||||
this.name = 'TooltipError';
|
||||
this.tooltipId = tooltipId;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Handle tooltip definition errors
|
||||
* @param {Object} validation - Validation result
|
||||
* @throws {TooltipError} If validation fails
|
||||
*/
|
||||
function handleValidationErrors(validation) {
|
||||
if (!validation.valid) {
|
||||
const errorMessages = validation.errors.map(e =>
|
||||
`${e.tooltip}: ${e.errors.join(', ')}`
|
||||
).join('\n');
|
||||
|
||||
console.error('[TooltipDefinitions] Validation errors:', errorMessages);
|
||||
throw new TooltipError(`Tooltip validation failed:\n${errorMessages}`);
|
||||
}
|
||||
}
|
||||
|
||||
// Export to global scope
|
||||
window.TooltipValidation = {
|
||||
validateTooltipDefinition,
|
||||
validateTooltipDefinitions,
|
||||
handleValidationErrors,
|
||||
TooltipError
|
||||
};
|
||||
|
||||
console.log('[TooltipDefinitions] Validation module loaded');
|
||||
|
||||
})(window);
|
||||
|
||||
|
||||
/**
|
||||
* Tooltip Definitions Array
|
||||
* Defines all tooltips for the onboarding tour
|
||||
*/
|
||||
const TOOLTIP_DEFINITIONS = [
|
||||
// 1. Welcome tooltip pointing to logo
|
||||
{
|
||||
id: 'welcome',
|
||||
element: '#brand',
|
||||
popover: {
|
||||
title: 'Welcome to DashCaddy!',
|
||||
description: `
|
||||
<p>Your personal dashboard for managing services with Caddy reverse proxy.</p>
|
||||
<p>Let's take a quick tour to help you get started.</p>
|
||||
<p style="margin-top: 8px; font-size: 0.85rem; opacity: 0.8;">Tip: You can customize this logo in Settings.</p>
|
||||
`,
|
||||
position: 'bottom',
|
||||
align: 'start',
|
||||
showButtons: ['next'],
|
||||
showProgress: true
|
||||
},
|
||||
priority: 1,
|
||||
isNewFeature: false
|
||||
},
|
||||
|
||||
// 2. Add Service button
|
||||
{
|
||||
id: 'add-service',
|
||||
element: '#add-service-btn',
|
||||
popover: {
|
||||
title: 'Adding New Services',
|
||||
description: `
|
||||
<p>Click <strong>+ Add Service</strong> to deploy new apps or add existing services to your dashboard.</p>
|
||||
<p>Choose from 50+ templates including:</p>
|
||||
<ul>
|
||||
<li>Media servers (Plex, Jellyfin, Emby)</li>
|
||||
<li>Download managers (qBittorrent, Transmission)</li>
|
||||
<li>DNS servers (Technitium, Pi-hole)</li>
|
||||
</ul>
|
||||
`,
|
||||
position: 'bottom',
|
||||
showButtons: ['previous', 'next'],
|
||||
showProgress: true
|
||||
},
|
||||
priority: 2,
|
||||
isNewFeature: false,
|
||||
condition: () => {
|
||||
return document.getElementById('add-service-btn') !== null;
|
||||
}
|
||||
},
|
||||
|
||||
// 3. App Grid explanation
|
||||
{
|
||||
id: 'app-grid',
|
||||
element: '#cards',
|
||||
popover: {
|
||||
title: 'Your Services',
|
||||
description: `
|
||||
<p>This is your service grid where all your deployed applications appear.</p>
|
||||
<p>Each card shows:</p>
|
||||
<ul>
|
||||
<li>Service status (online/offline)</li>
|
||||
<li>Response time</li>
|
||||
<li>Quick actions (restart, open, logs, settings)</li>
|
||||
</ul>
|
||||
`,
|
||||
position: 'top',
|
||||
showButtons: ['previous', 'next'],
|
||||
showProgress: true
|
||||
},
|
||||
priority: 3,
|
||||
isNewFeature: false
|
||||
},
|
||||
|
||||
// 4. Theme selector
|
||||
{
|
||||
id: 'theme-selector',
|
||||
element: '#theme',
|
||||
popover: {
|
||||
title: 'Customize Your Theme',
|
||||
description: `
|
||||
<p>DashCaddy comes with 7 themes. Click here to switch between them.</p>
|
||||
<p>Your preference is saved automatically.</p>
|
||||
`,
|
||||
position: 'bottom',
|
||||
showButtons: ['previous', 'close'],
|
||||
showProgress: true
|
||||
},
|
||||
priority: 4,
|
||||
isNewFeature: false,
|
||||
condition: () => {
|
||||
return document.getElementById('theme') !== null;
|
||||
}
|
||||
}
|
||||
];
|
||||
|
||||
/**
|
||||
* Get tooltip definitions
|
||||
* @returns {Array} Array of tooltip definitions
|
||||
*/
|
||||
function getTooltipDefinitions() {
|
||||
return TOOLTIP_DEFINITIONS;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get a specific tooltip by ID
|
||||
* @param {string} id - Tooltip ID
|
||||
* @returns {Object|null} Tooltip definition or null if not found
|
||||
*/
|
||||
function getTooltipById(id) {
|
||||
return TOOLTIP_DEFINITIONS.find(t => t.id === id) || null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get tooltips filtered by condition
|
||||
* @returns {Array} Array of tooltips that pass their condition check
|
||||
*/
|
||||
function getActiveTooltips() {
|
||||
return TOOLTIP_DEFINITIONS.filter(tooltip => {
|
||||
if (tooltip.condition && typeof tooltip.condition === 'function') {
|
||||
try {
|
||||
return tooltip.condition();
|
||||
} catch (error) {
|
||||
console.error(`[TooltipDefinitions] Error evaluating condition for ${tooltip.id}:`, error);
|
||||
return false;
|
||||
}
|
||||
}
|
||||
return true;
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Get tooltips sorted by priority
|
||||
* @returns {Array} Array of tooltips sorted by priority (ascending)
|
||||
*/
|
||||
function getSortedTooltips() {
|
||||
const tooltips = getActiveTooltips();
|
||||
return tooltips.sort((a, b) => {
|
||||
const priorityA = a.priority || 999;
|
||||
const priorityB = b.priority || 999;
|
||||
return priorityA - priorityB;
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Get tooltips marked as new features
|
||||
* @returns {Array} Array of tooltips marked with isNewFeature flag
|
||||
*/
|
||||
function getNewFeatureTooltips() {
|
||||
const tooltips = getActiveTooltips();
|
||||
return tooltips.filter(tooltip => tooltip.isNewFeature === true)
|
||||
.sort((a, b) => {
|
||||
const priorityA = a.priority || 999;
|
||||
const priorityB = b.priority || 999;
|
||||
return priorityA - priorityB;
|
||||
});
|
||||
}
|
||||
|
||||
// Export to global scope
|
||||
window.TooltipDefinitions = {
|
||||
TOOLTIP_DEFINITIONS,
|
||||
getTooltipDefinitions,
|
||||
getTooltipById,
|
||||
getActiveTooltips,
|
||||
getSortedTooltips,
|
||||
getNewFeatureTooltips
|
||||
};
|
||||
|
||||
console.log('[TooltipDefinitions] Definitions loaded:', TOOLTIP_DEFINITIONS.length, 'tooltips');
|
||||
|
||||
/**
|
||||
* Tooltip Definitions
|
||||
* Defines all tooltip content, positioning, and behavior for the onboarding system
|
||||
*/
|
||||
|
||||
(function(window) {
|
||||
'use strict';
|
||||
|
||||
/**
|
||||
* Validate a tooltip definition
|
||||
* @param {Object} tooltip - The tooltip definition to validate
|
||||
* @returns {Object} { valid: boolean, errors: string[] }
|
||||
*/
|
||||
function validateTooltipDefinition(tooltip) {
|
||||
const errors = [];
|
||||
|
||||
// Required fields
|
||||
if (!tooltip.id || typeof tooltip.id !== 'string') {
|
||||
errors.push('Tooltip must have a valid string id');
|
||||
}
|
||||
|
||||
if (!tooltip.element) {
|
||||
errors.push('Tooltip must have an element selector or HTMLElement');
|
||||
}
|
||||
|
||||
if (!tooltip.popover || typeof tooltip.popover !== 'object') {
|
||||
errors.push('Tooltip must have a popover object');
|
||||
} else {
|
||||
// Validate popover fields
|
||||
if (!tooltip.popover.title || typeof tooltip.popover.title !== 'string') {
|
||||
errors.push('Tooltip popover must have a valid string title');
|
||||
}
|
||||
|
||||
if (!tooltip.popover.description || typeof tooltip.popover.description !== 'string') {
|
||||
errors.push('Tooltip popover must have a valid string description');
|
||||
}
|
||||
|
||||
// Validate position if provided
|
||||
if (tooltip.popover.position) {
|
||||
const validPositions = ['top', 'bottom', 'left', 'right', 'center'];
|
||||
if (!validPositions.includes(tooltip.popover.position)) {
|
||||
errors.push(`Invalid position: ${tooltip.popover.position}. Must be one of: ${validPositions.join(', ')}`);
|
||||
}
|
||||
}
|
||||
|
||||
// Validate align if provided
|
||||
if (tooltip.popover.align) {
|
||||
const validAligns = ['start', 'center', 'end'];
|
||||
if (!validAligns.includes(tooltip.popover.align)) {
|
||||
errors.push(`Invalid align: ${tooltip.popover.align}. Must be one of: ${validAligns.join(', ')}`);
|
||||
}
|
||||
}
|
||||
|
||||
// Validate showButtons if provided
|
||||
if (tooltip.popover.showButtons && !Array.isArray(tooltip.popover.showButtons)) {
|
||||
errors.push('showButtons must be an array');
|
||||
}
|
||||
|
||||
// Validate callbacks if provided
|
||||
const callbacks = ['onNext', 'onPrevious', 'onClose', 'onSetupNow', 'onLater'];
|
||||
callbacks.forEach(callback => {
|
||||
if (tooltip.popover[callback] && typeof tooltip.popover[callback] !== 'function') {
|
||||
errors.push(`${callback} must be a function`);
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
// Validate condition if provided
|
||||
if (tooltip.condition && typeof tooltip.condition !== 'function') {
|
||||
errors.push('condition must be a function');
|
||||
}
|
||||
|
||||
// Validate priority if provided
|
||||
if (tooltip.priority !== undefined && typeof tooltip.priority !== 'number') {
|
||||
errors.push('priority must be a number');
|
||||
}
|
||||
|
||||
return {
|
||||
valid: errors.length === 0,
|
||||
errors
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Validate an array of tooltip definitions
|
||||
* @param {Array} tooltips - Array of tooltip definitions
|
||||
* @returns {Object} { valid: boolean, errors: Object[] }
|
||||
*/
|
||||
function validateTooltipDefinitions(tooltips) {
|
||||
if (!Array.isArray(tooltips)) {
|
||||
return {
|
||||
valid: false,
|
||||
errors: [{ tooltip: null, errors: ['tooltips must be an array'] }]
|
||||
};
|
||||
}
|
||||
|
||||
const allErrors = [];
|
||||
const ids = new Set();
|
||||
|
||||
tooltips.forEach((tooltip, index) => {
|
||||
const validation = validateTooltipDefinition(tooltip);
|
||||
|
||||
if (!validation.valid) {
|
||||
allErrors.push({
|
||||
tooltip: tooltip.id || `index ${index}`,
|
||||
errors: validation.errors
|
||||
});
|
||||
}
|
||||
|
||||
// Check for duplicate IDs
|
||||
if (tooltip.id) {
|
||||
if (ids.has(tooltip.id)) {
|
||||
allErrors.push({
|
||||
tooltip: tooltip.id,
|
||||
errors: [`Duplicate tooltip ID: ${tooltip.id}`]
|
||||
});
|
||||
}
|
||||
ids.add(tooltip.id);
|
||||
}
|
||||
});
|
||||
|
||||
return {
|
||||
valid: allErrors.length === 0,
|
||||
errors: allErrors
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Error handler for tooltip system
|
||||
*/
|
||||
class TooltipError extends Error {
|
||||
constructor(message, tooltipId = null) {
|
||||
super(message);
|
||||
this.name = 'TooltipError';
|
||||
this.tooltipId = tooltipId;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Handle tooltip definition errors
|
||||
* @param {Object} validation - Validation result
|
||||
* @throws {TooltipError} If validation fails
|
||||
*/
|
||||
function handleValidationErrors(validation) {
|
||||
if (!validation.valid) {
|
||||
const errorMessages = validation.errors.map(e =>
|
||||
`${e.tooltip}: ${e.errors.join(', ')}`
|
||||
).join('\n');
|
||||
|
||||
console.error('[TooltipDefinitions] Validation errors:', errorMessages);
|
||||
throw new TooltipError(`Tooltip validation failed:\n${errorMessages}`);
|
||||
}
|
||||
}
|
||||
|
||||
// Export to global scope
|
||||
window.TooltipValidation = {
|
||||
validateTooltipDefinition,
|
||||
validateTooltipDefinitions,
|
||||
handleValidationErrors,
|
||||
TooltipError
|
||||
};
|
||||
|
||||
console.log('[TooltipDefinitions] Validation module loaded');
|
||||
|
||||
})(window);
|
||||
|
||||
|
||||
/**
|
||||
* Tooltip Definitions Array
|
||||
* Defines all tooltips for the onboarding tour
|
||||
*/
|
||||
const TOOLTIP_DEFINITIONS = [
|
||||
// 1. Welcome tooltip pointing to logo
|
||||
{
|
||||
id: 'welcome',
|
||||
element: '#brand',
|
||||
popover: {
|
||||
title: 'Welcome to DashCaddy!',
|
||||
description: `
|
||||
<p>Your personal dashboard for managing services with Caddy reverse proxy.</p>
|
||||
<p>Let's take a quick tour to help you get started.</p>
|
||||
<p style="margin-top: 8px; font-size: 0.85rem; opacity: 0.8;">Tip: You can customize this logo in Settings.</p>
|
||||
`,
|
||||
position: 'bottom',
|
||||
align: 'start',
|
||||
showButtons: ['next'],
|
||||
showProgress: true
|
||||
},
|
||||
priority: 1,
|
||||
isNewFeature: false
|
||||
},
|
||||
|
||||
// 2. Add Service button
|
||||
{
|
||||
id: 'add-service',
|
||||
element: '#add-service-btn',
|
||||
popover: {
|
||||
title: 'Adding New Services',
|
||||
description: `
|
||||
<p>Click <strong>+ Add Service</strong> to deploy new apps or add existing services to your dashboard.</p>
|
||||
<p>Choose from 50+ templates including:</p>
|
||||
<ul>
|
||||
<li>Media servers (Plex, Jellyfin, Emby)</li>
|
||||
<li>Download managers (qBittorrent, Transmission)</li>
|
||||
<li>DNS servers (Technitium, Pi-hole)</li>
|
||||
</ul>
|
||||
`,
|
||||
position: 'bottom',
|
||||
showButtons: ['previous', 'next'],
|
||||
showProgress: true
|
||||
},
|
||||
priority: 2,
|
||||
isNewFeature: false,
|
||||
condition: () => {
|
||||
return document.getElementById('add-service-btn') !== null;
|
||||
}
|
||||
},
|
||||
|
||||
// 3. App Grid explanation
|
||||
{
|
||||
id: 'app-grid',
|
||||
element: '#cards',
|
||||
popover: {
|
||||
title: 'Your Services',
|
||||
description: `
|
||||
<p>This is your service grid where all your deployed applications appear.</p>
|
||||
<p>Each card shows:</p>
|
||||
<ul>
|
||||
<li>Service status (online/offline)</li>
|
||||
<li>Response time</li>
|
||||
<li>Quick actions (restart, open, logs, settings)</li>
|
||||
</ul>
|
||||
`,
|
||||
position: 'top',
|
||||
showButtons: ['previous', 'next'],
|
||||
showProgress: true
|
||||
},
|
||||
priority: 3,
|
||||
isNewFeature: false
|
||||
},
|
||||
|
||||
// 4. Theme selector
|
||||
{
|
||||
id: 'theme-selector',
|
||||
element: '#theme',
|
||||
popover: {
|
||||
title: 'Customize Your Theme',
|
||||
description: `
|
||||
<p>DashCaddy comes with 7 themes. Click here to switch between them.</p>
|
||||
<p>Your preference is saved automatically.</p>
|
||||
`,
|
||||
position: 'bottom',
|
||||
showButtons: ['previous', 'close'],
|
||||
showProgress: true
|
||||
},
|
||||
priority: 4,
|
||||
isNewFeature: false,
|
||||
condition: () => {
|
||||
return document.getElementById('theme') !== null;
|
||||
}
|
||||
}
|
||||
];
|
||||
|
||||
/**
|
||||
* Get tooltip definitions
|
||||
* @returns {Array} Array of tooltip definitions
|
||||
*/
|
||||
function getTooltipDefinitions() {
|
||||
return TOOLTIP_DEFINITIONS;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get a specific tooltip by ID
|
||||
* @param {string} id - Tooltip ID
|
||||
* @returns {Object|null} Tooltip definition or null if not found
|
||||
*/
|
||||
function getTooltipById(id) {
|
||||
return TOOLTIP_DEFINITIONS.find(t => t.id === id) || null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get tooltips filtered by condition
|
||||
* @returns {Array} Array of tooltips that pass their condition check
|
||||
*/
|
||||
function getActiveTooltips() {
|
||||
return TOOLTIP_DEFINITIONS.filter(tooltip => {
|
||||
if (tooltip.condition && typeof tooltip.condition === 'function') {
|
||||
try {
|
||||
return tooltip.condition();
|
||||
} catch (error) {
|
||||
console.error(`[TooltipDefinitions] Error evaluating condition for ${tooltip.id}:`, error);
|
||||
return false;
|
||||
}
|
||||
}
|
||||
return true;
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Get tooltips sorted by priority
|
||||
* @returns {Array} Array of tooltips sorted by priority (ascending)
|
||||
*/
|
||||
function getSortedTooltips() {
|
||||
const tooltips = getActiveTooltips();
|
||||
return tooltips.sort((a, b) => {
|
||||
const priorityA = a.priority || 999;
|
||||
const priorityB = b.priority || 999;
|
||||
return priorityA - priorityB;
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Get tooltips marked as new features
|
||||
* @returns {Array} Array of tooltips marked with isNewFeature flag
|
||||
*/
|
||||
function getNewFeatureTooltips() {
|
||||
const tooltips = getActiveTooltips();
|
||||
return tooltips.filter(tooltip => tooltip.isNewFeature === true)
|
||||
.sort((a, b) => {
|
||||
const priorityA = a.priority || 999;
|
||||
const priorityB = b.priority || 999;
|
||||
return priorityA - priorityB;
|
||||
});
|
||||
}
|
||||
|
||||
// Export to global scope
|
||||
window.TooltipDefinitions = {
|
||||
TOOLTIP_DEFINITIONS,
|
||||
getTooltipDefinitions,
|
||||
getTooltipById,
|
||||
getActiveTooltips,
|
||||
getSortedTooltips,
|
||||
getNewFeatureTooltips
|
||||
};
|
||||
|
||||
console.log('[TooltipDefinitions] Definitions loaded:', TOOLTIP_DEFINITIONS.length, 'tooltips');
|
||||
|
||||
@@ -1,363 +1,363 @@
|
||||
/**
|
||||
* Tour Manager
|
||||
* Orchestrates the onboarding tour using Driver.js
|
||||
*/
|
||||
|
||||
(function(window) {
|
||||
'use strict';
|
||||
|
||||
class TourManager {
|
||||
constructor(progressTracker, themeAdapter, dnsTemplateSelector) {
|
||||
this.progressTracker = progressTracker;
|
||||
this.themeAdapter = themeAdapter;
|
||||
this.dnsTemplateSelector = dnsTemplateSelector;
|
||||
this.driver = null;
|
||||
this.currentStepIndex = 0;
|
||||
this.isActive = false;
|
||||
this.resizeHandler = null;
|
||||
this.layoutChangeHandler = null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Initialize Driver.js with theme-aware configuration
|
||||
*/
|
||||
async initializeDriver() {
|
||||
// Driver.js v1.x IIFE: window.driver.js.driver is the factory function
|
||||
const driverFactory = window.driver?.js?.driver || window.driver?.driver || window.driver;
|
||||
|
||||
if (typeof driverFactory !== 'function') {
|
||||
console.error('[TourManager] Driver.js not loaded or invalid. window.driver:', window.driver);
|
||||
return false;
|
||||
}
|
||||
|
||||
const themeConfig = this.themeAdapter.getDriverTheme();
|
||||
|
||||
this.driver = driverFactory({
|
||||
showProgress: true,
|
||||
showButtons: ['next', 'previous', 'close'],
|
||||
allowClose: true,
|
||||
overlayClickNext: false,
|
||||
overlayOpacity: 0,
|
||||
stagePadding: 0,
|
||||
stageRadius: 0,
|
||||
allowKeyboardControl: true,
|
||||
popoverClass: 'dashcaddy-popover',
|
||||
onDestroyed: () => this.onTourComplete(),
|
||||
onDestroyStarted: () => {
|
||||
if (!this.progressTracker.isTourCompleted()) {
|
||||
this.onTourSkip();
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
// Apply theme
|
||||
this.themeAdapter.applyTheme(this.driver);
|
||||
|
||||
// Listen for theme changes
|
||||
this.themeAdapter.onThemeChange(() => {
|
||||
this.themeAdapter.applyTheme(this.driver);
|
||||
});
|
||||
|
||||
// Set up dynamic repositioning
|
||||
this.setupDynamicRepositioning();
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if tour should auto-start
|
||||
*/
|
||||
shouldAutoStart() {
|
||||
return !this.progressTracker.isTourCompleted() &&
|
||||
this.progressTracker.getCurrentStep() === 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* Start the onboarding tour
|
||||
*/
|
||||
async startTour() {
|
||||
if (!this.driver) {
|
||||
const initialized = await this.initializeDriver();
|
||||
if (!initialized) return;
|
||||
}
|
||||
|
||||
// Get active tooltips (filtered by conditions)
|
||||
const allTooltips = window.TooltipDefinitions.getSortedTooltips();
|
||||
|
||||
// Filter out completed tooltips
|
||||
const completedIds = this.progressTracker.getCompletedTooltips();
|
||||
const activeTooltips = allTooltips.filter(t => !completedIds.includes(t.id));
|
||||
|
||||
if (activeTooltips.length === 0) {
|
||||
console.log('[TourManager] No tooltips to show');
|
||||
this.progressTracker.markTourCompleted();
|
||||
return;
|
||||
}
|
||||
|
||||
// Convert to Driver.js steps with navigation logic
|
||||
const steps = activeTooltips.map((tooltip, index) => {
|
||||
const isFirst = index === 0;
|
||||
const isLast = index === activeTooltips.length - 1;
|
||||
|
||||
const step = {
|
||||
element: tooltip.element,
|
||||
popover: {
|
||||
title: tooltip.popover.title,
|
||||
description: tooltip.popover.description,
|
||||
side: tooltip.popover.position || 'bottom',
|
||||
align: tooltip.popover.align || 'start',
|
||||
showButtons: this._getButtonsForStep(tooltip, isFirst, isLast),
|
||||
showProgress: tooltip.popover.showProgress !== false,
|
||||
onNextClick: () => {
|
||||
this.progressTracker.markTooltipCompleted(tooltip.id);
|
||||
this.progressTracker.setCurrentStep(index + 1);
|
||||
this.currentStepIndex = index + 1;
|
||||
this.driver.moveNext();
|
||||
},
|
||||
onPrevClick: () => {
|
||||
this.progressTracker.setCurrentStep(Math.max(0, index - 1));
|
||||
this.currentStepIndex = Math.max(0, index - 1);
|
||||
this.driver.movePrevious();
|
||||
},
|
||||
onCloseClick: () => {
|
||||
this.skipTour();
|
||||
}
|
||||
}
|
||||
};
|
||||
|
||||
// Add custom handlers for DNS tooltip
|
||||
if (tooltip.id === 'dns-priority' && this.dnsTemplateSelector) {
|
||||
step.popover.onSetupNowClick = () => {
|
||||
console.log('[TourManager] Opening DNS template selector');
|
||||
this.dnsTemplateSelector.showTemplateSelector();
|
||||
// Mark tooltip as completed and move to next
|
||||
this.progressTracker.markTooltipCompleted(tooltip.id);
|
||||
this.progressTracker.setCurrentStep(index + 1);
|
||||
this.currentStepIndex = index + 1;
|
||||
this.driver.moveNext();
|
||||
};
|
||||
|
||||
step.popover.onLaterClick = () => {
|
||||
console.log('[TourManager] DNS setup deferred');
|
||||
this.progressTracker.markDnsSetupDeferred();
|
||||
// Mark tooltip as completed and move to next
|
||||
this.progressTracker.markTooltipCompleted(tooltip.id);
|
||||
this.progressTracker.setCurrentStep(index + 1);
|
||||
this.currentStepIndex = index + 1;
|
||||
this.driver.moveNext();
|
||||
};
|
||||
}
|
||||
|
||||
return step;
|
||||
});
|
||||
|
||||
this.isActive = true;
|
||||
this.driver.setSteps(steps);
|
||||
this.driver.drive();
|
||||
}
|
||||
|
||||
/**
|
||||
* Resume tour from last step
|
||||
*/
|
||||
async resumeTour() {
|
||||
const currentStep = this.progressTracker.getCurrentStep();
|
||||
if (currentStep > 0) {
|
||||
await this.startTour();
|
||||
// Driver.js will start from beginning, we'd need to skip to current step
|
||||
// This is a simplified implementation
|
||||
} else {
|
||||
await this.startTour();
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Skip the entire tour
|
||||
*/
|
||||
skipTour() {
|
||||
if (this.driver) {
|
||||
this.driver.destroy();
|
||||
}
|
||||
this.cleanupDynamicRepositioning();
|
||||
this.isActive = false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Restart tour from beginning
|
||||
*/
|
||||
async restartTour() {
|
||||
this.progressTracker.resetProgress();
|
||||
await this.startTour();
|
||||
}
|
||||
|
||||
/**
|
||||
* Show a specific tooltip by ID
|
||||
*/
|
||||
async showTooltip(tooltipId) {
|
||||
const tooltip = window.TooltipDefinitions.getTooltipById(tooltipId);
|
||||
if (!tooltip) {
|
||||
console.error(`[TourManager] Tooltip not found: ${tooltipId}`);
|
||||
return;
|
||||
}
|
||||
|
||||
if (!this.driver) {
|
||||
await this.initializeDriver();
|
||||
}
|
||||
|
||||
const step = {
|
||||
element: tooltip.element,
|
||||
popover: {
|
||||
title: tooltip.popover.title,
|
||||
description: tooltip.popover.description,
|
||||
side: tooltip.popover.position || 'bottom',
|
||||
align: tooltip.popover.align || 'start'
|
||||
}
|
||||
};
|
||||
|
||||
this.driver.highlight(step);
|
||||
}
|
||||
|
||||
/**
|
||||
* Show "What's New" tour - only tooltips marked as new features
|
||||
*/
|
||||
async showWhatsNew() {
|
||||
if (!this.driver) {
|
||||
const initialized = await this.initializeDriver();
|
||||
if (!initialized) return;
|
||||
}
|
||||
|
||||
// Get only new feature tooltips
|
||||
const newFeatureTooltips = window.TooltipDefinitions.getNewFeatureTooltips();
|
||||
|
||||
if (newFeatureTooltips.length === 0) {
|
||||
console.log('[TourManager] No new features to show');
|
||||
return;
|
||||
}
|
||||
|
||||
console.log(`[TourManager] Showing ${newFeatureTooltips.length} new features`);
|
||||
|
||||
// Convert to Driver.js steps
|
||||
const steps = newFeatureTooltips.map((tooltip, index) => {
|
||||
const isFirst = index === 0;
|
||||
const isLast = index === newFeatureTooltips.length - 1;
|
||||
|
||||
return {
|
||||
element: tooltip.element,
|
||||
popover: {
|
||||
title: `✨ NEW: ${tooltip.popover.title}`,
|
||||
description: tooltip.popover.description,
|
||||
side: tooltip.popover.position || 'bottom',
|
||||
align: tooltip.popover.align || 'start',
|
||||
showButtons: this._getButtonsForStep(tooltip, isFirst, isLast),
|
||||
showProgress: true,
|
||||
onNextClick: () => {
|
||||
this.driver.moveNext();
|
||||
},
|
||||
onPrevClick: () => {
|
||||
this.driver.movePrevious();
|
||||
},
|
||||
onCloseClick: () => {
|
||||
this.skipTour();
|
||||
}
|
||||
}
|
||||
};
|
||||
});
|
||||
|
||||
this.isActive = true;
|
||||
this.driver.setSteps(steps);
|
||||
this.driver.drive();
|
||||
}
|
||||
|
||||
/**
|
||||
* Set up dynamic repositioning for window resize and layout changes
|
||||
*/
|
||||
setupDynamicRepositioning() {
|
||||
// Window resize handler with debouncing
|
||||
let resizeTimeout;
|
||||
this.resizeHandler = () => {
|
||||
clearTimeout(resizeTimeout);
|
||||
resizeTimeout = setTimeout(() => {
|
||||
if (this.isActive && this.driver) {
|
||||
console.log('[TourManager] Window resized, repositioning tooltip');
|
||||
this.driver.refresh();
|
||||
}
|
||||
}, 150); // Debounce for 150ms
|
||||
};
|
||||
|
||||
// Layout change handler (for theme changes, DOM mutations)
|
||||
this.layoutChangeHandler = () => {
|
||||
if (this.isActive && this.driver) {
|
||||
console.log('[TourManager] Layout changed, repositioning tooltip');
|
||||
// Small delay to allow layout to settle
|
||||
setTimeout(() => {
|
||||
if (this.driver) {
|
||||
this.driver.refresh();
|
||||
}
|
||||
}, 100);
|
||||
}
|
||||
};
|
||||
|
||||
// Add event listeners
|
||||
window.addEventListener('resize', this.resizeHandler);
|
||||
|
||||
// Listen for theme changes (already handled by ThemeAdapter, but also trigger reposition)
|
||||
this.themeAdapter.onThemeChange(this.layoutChangeHandler);
|
||||
}
|
||||
|
||||
/**
|
||||
* Clean up dynamic repositioning listeners
|
||||
*/
|
||||
cleanupDynamicRepositioning() {
|
||||
if (this.resizeHandler) {
|
||||
window.removeEventListener('resize', this.resizeHandler);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Get buttons to show for a specific step
|
||||
* @private
|
||||
*/
|
||||
_getButtonsForStep(tooltip, isFirst, isLast) {
|
||||
// Check if tooltip has custom buttons defined
|
||||
if (tooltip.popover.showButtons) {
|
||||
return tooltip.popover.showButtons;
|
||||
}
|
||||
|
||||
// Default button configuration
|
||||
const buttons = [];
|
||||
|
||||
if (!isFirst) {
|
||||
buttons.push('previous');
|
||||
}
|
||||
|
||||
if (!isLast) {
|
||||
buttons.push('next');
|
||||
} else {
|
||||
buttons.push('close');
|
||||
}
|
||||
|
||||
return buttons;
|
||||
}
|
||||
|
||||
/**
|
||||
* Handle tour completion
|
||||
*/
|
||||
onTourComplete() {
|
||||
this.progressTracker.markTourCompleted();
|
||||
this.isActive = false;
|
||||
console.log('[TourManager] Tour completed');
|
||||
}
|
||||
|
||||
/**
|
||||
* Handle tour skip
|
||||
*/
|
||||
onTourSkip() {
|
||||
// Save current progress but don't mark as completed
|
||||
console.log('[TourManager] Tour skipped');
|
||||
this.isActive = false;
|
||||
}
|
||||
}
|
||||
|
||||
window.TourManager = TourManager;
|
||||
console.log('[TourManager] Module loaded');
|
||||
|
||||
})(window);
|
||||
/**
|
||||
* Tour Manager
|
||||
* Orchestrates the onboarding tour using Driver.js
|
||||
*/
|
||||
|
||||
(function(window) {
|
||||
'use strict';
|
||||
|
||||
class TourManager {
|
||||
constructor(progressTracker, themeAdapter, dnsTemplateSelector) {
|
||||
this.progressTracker = progressTracker;
|
||||
this.themeAdapter = themeAdapter;
|
||||
this.dnsTemplateSelector = dnsTemplateSelector;
|
||||
this.driver = null;
|
||||
this.currentStepIndex = 0;
|
||||
this.isActive = false;
|
||||
this.resizeHandler = null;
|
||||
this.layoutChangeHandler = null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Initialize Driver.js with theme-aware configuration
|
||||
*/
|
||||
async initializeDriver() {
|
||||
// Driver.js v1.x IIFE: window.driver.js.driver is the factory function
|
||||
const driverFactory = window.driver?.js?.driver || window.driver?.driver || window.driver;
|
||||
|
||||
if (typeof driverFactory !== 'function') {
|
||||
console.error('[TourManager] Driver.js not loaded or invalid. window.driver:', window.driver);
|
||||
return false;
|
||||
}
|
||||
|
||||
const themeConfig = this.themeAdapter.getDriverTheme();
|
||||
|
||||
this.driver = driverFactory({
|
||||
showProgress: true,
|
||||
showButtons: ['next', 'previous', 'close'],
|
||||
allowClose: true,
|
||||
overlayClickNext: false,
|
||||
overlayOpacity: 0,
|
||||
stagePadding: 0,
|
||||
stageRadius: 0,
|
||||
allowKeyboardControl: true,
|
||||
popoverClass: 'dashcaddy-popover',
|
||||
onDestroyed: () => this.onTourComplete(),
|
||||
onDestroyStarted: () => {
|
||||
if (!this.progressTracker.isTourCompleted()) {
|
||||
this.onTourSkip();
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
// Apply theme
|
||||
this.themeAdapter.applyTheme(this.driver);
|
||||
|
||||
// Listen for theme changes
|
||||
this.themeAdapter.onThemeChange(() => {
|
||||
this.themeAdapter.applyTheme(this.driver);
|
||||
});
|
||||
|
||||
// Set up dynamic repositioning
|
||||
this.setupDynamicRepositioning();
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if tour should auto-start
|
||||
*/
|
||||
shouldAutoStart() {
|
||||
return !this.progressTracker.isTourCompleted() &&
|
||||
this.progressTracker.getCurrentStep() === 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* Start the onboarding tour
|
||||
*/
|
||||
async startTour() {
|
||||
if (!this.driver) {
|
||||
const initialized = await this.initializeDriver();
|
||||
if (!initialized) return;
|
||||
}
|
||||
|
||||
// Get active tooltips (filtered by conditions)
|
||||
const allTooltips = window.TooltipDefinitions.getSortedTooltips();
|
||||
|
||||
// Filter out completed tooltips
|
||||
const completedIds = this.progressTracker.getCompletedTooltips();
|
||||
const activeTooltips = allTooltips.filter(t => !completedIds.includes(t.id));
|
||||
|
||||
if (activeTooltips.length === 0) {
|
||||
console.log('[TourManager] No tooltips to show');
|
||||
this.progressTracker.markTourCompleted();
|
||||
return;
|
||||
}
|
||||
|
||||
// Convert to Driver.js steps with navigation logic
|
||||
const steps = activeTooltips.map((tooltip, index) => {
|
||||
const isFirst = index === 0;
|
||||
const isLast = index === activeTooltips.length - 1;
|
||||
|
||||
const step = {
|
||||
element: tooltip.element,
|
||||
popover: {
|
||||
title: tooltip.popover.title,
|
||||
description: tooltip.popover.description,
|
||||
side: tooltip.popover.position || 'bottom',
|
||||
align: tooltip.popover.align || 'start',
|
||||
showButtons: this._getButtonsForStep(tooltip, isFirst, isLast),
|
||||
showProgress: tooltip.popover.showProgress !== false,
|
||||
onNextClick: () => {
|
||||
this.progressTracker.markTooltipCompleted(tooltip.id);
|
||||
this.progressTracker.setCurrentStep(index + 1);
|
||||
this.currentStepIndex = index + 1;
|
||||
this.driver.moveNext();
|
||||
},
|
||||
onPrevClick: () => {
|
||||
this.progressTracker.setCurrentStep(Math.max(0, index - 1));
|
||||
this.currentStepIndex = Math.max(0, index - 1);
|
||||
this.driver.movePrevious();
|
||||
},
|
||||
onCloseClick: () => {
|
||||
this.skipTour();
|
||||
}
|
||||
}
|
||||
};
|
||||
|
||||
// Add custom handlers for DNS tooltip
|
||||
if (tooltip.id === 'dns-priority' && this.dnsTemplateSelector) {
|
||||
step.popover.onSetupNowClick = () => {
|
||||
console.log('[TourManager] Opening DNS template selector');
|
||||
this.dnsTemplateSelector.showTemplateSelector();
|
||||
// Mark tooltip as completed and move to next
|
||||
this.progressTracker.markTooltipCompleted(tooltip.id);
|
||||
this.progressTracker.setCurrentStep(index + 1);
|
||||
this.currentStepIndex = index + 1;
|
||||
this.driver.moveNext();
|
||||
};
|
||||
|
||||
step.popover.onLaterClick = () => {
|
||||
console.log('[TourManager] DNS setup deferred');
|
||||
this.progressTracker.markDnsSetupDeferred();
|
||||
// Mark tooltip as completed and move to next
|
||||
this.progressTracker.markTooltipCompleted(tooltip.id);
|
||||
this.progressTracker.setCurrentStep(index + 1);
|
||||
this.currentStepIndex = index + 1;
|
||||
this.driver.moveNext();
|
||||
};
|
||||
}
|
||||
|
||||
return step;
|
||||
});
|
||||
|
||||
this.isActive = true;
|
||||
this.driver.setSteps(steps);
|
||||
this.driver.drive();
|
||||
}
|
||||
|
||||
/**
|
||||
* Resume tour from last step
|
||||
*/
|
||||
async resumeTour() {
|
||||
const currentStep = this.progressTracker.getCurrentStep();
|
||||
if (currentStep > 0) {
|
||||
await this.startTour();
|
||||
// Driver.js will start from beginning, we'd need to skip to current step
|
||||
// This is a simplified implementation
|
||||
} else {
|
||||
await this.startTour();
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Skip the entire tour
|
||||
*/
|
||||
skipTour() {
|
||||
if (this.driver) {
|
||||
this.driver.destroy();
|
||||
}
|
||||
this.cleanupDynamicRepositioning();
|
||||
this.isActive = false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Restart tour from beginning
|
||||
*/
|
||||
async restartTour() {
|
||||
this.progressTracker.resetProgress();
|
||||
await this.startTour();
|
||||
}
|
||||
|
||||
/**
|
||||
* Show a specific tooltip by ID
|
||||
*/
|
||||
async showTooltip(tooltipId) {
|
||||
const tooltip = window.TooltipDefinitions.getTooltipById(tooltipId);
|
||||
if (!tooltip) {
|
||||
console.error(`[TourManager] Tooltip not found: ${tooltipId}`);
|
||||
return;
|
||||
}
|
||||
|
||||
if (!this.driver) {
|
||||
await this.initializeDriver();
|
||||
}
|
||||
|
||||
const step = {
|
||||
element: tooltip.element,
|
||||
popover: {
|
||||
title: tooltip.popover.title,
|
||||
description: tooltip.popover.description,
|
||||
side: tooltip.popover.position || 'bottom',
|
||||
align: tooltip.popover.align || 'start'
|
||||
}
|
||||
};
|
||||
|
||||
this.driver.highlight(step);
|
||||
}
|
||||
|
||||
/**
|
||||
* Show "What's New" tour - only tooltips marked as new features
|
||||
*/
|
||||
async showWhatsNew() {
|
||||
if (!this.driver) {
|
||||
const initialized = await this.initializeDriver();
|
||||
if (!initialized) return;
|
||||
}
|
||||
|
||||
// Get only new feature tooltips
|
||||
const newFeatureTooltips = window.TooltipDefinitions.getNewFeatureTooltips();
|
||||
|
||||
if (newFeatureTooltips.length === 0) {
|
||||
console.log('[TourManager] No new features to show');
|
||||
return;
|
||||
}
|
||||
|
||||
console.log(`[TourManager] Showing ${newFeatureTooltips.length} new features`);
|
||||
|
||||
// Convert to Driver.js steps
|
||||
const steps = newFeatureTooltips.map((tooltip, index) => {
|
||||
const isFirst = index === 0;
|
||||
const isLast = index === newFeatureTooltips.length - 1;
|
||||
|
||||
return {
|
||||
element: tooltip.element,
|
||||
popover: {
|
||||
title: `✨ NEW: ${tooltip.popover.title}`,
|
||||
description: tooltip.popover.description,
|
||||
side: tooltip.popover.position || 'bottom',
|
||||
align: tooltip.popover.align || 'start',
|
||||
showButtons: this._getButtonsForStep(tooltip, isFirst, isLast),
|
||||
showProgress: true,
|
||||
onNextClick: () => {
|
||||
this.driver.moveNext();
|
||||
},
|
||||
onPrevClick: () => {
|
||||
this.driver.movePrevious();
|
||||
},
|
||||
onCloseClick: () => {
|
||||
this.skipTour();
|
||||
}
|
||||
}
|
||||
};
|
||||
});
|
||||
|
||||
this.isActive = true;
|
||||
this.driver.setSteps(steps);
|
||||
this.driver.drive();
|
||||
}
|
||||
|
||||
/**
|
||||
* Set up dynamic repositioning for window resize and layout changes
|
||||
*/
|
||||
setupDynamicRepositioning() {
|
||||
// Window resize handler with debouncing
|
||||
let resizeTimeout;
|
||||
this.resizeHandler = () => {
|
||||
clearTimeout(resizeTimeout);
|
||||
resizeTimeout = setTimeout(() => {
|
||||
if (this.isActive && this.driver) {
|
||||
console.log('[TourManager] Window resized, repositioning tooltip');
|
||||
this.driver.refresh();
|
||||
}
|
||||
}, 150); // Debounce for 150ms
|
||||
};
|
||||
|
||||
// Layout change handler (for theme changes, DOM mutations)
|
||||
this.layoutChangeHandler = () => {
|
||||
if (this.isActive && this.driver) {
|
||||
console.log('[TourManager] Layout changed, repositioning tooltip');
|
||||
// Small delay to allow layout to settle
|
||||
setTimeout(() => {
|
||||
if (this.driver) {
|
||||
this.driver.refresh();
|
||||
}
|
||||
}, 100);
|
||||
}
|
||||
};
|
||||
|
||||
// Add event listeners
|
||||
window.addEventListener('resize', this.resizeHandler);
|
||||
|
||||
// Listen for theme changes (already handled by ThemeAdapter, but also trigger reposition)
|
||||
this.themeAdapter.onThemeChange(this.layoutChangeHandler);
|
||||
}
|
||||
|
||||
/**
|
||||
* Clean up dynamic repositioning listeners
|
||||
*/
|
||||
cleanupDynamicRepositioning() {
|
||||
if (this.resizeHandler) {
|
||||
window.removeEventListener('resize', this.resizeHandler);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Get buttons to show for a specific step
|
||||
* @private
|
||||
*/
|
||||
_getButtonsForStep(tooltip, isFirst, isLast) {
|
||||
// Check if tooltip has custom buttons defined
|
||||
if (tooltip.popover.showButtons) {
|
||||
return tooltip.popover.showButtons;
|
||||
}
|
||||
|
||||
// Default button configuration
|
||||
const buttons = [];
|
||||
|
||||
if (!isFirst) {
|
||||
buttons.push('previous');
|
||||
}
|
||||
|
||||
if (!isLast) {
|
||||
buttons.push('next');
|
||||
} else {
|
||||
buttons.push('close');
|
||||
}
|
||||
|
||||
return buttons;
|
||||
}
|
||||
|
||||
/**
|
||||
* Handle tour completion
|
||||
*/
|
||||
onTourComplete() {
|
||||
this.progressTracker.markTourCompleted();
|
||||
this.isActive = false;
|
||||
console.log('[TourManager] Tour completed');
|
||||
}
|
||||
|
||||
/**
|
||||
* Handle tour skip
|
||||
*/
|
||||
onTourSkip() {
|
||||
// Save current progress but don't mark as completed
|
||||
console.log('[TourManager] Tour skipped');
|
||||
this.isActive = false;
|
||||
}
|
||||
}
|
||||
|
||||
window.TourManager = TourManager;
|
||||
console.log('[TourManager] Module loaded');
|
||||
|
||||
})(window);
|
||||
@@ -419,10 +419,7 @@ module.exports = function({ docker, caddy, credentialManager, servicesStateManag
|
||||
const notificationMessage = usedExisting
|
||||
? `**${template.name}** configured using existing container.\nURL: ${serviceUrl}`
|
||||
: `**${template.name}** has been deployed successfully.\nURL: ${serviceUrl}`;
|
||||
ctx.notification.send('deploymentSuccess', {
|
||||
title: usedExisting ? 'Configuration Complete' : 'Deployment Successful',
|
||||
text: notificationMessage
|
||||
}, 'success');
|
||||
ctx.notification.send('deploymentSuccess', usedExisting ? 'Configuration Complete' : 'Deployment Successful', notificationMessage, 'success');
|
||||
|
||||
res.json(response);
|
||||
} catch (error) {
|
||||
@@ -430,10 +427,7 @@ module.exports = function({ docker, caddy, credentialManager, servicesStateManag
|
||||
const msg = error?.message || String(error || 'Unknown error');
|
||||
log.error('deploy', error, null, { note: 'Deployment failed', appId });
|
||||
const template = ctx.APP_TEMPLATES[appId];
|
||||
try { ctx.notification.send('deploymentFailed', {
|
||||
title: 'Deployment Failed',
|
||||
text: `Failed to deploy **${template?.name || appId}**.\nError: ${msg}`
|
||||
}, 'error'); } catch (_) {}
|
||||
try { ctx.notification.send('deploymentFailed', 'Deployment Failed', `Failed to deploy **${template?.name || appId}**.\nError: ${msg}`, 'error'); } catch (_) {}
|
||||
errorResponse(res, 500, ctx.safeErrorMessage(error));
|
||||
}
|
||||
}, 'apps-deploy'));
|
||||
|
||||
@@ -478,10 +478,8 @@ module.exports = function(ctx) {
|
||||
if (anyConfigured) {
|
||||
notification.send(
|
||||
'deploymentSuccess',
|
||||
{
|
||||
title: 'Arr Stack Auto-Connected',
|
||||
text: `Overseerr configured: ${Object.entries(configResults).filter(([k,v]) => v === 'configured').map(([k]) => k).join(', ')}`
|
||||
},
|
||||
'Arr Stack Auto-Connected',
|
||||
`Overseerr configured: ${Object.entries(configResults).filter(([k,v]) => v === 'configured').map(([k]) => k).join(', ')}`,
|
||||
'success'
|
||||
);
|
||||
}
|
||||
|
||||
@@ -313,10 +313,8 @@ module.exports = function({ credentialManager, servicesStateManager, fetchT, asy
|
||||
if (succeeded > 0) {
|
||||
ctx.notification.send(
|
||||
'deploymentSuccess',
|
||||
{
|
||||
title: 'Smart Arr Connect Complete',
|
||||
text: `${succeeded}/${steps.length} steps completed successfully`
|
||||
},
|
||||
'Smart Arr Connect Complete',
|
||||
`${succeeded}/${steps.length} steps completed successfully`,
|
||||
'success'
|
||||
);
|
||||
}
|
||||
|
||||
@@ -116,7 +116,7 @@ module.exports = function({ asyncHandler, errorResponse, log, session, dataDir }
|
||||
// `legacy: true` so the UI knows.
|
||||
return ok(res, {
|
||||
user: null,
|
||||
authenticated: session ? session.isValid(req) : false,
|
||||
authenticated: session ? session.isSessionValid(req) : false,
|
||||
role: 'admin', // legacy: assume operator-level access
|
||||
legacy: true,
|
||||
});
|
||||
|
||||
@@ -7,7 +7,6 @@ const initLogin = require('./login');
|
||||
const initAdmin = require('./admin');
|
||||
const { createAuthProviderRegistry } = require('../../src/auth/providers');
|
||||
const { createUserStore } = require('../../src/security/user-store');
|
||||
const { ok } = require('../../src/utils/responses');
|
||||
|
||||
/**
|
||||
* Auth routes aggregator
|
||||
@@ -145,62 +144,10 @@ module.exports = function(ctx) {
|
||||
router.use(initKeys(deps));
|
||||
router.use(initSsoGate({ ...deps, getAppSession, appSessionCache }));
|
||||
|
||||
// DC-093: /auth/me is ALWAYS mounted — even on single-user installs where
|
||||
// the rest of the admin router is not. The frontend admin panel polls
|
||||
// /api/v1/auth/me on every dashboard load (and re-probes every 60s while
|
||||
// unauthenticated), so leaving the route unmounted meant every single-user
|
||||
// install logged a DC-404 ERROR + stack at 1/min per open tab — for years
|
||||
// of tab-time. The response mirrors the mounted /me shape (routes/auth/
|
||||
// admin.js) and adds `mode` so clients can distinguish "multi-user with
|
||||
// this identity" from "single-user install" without guessing from a 404.
|
||||
// It sits behind the standard session middleware (NOT in PUBLIC_ROUTES),
|
||||
// so unauthenticated probes get a clean 401, never this handler.
|
||||
router.get('/auth/me', deps.asyncHandler(async (req, res) => {
|
||||
// Defense-in-depth: the production session context exposes isValid()
|
||||
// (src/context/session.js). If a future refactor passes a differently-
|
||||
// shaped object, fall back to authenticated:true rather than throwing
|
||||
// a 500 — /me is polled by every open dashboard tab every 60s, so a
|
||||
// throw here becomes a log storm (exactly what DC-093 removed), and
|
||||
// this handler only runs after the session middleware already
|
||||
// admitted the request, so default-false would misreport a valid
|
||||
// session as unauthenticated.
|
||||
const _authed = deps.session && typeof deps.session.isValid === 'function'
|
||||
? deps.session.isValid(req)
|
||||
: true;
|
||||
if (userStore && req.user && req.user.id) {
|
||||
const stored = await userStore.getUser(req.user.id);
|
||||
return ok(res, {
|
||||
user: stored
|
||||
? {
|
||||
id: stored.id,
|
||||
email: stored.email,
|
||||
displayName: stored.displayName,
|
||||
role: stored.role,
|
||||
isAdmin: stored.role === 'admin',
|
||||
createdAt: stored.createdAt,
|
||||
lastLoginAt: stored.lastLoginAt,
|
||||
loginCount: stored.loginCount,
|
||||
}
|
||||
: null,
|
||||
authenticated: _authed,
|
||||
mode: 'multi',
|
||||
});
|
||||
}
|
||||
// No user store mounted → single-user install. The operator who
|
||||
// unlocked TOTP IS the admin (there is no other identity).
|
||||
return ok(res, {
|
||||
user: null,
|
||||
authenticated: _authed,
|
||||
role: 'admin',
|
||||
isAdmin: true,
|
||||
legacy: true,
|
||||
mode: 'single',
|
||||
});
|
||||
}, 'auth-me-mode'));
|
||||
|
||||
// DC-048: mount admin routes ONLY when the user-store was instantiated
|
||||
// (i.e. email auth is enabled). Single-user installs don't see
|
||||
// /admin/* or /invites/* at all — /me above is the one exception.
|
||||
// (i.e. email auth is enabled). Single-user installs don't see /me,
|
||||
// /admin/*, or /invites/* at all. The route paths simply don't exist
|
||||
// so a request to /api/v1/auth/me returns 404 from the apiRouter.
|
||||
if (userStore) {
|
||||
// DC-052: pass licenseManager + userStore through so the tier-gate
|
||||
// middleware can read them. Both are optional — the gate short-
|
||||
|
||||
@@ -139,9 +139,6 @@ module.exports = function(ctx) {
|
||||
// can mis-handle; reject it to keep the password copy-paste-safe).
|
||||
const CA_PFX_PASSWORD_RE = /^[A-Za-z0-9!@#%^_+,.~:-]{8,64}$/;
|
||||
const CA_CERT_RATE_LIMIT = { windowMs: 60_000, max: 10 };
|
||||
// Single source of truth for accepted ?format= values. `wantsPfx`, the
|
||||
// password requirement, and the response dispatch all derive from this.
|
||||
const CA_CERT_FORMATS = ['pfx', 'pem', 'crt', 'key', 'fullchain'];
|
||||
const caCertRateBuckets = new Map(); // ip -> { count, resetAt }
|
||||
function caCertRateLimit(ip) {
|
||||
const now = Date.now();
|
||||
@@ -178,24 +175,6 @@ module.exports = function(ctx) {
|
||||
|
||||
const { domain } = req.params;
|
||||
|
||||
// FIX: `format` was referenced in the dispatch below but never declared,
|
||||
// so every request that passed validation threw ReferenceError. Default
|
||||
// 'pfx' matches the `wantsPfx` check (no format param => pfx).
|
||||
// Accept only a non-empty string: query strings can deliver arrays
|
||||
// (?format=a&format=b) or nested objects, which must be rejected.
|
||||
const rawFormat = req.query.format;
|
||||
if (rawFormat !== undefined && (typeof rawFormat !== 'string' || rawFormat === '')) {
|
||||
return ctx.errorResponse(res, 400,
|
||||
`Invalid format parameter. Use: ${CA_CERT_FORMATS.join(', ')}.`,
|
||||
{ code: 'DC-076_FORMAT_INVALID' });
|
||||
}
|
||||
if (rawFormat !== undefined && !CA_CERT_FORMATS.includes(rawFormat)) {
|
||||
return ctx.errorResponse(res, 400,
|
||||
`Invalid format '${rawFormat}'. Use: ${CA_CERT_FORMATS.join(', ')}.`,
|
||||
{ code: 'DC-076_FORMAT_INVALID' });
|
||||
}
|
||||
const format = rawFormat || 'pfx';
|
||||
|
||||
// DC-076: password is REQUIRED for the pfx format (no `=`) and must
|
||||
// be ≥ 8 chars. Previously `password = 'dashcaddy'` — a hardcoded
|
||||
// default that silently signed every PFX with the same published
|
||||
|
||||
@@ -64,8 +64,8 @@ function validateGenerationConfig(config) {
|
||||
// reverse_proxy upstreams). Two regex branches: (a) bare host with
|
||||
// required :port, (b) bracketed IPv6 literal with required :port.
|
||||
if (typeof upstream !== 'string'
|
||||
|| !/^[a-z0-9.-]+:\d{1,5}$/i.test(upstream)
|
||||
&& !/^\[[a-z0-9.:.-]+\]:\d{1,5}$/i.test(upstream)
|
||||
|| !/^[a-z0-9.\-]+:\d{1,5}$/i.test(upstream)
|
||||
&& !/^\[[a-z0-9.\-:.]+\]:\d{1,5}$/i.test(upstream)
|
||||
) {
|
||||
errors.push('upstream must be host:port (host letters/digits/dots/hyphens, port 1-65535, optional IPv6 brackets)');
|
||||
}
|
||||
|
||||
@@ -46,7 +46,6 @@ module.exports = function({ licenseManager, asyncHandler }) {
|
||||
|
||||
// Get current license status
|
||||
router.get('/status', asyncHandler(async (req, res) => {
|
||||
await licenseManager.refreshOnline?.();
|
||||
const status = licenseManager.getStatus();
|
||||
success(res, { license: status });
|
||||
}, 'license-status'));
|
||||
|
||||
@@ -270,10 +270,14 @@ module.exports = function({ asyncHandler, ok, docker, logDigest, dockerMaintenan
|
||||
// can't change statusCode. The reader does the same validation but
|
||||
// we want to short-circuit here so the response status reflects the
|
||||
// right category (400 for validation, 503 for bind-mount missing).
|
||||
// Throws pass straight to the global error middleware so the response
|
||||
// status + shape matches every other validation error in the API.
|
||||
journald.assertUnitAllowed(req.query.unit);
|
||||
if (req.query.since) journald.parseTimestamp(req.query.since, 'since');
|
||||
try {
|
||||
journald.assertUnitAllowed(req.query.unit);
|
||||
if (req.query.since) journald.parseTimestamp(req.query.since, 'since');
|
||||
} catch (err) {
|
||||
// Pass through the global error middleware so the response status
|
||||
// + shape matches every other validation error in the API.
|
||||
throw err;
|
||||
}
|
||||
|
||||
// SSE headers — same convention as /logs/stream/:id.
|
||||
res.setHeader('Content-Type', 'text/event-stream');
|
||||
|
||||
@@ -203,11 +203,6 @@ module.exports = function({ notification, asyncHandler, ok }) {
|
||||
backupComplete: 'backup-complete',
|
||||
backupFailed: 'backup-failed',
|
||||
autoRestart: 'auto-restart',
|
||||
// DC-094: same additions as the manager's EVENT_ALIASES — keep the
|
||||
// two maps in sync so a key saved here is the key send() gates on.
|
||||
recipeRemoved: 'recipe-removed',
|
||||
'dependency-restart-complete': 'dependency-restart',
|
||||
'dependency-restart-failed': 'dependency-restart',
|
||||
};
|
||||
const folded = {};
|
||||
for (const [k, v] of Object.entries(events)) {
|
||||
@@ -269,7 +264,7 @@ module.exports = function({ notification, asyncHandler, ok }) {
|
||||
res.json({ success: result.success, provider, error: result.error });
|
||||
} else {
|
||||
// Test all enabled providers
|
||||
const result = await notification.send('test', { title: 'Test Notification', text: 'This is a test notification from DashCaddy.' }, 'info');
|
||||
const result = await notification.send('test', 'Test Notification', 'This is a test notification from DashCaddy.', 'info');
|
||||
ok(res, { ...result });
|
||||
}
|
||||
}, 'notifications-test'));
|
||||
|
||||
@@ -147,7 +147,7 @@ module.exports = function openClawRoutes(ctx) {
|
||||
// Allowed chars in the downstream `path` segment: alphanumerics, `-`, `_`,
|
||||
// `.`, `~`, `/`, `?`, `&`, `=`, `:`, `@`, `+`, `,`, `;` (RFC 3986 pchar +
|
||||
// query/fragment separators). Anything else → 400.
|
||||
const ALLOWED_PATH_RE = /^[a-zA-Z0-9._~/?&=:@+,;%-]*$/;
|
||||
const ALLOWED_PATH_RE = /^[a-zA-Z0-9._~/?&=:@+,;%\-]*$/;
|
||||
// Maximum total `path` length (reasonable for a gateway UI endpoint).
|
||||
const MAX_PATH_LEN = 1024;
|
||||
|
||||
|
||||
@@ -142,10 +142,10 @@ module.exports = function({ docker, credentialManager: _credentialManager, servi
|
||||
setupInstructions: recipe.setupInstructions
|
||||
};
|
||||
|
||||
ctx.notification.send('deploymentSuccess', {
|
||||
title: 'Recipe Deployed',
|
||||
text: `**${recipe.name}** recipe deployed (${deployedComponents.length} components).`
|
||||
}, 'success');
|
||||
ctx.notification.send('deploymentSuccess', 'Recipe Deployed',
|
||||
`**${recipe.name}** recipe deployed (${deployedComponents.length} components).`,
|
||||
'success'
|
||||
);
|
||||
|
||||
ok(res, response);
|
||||
} catch (error) {
|
||||
@@ -175,10 +175,9 @@ module.exports = function({ docker, credentialManager: _credentialManager, servi
|
||||
}
|
||||
}
|
||||
|
||||
ctx.notification.send('deploymentFailed', {
|
||||
title: 'Recipe Failed',
|
||||
text: `Failed to deploy **${recipe.name}**: ${error.message}`
|
||||
}, 'error');
|
||||
ctx.notification.send('deploymentFailed', 'Recipe Failed',
|
||||
`Failed to deploy **${recipe.name}**: ${error.message}`, 'error'
|
||||
);
|
||||
|
||||
// Error automatically handled by middleware
|
||||
}
|
||||
|
||||
@@ -273,10 +273,10 @@ module.exports = function({ servicesStateManager, asyncHandler, log, docker, not
|
||||
}
|
||||
}
|
||||
|
||||
ctx.notification.send('recipeRemoved', {
|
||||
title: 'Recipe Removed',
|
||||
text: `Removed **${recipeId}** recipe (${results.filter(r => r.status === 'removed').length} containers).`
|
||||
}, 'info');
|
||||
ctx.notification.send('recipeRemoved', 'Recipe Removed',
|
||||
`Removed **${recipeId}** recipe (${results.filter(r => r.status === 'removed').length} containers).`,
|
||||
'info'
|
||||
);
|
||||
|
||||
log.info('recipe', 'Recipe removed', { recipeId, results });
|
||||
ok(res, { recipeId, results });
|
||||
|
||||
@@ -8,8 +8,6 @@
|
||||
* target; pagination via limit/offset)
|
||||
* GET /events/stats — Aggregations (top actors, top targets,
|
||||
* counts by source/severity/host)
|
||||
* GET /events/perimeter — Caddy-source perimeter aggregation
|
||||
* (per-IP + per-vhost breakdowns)
|
||||
* GET /events/:id — Single event by id
|
||||
* GET /events/stream — Server-Sent Events live tail (auth required)
|
||||
*
|
||||
@@ -75,103 +73,6 @@ module.exports = function({ log }) {
|
||||
ok(res, stats);
|
||||
});
|
||||
|
||||
// GET /events/perimeter — DC-120: caddy-source perimeter aggregation
|
||||
// (per-IP + per-vhost breakdowns) for the Log Insights panel.
|
||||
//
|
||||
// Replaces the frontend doing N paged /events calls and re-deriving
|
||||
// counts client-side (which capped at 1000 and lost per-key maps).
|
||||
// Reads the SAME store the /events endpoints read; aggregation runs
|
||||
// over the in-memory window only (bounded by maxMemory, default 10k).
|
||||
//
|
||||
// Query params:
|
||||
// hours : window in hours, default 24, falls back to 24 for invalid values.
|
||||
// The endpoint scans only the bounded in-memory window
|
||||
// (maxMemory, default 10k events), so accepting 720 hours does
|
||||
// not guarantee 30 days of retained data — it only controls the
|
||||
// timestamp filter applied to whatever events are currently in memory.
|
||||
// limit : top-N IPs returned, default 15, max 50
|
||||
//
|
||||
// Ordering: strict count desc; ties broken by IP string so output is
|
||||
// deterministic across restarts.
|
||||
router.get('/events/perimeter', (req, res) => {
|
||||
// --- validate + default window ---
|
||||
// hours/limit values outside bounds fall back to defaults (24h / 15) —
|
||||
// NOT clamped to the nearest boundary. This is intentional: silently
|
||||
// coercing a typo like hours=9999 to 720 hides the operator's mistake,
|
||||
// whereas a default fallback makes the effective window visible in the
|
||||
// response (window.hours === 24 when garbage was sent).
|
||||
// Strict integer parsing: reject anything that isn't a clean integer
|
||||
// (parseInt accepts "1junk" → 1, "1.5" → 1; both now rejected).
|
||||
const rawHours = String(req.query.hours || '').trim();
|
||||
const rawLimit = String(req.query.limit || '').trim();
|
||||
const hoursMatch = rawHours.match(/^[0-9]+$/);
|
||||
const limitMatch = rawLimit.match(/^[0-9]+$/);
|
||||
const hours = hoursMatch ? parseInt(rawHours, 10) : 24;
|
||||
const limit = limitMatch ? parseInt(rawLimit, 10) : 15;
|
||||
const defaultHours = (hours >= 1 && hours <= 720) ? hours : 24;
|
||||
const defaultLimit = (limit >= 1 && limit <= 50) ? limit : 15;
|
||||
const since = new Date(Date.now() - defaultHours * 3600000).toISOString();
|
||||
|
||||
// --- collect caddy events in window (bounded by maxMemory) ---
|
||||
// filterEvents() scans the in-memory window once. Aggregation then
|
||||
// traverses the selected subset (two Map reductions + summary counts).
|
||||
const events = store.filterEvents({ source_type: 'caddy', since });
|
||||
|
||||
// --- per-IP aggregation ---
|
||||
const ipMap = new Map();
|
||||
for (const ev of events) {
|
||||
const ip = ev.actor || 'unknown';
|
||||
let s = ipMap.get(ip);
|
||||
if (!s) {
|
||||
s = { count: 0, denied: 0, error: 0, hosts: new Set() };
|
||||
ipMap.set(ip, s);
|
||||
}
|
||||
s.count++;
|
||||
if (ev.outcome === 'denied' || ev.outcome === 'rate-limited') s.denied++;
|
||||
if (ev.outcome === 'error') s.error++;
|
||||
const host = ev.metadata && ev.metadata.host;
|
||||
if (host) s.hosts.add(host);
|
||||
}
|
||||
|
||||
const ips = [...ipMap.entries()]
|
||||
.map(([ip, s]) => ({
|
||||
ip,
|
||||
count: s.count,
|
||||
denied: s.denied,
|
||||
error: s.error,
|
||||
hosts: [...s.hosts].sort(),
|
||||
}))
|
||||
.sort((a, b) => b.count - a.count || (a.ip < b.ip ? -1 : a.ip > b.ip ? 1 : 0))
|
||||
.slice(0, defaultLimit);
|
||||
|
||||
// --- per-host (vhost) aggregation ---
|
||||
const hostMap = new Map();
|
||||
for (const ev of events) {
|
||||
const host = (ev.metadata && ev.metadata.host) || 'unknown';
|
||||
const h = hostMap.get(host) || { count: 0, denied: 0, error: 0 };
|
||||
h.count++;
|
||||
if (ev.outcome === 'denied' || ev.outcome === 'rate-limited') h.denied++;
|
||||
if (ev.outcome === 'error') h.error++;
|
||||
hostMap.set(host, h);
|
||||
}
|
||||
const byHost = [...hostMap.entries()]
|
||||
.map(([host, h]) => ({ host, ...h }))
|
||||
.sort((a, b) => b.count - a.count || (a.host < b.host ? -1 : a.host > b.host ? 1 : 0))
|
||||
.slice(0, 20);
|
||||
|
||||
ok(res, {
|
||||
window: { hours: defaultHours, since, until: new Date().toISOString() },
|
||||
summary: {
|
||||
events: events.length,
|
||||
uniqueIPs: ipMap.size,
|
||||
denied: events.reduce((n, ev) => n + (ev.outcome === 'denied' || ev.outcome === 'rate-limited' ? 1 : 0), 0),
|
||||
error: events.reduce((n, ev) => n + (ev.outcome === 'error' ? 1 : 0), 0),
|
||||
},
|
||||
topIPs: ips,
|
||||
byHost,
|
||||
});
|
||||
});
|
||||
|
||||
// GET /events/stream — SSE live tail (must come BEFORE /events/:id!)
|
||||
router.get('/events/stream', (req, res) => {
|
||||
res.writeHead(200, {
|
||||
|
||||
@@ -1,167 +0,0 @@
|
||||
#!/usr/bin/env node
|
||||
/**
|
||||
* DC-098 — One-shot PII redaction for pre-DC-095 log files.
|
||||
*
|
||||
* DC-095 masked email PII at every log sink, but files written BEFORE that
|
||||
* change still hold raw addresses on disk (e.g. error.log.1 line ~48136:
|
||||
* POST /auth/login context with "email":"user@domain"). This script rewrites
|
||||
* such files in place, applying the SAME canonical mask the live logger uses
|
||||
* (sa****@example.com), so historical and new lines show one consistent shape.
|
||||
*
|
||||
* Design constraints (judge-facing):
|
||||
* - Reuses the canonical EMAIL_RE + maskEmailAddress from src/utils/logging.js
|
||||
* — no second regex to drift. (EMAIL_RE is /g: never reuse a /g regex across
|
||||
* .test/.exec calls; here we only .replace() which resets lastIndex.)
|
||||
* - Atomic rewrite: write sibling temp file in the same directory, fsync, then
|
||||
* rename() over the original. A crash mid-redaction can never leave a
|
||||
* half-redacted file behind.
|
||||
* - No PII backup by default: the point of this pass is to REMOVE raw PII from
|
||||
* disk. Backups would silently reintroduce the leak we are fixing.
|
||||
* --keep-raw exists for operators who explicitly want a copy.
|
||||
* - Idempotent: the canonical mask output cannot re-match EMAIL_RE (stars and
|
||||
* quotes are outside the local-part class), so re-running is a no-op.
|
||||
* - Read-only when nothing matches (byte-identical content is never rewritten,
|
||||
* mtime preserved) — safe to point at a whole directory.
|
||||
* - Whole-file read + write. These logs are rotation-bounded (error.log.1 is
|
||||
* ~5 MB); buffering is the simplest correct approach and keeps the atomic
|
||||
* single-rename guarantee. Not for unbounded/streaming files.
|
||||
*
|
||||
* Usage:
|
||||
* node scripts/redact-log-pii.js [--dry-run] [--keep-raw] <file-or-dir> [...]
|
||||
* --dry-run report what would change, touch nothing
|
||||
* --keep-raw alongside the redacted file, keep <file>.raw-<epoch>
|
||||
* (WARNING: this preserves the PII you are trying to remove)
|
||||
*
|
||||
* Exit codes: 0 = success (incl. "nothing to do"), 1 = usage/IO error,
|
||||
* 2 = redaction ran but raw addresses remain (must not happen —
|
||||
* EMAIL_RE is total over its own match set).
|
||||
*/
|
||||
|
||||
'use strict';
|
||||
|
||||
const fs = require('fs');
|
||||
const path = require('path');
|
||||
|
||||
const { EMAIL_RE, maskEmailAddress } = require('../src/utils/logging');
|
||||
|
||||
const argv = process.argv.slice(2);
|
||||
const DRY_RUN = argv.includes('--dry-run');
|
||||
const KEEP_RAW = argv.includes('--keep-raw');
|
||||
const targets = argv.filter((a) => !a.startsWith('--'));
|
||||
|
||||
if (targets.length === 0) {
|
||||
console.error(
|
||||
'Usage: node scripts/redact-log-pii.js [--dry-run] [--keep-raw] <file-or-dir> [...]'
|
||||
);
|
||||
process.exit(1);
|
||||
}
|
||||
|
||||
// Directories this script will never touch, even when handed a directory.
|
||||
const SKIP_NAMES = new Set([
|
||||
'node_modules', '.git', 'coverage', '__tests__', 'dist', 'build',
|
||||
]);
|
||||
|
||||
// Log-line size guard: readline-style splitting is unbounded per line; a
|
||||
// pathological single-line file is instead processed as one segment. This is
|
||||
// only a memory guard, not a correctness limit — segments are redacted with
|
||||
// the same total function.
|
||||
function redactString(s, stats) {
|
||||
if (typeof s !== 'string' || !s.includes('@')) return s;
|
||||
// .replace() with a /g regex always starts at index 0 (resets lastIndex),
|
||||
// so sharing EMAIL_RE here is safe.
|
||||
const out = s.replace(EMAIL_RE, (addr) => {
|
||||
stats.addresses += 1;
|
||||
return maskEmailAddress(addr);
|
||||
});
|
||||
if (out !== s) stats.lines += 1;
|
||||
return out;
|
||||
}
|
||||
|
||||
function redactFile(filePath, dryRun, keepRaw, report) {
|
||||
const stat = fs.lstatSync(filePath);
|
||||
if (!stat.isFile()) {
|
||||
report.skipped.push(`${filePath} (not a regular file)`);
|
||||
return;
|
||||
}
|
||||
const raw = fs.readFileSync(filePath, 'utf8');
|
||||
const stats = { addresses: 0, lines: 0 };
|
||||
const out = redactString(raw, stats);
|
||||
if (out === raw) {
|
||||
report.clean.push(filePath);
|
||||
return; // byte-identical → never rewrite (preserves mtime, inode)
|
||||
}
|
||||
if (dryRun) {
|
||||
report.wouldRedact.push({ file: filePath, ...stats });
|
||||
return;
|
||||
}
|
||||
if (keepRaw) {
|
||||
fs.copyFileSync(filePath, `${filePath}.raw-${Math.floor(Date.now() / 1000)}`);
|
||||
}
|
||||
// Atomic rewrite: same-directory temp + fsync + rename.
|
||||
const tmp = path.join(
|
||||
path.dirname(filePath),
|
||||
`.${path.basename(filePath)}.redact-${process.pid}`
|
||||
);
|
||||
const fd = fs.openSync(tmp, 'wx', stat.mode);
|
||||
try {
|
||||
fs.writeSync(fd, out, null, 'utf8');
|
||||
fs.fsyncSync(fd);
|
||||
} finally {
|
||||
fs.closeSync(fd);
|
||||
}
|
||||
fs.renameSync(tmp, filePath);
|
||||
report.redacted.push({ file: filePath, ...stats });
|
||||
}
|
||||
|
||||
function walk(target, report) {
|
||||
let st;
|
||||
try {
|
||||
st = fs.lstatSync(target);
|
||||
} catch (e) {
|
||||
report.errors.push(`${target}: ${e.message}`);
|
||||
return;
|
||||
}
|
||||
if (st.isDirectory()) {
|
||||
for (const ent of fs.readdirSync(target, { withFileTypes: true })) {
|
||||
if (SKIP_NAMES.has(ent.name)) continue;
|
||||
walk(path.join(target, ent.name), report);
|
||||
}
|
||||
} else {
|
||||
try {
|
||||
redactFile(target, DRY_RUN, KEEP_RAW, report);
|
||||
} catch (e) {
|
||||
report.errors.push(`${target}: ${e.message}`);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
const report = { clean: [], redacted: [], wouldRedact: [], skipped: [], errors: [] };
|
||||
for (const t of targets) walk(t, report);
|
||||
|
||||
if (report.errors.length > 0) {
|
||||
for (const e of report.errors) console.error(`error: ${e}`);
|
||||
process.exit(1);
|
||||
}
|
||||
|
||||
for (const f of report.clean) console.log(`clean (nothing to redact): ${f}`);
|
||||
for (const r of report.wouldRedact)
|
||||
console.log(`would redact: ${r.file} (${r.addresses} addresses in ${r.lines} segments)`);
|
||||
for (const r of report.redacted)
|
||||
console.log(`redacted: ${r.file} (${r.addresses} addresses in ${r.lines} segments)`);
|
||||
|
||||
// Post-verify: after an actual run, no raw address may remain in any file we
|
||||
// redacted. This is a belt-and-braces check — mask output cannot re-match.
|
||||
if (!DRY_RUN) {
|
||||
let leaked = 0;
|
||||
for (const r of report.redacted) {
|
||||
const content = fs.readFileSync(r.file, 'utf8');
|
||||
const re = new RegExp(EMAIL_RE.source, EMAIL_RE.flags);
|
||||
if (re.test(content)) {
|
||||
console.error(`POST-VERIFY FAIL: raw addresses remain in ${r.file}`);
|
||||
leaked += 1;
|
||||
}
|
||||
}
|
||||
if (leaked > 0) process.exit(2);
|
||||
}
|
||||
|
||||
console.log('done.');
|
||||
@@ -105,7 +105,6 @@ const fs = require('fs');
|
||||
const path = require('path');
|
||||
const { generateCodes, loadSecret } = require('../license-keygen');
|
||||
const platformPaths = require('../platform-paths');
|
||||
const { atomicWriteJSON } = require('../src/utils/atomic-write');
|
||||
const catalog = require('../src/billing/catalog');
|
||||
const invoice = require('../src/billing/invoice');
|
||||
const { createFulfillmentStore, DELIVERY_LEASE_MS } = require('../src/billing/fulfillment-store');
|
||||
@@ -221,11 +220,10 @@ function readEvents() {
|
||||
}
|
||||
|
||||
function writeEvents(state) {
|
||||
// Canonical atomic writer (DC-099/DC-104): exclusive-create tmp + fsync +
|
||||
// rename + parent-dir fsync, 0600. Replaces the private tmp+rename copy —
|
||||
// a torn stripe-events.json silently drops event-ids, which makes a
|
||||
// Stripe retry re-run delivery (duplicate license email / duplicate key).
|
||||
atomicWriteJSON(EVENTS_FILE, state, { mode: 0o600 });
|
||||
// Atomic write: tmp + rename.
|
||||
const tmp = `${EVENTS_FILE}.tmp.${process.pid}.${Date.now()}`;
|
||||
fs.writeFileSync(tmp, JSON.stringify(state, null, 2) + '\n', { mode: 0o600 });
|
||||
fs.renameSync(tmp, EVENTS_FILE);
|
||||
}
|
||||
|
||||
function recordEvent(eventId, meta) {
|
||||
|
||||
@@ -235,9 +235,9 @@ async function createApp() {
|
||||
//
|
||||
// Path mapping (any -> canonical):
|
||||
// /api/auth/gate/<id> -> /api/v1/auth/gate/<id> (mounted at /auth/gate/:serviceId)
|
||||
// /api/v1/auth/gate/<id> -> (unchanged — already canonical, DC-111)
|
||||
// /api/v1/auth/gate/<id> -> /api/v1/auth/gate/<id> (drift, gate pre-1.5.0 sometimes used this)
|
||||
// /api/auth/app-token/<id> -> /api/v1/auth/app-token/<id> (mounted at /auth/app-token/:serviceId)
|
||||
// /api/v1/auth/app-token/<id> -> (unchanged — already canonical, DC-111)
|
||||
// /api/v1/auth/app-token/<id> -> /api/v1/auth/app-token/<id> (drift)
|
||||
// /api/auth/totp/check-session -> /api/v1/totp/check-session (mounted at /totp/check-session — no /auth prefix)
|
||||
// /api/v1/auth/totp/check-session->/api/v1/totp/check-session (drift)
|
||||
// /api/auth/sso-exchange -> /api/v1/auth/sso-exchange (mounted at /auth/sso-exchange, same shape as gate/app-token)
|
||||
@@ -254,14 +254,8 @@ async function createApp() {
|
||||
// — needs the same rewrite as gate/app-token, not the check-session one
|
||||
// (this route's canonical mount already includes /auth/).
|
||||
app.use((req, res, next) => {
|
||||
// DC-111: the '/api/v1/...' drift variants are ALREADY canonical — the
|
||||
// gate and app-token routes mount at /auth/* INSIDE the /api/v1 router.
|
||||
// DC-044 added them to the '/api' + slice(4) rewrite, which turned
|
||||
// /api/v1/auth/gate/plex into /api/v1/v1/auth/gate/plex → 401/404 for
|
||||
// every canonical-URI client (the exact drift case DC-044 meant to
|
||||
// tolerate). Only the legacy '/api/auth/...' shapes need rewriting.
|
||||
if (req.url.startsWith('/api/auth/gate/')
|
||||
|| req.url.startsWith('/api/auth/app-token/')
|
||||
if (req.url.startsWith('/api/auth/gate/') || req.url.startsWith('/api/v1/auth/gate/')
|
||||
|| req.url.startsWith('/api/auth/app-token/') || req.url.startsWith('/api/v1/auth/app-token/')
|
||||
|| req.url.startsWith('/api/auth/sso-exchange')) {
|
||||
req.url = '/api/v1' + req.url.slice(4); // '/api'.length === 4
|
||||
} else if (req.url.startsWith('/api/auth/totp/check-session')) {
|
||||
@@ -270,7 +264,6 @@ async function createApp() {
|
||||
req.url = '/api/v1' + req.url.slice(9); // '/api/auth'.length === 9
|
||||
} else if (req.url.startsWith('/api/v1/auth/totp/check-session')) {
|
||||
// Drift: /api/v1/auth/totp/check-session -> /api/v1/totp/check-session
|
||||
// (canonical route is /totp/check-session — genuinely different mount)
|
||||
// Drop the '/api/v1/auth' prefix (12 chars), keep the leading '/'.
|
||||
req.url = '/api/v1' + req.url.slice(12); // '/api/v1/auth'.length === 12
|
||||
}
|
||||
|
||||
@@ -10,8 +10,8 @@
|
||||
|
||||
const fs = require('fs');
|
||||
const path = require('path');
|
||||
const crypto = require('crypto');
|
||||
const platformPaths = require('../../platform-paths');
|
||||
const { atomicWriteJSON } = require('../utils/atomic-write');
|
||||
|
||||
const DELIVERY_LEASE_MS = 5 * 60 * 1000;
|
||||
|
||||
@@ -44,11 +44,15 @@ function createFulfillmentStore(options = {}) {
|
||||
function writeState(state) {
|
||||
const dir = path.dirname(filePath);
|
||||
fs.mkdirSync(dir, { recursive: true });
|
||||
// Canonical atomic-write (DC-099): fsync-before-rename + exclusive-create
|
||||
// tmp + dir fsync. A crash mid-write can no longer leave a torn
|
||||
// stripe-fulfillments.json — which would have forced the bridge to
|
||||
// re-mint a duplicate license key on the next webhook retry.
|
||||
atomicWriteJSON(filePath, state);
|
||||
const tmp = `${filePath}.tmp.${process.pid}.${Date.now()}.${crypto.randomBytes(4).toString('hex')}`;
|
||||
fs.writeFileSync(tmp, JSON.stringify(state, null, 2) + '\n', { mode: 0o600 });
|
||||
try {
|
||||
fs.renameSync(tmp, filePath);
|
||||
} catch (error) {
|
||||
try { fs.unlinkSync(tmp); } catch (_) { /* best effort */ }
|
||||
throw error;
|
||||
}
|
||||
try { fs.chmodSync(filePath, 0o600); } catch (_) { /* best effort */ }
|
||||
}
|
||||
|
||||
function mutate(mutator) {
|
||||
|
||||
@@ -13,6 +13,7 @@ const { loadAndMigrate, CURRENT_VERSION } = require('./migrations');
|
||||
|
||||
const siteConfig = {
|
||||
tld: '.home',
|
||||
caName: '',
|
||||
dnsServerIp: '',
|
||||
dnsServerPort: CADDY.DEFAULT_DNS_PORT,
|
||||
dashboardHost: '',
|
||||
@@ -26,6 +27,7 @@ const siteConfig = {
|
||||
function applyConfigFields(raw) {
|
||||
siteConfig.tld = raw.tld || '.home';
|
||||
if (!siteConfig.tld.startsWith('.')) siteConfig.tld = '.' + siteConfig.tld;
|
||||
siteConfig.caName = raw.caName || '';
|
||||
siteConfig.dnsServerIp = (raw.dns && raw.dns.ip) || '';
|
||||
siteConfig.dnsServerPort = (raw.dns && raw.dns.port) || CADDY.DEFAULT_DNS_PORT;
|
||||
siteConfig.dashboardHost = raw.dashboardHost || `status${siteConfig.tld}`;
|
||||
@@ -35,11 +37,6 @@ function applyConfigFields(raw) {
|
||||
siteConfig.domain = raw.domain || '';
|
||||
siteConfig.routingMode = raw.routingMode || 'subdomain';
|
||||
siteConfig.pylon = raw.pylon || null;
|
||||
// DC-096: `monitoring` was previously NOT copied out of raw config, so the
|
||||
// documented hardening option `monitoring: { public: false }` (middleware.js
|
||||
// MONITORING_PUBLIC) silently never applied — siteConfig.monitoring stayed
|
||||
// undefined forever. Copy it through so the middleware actually sees it.
|
||||
siteConfig.monitoring = raw.monitoring || null;
|
||||
}
|
||||
function validateAndLogConfig(raw, log) {
|
||||
const { valid, errors: configErrors, warnings: configWarnings } = validateConfig(raw);
|
||||
|
||||
@@ -8,7 +8,6 @@ const keychainManager = require('../security/keychain-manager');
|
||||
const cryptoUtils = require('../security/crypto-utils');
|
||||
const lockfile = require('proper-lockfile');
|
||||
const fs = require('fs');
|
||||
const { atomicWriteJSON } = require('../utils/atomic-write');
|
||||
const { log } = require('../utils/logging');
|
||||
const path = require('path');
|
||||
const platformPaths = require('../../platform-paths');
|
||||
@@ -176,7 +175,6 @@ class CredentialManager {
|
||||
*/
|
||||
async rotateEncryptionKey() {
|
||||
let release;
|
||||
let oldKey = null; // DC-107: hoisted so the catch can roll back
|
||||
try {
|
||||
log.info('cred', 'Starting encryption key rotation');
|
||||
|
||||
@@ -204,7 +202,7 @@ class CredentialManager {
|
||||
}
|
||||
|
||||
// Generate new key (this replaces the cached key and saves to disk)
|
||||
({ oldKey } = cryptoUtils.rotateKey());
|
||||
const { oldKey } = cryptoUtils.rotateKey();
|
||||
|
||||
// Re-encrypt all credentials with the new key
|
||||
const rotated = {};
|
||||
@@ -216,9 +214,8 @@ class CredentialManager {
|
||||
};
|
||||
}
|
||||
|
||||
// Save with new encryption (DC-106: canonical atomic-write; proper-lockfile
|
||||
// only tracks its own .lock dir, so the rename swap is lock-safe)
|
||||
atomicWriteJSON(CREDENTIALS_FILE, rotated, { mode: 0o600 });
|
||||
// Save with new encryption
|
||||
fs.writeFileSync(CREDENTIALS_FILE, JSON.stringify(rotated, null, 2), { mode: 0o600 });
|
||||
|
||||
// Clear cache to force reload
|
||||
this.cache.clear();
|
||||
@@ -226,24 +223,6 @@ class CredentialManager {
|
||||
log.info('cred', 'Rotated credentials', { count: keys.length });
|
||||
return true;
|
||||
} catch (error) {
|
||||
// DC-107: in-process rollback — the write above failed after rotateKey()
|
||||
// already swapped the on-disk key and in-memory cache. Restore the old
|
||||
// key so this process keeps running with a key that can still read the
|
||||
// on-disk credentials.json. (Hard-crash window between rotateKey() and
|
||||
// the atomic write is covered separately by the startup .bak fallback
|
||||
// in crypto-utils.loadOrCreateKey.)
|
||||
if (oldKey) {
|
||||
try {
|
||||
cryptoUtils.restoreKey(oldKey.toString('hex'));
|
||||
log.warn('cred', 'Rolled back encryption key after write failure');
|
||||
} catch (rollbackError) {
|
||||
// If THIS write fails too (or we hard-crash mid-rollback), restart
|
||||
// recovery is covered by the startup .bak fallback in
|
||||
// crypto-utils.loadOrCreateKey (KEY_FILE+.bak still holds the old
|
||||
// key from rotateKey's pre-swap save).
|
||||
log.error('cred', rollbackError, { operation: 'rotate-rollback' });
|
||||
}
|
||||
}
|
||||
log.error('cred', error, { operation: 'rotate' });
|
||||
return false;
|
||||
} finally {
|
||||
@@ -299,9 +278,7 @@ class CredentialManager {
|
||||
if (!fs.existsSync(dir)) {
|
||||
fs.mkdirSync(dir, { recursive: true });
|
||||
}
|
||||
// DC-106: canonical atomic-write — same wx/fsync/rename discipline as every
|
||||
// other store. '{}' initial payload; 0600 mode is atomicWriteFile's default.
|
||||
atomicWriteJSON(CREDENTIALS_FILE, {});
|
||||
fs.writeFileSync(CREDENTIALS_FILE, '{}', { mode: 0o600 });
|
||||
}
|
||||
}
|
||||
|
||||
@@ -319,10 +296,7 @@ class CredentialManager {
|
||||
const data = fs.readFileSync(CREDENTIALS_FILE, 'utf8');
|
||||
const credentials = JSON.parse(data);
|
||||
const updated = await updateFn(credentials);
|
||||
// DC-106: canonical atomic-write under the proper-lockfile lock — a crash
|
||||
// can no longer tear credentials.json mid-write (the lockfile dir is a
|
||||
// sibling of the target path, so the rename swap stays lock-safe).
|
||||
atomicWriteJSON(CREDENTIALS_FILE, updated, { mode: 0o600 });
|
||||
fs.writeFileSync(CREDENTIALS_FILE, JSON.stringify(updated, null, 2), { mode: 0o600 });
|
||||
return updated;
|
||||
} catch (error) {
|
||||
if (error.code === 'ELOCKED') {
|
||||
|
||||
@@ -5,9 +5,9 @@
|
||||
* Uses credential-manager for secure storage of activation tokens.
|
||||
*
|
||||
* Hybrid model:
|
||||
* - Server-managed installs validate and renew online with a stable key.
|
||||
* - Legacy installs without LICENSE_SERVER_URL retain offline HMAC validation.
|
||||
* - A cached online entitlement survives a temporary outage only until its cached expiry.
|
||||
* - First activation: online validation against license server (if reachable)
|
||||
* - Fallback: offline HMAC validation using embedded master secret hash
|
||||
* - Ongoing: locally stored activation token checked on each premium request
|
||||
*/
|
||||
|
||||
const crypto = require('crypto');
|
||||
@@ -35,8 +35,6 @@ class LicenseManager {
|
||||
this.activation = null; // Cached activation state
|
||||
this.masterSecretHash = null; // Loaded from shipped secret hash (not the secret itself)
|
||||
this._loaded = false;
|
||||
this._activationGeneration = 0;
|
||||
this._activationMutationQueue = Promise.resolve();
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -50,26 +48,6 @@ class LicenseManager {
|
||||
const stored = await this.credentialManager.retrieve(LICENSE_CRED_KEY);
|
||||
if (stored) {
|
||||
this.activation = JSON.parse(stored);
|
||||
if (!this._isStructurallyValidLoadedActivation()) {
|
||||
this.activation = null;
|
||||
try { await this.credentialManager.delete(LICENSE_CRED_KEY); } catch (_) { /* fail closed in memory */ }
|
||||
try { await this._updateConfig(true); } catch (_) { /* fail closed in memory */ }
|
||||
this._loaded = true;
|
||||
return;
|
||||
}
|
||||
if (await this._isRevocationTombstoned(this.activation.code)) {
|
||||
this.activation = null;
|
||||
try { await this.credentialManager.delete(LICENSE_CRED_KEY); } catch (_) { /* tombstone remains authoritative */ }
|
||||
try { await this._updateConfig(true); } catch (error) {
|
||||
this.log.warn?.('license', 'Could not persist inactive state after tombstone', { error: error.message });
|
||||
}
|
||||
this._loaded = true;
|
||||
return;
|
||||
}
|
||||
if (!await this._validateLoadedActivationForServerMode()) {
|
||||
this._loaded = true;
|
||||
return;
|
||||
}
|
||||
if (this.isExpired()) {
|
||||
this.log.info?.('license', 'License has expired', {
|
||||
code: this._maskCode(this.activation.code),
|
||||
@@ -83,7 +61,6 @@ class LicenseManager {
|
||||
});
|
||||
}
|
||||
this._loaded = true;
|
||||
this._startOnlineRefresh();
|
||||
return;
|
||||
}
|
||||
} catch (error) {
|
||||
@@ -96,28 +73,7 @@ class LicenseManager {
|
||||
const data = await fsp.readFile(this.configFile, 'utf8');
|
||||
const config = JSON.parse(data);
|
||||
if (config.licenseBackup) {
|
||||
// Server-managed entitlements are never restored from plaintext config backup.
|
||||
// Only the credential store plus online validation/bounded cache is authoritative.
|
||||
if (LICENSE_SERVER_URL) {
|
||||
this.log.warn?.('license', 'Ignoring config license backup in server-managed mode');
|
||||
this._loaded = true;
|
||||
return;
|
||||
}
|
||||
this.activation = config.licenseBackup;
|
||||
if (!this._isStructurallyValidLoadedActivation()) {
|
||||
this.activation = null;
|
||||
this._loaded = true;
|
||||
return;
|
||||
}
|
||||
if (await this._isRevocationTombstoned(this.activation.code)) {
|
||||
this.activation = null;
|
||||
this._loaded = true;
|
||||
return;
|
||||
}
|
||||
if (!await this._validateLoadedActivationForServerMode()) {
|
||||
this._loaded = true;
|
||||
return;
|
||||
}
|
||||
this.log.info?.('license', 'License restored from config backup', {
|
||||
code: this._maskCode(this.activation.code),
|
||||
lifetime: this.activation.lifetime
|
||||
@@ -130,7 +86,6 @@ class LicenseManager {
|
||||
this.log.warn?.('license', 'Could not re-store license in credential manager', { error: storeErr.message });
|
||||
}
|
||||
this._loaded = true;
|
||||
this._startOnlineRefresh();
|
||||
return;
|
||||
}
|
||||
} catch (_) {
|
||||
@@ -192,11 +147,6 @@ class LicenseManager {
|
||||
* @returns {Object} { success, message, activation? }
|
||||
*/
|
||||
async activate(code) {
|
||||
const previousMutation = this._activationMutationQueue;
|
||||
let releaseMutation;
|
||||
this._activationMutationQueue = new Promise((resolve) => { releaseMutation = resolve; });
|
||||
await previousMutation;
|
||||
try {
|
||||
if (!code || typeof code !== 'string') {
|
||||
return { success: false, message: 'License code is required' };
|
||||
}
|
||||
@@ -206,12 +156,9 @@ class LicenseManager {
|
||||
if (!code.startsWith('DC-')) {
|
||||
return { success: false, message: 'Invalid code format. Codes start with DC-' };
|
||||
}
|
||||
if (this._refreshInFlight) await this._refreshInFlight;
|
||||
this._activationGeneration++;
|
||||
const previousActivation = this.activation;
|
||||
|
||||
// Check if already activated with this code
|
||||
if (this.activation && this.activation.code === code && !this.isExpired() && !LICENSE_SERVER_URL) {
|
||||
if (this.activation && this.activation.code === code && !this.isExpired()) {
|
||||
return {
|
||||
success: true,
|
||||
message: 'This code is already activated',
|
||||
@@ -224,31 +171,17 @@ class LicenseManager {
|
||||
if (LICENSE_SERVER_URL) {
|
||||
onlineResult = await this._validateOnline(code);
|
||||
if (onlineResult && !onlineResult.success) {
|
||||
// Server explicitly rejected — revoke any matching cached entitlement.
|
||||
if (this.activation?.code === code) await this._revokeCachedEntitlement(onlineResult.message);
|
||||
// Server explicitly rejected — don't fallback to offline
|
||||
return onlineResult;
|
||||
}
|
||||
if (!onlineResult) {
|
||||
if (this.activation && this.activation.code === code && this._isValidBoundedOnlineCache()) {
|
||||
return {
|
||||
success: true,
|
||||
message: 'License server unavailable; using the last online entitlement until its cached expiry',
|
||||
activation: this.getStatus()
|
||||
};
|
||||
}
|
||||
return { success: false, message: 'License server is temporarily unavailable. Try again shortly.' };
|
||||
}
|
||||
}
|
||||
|
||||
// Offline validation (HMAC check)
|
||||
if (!onlineResult && !LICENSE_SERVER_URL) {
|
||||
if (!onlineResult) {
|
||||
const offlineResult = this._validateOffline(code);
|
||||
if (!offlineResult.valid) {
|
||||
return { success: false, message: offlineResult.reason || 'Invalid license code' };
|
||||
}
|
||||
if (offlineResult.expired) {
|
||||
return { success: false, message: 'License code has expired' };
|
||||
}
|
||||
|
||||
// DC-052: LIFETIME keys are creator-only. Reject any lifetime code
|
||||
// unless ALLOW_LIFETIME_LICENSE=true is set on this host (Sami's
|
||||
@@ -270,7 +203,7 @@ class LicenseManager {
|
||||
const now = new Date();
|
||||
const expiresAt = isLifetime
|
||||
? new Date('2099-12-31T23:59:59.999Z')
|
||||
: new Date(offlineResult.expiresAt);
|
||||
: new Date(now.getTime() + offlineResult.durationDays * 86400000);
|
||||
|
||||
this.activation = {
|
||||
code,
|
||||
@@ -287,7 +220,6 @@ class LicenseManager {
|
||||
// Online validation succeeded — use server response
|
||||
this.activation = onlineResult.activation;
|
||||
this.activation.validationMethod = 'online';
|
||||
this.activation.lastOnlineValidatedAt = new Date().toISOString();
|
||||
}
|
||||
|
||||
// Store activation token
|
||||
@@ -296,16 +228,13 @@ class LicenseManager {
|
||||
activatedAt: this.activation.activatedAt,
|
||||
expiresAt: this.activation.expiresAt
|
||||
});
|
||||
await this._clearRevocationTombstone();
|
||||
} catch (error) {
|
||||
this.activation = previousActivation || null;
|
||||
this.log.error?.('license', 'Failed to store activation', { error: error.message });
|
||||
return { success: false, message: 'License validated but failed to save activation' };
|
||||
}
|
||||
|
||||
// Update config.json with license info (non-sensitive)
|
||||
await this._updateConfig();
|
||||
this._startOnlineRefresh();
|
||||
|
||||
this.log.info?.('license', 'License activated', {
|
||||
code: this._maskCode(code),
|
||||
@@ -320,9 +249,6 @@ class LicenseManager {
|
||||
message: `License activated for ${durationLabel}`,
|
||||
activation: this.getStatus()
|
||||
};
|
||||
} finally {
|
||||
releaseMutation();
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -330,19 +256,9 @@ class LicenseManager {
|
||||
* @returns {Object} { success, message }
|
||||
*/
|
||||
async deactivate() {
|
||||
const previousMutation = this._activationMutationQueue;
|
||||
let releaseMutation;
|
||||
this._activationMutationQueue = new Promise((resolve) => { releaseMutation = resolve; });
|
||||
await previousMutation;
|
||||
try {
|
||||
if (!this.activation) {
|
||||
return { success: false, message: 'No active license to deactivate' };
|
||||
}
|
||||
if (this._refreshInFlight) await this._refreshInFlight;
|
||||
if (!this.activation) {
|
||||
return { success: false, message: 'License was already revoked during online refresh' };
|
||||
}
|
||||
this._activationGeneration++;
|
||||
|
||||
const code = this._maskCode(this.activation.code);
|
||||
|
||||
@@ -358,18 +274,11 @@ class LicenseManager {
|
||||
// Clear local activation
|
||||
await this.credentialManager.delete(LICENSE_CRED_KEY);
|
||||
this.activation = null;
|
||||
if (this._onlineRefreshTimer) {
|
||||
clearInterval(this._onlineRefreshTimer);
|
||||
this._onlineRefreshTimer = null;
|
||||
}
|
||||
await this._updateConfig();
|
||||
|
||||
this.log.info?.('license', 'License deactivated', { code });
|
||||
|
||||
return { success: true, message: 'License deactivated. You can reuse this code on another machine.' };
|
||||
} finally {
|
||||
releaseMutation();
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -406,240 +315,6 @@ class LicenseManager {
|
||||
};
|
||||
}
|
||||
|
||||
/** Refresh a server-managed entitlement without changing its stable key. */
|
||||
async refreshOnline(force = false) {
|
||||
await this._activationMutationQueue;
|
||||
if (!LICENSE_SERVER_URL || !this.activation?.code) return false;
|
||||
const last = new Date(this.activation.lastOnlineValidatedAt || 0).getTime();
|
||||
if (!force && Date.now() - last < 60 * 60 * 1000) return true;
|
||||
if (this._refreshInFlight) return this._refreshInFlight;
|
||||
this._refreshInFlight = (async () => {
|
||||
const generation = this._activationGeneration;
|
||||
const refreshingCode = this.activation.code;
|
||||
const originalActivatedAt = this.activation.activatedAt;
|
||||
const result = await this._validateOnline(refreshingCode);
|
||||
if (generation !== this._activationGeneration || this.activation?.code !== refreshingCode) return false;
|
||||
if (result === null) return false;
|
||||
if (!result.success) {
|
||||
this.log.warn?.('license', 'License server explicitly rejected cached entitlement', { message: result.message });
|
||||
await this._revokeCachedEntitlement(result.message);
|
||||
return false;
|
||||
}
|
||||
this.activation = {
|
||||
...this.activation,
|
||||
...result.activation,
|
||||
activatedAt: originalActivatedAt || result.activation.activatedAt,
|
||||
validationMethod: 'online',
|
||||
lastOnlineValidatedAt: new Date().toISOString()
|
||||
};
|
||||
await this.credentialManager.store(LICENSE_CRED_KEY, JSON.stringify(this.activation), {
|
||||
activatedAt: this.activation.activatedAt,
|
||||
expiresAt: this.activation.expiresAt
|
||||
});
|
||||
await this._clearRevocationTombstone();
|
||||
await this._updateConfig();
|
||||
return true;
|
||||
})();
|
||||
try {
|
||||
return await this._refreshInFlight;
|
||||
} finally {
|
||||
this._refreshInFlight = null;
|
||||
}
|
||||
}
|
||||
|
||||
_startOnlineRefresh() {
|
||||
if (!LICENSE_SERVER_URL || this._onlineRefreshTimer) return;
|
||||
this._onlineRefreshTimer = setInterval(() => {
|
||||
this.refreshOnline(true).catch((error) => {
|
||||
this.log.warn?.('license', 'Periodic online entitlement refresh failed', { error: error.message });
|
||||
});
|
||||
}, 15 * 60 * 1000);
|
||||
this._onlineRefreshTimer.unref?.();
|
||||
}
|
||||
|
||||
_startStartupRecovery() {
|
||||
if (this._startupRecoveryTimer || !this._pendingStartupCode) return;
|
||||
this._startupRecoveryTimer = setInterval(() => {
|
||||
this._retryStartupValidation().catch((error) => {
|
||||
this.log.warn?.('license', 'Startup license recovery retry failed', { error: error.message });
|
||||
});
|
||||
}, 60 * 1000);
|
||||
this._startupRecoveryTimer.unref?.();
|
||||
}
|
||||
|
||||
async _retryStartupValidation() {
|
||||
if (!this._pendingStartupCode || this.activation) return false;
|
||||
const code = this._pendingStartupCode;
|
||||
const result = await this._validateOnline(code);
|
||||
if (result === null) return false;
|
||||
if (!result.success) {
|
||||
const stored = await this.credentialManager.retrieve(LICENSE_CRED_KEY);
|
||||
try { this.activation = stored ? JSON.parse(stored) : { code }; } catch (_) { this.activation = { code }; }
|
||||
await this._revokeCachedEntitlement(result.message || 'Server rejected entitlement');
|
||||
this._pendingStartupCode = null;
|
||||
clearInterval(this._startupRecoveryTimer);
|
||||
this._startupRecoveryTimer = null;
|
||||
return false;
|
||||
}
|
||||
const nextActivation = {
|
||||
...result.activation,
|
||||
validationMethod: 'online',
|
||||
lastOnlineValidatedAt: new Date().toISOString()
|
||||
};
|
||||
const previousStored = await this.credentialManager.retrieve(LICENSE_CRED_KEY);
|
||||
try {
|
||||
await this.credentialManager.store(LICENSE_CRED_KEY, JSON.stringify(nextActivation));
|
||||
this.activation = nextActivation;
|
||||
await this._updateConfig(true);
|
||||
} catch (error) {
|
||||
this.activation = null;
|
||||
try {
|
||||
if (previousStored) await this.credentialManager.store(LICENSE_CRED_KEY, previousStored);
|
||||
else await this.credentialManager.delete(LICENSE_CRED_KEY);
|
||||
} catch (rollbackError) {
|
||||
this.log.error?.('license', 'Recovery credential rollback failed; startup validation will still fail closed', { error: rollbackError.message });
|
||||
}
|
||||
this.log.warn?.('license', 'Recovered entitlement could not be committed; remaining fail-closed', { error: error.message });
|
||||
return false;
|
||||
}
|
||||
this._pendingStartupCode = null;
|
||||
clearInterval(this._startupRecoveryTimer);
|
||||
this._startupRecoveryTimer = null;
|
||||
this._startOnlineRefresh();
|
||||
return true;
|
||||
}
|
||||
|
||||
async _validateLoadedActivationForServerMode() {
|
||||
if (!LICENSE_SERVER_URL || !this.activation) return true;
|
||||
const cachedWasOnline = this.activation.validationMethod === 'online';
|
||||
const result = await this._validateOnline(this.activation.code);
|
||||
// Startup always requires a live server decision. Bounded cached access is
|
||||
// only an in-process outage bridge; it is never trusted across restart.
|
||||
if (result === null) {
|
||||
// Fail closed now, preserve a validated-online credential, and retry in
|
||||
// this process so connectivity recovery does not require a restart.
|
||||
const pendingCode = this.activation.code;
|
||||
this.activation = null;
|
||||
if (!cachedWasOnline) {
|
||||
try { await this.credentialManager.delete(LICENSE_CRED_KEY); } catch (_) { /* remains quarantined */ }
|
||||
}
|
||||
try { await this._updateConfig(true); } catch (error) {
|
||||
this.log.warn?.('license', 'Could not persist startup outage state', { error: error.message });
|
||||
}
|
||||
if (cachedWasOnline) {
|
||||
this._pendingStartupCode = pendingCode;
|
||||
this._startStartupRecovery();
|
||||
}
|
||||
return false;
|
||||
}
|
||||
if (!result?.success) {
|
||||
await this._revokeCachedEntitlement(result?.message || 'Server validation required');
|
||||
return false;
|
||||
}
|
||||
this.activation = {
|
||||
...this.activation,
|
||||
...result.activation,
|
||||
validationMethod: 'online',
|
||||
lastOnlineValidatedAt: new Date().toISOString()
|
||||
};
|
||||
await this.credentialManager.store(LICENSE_CRED_KEY, JSON.stringify(this.activation));
|
||||
await this._clearRevocationTombstone();
|
||||
await this._updateConfig();
|
||||
return true;
|
||||
}
|
||||
|
||||
async _revokeCachedEntitlement(reason) {
|
||||
const rejectedCode = this.activation?.code;
|
||||
this.activation = null;
|
||||
if (rejectedCode) {
|
||||
try {
|
||||
await this._writeRevocationTombstone(rejectedCode, reason);
|
||||
} catch (error) {
|
||||
this.log.error?.('license', 'CRITICAL: rejected entitlement could not be tombstoned; remaining fail-closed in memory', { error: error.message });
|
||||
}
|
||||
}
|
||||
try {
|
||||
await this.credentialManager.delete(LICENSE_CRED_KEY);
|
||||
} catch (error) {
|
||||
this.log.warn?.('license', 'Could not delete rejected entitlement from credential store', { error: error.message });
|
||||
}
|
||||
try {
|
||||
await this._updateConfig(true);
|
||||
} catch (error) {
|
||||
this.log.warn?.('license', 'Could not update config after entitlement rejection', { error: error.message });
|
||||
}
|
||||
this.log.warn?.('license', 'Cached entitlement revoked', { reason });
|
||||
}
|
||||
|
||||
_revocationTombstonePath() {
|
||||
return `${this.configFile}.license-revoked`;
|
||||
}
|
||||
|
||||
_codeDigest(code) {
|
||||
return crypto.createHash('sha256').update(String(code || '')).digest('hex');
|
||||
}
|
||||
|
||||
async _writeRevocationTombstone(code, reason) {
|
||||
const tombstone = JSON.stringify({
|
||||
codeHash: this._codeDigest(code),
|
||||
revokedAt: new Date().toISOString(),
|
||||
reason
|
||||
});
|
||||
const target = this._revocationTombstonePath();
|
||||
const temp = `${target}.${process.pid}.${Date.now()}.tmp`;
|
||||
let handle;
|
||||
try {
|
||||
handle = await fs.promises.open(temp, 'wx', 0o600);
|
||||
await handle.writeFile(tombstone, 'utf8');
|
||||
await handle.sync();
|
||||
await handle.close();
|
||||
handle = null;
|
||||
await fs.promises.rename(temp, target);
|
||||
const dirHandle = await fs.promises.open(path.dirname(target), 'r');
|
||||
try { await dirHandle.sync(); } finally { await dirHandle.close(); }
|
||||
} catch (error) {
|
||||
if (handle) await handle.close().catch(() => {});
|
||||
await fs.promises.unlink(temp).catch(() => {});
|
||||
throw error;
|
||||
}
|
||||
}
|
||||
|
||||
async _isRevocationTombstoned(code) {
|
||||
try {
|
||||
const data = JSON.parse(await fs.promises.readFile(this._revocationTombstonePath(), 'utf8'));
|
||||
return data.codeHash === this._codeDigest(code);
|
||||
} catch (error) {
|
||||
if (error.code === 'ENOENT') return false;
|
||||
// Corrupt/unreadable marker is fail-closed: never resurrect cached premium access.
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
async _clearRevocationTombstone() {
|
||||
try {
|
||||
await fs.promises.unlink(this._revocationTombstonePath());
|
||||
} catch (error) {
|
||||
if (error.code !== 'ENOENT') throw error;
|
||||
}
|
||||
}
|
||||
|
||||
_isValidBoundedOnlineCache() {
|
||||
if (!this.activation || this.activation.validationMethod !== 'online') return false;
|
||||
const expiryMs = new Date(this.activation.expiresAt).getTime();
|
||||
const validatedAtMs = new Date(this.activation.lastOnlineValidatedAt || this.activation.activatedAt).getTime();
|
||||
const durationDays = Number(this.activation.durationDays);
|
||||
const validFeatures = Array.isArray(this.activation.features)
|
||||
&& this.activation.features.every((item) => typeof item === 'string');
|
||||
return Number.isFinite(expiryMs)
|
||||
&& Number.isFinite(validatedAtMs)
|
||||
&& expiryMs > Date.now()
|
||||
&& Number.isInteger(durationDays)
|
||||
&& durationDays > 0
|
||||
&& durationDays <= 3650
|
||||
&& expiryMs <= validatedAtMs + (durationDays + 1) * 24 * 60 * 60 * 1000
|
||||
&& validFeatures;
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if a specific premium feature is available
|
||||
* @param {string} feature - Feature key (e.g., 'sso', 'recipes', 'swarm')
|
||||
@@ -683,27 +358,10 @@ class LicenseManager {
|
||||
*/
|
||||
isExpired() {
|
||||
if (!this.activation) return true;
|
||||
if (this.activation.validationMethod === 'online') {
|
||||
const expiryMs = new Date(this.activation.expiresAt).getTime();
|
||||
return !Number.isFinite(expiryMs) || expiryMs <= Date.now();
|
||||
}
|
||||
// Lifetime must be explicitly signed/recorded as lifetime, not inferred from a zero.
|
||||
if (this.activation.lifetime === true && this.activation.durationDays === 0) return false;
|
||||
const expiryMs = new Date(this.activation.expiresAt).getTime();
|
||||
if (!Number.isFinite(expiryMs)) return true;
|
||||
return Date.now() > expiryMs;
|
||||
}
|
||||
|
||||
_isStructurallyValidLoadedActivation() {
|
||||
const value = this.activation;
|
||||
if (!value || typeof value.code !== 'string' || !value.code.startsWith('DC-')) return false;
|
||||
if (!Array.isArray(value.features) || !value.features.every((feature) => typeof feature === 'string')) return false;
|
||||
if (value.validationMethod === 'online') return this._isValidBoundedOnlineCache();
|
||||
if (value.validationMethod !== 'offline') return false;
|
||||
if (value.lifetime === true) return value.durationDays === 0;
|
||||
if (!Number.isInteger(value.durationDays) || value.durationDays <= 0) return false;
|
||||
const expiryMs = new Date(value.expiresAt).getTime();
|
||||
return Number.isFinite(expiryMs) && expiryMs > Date.now();
|
||||
// Lifetime licenses never expire
|
||||
if (this.activation.lifetime || this.activation.durationDays === 0) return false;
|
||||
if (!this.activation.expiresAt) return false; // No expiry set = lifetime
|
||||
return Date.now() > new Date(this.activation.expiresAt).getTime();
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -777,51 +435,30 @@ class LicenseManager {
|
||||
|
||||
if (!response.ok) {
|
||||
const data = await response.json().catch(() => ({}));
|
||||
const authoritativeStatuses = new Set([400, 401, 403, 404, 409, 410, 422]);
|
||||
if (authoritativeStatuses.has(response.status)) {
|
||||
return { success: false, message: data.error || `Server returned ${response.status}` };
|
||||
}
|
||||
this.log.warn?.('license', 'License server returned a retryable status', { status: response.status });
|
||||
return null;
|
||||
return { success: false, message: data.error || `Server returned ${response.status}` };
|
||||
}
|
||||
|
||||
const data = await response.json();
|
||||
if (data.success) {
|
||||
const expiryMs = typeof data.expiresAt === 'string' ? new Date(data.expiresAt).getTime() : NaN;
|
||||
const durationDays = Number(data.durationDays);
|
||||
const validFeatures = Array.isArray(data.features) && data.features.every((item) => typeof item === 'string');
|
||||
const maxExpiryMs = Date.now() + (durationDays + 1) * 24 * 60 * 60 * 1000;
|
||||
if (!Number.isFinite(expiryMs) || expiryMs <= Date.now()
|
||||
|| expiryMs > maxExpiryMs
|
||||
|| !Number.isInteger(durationDays) || durationDays <= 0 || durationDays > 3650
|
||||
|| !validFeatures) {
|
||||
this.log.warn?.('license', 'License server returned a malformed success response');
|
||||
return null;
|
||||
}
|
||||
return {
|
||||
success: true,
|
||||
activation: {
|
||||
code,
|
||||
codeId: data.codeId,
|
||||
durationDays,
|
||||
durationDays: data.durationDays,
|
||||
activatedAt: new Date().toISOString(),
|
||||
expiresAt: data.expiresAt,
|
||||
machineId,
|
||||
features: data.features,
|
||||
serverToken: data.token || null
|
||||
features: data.features || Object.keys(PREMIUM_FEATURES),
|
||||
serverToken: data.token
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
if (data.success === false && (typeof data.error === 'string' || typeof data.message === 'string')) {
|
||||
return { success: false, message: data.error || data.message };
|
||||
}
|
||||
this.log.warn?.('license', 'License server returned an ambiguous HTTP 200 response');
|
||||
return null;
|
||||
return { success: false, message: data.message || 'License server rejected the code' };
|
||||
} catch (error) {
|
||||
// Server unreachable — keep only a previously online-validated cached
|
||||
// entitlement, bounded by its last server-provided expiry.
|
||||
this.log.warn?.('license', 'License server unreachable', {
|
||||
// Server unreachable — return null to fallback to offline
|
||||
this.log.warn?.('license', 'License server unreachable, falling back to offline validation', {
|
||||
error: error.message
|
||||
});
|
||||
return null;
|
||||
@@ -846,10 +483,11 @@ class LicenseManager {
|
||||
}
|
||||
|
||||
/**
|
||||
* Update config.json with license summary. Legacy offline mode also stores
|
||||
* a backup; server-managed mode keeps activation tokens only in credentials.
|
||||
* Update config.json with license info and full activation backup.
|
||||
* The backup ensures the license survives encryption key changes
|
||||
* (e.g. container rebuilds that generate new keys).
|
||||
*/
|
||||
async _updateConfig(throwOnError = false) {
|
||||
async _updateConfig() {
|
||||
try {
|
||||
const fsp = require('fs').promises;
|
||||
let config = {};
|
||||
@@ -869,8 +507,7 @@ class LicenseManager {
|
||||
features: this.activation.features || Object.keys(PREMIUM_FEATURES)
|
||||
};
|
||||
// Full backup of activation data (config.json is volume-mounted and persists)
|
||||
if (LICENSE_SERVER_URL) delete config.licenseBackup;
|
||||
else config.licenseBackup = this.activation;
|
||||
config.licenseBackup = this.activation;
|
||||
} else {
|
||||
config.license = { active: false, tier: 'free' };
|
||||
delete config.licenseBackup;
|
||||
@@ -880,7 +517,6 @@ class LicenseManager {
|
||||
await fsp.writeFile(this.configFile, JSON.stringify(config, null, 2), 'utf8');
|
||||
} catch (error) {
|
||||
this.log.error?.('license', 'Failed to update config with license info', { error: error.message });
|
||||
if (throwOnError) throw error;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -6,7 +6,6 @@ const EventEmitter = require('events');
|
||||
const fs = require('fs');
|
||||
const path = require('path');
|
||||
const nodemailer = require('nodemailer');
|
||||
const { atomicWriteJSON } = require('../utils/atomic-write');
|
||||
|
||||
// Canonical event names are kebab-case ('container-down'). Emitters and the
|
||||
// settings UI historically send camelCase ('containerDown', 'deploymentSuccess')
|
||||
@@ -16,8 +15,6 @@ const { atomicWriteJSON } = require('../utils/atomic-write');
|
||||
// 'auto-restart' (resource-monitor.js) were absent from DEFAULT events and
|
||||
// silently dropped, and UI camelCase toggles never reached the kebab keys the
|
||||
// gate reads — the toggles were cosmetic.
|
||||
// DC-094: recipe emitters used 'recipeRemoved' (camelCase) — alias onto the
|
||||
// canonical kebab key like every other spelling drift before it.
|
||||
const EVENT_ALIASES = {
|
||||
containerDown: 'container-down',
|
||||
containerUp: 'container-up',
|
||||
@@ -30,11 +27,6 @@ const EVENT_ALIASES = {
|
||||
backupComplete: 'backup-complete',
|
||||
backupFailed: 'backup-failed',
|
||||
autoRestart: 'auto-restart',
|
||||
recipeRemoved: 'recipe-removed',
|
||||
// DC-094: dependency-manager fires two spellings; one canonical toggle
|
||||
// gates both (stored configs with either key fold onto it at load).
|
||||
'dependency-restart-complete': 'dependency-restart',
|
||||
'dependency-restart-failed': 'dependency-restart',
|
||||
};
|
||||
|
||||
const DEFAULT_CONFIG = {
|
||||
@@ -57,23 +49,7 @@ const DEFAULT_CONFIG = {
|
||||
// silently dropped before this fix.
|
||||
'deploy-success': true,
|
||||
'deploy-failed': true,
|
||||
'auto-restart': true,
|
||||
// DC-094: seven more emitters were absent from DEFAULT events, so the
|
||||
// send() gate (config.events[canonical] !== true) silently dropped every
|
||||
// one of them: SSL expiry warnings, DNS propagation results, config
|
||||
// drift alerts, dependency restart results, recipe removals, and
|
||||
// workflow notify actions. All default ON — every one of these fires
|
||||
// only when something actually happened (and workflow notify actions
|
||||
// are explicitly authored by the operator, so an off-by-default gate
|
||||
// would just re-create this same silent-death bug). Recipe DEPLOY
|
||||
// notifications need no key: recipes/deploy.js emits the
|
||||
// deploymentSuccess/deploymentFailed aliases → deploy-success/failed.
|
||||
'ssl-cert-expiry': true,
|
||||
'dns-propagation': true,
|
||||
'drift-detected': true,
|
||||
'dependency-restart': true,
|
||||
'recipe-removed': true,
|
||||
'workflow': true
|
||||
'auto-restart': true
|
||||
}
|
||||
};
|
||||
|
||||
@@ -99,43 +75,15 @@ class NotificationManager extends EventEmitter {
|
||||
_loadConfig() {
|
||||
try {
|
||||
if (fs.existsSync(this.NOTIFICATIONS_FILE)) {
|
||||
const raw = fs.readFileSync(this.NOTIFICATIONS_FILE, 'utf8');
|
||||
const data = JSON.parse(raw);
|
||||
const data = JSON.parse(fs.readFileSync(this.NOTIFICATIONS_FILE, 'utf8'));
|
||||
this._canonicalizeLegacyKeys(data);
|
||||
this.config = this._mergeConfig(DEFAULT_CONFIG, data);
|
||||
this._persistCanonicalForm(raw);
|
||||
}
|
||||
} catch (error) {
|
||||
this.log.error('notification', error, null, { note: 'Failed to load config' });
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* DC-097: _canonicalizeLegacyKeys only fixed the file in memory — the
|
||||
* on-disk file kept its legacy spellings (email user/pass, camelCase
|
||||
* event keys, string `secure`) until the next explicit UI save, so any
|
||||
* pre-DC-092 file stayed stale forever on installs that never touch the
|
||||
* settings page. After the defaults merge, persist the canonical form
|
||||
* whenever it differs from what is on disk. Best-effort: the config is
|
||||
* already correct in memory, so a write failure (read-only mount, EACCES)
|
||||
* must never block startup — warn and continue. Idempotent: once written,
|
||||
* the re-serialized form matches the file byte-for-byte and no further
|
||||
* writes happen on subsequent loads.
|
||||
*/
|
||||
_persistCanonicalForm(rawFileContents) {
|
||||
try {
|
||||
const canonical = JSON.stringify(this.config, null, 2);
|
||||
if (canonical !== rawFileContents) {
|
||||
// DC-099: tmp+fsync+rename — a crash mid-write can no longer leave a
|
||||
// truncated/empty notifications.json (plain writeFileSync could).
|
||||
atomicWriteJSON(this.NOTIFICATIONS_FILE, this.config);
|
||||
this.log.info?.('notification', 'Notification config canonicalized on disk (legacy keys normalized)', {});
|
||||
}
|
||||
} catch (writeError) {
|
||||
this.log.warn?.('notification', 'Failed to persist canonicalized notification config; continuing with in-memory config', { error: writeError?.message || String(writeError) });
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* DC-092: configs saved by older clients may contain the legacy spellings
|
||||
* the old POST /config merged verbatim — email.user/email.pass instead of
|
||||
@@ -201,9 +149,7 @@ class NotificationManager extends EventEmitter {
|
||||
if (!fs.existsSync(dir)) {
|
||||
fs.mkdirSync(dir, { recursive: true });
|
||||
}
|
||||
// DC-099: atomic tmp+fsync+rename — the UI save path gets the same
|
||||
// crash-safety as the load-path write-back (no torn notifications.json).
|
||||
atomicWriteJSON(this.NOTIFICATIONS_FILE, this.config);
|
||||
fs.writeFileSync(this.NOTIFICATIONS_FILE, JSON.stringify(this.config, null, 2));
|
||||
return true;
|
||||
} catch (error) {
|
||||
this.log.error('notification', error, null, { note: 'Failed to save config' });
|
||||
@@ -243,25 +189,6 @@ class NotificationManager extends EventEmitter {
|
||||
* Send notification via all enabled providers
|
||||
*/
|
||||
async send(event, data, type = 'info') {
|
||||
// DC-094: nine in-repo call sites used a legacy 4-arg shape
|
||||
// send(event, title, message, type) against this 3-arg signature, so the
|
||||
// message string silently landed in the `type` slot (Discord embed color
|
||||
// fell back to info-blue) and providers received the TITLE as the body —
|
||||
// deploy-failure notifications lost the actual error text entirely. The
|
||||
// in-repo sites are fixed at source; this shim stays so any external
|
||||
// caller of the same legacy shape keeps working instead of silently
|
||||
// degrading again. Guarded on typeof data === 'string': the legacy shape
|
||||
// always passed a string title as arg 2, so a hypothetical
|
||||
// send(event, {...}, type, extra) call is left untouched rather than
|
||||
// mangled by the rewrite.
|
||||
if (arguments.length >= 4 && typeof data === 'string') {
|
||||
const legacyTitle = data;
|
||||
const legacyMessage = type;
|
||||
const legacyType = arguments[3];
|
||||
data = { title: legacyTitle, text: legacyMessage };
|
||||
type = legacyType || 'info';
|
||||
}
|
||||
|
||||
if (!this.config.enabled) {
|
||||
return { success: false, error: 'Notifications disabled' };
|
||||
}
|
||||
@@ -277,12 +204,6 @@ class NotificationManager extends EventEmitter {
|
||||
return { success: false, error: `Event ${canonical} not enabled` };
|
||||
}
|
||||
|
||||
// Provider-facing title: an explicit data.title (legacy 4-arg callers
|
||||
// passed a specific one, e.g. "Recipe Deployed") beats the generic
|
||||
// per-event title.
|
||||
const title = (data && typeof data === 'object' && typeof data.title === 'string' && data.title)
|
||||
|| this._formatTitle(canonical);
|
||||
|
||||
const results = [];
|
||||
const providers = this.config.providers;
|
||||
|
||||
@@ -309,7 +230,7 @@ class NotificationManager extends EventEmitter {
|
||||
// ntfy
|
||||
if (providers.ntfy?.enabled && providers.ntfy?.topic) {
|
||||
try {
|
||||
const result = await this.sendNtfy(this._formatText(data, canonical), title);
|
||||
const result = await this.sendNtfy(this._formatText(data, canonical), this._formatTitle(canonical));
|
||||
results.push({ provider: 'ntfy', ...result });
|
||||
} catch (error) {
|
||||
results.push({ provider: 'ntfy', success: false, error: error.message });
|
||||
@@ -320,7 +241,7 @@ class NotificationManager extends EventEmitter {
|
||||
if (providers.email?.enabled && providers.email?.host && providers.email?.to) {
|
||||
try {
|
||||
const result = await this.sendEmail(
|
||||
title,
|
||||
this._formatTitle(canonical),
|
||||
this._formatText(data, canonical)
|
||||
);
|
||||
results.push({ provider: 'email', ...result });
|
||||
@@ -331,7 +252,7 @@ class NotificationManager extends EventEmitter {
|
||||
|
||||
const allSucceeded = results.every(r => r.success);
|
||||
this._addToHistory({
|
||||
title,
|
||||
title: this._formatTitle(canonical),
|
||||
type,
|
||||
event: canonical,
|
||||
results
|
||||
@@ -522,14 +443,7 @@ class NotificationManager extends EventEmitter {
|
||||
'test': 'Test Notification',
|
||||
'auto-restart': 'Auto-Restart',
|
||||
'deploy-success': 'Deployment Success',
|
||||
'deploy-failed': 'Deployment Failed',
|
||||
// DC-094: newly gated events get real provider titles too.
|
||||
'ssl-cert-expiry': 'SSL Certificate Expiry',
|
||||
'dns-propagation': 'DNS Propagation',
|
||||
'drift-detected': 'Configuration Drift',
|
||||
'dependency-restart': 'Dependency Restart',
|
||||
'recipe-removed': 'Recipe Removed',
|
||||
'workflow': 'Workflow Notification'
|
||||
'deploy-failed': 'Deployment Failed'
|
||||
};
|
||||
return titles[event] || 'DashCaddy Notification';
|
||||
}
|
||||
@@ -544,7 +458,7 @@ class NotificationManager extends EventEmitter {
|
||||
if (data.embed) return data.embed;
|
||||
|
||||
return {
|
||||
title: (typeof data.title === 'string' && data.title) || this._formatTitle(event),
|
||||
title: this._formatTitle(event),
|
||||
description: data.text || data.message || '',
|
||||
color: this._getTypeColor(type),
|
||||
timestamp: new Date().toISOString()
|
||||
|
||||
@@ -16,8 +16,6 @@
|
||||
*
|
||||
* State persisted to <dataDir>/caddy-upstreams.json. Mute list is part of
|
||||
* the same file so atomic-write semantics keep state + mutes consistent.
|
||||
* Writes go through the canonical atomic-write util (DC-099/DC-105):
|
||||
* fsync'd same-dir tmp + rename — a crash can never tear the mute list.
|
||||
*
|
||||
* The probe DOES NOT use Caddy's health_uri (that's Caddy's own probe and
|
||||
* the source of the spam). The probe also stamps `X-DashCaddy-HealthCheck: 1`
|
||||
@@ -33,7 +31,6 @@ const https = require('https');
|
||||
const http = require('http');
|
||||
const EventEmitter = require('events');
|
||||
const platformPaths = require('../../platform-paths');
|
||||
const { atomicWriteJSON } = require('../utils/atomic-write');
|
||||
|
||||
/** Default probe interval: 60s. Independent of Caddy's 10s internal probe. */
|
||||
const PROBE_INTERVAL_MS = parseInt(process.env.CADDY_UPSTREAM_PROBE_INTERVAL_MS || '60000', 10);
|
||||
@@ -535,12 +532,9 @@ class CaddyUpstreamWatcher extends EventEmitter {
|
||||
verifiedViaBridge: !!v.verifiedViaBridge
|
||||
};
|
||||
}
|
||||
// Canonical atomic-write (DC-099, migrated DC-105): fsync'd same-dir
|
||||
// tmp + rename via the shared util. A crash mid-write can no longer
|
||||
// tear caddy-upstreams.json (muted list + probe state) — the old
|
||||
// writeFileSync-to-fixed-.tmp had no fsync, so a power loss could
|
||||
// leave an empty/short state file and silently drop every mute.
|
||||
atomicWriteJSON(STATE_FILE, { muted: Array.from(this.muted), upstreams });
|
||||
const tmp = STATE_FILE + '.tmp';
|
||||
fs.writeFileSync(tmp, JSON.stringify({ muted: Array.from(this.muted), upstreams }, null, 2));
|
||||
fs.renameSync(tmp, STATE_FILE);
|
||||
} catch (e) {
|
||||
this.log.warn?.('caddy-upstream-watcher', `state save failed: ${e.message}`);
|
||||
}
|
||||
|
||||
@@ -500,10 +500,7 @@ class WorkflowEngine extends EventEmitter {
|
||||
}
|
||||
|
||||
log.info('workflow', 'Sending notification', { message });
|
||||
notification.send('workflow', {
|
||||
title: 'Workflow Notification',
|
||||
text: message
|
||||
}, 'info');
|
||||
notification.send('workflow', 'Workflow Notification', message, 'info');
|
||||
|
||||
return { notified: true, message };
|
||||
}
|
||||
|
||||
@@ -2,9 +2,6 @@ const path = require('path');
|
||||
const StateManager = require('../managers/state-manager');
|
||||
const crypto = require('crypto');
|
||||
const platformPaths = require('../../platform-paths');
|
||||
// DC-110: canonical email-mask primitives from the unified logger — same
|
||||
// EMAIL_RE + maskEmailAddress shape every other sink uses (DC-095/DC-109).
|
||||
const { maskEmails, maskEmailsInString } = require('../utils/logging');
|
||||
|
||||
const AUDIT_LOG_FILE = process.env.AUDIT_LOG_FILE || path.join(platformPaths.dataDir, 'audit-log.json');
|
||||
const MAX_ENTRIES = parseInt(process.env.AUDIT_MAX_ENTRIES || '1000', 10);
|
||||
@@ -144,23 +141,13 @@ class AuditLogger {
|
||||
|
||||
async log({ action, resource, details, outcome, ip }) {
|
||||
try {
|
||||
// DC-110: PII parity with the unified logger (DC-095). Every string
|
||||
// that reaches audit-log.json gets email-masked with the SAME
|
||||
// canonical mask (sa****@example.com) the other sinks use, so one
|
||||
// consistent masked form everywhere. Applied HERE — the single
|
||||
// write-point — instead of at each call site: covers middleware
|
||||
// bodies, DC-048 userEmail attribution, direct route calls, and the
|
||||
// security-event-store mirror below, regardless of caller. `action`
|
||||
// is an internal token (service.create / dns.add-record) and never
|
||||
// contains PII; `ip` is an address literal. maskEmails() clones, so
|
||||
// the caller's `details` object is never mutated.
|
||||
const entry = {
|
||||
id: crypto.randomUUID(),
|
||||
timestamp: new Date().toISOString(),
|
||||
ip: ip || '',
|
||||
action: action || '',
|
||||
resource: maskEmailsInString(resource || ''),
|
||||
details: maskEmails(details || {}),
|
||||
resource: resource || '',
|
||||
details: details || {},
|
||||
outcome: outcome || 'unknown'
|
||||
};
|
||||
|
||||
@@ -185,14 +172,11 @@ class AuditLogger {
|
||||
source_host: hostname,
|
||||
source_type: 'api',
|
||||
actor: ip || null,
|
||||
// DC-110 round 2 (judge fix-first): use the MASKED entry.resource
|
||||
// — the raw parameter leaked emails into security-events.jsonl
|
||||
// via target and the message template.
|
||||
target: entry.resource || null,
|
||||
target: resource || null,
|
||||
action: action || 'unknown',
|
||||
outcome: outcome || 'unknown',
|
||||
severity,
|
||||
message: `${action} ${outcome} on ${entry.resource}`.trim(),
|
||||
message: `${action} ${outcome} on ${resource}`.trim(),
|
||||
metadata: {
|
||||
method: details?.body && Object.keys(details.body)[0] ? '(see audit-log)' : undefined,
|
||||
audit_id: entry.id,
|
||||
@@ -228,29 +212,12 @@ class AuditLogger {
|
||||
return (req, res, next) => {
|
||||
if (this.shouldSkip(req.method, req.path)) return next();
|
||||
|
||||
// DC-111: snapshot the request path NOW, at app-level (pre-router).
|
||||
// The res.json override below fires AFTER the /api/v1 router has
|
||||
// dispatched the request, and Express rebases req.url to the
|
||||
// router-relative path at that point (/api/v1/auth/gate/plex becomes
|
||||
// /auth/gate/plex). resolveAction/extractResource on the rebased path
|
||||
// fall through ACTION_MAP and derive 'unknown.*' — which is exactly
|
||||
// how 45,899 'unknown.get' entries landed in the audit trail between
|
||||
// 2026-07-14 and 2026-08-23. Snapshot req.path in the middleware body
|
||||
// (string copy — req.path is a live getter over req.url): this runs
|
||||
// after the DC-044 legacy-prefix shim has canonicalized /api/auth/*
|
||||
// to /api/v1/* but before the router rebase, so ACTION_MAP sees the
|
||||
// canonical path for both legacy and canonical clients. Do NOT use
|
||||
// req.originalUrl — it freezes the PRE-shim legacy path, which
|
||||
// ACTION_MAP does not cover.
|
||||
const requestPath = req.path;
|
||||
const requestMethod = req.method;
|
||||
|
||||
const originalJson = res.json.bind(res);
|
||||
res.json = (data) => {
|
||||
// Log asynchronously — don't block the response
|
||||
const ip = req.ip || req.socket?.remoteAddress || '';
|
||||
const action = this.resolveAction(requestMethod, requestPath);
|
||||
const resource = this.extractResource(requestPath);
|
||||
const action = this.resolveAction(req.method, req.path);
|
||||
const resource = this.extractResource(req.path);
|
||||
const outcome = data && data.success === false ? 'failure' : 'success';
|
||||
|
||||
// Sanitize details — don't log passwords or tokens
|
||||
|
||||
@@ -424,27 +424,6 @@ function clearCachedKey() {
|
||||
encryptionKey = null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Restore the encryption key to a previous value (in-process rollback).
|
||||
* Writes `oldKeyHex` back to KEY_FILE atomically (DC-107: same canonical
|
||||
* atomic-write path as every other state file — tmp + fsync + rename, mode
|
||||
* 0600) and clears the cached key so the next operation reloads from disk.
|
||||
* Used when a write (e.g. atomicWriteJSON of rotated credentials) fails
|
||||
* after rotateKey() has already swapped the on-disk key and in-memory cache.
|
||||
* @param {string} oldKeyHex - Previous key as hex string (32 bytes = 64 hex chars)
|
||||
* @returns {string} the final path (KEY_FILE)
|
||||
* @throws {Error} If oldKeyHex is not a 64-char hex string or the write fails
|
||||
*/
|
||||
function restoreKey(oldKeyHex) {
|
||||
if (typeof oldKeyHex !== 'string' || !/^[0-9a-fA-F]{64}$/.test(oldKeyHex)) {
|
||||
throw new Error('restoreKey: expected 64-char hex string (32-byte key)');
|
||||
}
|
||||
const { atomicWriteFile } = require('../utils/atomic-write');
|
||||
atomicWriteFile(KEY_FILE, oldKeyHex, { mode: 0o600 });
|
||||
clearCachedKey();
|
||||
return KEY_FILE;
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
encrypt,
|
||||
decrypt,
|
||||
@@ -458,6 +437,5 @@ module.exports = {
|
||||
deriveKey,
|
||||
rotateKey,
|
||||
decryptWithKey,
|
||||
clearCachedKey,
|
||||
restoreKey
|
||||
clearCachedKey
|
||||
};
|
||||
@@ -34,15 +34,9 @@ const EVENT_STORE_FILE = process.env.SECURITY_EVENT_LOG_FILE
|
||||
const MAX_EVENTS_IN_MEMORY = parseInt(process.env.SECURITY_EVENT_MAX_MEMORY || '10000', 10);
|
||||
const MAX_EVENTS_ON_DISK = parseInt(process.env.SECURITY_EVENT_MAX_DISK || '100000', 10);
|
||||
|
||||
// DC-116: size trigger for disk trim. Env-overridable so operators (and tests)
|
||||
// can tighten it without rebuilding. Default unchanged: 50MB.
|
||||
const TRIM_TARGET_FACTOR = 0.8; // post-trim target: ≤80% of the byte budget
|
||||
const DEFAULT_TRIM_SIZE_LIMIT = parseInt(
|
||||
process.env.SECURITY_EVENT_TRIM_BYTES || String(50 * 1024 * 1024), 10);
|
||||
|
||||
const VALID_SOURCE_TYPES = new Set(['api', 'caddy', 'fail2ban', 'shared-bans', 'syslog', 'agent']);
|
||||
const VALID_SEVERITIES = new Set(['info', 'notice', 'warn', 'error', 'critical']);
|
||||
const VALID_OUTCOMES = new Set(['success', 'failure', 'denied', 'blocked', 'rate-limited', 'error', 'unknown']);
|
||||
const VALID_OUTCOMES = new Set(['success', 'denied', 'blocked', 'rate-limited', 'error', 'unknown']);
|
||||
|
||||
class SecurityEventStore extends EventEmitter {
|
||||
constructor(opts = {}) {
|
||||
@@ -50,15 +44,12 @@ class SecurityEventStore extends EventEmitter {
|
||||
this.filePath = opts.filePath || EVENT_STORE_FILE;
|
||||
this.maxMemory = opts.maxMemory || MAX_EVENTS_IN_MEMORY;
|
||||
this.maxDisk = opts.maxDisk || MAX_EVENTS_ON_DISK;
|
||||
// DC-116: byte budget for the on-disk file (trigger AND target of _trim)
|
||||
this.trimSizeLimit = opts.trimSizeLimit != null ? opts.trimSizeLimit : DEFAULT_TRIM_SIZE_LIMIT;
|
||||
this.log = opts.log || console;
|
||||
this.events = []; // newest first
|
||||
this.byId = new Map();
|
||||
this.lastWriteLine = 0; // byte offset of last successfully-written line
|
||||
this.writeQueue = []; // serialized write buffer
|
||||
this.writing = false;
|
||||
this._trimScheduled = false; // DC-116: one in-flight trim at a time
|
||||
this._load();
|
||||
}
|
||||
|
||||
@@ -179,108 +170,59 @@ class SecurityEventStore extends EventEmitter {
|
||||
|
||||
/**
|
||||
* Serialize appends to disk. Writes one line at a time, doesn't truncate.
|
||||
* Disk trimming happens separately via _maybeTrim() — and only while the
|
||||
* write queue is empty, so an append can never land on the unlinked
|
||||
* pre-trim inode (DC-116).
|
||||
* Disk trimming happens separately via _trim().
|
||||
*/
|
||||
_flushQueue() {
|
||||
if (this.writing) return;
|
||||
const next = this.writeQueue.shift();
|
||||
if (!next) {
|
||||
// Write path idle — safe point to run a pending trim (no in-flight
|
||||
// append can race the rename; new appends queue behind this.writing).
|
||||
this._maybeTrim();
|
||||
return;
|
||||
}
|
||||
if (!next) return;
|
||||
this.writing = true;
|
||||
const line = JSON.stringify(next) + '\n';
|
||||
fs.appendFile(this.filePath, line, 'utf8', (err) => {
|
||||
this.writing = false;
|
||||
if (err) {
|
||||
this.log.error?.('security', 'write failed', { error: err.message });
|
||||
// Re-queue so we don't lose the event on transient errors. Do NOT
|
||||
// auto-retry here — a persistent failure (disk full, perms) would
|
||||
// turn setImmediate into a hot loop. The next append() re-kicks
|
||||
// the flush (same semantics as before DC-116).
|
||||
// Re-queue so we don't lose the event on transient errors
|
||||
this.writeQueue.unshift(next);
|
||||
return;
|
||||
}
|
||||
// Drain the rest of the queue before considering a trim. (Note: this
|
||||
// merely defers to the next tick — it batches, it does not throttle;
|
||||
// with an instantly-draining queue each drain can still end in a trim.)
|
||||
if (this.writeQueue.length > 0) {
|
||||
setImmediate(() => this._flushQueue());
|
||||
} else {
|
||||
// Try next
|
||||
if (this.writeQueue.length > 0) setImmediate(() => this._flushQueue());
|
||||
this._maybeTrim();
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Trim disk log when it exceeds the byte budget. Runs on the write path
|
||||
* only when the queue is empty (see _flushQueue), and at most one trim is
|
||||
* in flight at a time. Strategy: rewrite the file keeping the most recent
|
||||
* Trim disk log if it exceeds maxDisk lines. Done in the background — never
|
||||
* blocks an append(). Strategy: rewrite the file keeping the most recent
|
||||
* maxDisk lines, atomically (write tmp + rename).
|
||||
*
|
||||
* DC-116 fix — two prior bugs:
|
||||
* 1. Trigger/curer mismatch: the trigger was size-based (>50MB) but the
|
||||
* curer was line-count-based (keep maxDisk=100k lines). If the average
|
||||
* line exceeds SIZE_LIMIT/maxDisk (~524B) the trim no-ops forever while
|
||||
* the size trigger keeps firing — unbounded file + a full-file stat
|
||||
* (and potentially re-read) on every append. Now: trim fires on size
|
||||
* and keeps the most recent maxDisk LINES OR enough BYTES to get under
|
||||
* 80% of the budget, whichever retains fewer lines — the file always
|
||||
* shrinks back below the trigger.
|
||||
* 2. Trim/append race: trim renamed over the file while unrelated appends
|
||||
* were in flight, silently losing them to the unlinked inode. Now trim
|
||||
* runs only between writes (queue empty, this.writing false) and holds
|
||||
* the write lock for its duration.
|
||||
*/
|
||||
_maybeTrim() {
|
||||
if (this._trimScheduled) return; // one at a time
|
||||
fs.stat(this.filePath, (err, st) => {
|
||||
if (err || !st) return;
|
||||
if (st.size < this.trimSizeLimit) return;
|
||||
this._trimScheduled = true;
|
||||
this.writing = true; // hold the write lock for the whole trim
|
||||
this._trim(st.size);
|
||||
// Cheap heuristic: if file is > 50MB we always trim. Otherwise count lines.
|
||||
const SIZE_LIMIT = 50 * 1024 * 1024;
|
||||
if (st.size < SIZE_LIMIT) return;
|
||||
this._trim();
|
||||
});
|
||||
}
|
||||
|
||||
_trim(fileSizeBytes) {
|
||||
this.log.info?.('security', 'trimming event store', {
|
||||
file: this.filePath,
|
||||
size_bytes: fileSizeBytes,
|
||||
keep_lines: this.maxDisk,
|
||||
budget_bytes: this.trimSizeLimit,
|
||||
});
|
||||
_trim() {
|
||||
this.log.info?.('security', 'trimming event store', { file: this.filePath });
|
||||
fs.readFile(this.filePath, 'utf8', (err, content) => {
|
||||
const done = (e) => {
|
||||
this._trimScheduled = false;
|
||||
this.writing = false; // release the write lock
|
||||
if (this.writeQueue.length > 0) setImmediate(() => this._flushQueue());
|
||||
if (e) this.log.error?.('security', 'trim failed', { error: e.message });
|
||||
};
|
||||
if (err) return done(err);
|
||||
|
||||
if (err) return;
|
||||
const lines = content.split('\n').filter(l => l.trim());
|
||||
if (lines.length === 0) return done();
|
||||
|
||||
// Byte-aware reconciliation: keep the most recent maxDisk lines, but if
|
||||
// that slice alone still exceeds ~80% of the byte budget, drop further
|
||||
// lines (oldest first) until it fits. Always retains at least one line.
|
||||
const keep = lines.slice(-this.maxDisk);
|
||||
let keepBytes = Buffer.byteLength(keep.join('\n') + '\n', 'utf8');
|
||||
const byteCeiling = Math.floor(this.trimSizeLimit * TRIM_TARGET_FACTOR);
|
||||
while (keep.length > 1 && keepBytes > byteCeiling) {
|
||||
keepBytes -= Buffer.byteLength(keep.shift() + '\n', 'utf8');
|
||||
}
|
||||
|
||||
const kept = keep.join('\n') + '\n';
|
||||
if (lines.length <= this.maxDisk) return;
|
||||
const kept = lines.slice(-this.maxDisk).join('\n') + '\n';
|
||||
const tmp = this.filePath + '.tmp';
|
||||
fs.writeFile(tmp, kept, 'utf8', (e) => {
|
||||
if (e) return done(e);
|
||||
fs.rename(tmp, this.filePath, done);
|
||||
if (e) {
|
||||
this.log.error?.('security', 'trim write failed', { error: e.message });
|
||||
return;
|
||||
}
|
||||
fs.rename(tmp, this.filePath, (e2) => {
|
||||
if (e2) this.log.error?.('security', 'trim rename failed', { error: e2.message });
|
||||
});
|
||||
});
|
||||
});
|
||||
}
|
||||
@@ -288,13 +230,6 @@ class SecurityEventStore extends EventEmitter {
|
||||
/**
|
||||
* Query events. All filters are AND-combined. Results are newest-first.
|
||||
*
|
||||
* `total` is the true count of ALL matching events in the memory window
|
||||
* (DC-116 fix: the loop previously broke at offset+limit, so `total` was
|
||||
* silently capped at the page size — the dashboard's "N events (24h)" stat
|
||||
* and hosts/:id/health events_24h read 1000 when the real count was tens
|
||||
* of thousands). The scan now always completes; per-page cost is bounded
|
||||
* by the in-memory cap (maxMemory, default 10k).
|
||||
*
|
||||
* @param {object} q - query
|
||||
* limit : number, default 100, max 1000
|
||||
* offset : number, default 0
|
||||
@@ -310,64 +245,32 @@ class SecurityEventStore extends EventEmitter {
|
||||
query(q = {}) {
|
||||
const limit = Math.min(parseInt(q.limit || '100', 10), 1000);
|
||||
const offset = parseInt(q.offset || '0', 10);
|
||||
const match = this.compileFilter(q);
|
||||
const sourceTypes = this._toArr(q.source_type);
|
||||
const severities = this._toArr(q.severity);
|
||||
const outcomes = this._toArr(q.outcome);
|
||||
|
||||
let total = 0;
|
||||
const page = [];
|
||||
const matches = [];
|
||||
for (const ev of this.events) {
|
||||
if (!match(ev)) continue;
|
||||
total++;
|
||||
if (total > offset && page.length < limit) page.push(ev);
|
||||
if (sourceTypes.length && !sourceTypes.includes(ev.source_type)) continue;
|
||||
if (q.source_host && ev.source_host !== q.source_host) continue;
|
||||
if (severities.length && !severities.includes(ev.severity)) continue;
|
||||
if (outcomes.length && !outcomes.includes(ev.outcome)) continue;
|
||||
if (q.actor && ev.actor !== q.actor) continue;
|
||||
if (q.actor_prefix && (!ev.actor || !ev.actor.startsWith(q.actor_prefix))) continue;
|
||||
if (q.action && ev.action !== q.action) continue;
|
||||
if (q.since && ev.ts < q.since) continue;
|
||||
if (q.until && ev.ts >= q.until) continue;
|
||||
if (q.target && ev.target !== q.target) continue;
|
||||
matches.push(ev);
|
||||
if (matches.length >= offset + limit) break; // avoid scanning further
|
||||
}
|
||||
|
||||
return {
|
||||
total,
|
||||
events: page,
|
||||
total: matches.length,
|
||||
events: matches.slice(offset, offset + limit),
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Compile the query filters into a single predicate. Shared by query()
|
||||
* (paged access) and filterEvents() (full-set access) so the two can
|
||||
* never drift on filter semantics (DC-120).
|
||||
*
|
||||
* All filters AND-combine; an absent filter matches everything.
|
||||
*/
|
||||
compileFilter(q = {}) {
|
||||
const sourceTypes = this._toArr(q.source_type);
|
||||
const severities = this._toArr(q.severity);
|
||||
const outcomes = this._toArr(q.outcome);
|
||||
return (ev) => {
|
||||
if (sourceTypes.length && !sourceTypes.includes(ev.source_type)) return false;
|
||||
if (q.source_host && ev.source_host !== q.source_host) return false;
|
||||
if (severities.length && !severities.includes(ev.severity)) return false;
|
||||
if (outcomes.length && !outcomes.includes(ev.outcome)) return false;
|
||||
if (q.actor && ev.actor !== q.actor) return false;
|
||||
if (q.actor_prefix && (!ev.actor || !ev.actor.startsWith(q.actor_prefix))) return false;
|
||||
if (q.action && ev.action !== q.action) return false;
|
||||
if (q.since && ev.ts < q.since) return false;
|
||||
if (q.until && ev.ts >= q.until) return false;
|
||||
if (q.target && ev.target !== q.target) return false;
|
||||
return true;
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* DC-120: full filtered set, newest-first, for route-level aggregation
|
||||
* that the paged query() API can't express (e.g. per-IP outcome
|
||||
* breakdowns across every caddy event in a window — query() pages at
|
||||
* 1000 and `total` alone can't rebuild the per-key maps).
|
||||
*
|
||||
* Cost is bounded by the in-memory cap (maxMemory, default 10k) — the
|
||||
* same bound query() already scans — so callers cannot request
|
||||
* unbounded work. Filters are identical to query() by construction
|
||||
* (shared compileFilter).
|
||||
*/
|
||||
filterEvents(q = {}) {
|
||||
const match = this.compileFilter(q);
|
||||
return this.events.filter(match);
|
||||
}
|
||||
|
||||
_toArr(v) {
|
||||
if (!v) return [];
|
||||
if (Array.isArray(v)) return v;
|
||||
|
||||
@@ -45,77 +45,21 @@ const { getStore } = require('./event-store');
|
||||
|
||||
const HOSTNAME = os.hostname();
|
||||
|
||||
/**
|
||||
* DC-112: map caddy access-log requests to named actions for credential-
|
||||
* bearing auth endpoints, mirroring the in-app audit logger's ACTION_MAP
|
||||
* vocabulary (src/security/audit-logger.js) so both writers answer "who
|
||||
* hit the SSO gate?" with the same action names.
|
||||
*
|
||||
* Caddy forward_auth gates call the API with the LEGACY pre-shim prefix
|
||||
* (/api/auth/gate/<id> — see the dashcaddy_auth snippet in the Caddyfile
|
||||
* and the back-compat shim in src/app.js), while dashboard JS uses the
|
||||
* canonical /api/v1/... prefix. Both shapes map to the same name here,
|
||||
* matching what the in-app audit logger records for the same request
|
||||
* (GET /api/v1/auth/gate → 'auth.credential-injection', GET .../app-token
|
||||
* → 'auth.app-token-issue'). sso-exchange is a POST with no id segment.
|
||||
*
|
||||
* Everything else keeps the status-derived `http.<status>` action — the
|
||||
* status IS the action for ordinary edge traffic.
|
||||
*
|
||||
* Same defect class as DC-111 defect 1 (status-only/uniform action names
|
||||
* made 45,899 audit entries unanswerable), different writer.
|
||||
*/
|
||||
function resolveCaddyAction(method, uri, status) {
|
||||
if (method === 'GET') {
|
||||
if (uri.startsWith('/api/v1/auth/gate/') || uri.startsWith('/api/auth/gate/')) {
|
||||
return 'auth.credential-injection';
|
||||
}
|
||||
if (uri.startsWith('/api/v1/auth/app-token/') || uri.startsWith('/api/auth/app-token/')) {
|
||||
return 'auth.app-token-issue';
|
||||
}
|
||||
}
|
||||
if (method === 'POST') {
|
||||
// No id segment — exact path match (query tolerated), so a 404 on
|
||||
// e.g. /api/auth/sso-exchange-x is NOT misnamed.
|
||||
const p = uri.split('?')[0];
|
||||
if (p === '/api/v1/auth/sso-exchange' || p === '/api/auth/sso-exchange') {
|
||||
return 'auth.sso-exchange';
|
||||
}
|
||||
}
|
||||
return `http.${status}`;
|
||||
}
|
||||
|
||||
/**
|
||||
* Generic tail-follower with offset persistence.
|
||||
* Watches `filePath`, emits each new line via `onLine(line)`.
|
||||
* Persists last-read offset to `stateFile` so restarts don't re-process.
|
||||
* On file truncation (rotation), resets offset to 0.
|
||||
*
|
||||
* DC-113: `onAppear` fires on every missing→present transition of the file
|
||||
* (including the first-ever appearance), letting callers log recovery from
|
||||
* a dead path (judge polish round on DC-112).
|
||||
*
|
||||
* DC-113 r2 (judge fix-first fold): `firstStartMaxBytes` bounds the replay
|
||||
* on the FIRST-EVER start (no persisted offset). A fresh deployment pointing
|
||||
* at a long-lived log would otherwise ingest the entire backlog into the
|
||||
* capped security store, evicting recent history. We jump to (size - cap)
|
||||
* and discard the partial first line. Normal restarts (state file exists)
|
||||
* always resume at the exact persisted offset — no data gap, no skip.
|
||||
*/
|
||||
function createTail({ filePath, stateFile, onLine, onAppear, label = 'tail', pollMs = 1000, firstStartMaxBytes = null }) {
|
||||
function createTail({ filePath, stateFile, onLine, label = 'tail', pollMs = 1000 }) {
|
||||
let offset = 0;
|
||||
let buffer = '';
|
||||
let stopped = false;
|
||||
let sawFile = false;
|
||||
let firstStart = false;
|
||||
let skipPartialFirstLine = false;
|
||||
|
||||
// Load persisted offset
|
||||
try {
|
||||
if (fs.existsSync(stateFile)) {
|
||||
offset = parseInt(fs.readFileSync(stateFile, 'utf8').trim(), 10) || 0;
|
||||
} else {
|
||||
firstStart = true;
|
||||
}
|
||||
} catch {}
|
||||
|
||||
@@ -129,27 +73,12 @@ function createTail({ filePath, stateFile, onLine, onAppear, label = 'tail', pol
|
||||
fs.stat(filePath, (err, st) => {
|
||||
if (err) {
|
||||
// File doesn't exist yet — just wait
|
||||
sawFile = false;
|
||||
return setTimeout(tick, pollMs * 5);
|
||||
}
|
||||
if (!sawFile) {
|
||||
sawFile = true;
|
||||
try { onAppear && onAppear(); } catch (e) {
|
||||
log.error('events', e, { worker: label, phase: 'onAppear' });
|
||||
}
|
||||
}
|
||||
// First-ever start against a large pre-existing file: skip to live.
|
||||
if (firstStart && typeof firstStartMaxBytes === 'number' && st.size > firstStartMaxBytes) {
|
||||
offset = st.size - firstStartMaxBytes;
|
||||
skipPartialFirstLine = true;
|
||||
buffer = '';
|
||||
}
|
||||
firstStart = false;
|
||||
// Detect truncation/rotation
|
||||
if (st.size < offset) {
|
||||
offset = 0;
|
||||
buffer = '';
|
||||
skipPartialFirstLine = false;
|
||||
}
|
||||
if (st.size === offset) {
|
||||
return setTimeout(tick, pollMs);
|
||||
@@ -161,16 +90,7 @@ function createTail({ filePath, stateFile, onLine, onAppear, label = 'tail', pol
|
||||
encoding: 'utf8',
|
||||
});
|
||||
stream.on('data', (chunk) => {
|
||||
let text = chunk;
|
||||
if (skipPartialFirstLine) {
|
||||
// We jumped into the middle of the file — discard bytes up to
|
||||
// the first newline (the partial line we cut into).
|
||||
const nl = text.indexOf('\n');
|
||||
if (nl === -1) return; // still inside the partial line
|
||||
text = text.slice(nl + 1);
|
||||
skipPartialFirstLine = false;
|
||||
}
|
||||
buffer += text;
|
||||
buffer += chunk;
|
||||
const lines = buffer.split('\n');
|
||||
buffer = lines.pop() || ''; // last partial stays
|
||||
for (const line of lines) {
|
||||
@@ -206,75 +126,15 @@ function createTail({ filePath, stateFile, onLine, onAppear, label = 'tail', pol
|
||||
* {"ts":1700000000,"request":{"remote_ip":"1.2.3.4","method":"GET","uri":"/x"},"status":200,...}
|
||||
* We turn that into a security event.
|
||||
*/
|
||||
function startCaddyWorker({ log: logger = log } = {}) {
|
||||
function startCaddyWorker({ log } = {}) {
|
||||
const caddyLog = process.env.CADDY_ACCESS_LOG || '/var/log/caddy/access.log';
|
||||
const stateFile = path.join(platformPaths.dataDir, '.caddy-tail-offset');
|
||||
const store = getStore({ log: logger });
|
||||
|
||||
// DC-112: the tail loop's stat-error path (missing log file) is fully
|
||||
// silent — the worker looks healthy in the startup log while delivering
|
||||
// nothing. In the current DNS2 container there is no /var/log/caddy
|
||||
// mount and no CADDY_ACCESS_LOG override, so ALL caddy-source security
|
||||
// events have been silently absent (store census: 45,912 events, 100%
|
||||
// source_type 'api', zero 'caddy'). Surface the dead path once per
|
||||
// process lifetime so the gap is visible in docker logs instead of
|
||||
// requiring a store census to detect.
|
||||
let missingWarned = false;
|
||||
function warnIfMissing() {
|
||||
if (missingWarned) return;
|
||||
fs.stat(caddyLog, (err) => {
|
||||
if (!err) return;
|
||||
missingWarned = true;
|
||||
logger.warn?.('events', `caddy access log not found at ${caddyLog} — caddy-source security events disabled (set CADDY_ACCESS_LOG or mount the log)`, { worker: 'caddy' });
|
||||
});
|
||||
}
|
||||
warnIfMissing();
|
||||
|
||||
// DC-113: self-noise filter. The API's own probes (health-checker,
|
||||
// caddy-upstream-watcher, uptime watchdog) hit Caddy ~every 10-30s per
|
||||
// service and would bury real perimeter signal in the 100k-event store
|
||||
// within hours. Drop our own probe UAs from the event stream — the raw
|
||||
// access.log keeps every line for forensics; only the derived security
|
||||
// store is filtered.
|
||||
const SELF_NOISE_UAS = [
|
||||
'DashCaddy-Probe/1.0', // health-checker + upstream watcher
|
||||
'DashCaddy-HealthCheck/1.0', // startup validator
|
||||
];
|
||||
// DC-118: the host-side uptime watchdog and on-host cron jobs curl Caddy
|
||||
// with a stock curl/<ver> UA from the machine's own addresses (~300
|
||||
// events/day of GET /api/health 401). Dropping on UA alone would also
|
||||
// hide a real attacker using curl, so GENERIC UAs are only dropped when
|
||||
// the source IP is one of this host's own addresses: loopback always,
|
||||
// plus DASHCADDY_SELF_IPS (start.sh passes the tailscale IP). Uses
|
||||
// remote_ip (the TCP peer), never client_ip (X-Forwarded-For is
|
||||
// spoofable and must not be able to opt an attacker out of the store).
|
||||
// Prefix match (not equality) so version skew — curl/7.68, curl/8.5,
|
||||
// future curl/10 — all match; curl-impersonate-* deliberately does not.
|
||||
const GENERIC_PROBE_UAS = ['curl/'];
|
||||
const selfIps = new Set(
|
||||
(process.env.DASHCADDY_SELF_IPS || '127.0.0.1,::1')
|
||||
.split(',').map(s => s.trim()).filter(Boolean)
|
||||
);
|
||||
function isSelfNoise(userAgent, ip) {
|
||||
if (!userAgent) return false;
|
||||
if (SELF_NOISE_UAS.some(ua => userAgent.startsWith(ua))) return true;
|
||||
return selfIps.has(ip) && GENERIC_PROBE_UAS.some(ua => userAgent.startsWith(ua));
|
||||
}
|
||||
const store = getStore({ log });
|
||||
|
||||
return createTail({
|
||||
filePath: caddyLog,
|
||||
stateFile,
|
||||
label: 'caddy',
|
||||
// DC-113 r2: cap first-start replay at 5 MiB (~30-40k caddy lines) so a
|
||||
// fresh deployment against a long-lived access.log ingests only the
|
||||
// recent window, not the whole backlog (store caps at 100k events).
|
||||
firstStartMaxBytes: 5 * 1024 * 1024,
|
||||
// DC-113 (judge polish fold): emit a single info line when the log
|
||||
// path becomes (or starts out) readable, so recovery after the
|
||||
// missing-warn is visible in docker logs.
|
||||
onAppear: () => {
|
||||
logger.info?.('events', `caddy access log active at ${caddyLog} — caddy-source security events enabled`, { worker: 'caddy' });
|
||||
},
|
||||
onLine: (line) => {
|
||||
let entry;
|
||||
try { entry = JSON.parse(line); }
|
||||
@@ -284,14 +144,7 @@ function startCaddyWorker({ log: logger = log } = {}) {
|
||||
const ip = req.remote_ip;
|
||||
const method = req.method;
|
||||
const uri = req.uri || '';
|
||||
// Caddy logs headers as arrays ({"User-Agent":["curl/8.0"]}); the
|
||||
// old single-value read always produced null metadata.
|
||||
const uaHeader = (req.headers && (req.headers['User-Agent'] || req.headers['user-agent'])) || null;
|
||||
const userAgent = Array.isArray(uaHeader) ? uaHeader[0] : uaHeader;
|
||||
// DC-118: conjunction filter — see isSelfNoise. remote_ip (TCP peer),
|
||||
// never client_ip (spoofable X-Forwarded-For must not opt an attacker
|
||||
// out of the security store).
|
||||
if (isSelfNoise(userAgent, ip)) return;
|
||||
const userAgent = (req.headers && req.headers['User-Agent']) || null;
|
||||
|
||||
// Severity mapping
|
||||
let severity = 'info';
|
||||
@@ -301,13 +154,8 @@ function startCaddyWorker({ log: logger = log } = {}) {
|
||||
else if (status >= 500) { severity = 'error'; outcome = 'error'; }
|
||||
else if (status >= 400) { severity = 'notice'; outcome = 'denied'; }
|
||||
|
||||
// Escalate credential-endpoint hits. Legacy /api/auth/* shapes count
|
||||
// too — the forward_auth gates send the pre-shim prefix (judge polish
|
||||
// round: the canonical-only list missed exactly those hits).
|
||||
const sensitivePaths = [
|
||||
'/api/v1/auth/', '/api/auth/',
|
||||
'/api/v1/totp/', '/api/v1/license/', '/api/v1/credentials/',
|
||||
];
|
||||
// Escalate credential-endpoint hits
|
||||
const sensitivePaths = ['/api/v1/auth/', '/api/v1/totp/', '/api/v1/license/', '/api/v1/credentials/'];
|
||||
if (sensitivePaths.some(p => uri.startsWith(p)) && status >= 400) {
|
||||
severity = 'warn';
|
||||
}
|
||||
@@ -317,24 +165,16 @@ function startCaddyWorker({ log: logger = log } = {}) {
|
||||
source_type: 'caddy',
|
||||
actor: ip,
|
||||
target: `${method} ${uri}`,
|
||||
action: resolveCaddyAction(method, uri, status),
|
||||
action: `http.${status}`,
|
||||
outcome,
|
||||
severity,
|
||||
message: `${ip} ${method} ${uri} -> ${status}`,
|
||||
metadata: {
|
||||
status,
|
||||
duration_ms: entry.duration || null, // caddy logs SECONDS (judge
|
||||
// polish round DC-112: kept for backwards compatibility, no
|
||||
// consumer reads it yet; new field below carries true semantics)
|
||||
duration_seconds: entry.duration || null,
|
||||
duration_ms: entry.duration || null,
|
||||
user_agent: userAgent,
|
||||
size: entry.size || null,
|
||||
proto: req.proto || null,
|
||||
// DC-113: real caddy JSON nests host inside request — the
|
||||
// top-level read was always null on live lines (the DC-112 test
|
||||
// fixture shape was wrong; verified against /var/log/caddy/
|
||||
// seeds.log lines on DNS2).
|
||||
host: req.host || entry.host || null,
|
||||
},
|
||||
});
|
||||
},
|
||||
@@ -445,5 +285,4 @@ module.exports = {
|
||||
startSharedBansWorker,
|
||||
startFail2banWorker,
|
||||
startAll,
|
||||
resolveCaddyAction,
|
||||
};
|
||||
@@ -5,8 +5,7 @@
|
||||
* the system emails (or logs in dev) a magic-link-style URL containing the
|
||||
* raw token. The recipient clicks → accepts → becomes an authorized user.
|
||||
*
|
||||
* Storage: data/invites.json. Atomic durable writes via the canonical
|
||||
* shared atomic-write util (DC-099/DC-100) — fsync'd tmp+rename.
|
||||
* Storage: data/invites.json. Atomic writes via tmp+rename.
|
||||
*
|
||||
* Token shape:
|
||||
* - 32 random bytes, base64url-encoded (256 bits of entropy).
|
||||
@@ -31,7 +30,6 @@ const path = require('path');
|
||||
const fs = require('fs');
|
||||
const crypto = require('crypto');
|
||||
const platformPaths = require('../../platform-paths');
|
||||
const { atomicWriteJSON } = require('../utils/atomic-write');
|
||||
|
||||
const DEFAULT_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
|
||||
const PRUNE_AFTER_MS = 7 * 24 * 60 * 60 * 1000; // auto-prune used/expired after 7d
|
||||
@@ -39,6 +37,12 @@ const PRUNE_AFTER_MS = 7 * 24 * 60 * 60 * 1000; // auto-prune used/expired after
|
||||
function _nowMs() { return Date.now(); }
|
||||
function _nowIso() { return new Date().toISOString(); }
|
||||
|
||||
function _atomicWriteJSON(filePath, data) {
|
||||
const tmp = filePath + '.tmp.' + process.pid + '.' + Date.now();
|
||||
fs.writeFileSync(tmp, JSON.stringify(data, null, 2) + '\n', { mode: 0o600 });
|
||||
fs.renameSync(tmp, filePath);
|
||||
}
|
||||
|
||||
function _readJSON(filePath, fallback) {
|
||||
try {
|
||||
const raw = fs.readFileSync(filePath, 'utf8');
|
||||
@@ -81,7 +85,7 @@ function createInviteStore(opts = {}) {
|
||||
if (!data.invites || typeof data.invites !== 'object') data.invites = {};
|
||||
return data;
|
||||
}
|
||||
function _save(data) { atomicWriteJSON(file, data); }
|
||||
function _save(data) { _atomicWriteJSON(file, data); }
|
||||
|
||||
function _prune(data) {
|
||||
const cutoff = _nowMs() - PRUNE_AFTER_MS;
|
||||
|
||||
@@ -12,10 +12,9 @@
|
||||
* to a device tag. Invitee clicks the link → device joins the tailnet →
|
||||
* Caddy forward_auth inducts them into the service. Single-use, 24h TTL.
|
||||
*
|
||||
* Storage: data/shares.json. Atomic durable writes via the canonical
|
||||
* shared atomic-write util (DC-099/DC-102) — fsync'd tmp+rename. The on-disk
|
||||
* shape is identical to the invite store — UUID-keyed map of records with
|
||||
* SHA-256 hashed tokens. Raw token is only returned at issue() time.
|
||||
* Storage: data/shares.json. Atomic writes via tmp+rename. The on-disk shape
|
||||
* is identical to the invite store — UUID-keyed map of records with SHA-256
|
||||
* hashed tokens. Raw token is only returned at issue() time.
|
||||
*
|
||||
* Public-share token also carries a HMAC signature binding it to the
|
||||
* serviceId so a leaked token cannot be silently retargeted. The signature
|
||||
@@ -38,7 +37,6 @@ const path = require('path');
|
||||
const fs = require('fs');
|
||||
const crypto = require('crypto');
|
||||
const platformPaths = require('../../platform-paths');
|
||||
const { atomicWriteFile, atomicWriteJSON } = require('../utils/atomic-write');
|
||||
|
||||
const DEFAULT_PUBLIC_TTL_MS = 24 * 60 * 60 * 1000; // 24h
|
||||
const DEFAULT_TAILSCALE_TTL_MS = 24 * 60 * 60 * 1000; // 24h
|
||||
@@ -99,6 +97,12 @@ function validatePublicDeviceId(raw) {
|
||||
function _nowMs() { return Date.now(); }
|
||||
function _nowIso() { return new Date().toISOString(); }
|
||||
|
||||
function _atomicWriteJSON(filePath, data) {
|
||||
const tmp = filePath + '.tmp.' + process.pid + '.' + Date.now();
|
||||
fs.writeFileSync(tmp, JSON.stringify(data, null, 2) + '\n', { mode: 0o600 });
|
||||
fs.renameSync(tmp, filePath);
|
||||
}
|
||||
|
||||
function _readJSON(filePath, fallback) {
|
||||
try {
|
||||
const raw = fs.readFileSync(filePath, 'utf8');
|
||||
@@ -146,12 +150,7 @@ function createShareStore(opts = {}) {
|
||||
} catch (_) { /* missing or unreadable — generate fresh */ }
|
||||
const fresh = crypto.randomBytes(32).toString('base64url');
|
||||
try {
|
||||
// DC-102: canonical atomic write. A torn `.share-secret` write would
|
||||
// silently rotate the signing key on next boot — invalidating every
|
||||
// outstanding share signature (all peeks fail, links 404) — with no
|
||||
// error anywhere. fsync'd tmp+rename guarantees the file is either the
|
||||
// complete old secret or the complete new one.
|
||||
atomicWriteFile(_secretFile, fresh + '\n');
|
||||
fs.writeFileSync(_secretFile, fresh + '\n', { mode: 0o600 });
|
||||
} catch (err) {
|
||||
log.warn && log.warn('share', 'failed to persist signing secret', { err: err && err.message });
|
||||
}
|
||||
@@ -171,7 +170,7 @@ function createShareStore(opts = {}) {
|
||||
if (!data.shares || typeof data.shares !== 'object') data.shares = {};
|
||||
return data;
|
||||
}
|
||||
function _save(data) { atomicWriteJSON(file, data); }
|
||||
function _save(data) { _atomicWriteJSON(file, data); }
|
||||
|
||||
function _prune(data) {
|
||||
const cutoff = _nowMs() - PRUNE_AFTER_MS;
|
||||
|
||||
@@ -29,9 +29,8 @@
|
||||
* This is recorded by writing a sentinel file `data/.bootstrapped` with the
|
||||
* admin email so we never bootstrap twice (e.g. after a restore from backup).
|
||||
*
|
||||
* Atomic writes: every persistence op goes through the canonical shared
|
||||
* atomic-write util (DC-099) — fsync'd same-dir tmp+rename, so a crash or
|
||||
* process restart loses nothing in flight and never leaves a torn file.
|
||||
* Atomic writes: every persistence op writes to a .tmp file then renames.
|
||||
* process restart loses nothing in flight because rename is atomic on POSIX.
|
||||
*
|
||||
* Concurrency: a single in-process mutex serializes mutating ops. We don't
|
||||
* need cross-process locks because this API is single-instance by design.
|
||||
@@ -43,7 +42,6 @@ const path = require('path');
|
||||
const fs = require('fs');
|
||||
const crypto = require('crypto');
|
||||
const platformPaths = require('../../platform-paths');
|
||||
const { atomicWriteJSON } = require('../utils/atomic-write');
|
||||
|
||||
const ROLES = Object.freeze({
|
||||
ADMIN: 'admin',
|
||||
@@ -78,6 +76,12 @@ function _resolveDataDir(opts) {
|
||||
return require('os').tmpdir();
|
||||
}
|
||||
|
||||
function _atomicWriteJSON(filePath, data) {
|
||||
const tmp = filePath + '.tmp.' + process.pid + '.' + Date.now();
|
||||
fs.writeFileSync(tmp, JSON.stringify(data, null, 2) + '\n', { mode: 0o600 });
|
||||
fs.renameSync(tmp, filePath);
|
||||
}
|
||||
|
||||
function _readJSON(filePath, fallback) {
|
||||
try {
|
||||
const raw = fs.readFileSync(filePath, 'utf8');
|
||||
@@ -129,8 +133,8 @@ function createUserStore(opts = {}) {
|
||||
return data;
|
||||
}
|
||||
|
||||
function _saveUsers(data) { atomicWriteJSON(usersFile, data); }
|
||||
function _saveAllowlist(data) { atomicWriteJSON(allowlistFile, data); }
|
||||
function _saveUsers(data) { _atomicWriteJSON(usersFile, data); }
|
||||
function _saveAllowlist(data) { _atomicWriteJSON(allowlistFile, data); }
|
||||
|
||||
function _bootstrapDone() {
|
||||
try { return fs.existsSync(bootstrapSentinel); }
|
||||
@@ -138,7 +142,7 @@ function createUserStore(opts = {}) {
|
||||
}
|
||||
|
||||
function _writeBootstrapSentinel(adminEmail) {
|
||||
atomicWriteJSON(bootstrapSentinel, {
|
||||
_atomicWriteJSON(bootstrapSentinel, {
|
||||
bootstrappedAt: _nowIso(),
|
||||
adminEmail: adminEmail.toLowerCase(),
|
||||
});
|
||||
|
||||
@@ -10,7 +10,7 @@ const VALID_DNS_PROVIDERS = ['technitium', 'cloudflare', 'rfc2136', 'manual'];
|
||||
const KNOWN_KEYS = [
|
||||
'tld', 'caName', 'dns', 'dnsServers', 'dashboardHost', 'timezone', 'theme',
|
||||
'updatedAt', 'timestamp', 'logo', 'logoPosition', 'favicon', 'weather',
|
||||
'setupComplete', 'onboardingCompleted',
|
||||
'setupComplete', 'setupCompleted', 'setupMode', 'onboardingCompleted',
|
||||
'configurationType', 'defaults', 'customLogo', 'customFavicon',
|
||||
'dashboardTitle', 'tailscale', 'license', 'skipped',
|
||||
'routingMode', 'domain', 'email', 'defaultIP', 'pylon',
|
||||
@@ -18,13 +18,7 @@ const KNOWN_KEYS = [
|
||||
// license-manager.js persists the last activation to config.licenseBackup
|
||||
// (restore-on-restart path); src/config/migrations.js stamps _version.
|
||||
// Both are first-party writes — see DC-091.
|
||||
'licenseBackup', '_version',
|
||||
// DC-096: monitoring.public gates whether /api/v1/monitoring/stats and
|
||||
// /api/v1/health-checks/status are public (middleware.js isMonitoringPublic).
|
||||
// Removed 'setupCompleted' and 'setupMode' — never written by any code
|
||||
// (past or present); they only existed here, where they masked the actual
|
||||
// typo of the real key `setupComplete` (writers: setup-wizard.js).
|
||||
'monitoring'
|
||||
'licenseBackup', '_version'
|
||||
];
|
||||
|
||||
/**
|
||||
@@ -168,22 +162,6 @@ function validateKnownKeys(ctx, config) {
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {{errors:string[], warnings:string[]}} ctx
|
||||
* @param {object} config
|
||||
*/
|
||||
function validateMonitoring(ctx, config) {
|
||||
if (config.monitoring === undefined) return;
|
||||
if (typeof config.monitoring !== 'object' || config.monitoring === null) {
|
||||
ctx.errors.push('monitoring must be an object');
|
||||
return;
|
||||
}
|
||||
if (config.monitoring.public !== undefined
|
||||
&& typeof config.monitoring.public !== 'boolean') {
|
||||
ctx.errors.push('monitoring.public must be a boolean');
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Validate a config object and return errors/warnings.
|
||||
* @param {object} config - The config object to validate
|
||||
@@ -205,7 +183,6 @@ function validateConfig(config) {
|
||||
validateTheme(ctx, config);
|
||||
validateRoutingMode(ctx, config);
|
||||
validateDomain(ctx, config);
|
||||
validateMonitoring(ctx, config);
|
||||
validateKnownKeys(ctx, config);
|
||||
|
||||
return { valid: errors.length === 0, errors, warnings };
|
||||
|
||||
@@ -300,7 +300,6 @@ function validateFleetHost(input) {
|
||||
}
|
||||
// Disallow control chars in name (newlines would let a stored name break
|
||||
// log-file formats and could enable log injection if not properly escaped).
|
||||
// eslint-disable-next-line no-control-regex -- intentionally matching control chars
|
||||
if (/[\x00-\x1f]/.test(name)) {
|
||||
return {
|
||||
ok: false,
|
||||
@@ -395,7 +394,6 @@ function validateFleetHost(input) {
|
||||
message: 'each tag must be a string of 1..50 characters',
|
||||
};
|
||||
}
|
||||
// eslint-disable-next-line no-control-regex -- intentionally matching control chars
|
||||
if (/[\x00-\x1f]/.test(t)) {
|
||||
return {
|
||||
ok: false,
|
||||
|
||||
@@ -359,25 +359,18 @@ module.exports = function configureMiddleware(app, {
|
||||
// (env var) or `monitoring: { public: false }` (config.json) to require
|
||||
// auth for these — useful for internet-exposed deployments where
|
||||
// CPU/memory/disk data is sensitive.
|
||||
//
|
||||
// DC-096: this used to be a const frozen at mount time AND it re-required
|
||||
// the config/site singleton instead of using the `siteConfig` dependency
|
||||
// injected by app.js — so POST /api/v1/config changes never took effect
|
||||
// until a full process restart, and a fresh process with
|
||||
// monitoring.public=false in config.json never saw it either (the field
|
||||
// was dropped by applyConfigFields — see site.js). Resolved per-request
|
||||
// from: explicit env override → live config value → default (public).
|
||||
const isMonitoringPublic = () => {
|
||||
const MONITORING_PUBLIC = (() => {
|
||||
if (process.env.MONITORING_PUBLIC === 'false') return false;
|
||||
if (process.env.MONITORING_PUBLIC === 'true') return true;
|
||||
// Read the injected config object live — siteConfig is the same mutable
|
||||
// singleton that loadSiteConfig()/POST /config refresh in place.
|
||||
if (siteConfig && typeof siteConfig.monitoring === 'object' && siteConfig.monitoring !== null
|
||||
&& typeof siteConfig.monitoring.public === 'boolean') {
|
||||
return siteConfig.monitoring.public;
|
||||
}
|
||||
// Default: check config.json if loaded
|
||||
try {
|
||||
const cfg = require('../config/site').siteConfig;
|
||||
if (cfg && cfg.monitoring && typeof cfg.monitoring.public === 'boolean') {
|
||||
return cfg.monitoring.public;
|
||||
}
|
||||
} catch { /* config not loaded yet, use default */ }
|
||||
return true; // default: public (current behavior, dashboard needs it)
|
||||
};
|
||||
})();
|
||||
|
||||
const PUBLIC_ROUTES = [
|
||||
// Health probes — root-level only. See src/app.js for the handler block.
|
||||
@@ -459,18 +452,18 @@ module.exports = function configureMiddleware(app, {
|
||||
{ path: '/api/v1/themes', exact: true, method: 'GET' },
|
||||
{ path: '/api/v1/license/status', exact: true, method: 'GET' },
|
||||
{ path: '/api/v1/license/feature/', prefix: true, method: 'GET' },
|
||||
{ path: '/api/v1/config', exact: true, method: 'GET' },
|
||||
{ path: '/api/v1/services/status', exact: true, method: 'GET' },
|
||||
// (/api/v1/health-checks/status and /api/v1/monitoring/stats are listed
|
||||
// further below WITH the monitoring.public live gate — DC-096. They were
|
||||
// previously duplicated here unconditionally, which silently defeated
|
||||
// the MONITORING_PUBLIC gate entirely.)
|
||||
{ path: '/api/v1/config', exact: true, method: 'GET' },
|
||||
{ path: '/api/v1/services/status', exact: true, method: 'GET' },
|
||||
{ path: '/api/v1/health-checks/status', exact: true, method: 'GET' },
|
||||
// DC-075: System health endpoint for external uptime monitoring (UptimeRobot, BetterStack)
|
||||
{ path: '/api/v1/system/health', exact: true, method: 'GET' },
|
||||
{ path: '/api/v1/system/health', exact: true, method: 'GET' },
|
||||
// DC-097: Prometheus metrics endpoint (scraped by Prometheus, no auth)
|
||||
{ path: '/api/v1/metrics/prometheus', exact: true, method: 'GET' },
|
||||
// DC-077: i18n endpoints (language list + translations, public)
|
||||
{ path: '/api/v1/i18n/', prefix: true, method: 'GET' },
|
||||
// System Overview widget on the dashboard — needs the flattened CPU/mem
|
||||
// data without going through auth. See skill references/totp-and-system-overview-pitfalls.md §3.
|
||||
{ path: '/api/v1/monitoring/stats', exact: true, method: 'GET' },
|
||||
// Read-only update/version info shown on the dashboard view (verification
|
||||
// modal, topbar version, update badges). Mutating actions — update-apply,
|
||||
// rollback (POST) — are NOT listed here and stay TOTP-protected.
|
||||
@@ -480,13 +473,11 @@ module.exports = function configureMiddleware(app, {
|
||||
{ path: '/api/v1/system/update-check', exact: true, method: 'GET' },
|
||||
{ path: '/api/v1/updates/available', exact: true, method: 'GET' },
|
||||
{ path: '/api/v1/system/update-notify', exact: true, method: 'POST' },
|
||||
// Monitoring endpoints — public only while isMonitoringPublic() is true.
|
||||
// DC-096: these are listed unconditionally and gated inside
|
||||
// isPublicRoute() so the gate is resolved LIVE per request — flipping
|
||||
// `monitoring: { public: false }` via POST /api/v1/config takes effect
|
||||
// on the next request, no process restart.
|
||||
{ path: '/api/v1/monitoring/stats', exact: true, method: 'GET', monitoring: true },
|
||||
{ path: '/api/v1/health-checks/status', exact: true, method: 'GET', monitoring: true },
|
||||
// Monitoring endpoints — only public if MONITORING_PUBLIC is true
|
||||
...(MONITORING_PUBLIC ? [
|
||||
{ path: '/api/v1/monitoring/stats', exact: true, method: 'GET' },
|
||||
{ path: '/api/v1/health-checks/status', exact: true, method: 'GET' },
|
||||
] : []),
|
||||
{ path: '/api/v1/version', exact: true, method: 'GET' },
|
||||
// Security ingest endpoints — auth via per-host Bearer token (handled in routes/security.js),
|
||||
// NOT via TOTP/JWT. This lets remote DashCaddy agents and log parsers push events
|
||||
@@ -498,9 +489,6 @@ module.exports = function configureMiddleware(app, {
|
||||
function isPublicRoute(req) {
|
||||
return PUBLIC_ROUTES.some(r => {
|
||||
if (r.method && req.method !== r.method) return false;
|
||||
// DC-096: monitoring routes are only public while the live gate says so
|
||||
// (env override → config → default public). Checked per request.
|
||||
if (r.monitoring && !isMonitoringPublic()) return false;
|
||||
if (r.exact) {
|
||||
// Exact string match, BUT allow `:param` placeholders in the
|
||||
// PUBLIC_ROUTES entry to match any single path segment. This was a
|
||||
|
||||
@@ -1,101 +0,0 @@
|
||||
/**
|
||||
* Canonical atomic file writer (DC-099).
|
||||
*
|
||||
* Write discipline: same-directory temp file → write → fsync → close → rename.
|
||||
* rename() is atomic on POSIX, so a reader (or a crash) can only ever see the
|
||||
* complete old file or the complete new file — never a truncated mix. fsync
|
||||
* before rename pins the bytes so a post-rename power loss doesn't leave an
|
||||
* empty/short file behind (the failure mode plain writeFileSync has).
|
||||
*
|
||||
* This is the ONE shared implementation. It replaces the three private
|
||||
* `_atomicWriteJSON` copies (invite-store, user-store, share-store) as they
|
||||
* are touched, and mirrors the DC-098 redact tool's write path. Do not add a
|
||||
* fourth copy — require this module instead.
|
||||
*/
|
||||
|
||||
'use strict';
|
||||
|
||||
const fs = require('fs');
|
||||
const path = require('path');
|
||||
|
||||
// Monotonic counter guarantees unique tmp names even for back-to-back writes
|
||||
// of the same target within one process tick.
|
||||
let writeCounter = 0;
|
||||
|
||||
function tmpPathFor(filePath) {
|
||||
writeCounter += 1;
|
||||
const base = path.basename(filePath);
|
||||
const dir = path.dirname(filePath);
|
||||
return path.join(dir, `.${base}.tmp-${process.pid}-${Date.now().toString(36)}-${writeCounter}`);
|
||||
}
|
||||
|
||||
/**
|
||||
* Best-effort durability for the rename itself: fsync the parent directory so
|
||||
* the swap survives a post-rename power loss. POSIX guarantees the rename is
|
||||
* atomic *visibly*, but without a dir fsync a crash can leave the old entry —
|
||||
* a stale-but-complete file, never a torn one, so failure here is not fatal.
|
||||
*/
|
||||
function fsyncDir(dirPath) {
|
||||
let dfd = null;
|
||||
try {
|
||||
dfd = fs.openSync(dirPath, 'r');
|
||||
fs.fsyncSync(dfd);
|
||||
} catch (_) {
|
||||
// Some platforms/filesystems reject fsync on directory fds; the payload
|
||||
// is already durable via the file-level fsync above.
|
||||
} finally {
|
||||
if (dfd !== null) {
|
||||
try { fs.closeSync(dfd); } catch (_) { /* fd already closed */ }
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Atomically replace `filePath` with `contents`.
|
||||
*
|
||||
* @param {string} filePath - destination (parent dir must exist)
|
||||
* @param {string} contents - full file contents
|
||||
* @param {object} [opts]
|
||||
* @param {number} [opts.mode=0o600] - mode for a newly created file
|
||||
* @returns {string} the final path (filePath)
|
||||
* @throws whatever fs throws (ENOSPC, EACCES, …); on failure the destination
|
||||
* is untouched and the temp file is removed best-effort.
|
||||
*/
|
||||
function atomicWriteFile(filePath, contents, opts = {}) {
|
||||
const mode = typeof opts.mode === 'number' ? opts.mode : 0o600;
|
||||
const tmp = tmpPathFor(filePath);
|
||||
let fd = null;
|
||||
try {
|
||||
// 'wx' — fail loudly if the tmp name somehow exists rather than clobber.
|
||||
fd = fs.openSync(tmp, 'wx', mode);
|
||||
fs.writeSync(fd, contents, null, 'utf8');
|
||||
fs.fsyncSync(fd);
|
||||
fs.closeSync(fd);
|
||||
fd = null;
|
||||
fs.renameSync(tmp, filePath);
|
||||
fsyncDir(path.dirname(filePath));
|
||||
return filePath;
|
||||
} catch (err) {
|
||||
if (fd !== null) {
|
||||
try { fs.closeSync(fd); } catch (_) { /* fd already closed or broken */ }
|
||||
}
|
||||
try { fs.unlinkSync(tmp); } catch (_) { /* nothing to clean up */ }
|
||||
throw err;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Atomically write `data` as JSON. Single serializer for the whole codebase:
|
||||
* 2-space indent, no trailing newline (matches the notification config's
|
||||
* byte-for-byte idempotence check in _persistCanonicalForm).
|
||||
*
|
||||
* @param {string} filePath
|
||||
* @param {*} data - JSON.stringify-able value
|
||||
* @param {object} [opts] - passed through to atomicWriteFile
|
||||
* @returns {string} the final path (filePath)
|
||||
*/
|
||||
function atomicWriteJSON(filePath, data, opts = {}) {
|
||||
return atomicWriteFile(filePath, JSON.stringify(data, null, 2), opts);
|
||||
}
|
||||
|
||||
module.exports = { atomicWriteFile, atomicWriteJSON, tmpPathFor };
|
||||
@@ -64,99 +64,10 @@ function formatTime() {
|
||||
return `${d.getFullYear()}-${pad(d.getMonth()+1)}-${pad(d.getDate())} ${pad(d.getHours())}:${pad(d.getMinutes())}:${pad(d.getSeconds())}`;
|
||||
}
|
||||
|
||||
// ─── Email (PII) masking ──────────────────────────────────────────────────────
|
||||
// Central defense: every log sink (console JSON, error.log, audit details)
|
||||
// masks email addresses so raw PII never reaches disk/stdout regardless of
|
||||
// what a call site interpolates. Shape matches AuthProvider.maskEmail
|
||||
// ("sa****@example.com") so operators see one consistent masked form.
|
||||
//
|
||||
// Regex hardening (judge round 1 findings):
|
||||
// - Every quantifier is BOUNDED ({1,64} local, {0,253} domain body, {2,24}
|
||||
// TLD) so a 40KB adversarial string cannot trigger quadratic
|
||||
// backtracking — verified <10ms on the classic "a@" + "1.".repeat(20000)
|
||||
// payload that stalled 3.3s with unbounded quantifiers.
|
||||
// - Quoted local-parts ("john doe"@example.com) are matched too — SMTP
|
||||
// permits them and they are still PII.
|
||||
// - `root@hostname` (no dotted TLD), `pkg@1.2.3` (numeric TLD),
|
||||
// `image@sha256:...` do NOT match.
|
||||
// Masked output cannot re-match (`*` and `"` are not in the unquoted local
|
||||
// class), so masking is idempotent under double application.
|
||||
|
||||
const EMAIL_RE = /(?:[A-Za-z0-9._%+-]{1,64}|"[^"\n\\]{1,64}")@[A-Za-z0-9.-]{0,253}\.[A-Za-z]{2,24}/g;
|
||||
|
||||
function maskEmailAddress(addr) {
|
||||
// addr is always a full EMAIL_RE match. Quoted local-parts (RFC 5322) match
|
||||
// WITH their delimiter quotes and may contain '@' inside the quotes, so
|
||||
// split on the LAST '@' (the real domain boundary), never the first.
|
||||
// The quotes are syntax, not PII: strip them before masking and never
|
||||
// re-emit them — slice(0, 2) of '"john doe"@…' used to leave a stray
|
||||
// unbalanced quote in the output that could glue onto later text and
|
||||
// re-match EMAIL_RE on a second pass (DC-109).
|
||||
const at = addr.lastIndexOf('@');
|
||||
let local = addr.slice(0, at);
|
||||
const domain = addr.slice(at);
|
||||
if (local.length >= 2 && local.startsWith('"') && local.endsWith('"')) {
|
||||
local = local.slice(1, -1);
|
||||
}
|
||||
if (local.length === 0) return '****' + domain;
|
||||
if (local.length <= 2) return local[0] + '****' + domain;
|
||||
return local.slice(0, 2) + '****' + domain;
|
||||
}
|
||||
|
||||
function maskEmailsInString(s) {
|
||||
if (typeof s !== 'string' || !s.includes('@')) return s;
|
||||
return s.replace(EMAIL_RE, maskEmailAddress);
|
||||
}
|
||||
|
||||
/**
|
||||
* Recursively mask email substrings in strings inside a payload.
|
||||
* Returns a new structure; the input is never mutated.
|
||||
*
|
||||
* Correctness notes (judge round 1):
|
||||
* - MEMOIZED via Map, not a plain seen-set: a shared (DAG) reference must
|
||||
* get the SAME masked clone on every path — a seen-set returned the raw
|
||||
* original on second reference, leaking PII ({a:obj, b:obj} → b raw).
|
||||
* - The clone is registered BEFORE recursing into children, so true cycles
|
||||
* resolve to the in-progress clone (terminates; JSON.stringify on a
|
||||
* cyclic input throws either way — logging cyclic payloads is already
|
||||
* undefined behavior).
|
||||
* - Non-plain objects (class instances) with own enumerable props are
|
||||
* cloned with their prototype preserved (Object.create) and those props
|
||||
* masked — skipping them leaked enumerable string props that
|
||||
* JSON.stringify happily serializes. Objects with NO own enumerable
|
||||
* props (Date, RegExp) pass through unchanged — nothing to mask, and
|
||||
* cloning would destroy their internal state.
|
||||
*/
|
||||
function maskEmails(value, memo = new Map()) {
|
||||
if (typeof value === 'string') return maskEmailsInString(value);
|
||||
if (!value || typeof value !== 'object' || value instanceof Error) return value;
|
||||
if (memo.has(value)) return memo.get(value);
|
||||
const proto = Object.getPrototypeOf(value);
|
||||
const isPlain = proto === Object.prototype || proto === null;
|
||||
const isArray = Array.isArray(value);
|
||||
if (!isPlain && !isArray) {
|
||||
const ownKeys = Object.keys(value);
|
||||
if (ownKeys.length === 0) return value; // Date, RegExp, empty instances
|
||||
const inst = Object.create(proto);
|
||||
memo.set(value, inst);
|
||||
for (const k of ownKeys) inst[k] = maskEmails(value[k], memo);
|
||||
return inst;
|
||||
}
|
||||
const out = isArray ? new Array(value.length) : {};
|
||||
memo.set(value, out);
|
||||
if (isArray) {
|
||||
for (let i = 0; i < value.length; i++) out[i] = maskEmails(value[i], memo);
|
||||
} else {
|
||||
for (const [k, v] of Object.entries(value)) out[k] = maskEmails(v, memo);
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
// ─── Console output (dev = pretty, prod = JSON) ─────────────────────────────
|
||||
|
||||
function consoleWrite(level, ctx, msg, data) {
|
||||
if (GLOBAL_LEVEL > LEVELS[level]) return;
|
||||
msg = maskEmailsInString(msg);
|
||||
if (IS_DEV) {
|
||||
const parts = [
|
||||
`${C.dim}${formatTime()}${C.reset}`,
|
||||
@@ -165,7 +76,7 @@ function consoleWrite(level, ctx, msg, data) {
|
||||
`${msg}`,
|
||||
];
|
||||
if (data && typeof data === 'object' && !(data instanceof Error)) {
|
||||
parts.push(`${C.dim}${JSON.stringify(maskEmails(data))}${C.reset}`);
|
||||
parts.push(`${C.dim}${JSON.stringify(data)}${C.reset}`);
|
||||
}
|
||||
let fn = console.log;
|
||||
if (level === 'error') fn = console.error;
|
||||
@@ -174,9 +85,9 @@ function consoleWrite(level, ctx, msg, data) {
|
||||
} else {
|
||||
let extra;
|
||||
if (data instanceof Error) {
|
||||
extra = { error: { message: maskEmailsInString(data.message), code: data.code, stack: maskEmailsInString(data.stack) } };
|
||||
extra = { error: { message: data.message, code: data.code, stack: data.stack } };
|
||||
} else if (data && typeof data === 'object') {
|
||||
extra = { data: maskEmails(data) };
|
||||
extra = { data };
|
||||
} else {
|
||||
extra = {};
|
||||
}
|
||||
@@ -187,59 +98,6 @@ function consoleWrite(level, ctx, msg, data) {
|
||||
|
||||
// ─── Error log file ──────────────────────────────────────────────────────────────
|
||||
|
||||
// DC-108: redact-on-rotate — the rotated archive is the belt-and-braces
|
||||
// backstop for DC-095's mask-at-every-sink defense. Any future sink that
|
||||
// forgets to mask would otherwise persist raw PII in error.log.1 for a
|
||||
// full rotation cycle (up to 5 MB × the archive's lifetime). Scrub the
|
||||
// archive with the SAME canonical mask (sa****@example.com) the live
|
||||
// sinks use, so historical and new lines keep one consistent shape.
|
||||
//
|
||||
// Design constraints (judge-facing):
|
||||
// - Atomic rewrite: sibling temp file + fsync + rename() over the
|
||||
// archive. A crash mid-scrub can never leave a half-redacted (or
|
||||
// empty) error.log.1 behind.
|
||||
// - Read-only when nothing matches (byte-identical content is never
|
||||
// rewritten — mtime and inode preserved), mirroring
|
||||
// scripts/redact-log-pii.js so pointing both at the same file is safe.
|
||||
// - Never blocks the hot error path: a scrub failure is logged to
|
||||
// console and swallowed — the freshly rotated file and the new
|
||||
// error line are still written (rotation already succeeded).
|
||||
// - Preserves the archive's existing mode when stat-able, else 0600
|
||||
// (PII-bearing archives default closed).
|
||||
async function redactRotatedArchive(rotated) {
|
||||
const raw = await fsp.readFile(rotated, 'utf8');
|
||||
if (!raw.includes('@')) return false; // fast path — nothing that could be PII
|
||||
const scrubbed = maskEmailsInString(raw);
|
||||
if (scrubbed === raw) return false; // already clean — never rewrite
|
||||
let mode = 0o600;
|
||||
const st = await fsp.stat(rotated).catch(() => null);
|
||||
if (st) mode = st.mode & 0o777;
|
||||
const tmp = `${rotated}.redact-${process.pid}`;
|
||||
const fh = await fsp.open(tmp, 'wx', mode);
|
||||
try {
|
||||
await fh.writeFile(scrubbed, 'utf8');
|
||||
await fh.sync(); // fsync: crash cannot leave an empty renamed archive
|
||||
} finally {
|
||||
await fh.close();
|
||||
}
|
||||
await fsp.rename(tmp, rotated);
|
||||
return true;
|
||||
}
|
||||
|
||||
// DC-108 (judge nit fold): a hard crash between the temp's wx-open and the
|
||||
// rename leaves a stale `.redact-<pid>` sibling behind. Best-effort sweep on
|
||||
// every rotation — cheap readdir, failures swallowed (the sweep must never
|
||||
// endanger the rotation itself).
|
||||
async function sweepStaleRedactTemps(rotated) {
|
||||
const dir = path.dirname(rotated);
|
||||
const prefix = path.basename(rotated) + '.redact-';
|
||||
for (const ent of await fsp.readdir(dir)) {
|
||||
if (ent.startsWith(prefix)) {
|
||||
await fsp.unlink(path.join(dir, ent)).catch(() => {});
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
async function appendErrorLog(line) {
|
||||
try {
|
||||
const stats = await fsp.stat(ERROR_LOG_FILE).catch(() => null);
|
||||
@@ -247,18 +105,6 @@ async function appendErrorLog(line) {
|
||||
const rotated = ERROR_LOG_FILE + '.1';
|
||||
await fsp.unlink(rotated).catch(() => {});
|
||||
await fsp.rename(ERROR_LOG_FILE, rotated);
|
||||
// DC-108: scrub the archive we just created. Isolated try/catch on
|
||||
// purpose — a scrub failure must not stop the new line below from
|
||||
// being appended (rotation already committed).
|
||||
try {
|
||||
await redactRotatedArchive(rotated);
|
||||
} catch (e) {
|
||||
console.error('[logger] Failed to redact rotated error.log archive:', e.message);
|
||||
}
|
||||
// Best-effort stale-temp sweep — never blocks rotation
|
||||
try {
|
||||
await sweepStaleRedactTemps(rotated);
|
||||
} catch (_) {}
|
||||
}
|
||||
await fsp.appendFile(ERROR_LOG_FILE, line + '\n');
|
||||
} catch (e) {
|
||||
@@ -333,22 +179,18 @@ async function writeErrorLog(ctx, error, req, extra) {
|
||||
} else {
|
||||
headLine = String(error);
|
||||
}
|
||||
// PII: mask emails in every line that reaches error.log — the error chain,
|
||||
// the stack, and the JSON-serialized extra context.
|
||||
headLine = maskEmailsInString(headLine);
|
||||
diagLines = diagLines.map(maskEmailsInString);
|
||||
// Preserve the historical `ctx: <head>` shape so log scrapers don't break.
|
||||
// The head now carries `name [code]: message` instead of bare `.message`.
|
||||
const parts = [`[${ts}] [ERR] ${ctx}: ${headLine.replace(/^\s+/, '')}`];
|
||||
if (errStack) parts.push(maskEmailsInString(errStack));
|
||||
if (errStack) parts.push(errStack);
|
||||
if (diagLines.length) parts.push(' diagnostic: ' + diagLines.join('\n diagnostic: '));
|
||||
if (req) {
|
||||
const ip = req.ip || req.socket?.remoteAddress || '';
|
||||
const ua = req.get ? req.get('user-agent') : '';
|
||||
// PII: path and UA can carry emails (e.g. /invites/<email>/accept,
|
||||
// UA contact strings) — mask them like every other line.
|
||||
parts.push(` request: ${req.method || ''} ${maskEmailsInString(req.path || '')} | ip: ${ip} | ua: ${maskEmailsInString(ua)}${req.id ? ' | id: ' + req.id : ''}`);
|
||||
parts.push(` request: ${req.method || ''} ${req.path || ''} | ip: ${ip} | ua: ${ua}${req.id ? ' | id: ' + req.id : ''}`);
|
||||
}
|
||||
if (extra && Object.keys(extra).length) {
|
||||
parts.push(` context: ${JSON.stringify(maskEmails(extra))}`);
|
||||
parts.push(` context: ${JSON.stringify(extra)}`);
|
||||
}
|
||||
parts.push('─'.repeat(72));
|
||||
await appendErrorLog(parts.join('\n'));
|
||||
@@ -427,10 +269,6 @@ function sanitize(obj) {
|
||||
clean[k] = '***';
|
||||
} else if (v && typeof v === 'object') {
|
||||
clean[k] = sanitize(v);
|
||||
} else if (typeof v === 'string') {
|
||||
// PII: mask emails even in non-sensitive keys (e.g. req.body.email
|
||||
// on invite/auth POSTs used to land raw in audit-log.json).
|
||||
clean[k] = maskEmailsInString(v);
|
||||
} else {
|
||||
clean[k] = v;
|
||||
}
|
||||
@@ -493,12 +331,11 @@ class Logger extends EventEmitter {
|
||||
|
||||
_log(level, ctx, msg, data, { req, payload } = {}) {
|
||||
if (LEVELS[level] < this._level) return;
|
||||
msg = maskEmailsInString(msg);
|
||||
|
||||
const entry = {
|
||||
t: new Date().toISOString(), level, ctx, msg,
|
||||
...(data instanceof Error ? { error: { message: maskEmailsInString(data.message), code: data.code, stack: maskEmailsInString(data.stack) } } : {}),
|
||||
...(payload ? { data: maskEmails(payload) } : {}),
|
||||
...(data instanceof Error ? { error: { message: data.message, code: data.code, stack: data.stack } } : {}),
|
||||
...(payload ? { data: payload } : {}),
|
||||
};
|
||||
if (req && (req.id || req.ip || req.path)) {
|
||||
entry.requestId = req.id || null;
|
||||
@@ -683,13 +520,4 @@ module.exports = {
|
||||
AUDIT_SKIP_PATHS,
|
||||
AUDIT_ACTION_MAP,
|
||||
SENSITIVE_KEYS,
|
||||
// Email-PII masking primitives — exported for maintenance tooling
|
||||
// (scripts/redact-log-pii.js rewrites pre-DC-095 log files with the SAME
|
||||
// canonical mask so historical and new lines show one consistent shape).
|
||||
// EMAIL_RE is a /g regex: always clone it (new RegExp(src, flags)) before
|
||||
// .test()/.exec() or you will inherit a stale lastIndex.
|
||||
EMAIL_RE,
|
||||
maskEmailAddress,
|
||||
maskEmailsInString,
|
||||
maskEmails,
|
||||
};
|
||||
@@ -58,65 +58,20 @@ npm run build
|
||||
# Windows (creates portable .exe and installer)
|
||||
npm run build:win
|
||||
|
||||
# macOS zip (from any host; electron-builder's native target)
|
||||
# macOS (creates .dmg)
|
||||
npm run build:mac
|
||||
|
||||
# macOS real drag-install .dmg — built ON LINUX, no Mac needed
|
||||
# (one-time toolchain: see scripts/build-dmg-linux.sh header)
|
||||
npm run build:dmg
|
||||
|
||||
# Linux (creates AppImage and .deb)
|
||||
npm run build:linux
|
||||
```
|
||||
|
||||
### Build Output
|
||||
|
||||
Built applications are placed in the `build-output/` directory:
|
||||
Built applications are placed in the `dist/` directory:
|
||||
|
||||
- **Windows**: `build-output/DashCaddy Installer <version>.exe` (portable) and
|
||||
`build-output/DashCaddy Installer Setup <version>.exe` (NSIS installer)
|
||||
— filenames embed the current `version` from package.json
|
||||
- **macOS**: `build-output/DashCaddy Installer-<version>-mac.zip` — the
|
||||
configured mac target is `zip` (unsigned; signed builds require a Mac
|
||||
with signing credentials). `npm run build:dmg` additionally produces a
|
||||
real drag-install `build-output/DashCaddy Installer-<version>.dmg`
|
||||
built entirely on Linux (libguestfs HFS+ volume + libdmg-hfsplus UDZO
|
||||
compression; unsigned — macOS Gatekeeper will show the standard
|
||||
right-click→Open dialog on first launch)
|
||||
- **Linux**: `build-output/DashCaddy Installer-<version>.AppImage` and
|
||||
`build-output/dashcaddy-installer_<version>_amd64.deb`
|
||||
|
||||
### Cross-platform build requirements (verified 2026-09-01)
|
||||
|
||||
Building Windows installers from Linux requires **wine with both 64-bit and
|
||||
32-bit support** — NSIS's 32-bit post-processing runs under wine:
|
||||
|
||||
```bash
|
||||
# Ubuntu 24.04 (Debian/Ubuntu package names; other distros vary).
|
||||
# Requires root / sudo for the dpkg and apt steps.
|
||||
dpkg --add-architecture i386
|
||||
# add i386 mirror entries if the main sources are amd64-only pinned
|
||||
apt-get update && apt-get install -y wine64 wine32:i386
|
||||
# initialize a prefix once (avoids kernel32.dll load failures in CI)
|
||||
export WINEPREFIX=~/.wine-dashcaddy && wineboot --init
|
||||
```
|
||||
|
||||
Without wine32, the NSIS setup exe is built but ends up as a ~211KB stub
|
||||
(payload not appended) and the build appears to pass (exit 0). Check the
|
||||
result — the size (~90MB+) is a quick heuristic, but the **authoritative**
|
||||
check is listing/extracting the payload:
|
||||
|
||||
```bash
|
||||
7z l "build-output/DashCaddy Installer Setup <version>.exe" # should list a large app-64.7z
|
||||
# or extract and scan: 7z x <setup.exe> && 7z x '$PLUGINSDIR/app-64.7z'
|
||||
```
|
||||
|
||||
After every build, run the secrets scanner to verify no private key material
|
||||
was bundled into the shipped resources:
|
||||
|
||||
```bash
|
||||
npm run build:scan
|
||||
```
|
||||
- **Windows**: `dist/win-unpacked/DashCaddy Installer.exe` (portable)
|
||||
- **macOS**: `dist/DashCaddy Installer.dmg`
|
||||
- **Linux**: `dist/DashCaddy Installer.AppImage` and `.deb`
|
||||
|
||||
## Project Structure
|
||||
|
||||
|
||||
Whitespace-only changes.
@@ -11,9 +11,7 @@
|
||||
"build": "electron-builder",
|
||||
"build:win": "electron-builder --win",
|
||||
"build:mac": "electron-builder --mac",
|
||||
"build:linux": "electron-builder --linux",
|
||||
"build:scan": "bash scripts/check-artifact-secrets.sh build-output",
|
||||
"build:dmg": "npm run build:mac && bash scripts/build-dmg-linux.sh"
|
||||
"build:linux": "electron-builder --linux"
|
||||
},
|
||||
"keywords": [
|
||||
"dashcaddy",
|
||||
@@ -65,42 +63,7 @@
|
||||
"!node_modules/**",
|
||||
"!.git/**",
|
||||
"!**/*.test.js",
|
||||
"!**/*.spec.js",
|
||||
"!**/*.key",
|
||||
"!**/*.pem",
|
||||
"!**/*.p12",
|
||||
"!**/*.pfx",
|
||||
"!**/*.jks",
|
||||
"!**/*.keystore",
|
||||
"!**/*.ppk",
|
||||
"!**/*.asc",
|
||||
"!**/id_rsa*",
|
||||
"!**/id_ed25519*",
|
||||
"!**/secrets/**",
|
||||
"!**/.ssh/**",
|
||||
"!**/.aws/**",
|
||||
"!**/.gnupg/**",
|
||||
"!**/*.local",
|
||||
"!**/.npmrc",
|
||||
"!**/.netrc",
|
||||
"!pki/**",
|
||||
"!ca/**/*.key",
|
||||
"!ca/**/*.der",
|
||||
"!ca/**/*.mobileconfig",
|
||||
"!ca/**/*.p12",
|
||||
"!ca/**/*.pem",
|
||||
"!ca/intermediate.crt",
|
||||
"!ca/root.crt",
|
||||
"!ca/scripts/**",
|
||||
"!generated-certs/**",
|
||||
"!data/**",
|
||||
"!coverage/**",
|
||||
"!audit-log.json",
|
||||
"!error.log",
|
||||
"!.env",
|
||||
"!.env.*",
|
||||
"!openapi.yaml.bak",
|
||||
"!dist/**"
|
||||
"!**/*.spec.js"
|
||||
]
|
||||
}
|
||||
],
|
||||
|
||||
@@ -0,0 +1,104 @@
|
||||
{
|
||||
"name": "dashcaddy-installer",
|
||||
"version": "1.0.0",
|
||||
"description": "Cross-platform installer for DashCaddy platform",
|
||||
"main": "src/main/index.js",
|
||||
"scripts": {
|
||||
"start": "electron .",
|
||||
"dev": "electron . --dev",
|
||||
"test": "jest",
|
||||
"test:watch": "jest --watch",
|
||||
"build": "electron-builder",
|
||||
"build:win": "electron-builder --win",
|
||||
"build:mac": "electron-builder --mac",
|
||||
"build:linux": "electron-builder --linux"
|
||||
},
|
||||
"keywords": [
|
||||
"dashcaddy",
|
||||
"installer",
|
||||
"docker",
|
||||
"caddy"
|
||||
],
|
||||
"author": {
|
||||
"name": "DashCaddy Team",
|
||||
"email": "dashcaddy@sami.cloud"
|
||||
},
|
||||
"homepage": "https://github.com/dashcaddy/dashcaddy",
|
||||
"license": "MIT",
|
||||
"devDependencies": {
|
||||
"electron": "^28.3.3",
|
||||
"electron-builder": "^24.9.1",
|
||||
"fast-check": "^3.15.0",
|
||||
"jest": "^29.7.0"
|
||||
},
|
||||
"build": {
|
||||
"appId": "com.dashcaddy.installer",
|
||||
"productName": "DashCaddy Installer",
|
||||
"asar": true,
|
||||
"directories": {
|
||||
"output": "build-output"
|
||||
},
|
||||
"files": [
|
||||
"src/**/*",
|
||||
"assets/**/*",
|
||||
"templates/**/*"
|
||||
],
|
||||
"extraResources": [
|
||||
{
|
||||
"from": "../status",
|
||||
"to": "status",
|
||||
"filter": [
|
||||
"**/*",
|
||||
"!node_modules/**",
|
||||
"!.git/**",
|
||||
"!**/*.test.js",
|
||||
"!**/*.spec.js"
|
||||
]
|
||||
},
|
||||
{
|
||||
"from": "../dashcaddy-api",
|
||||
"to": "dashcaddy-api",
|
||||
"filter": [
|
||||
"**/*",
|
||||
"!node_modules/**",
|
||||
"!.git/**",
|
||||
"!**/*.test.js",
|
||||
"!**/*.spec.js"
|
||||
]
|
||||
}
|
||||
],
|
||||
"icon": "assets/favicon.ico",
|
||||
"win": {
|
||||
"target": [
|
||||
"nsis",
|
||||
"portable"
|
||||
],
|
||||
"icon": "assets/favicon.ico",
|
||||
"signAndEditExecutable": false
|
||||
},
|
||||
"mac": {
|
||||
"target": [
|
||||
"zip"
|
||||
],
|
||||
"icon": "assets/dashcaddy-logo.png"
|
||||
},
|
||||
"linux": {
|
||||
"target": [
|
||||
"AppImage",
|
||||
"deb"
|
||||
],
|
||||
"icon": "assets/dashcaddy-logo.png",
|
||||
"category": "Utility"
|
||||
},
|
||||
"nsis": {
|
||||
"oneClick": false,
|
||||
"allowToChangeInstallationDirectory": true,
|
||||
"installerIcon": "assets/icon.ico",
|
||||
"uninstallerIcon": "assets/icon.ico",
|
||||
"installerHeaderIcon": "assets/icon.ico"
|
||||
}
|
||||
},
|
||||
"dependencies": {
|
||||
"electron-updater": "^6.8.9"
|
||||
}
|
||||
}
|
||||
Whitespace-only changes.
@@ -1,54 +0,0 @@
|
||||
#!/bin/bash
|
||||
# Build a REAL .dmg for macOS users ON LINUX (no Mac needed).
|
||||
#
|
||||
# One-time toolchain setup (all on the Linux build host):
|
||||
# apt-get install -y hfsprogs libguestfs-tools linux-modules-extra-$(uname -r)
|
||||
# hfsprogs = the HFS+ volume formatter; libguestfs runs it INSIDE its
|
||||
# sandboxed appliance VM, where it only ever formats disk-image FILES —
|
||||
# never real block devices/drives.
|
||||
# modprobe hfsplus && echo hfsplus >> /etc/modules (kernel support)
|
||||
# git clone https://github.com/planetbeing/libdmg-hfsplus.git /opt/libdmg-hfsplus
|
||||
# cd /opt/libdmg-hfsplus
|
||||
# sed -i 's/IF(OPENSSL_FOUND)/IF(FALSE)/' dmg/CMakeLists.txt # OpenSSL 3 breaks FileVault; not needed for plain UDZO
|
||||
# mkdir build && cd build && cmake .. && make
|
||||
#
|
||||
# Usage: scripts/build-dmg-linux.sh (run from dashcaddy-installer/, after npm run build:mac)
|
||||
set -euo pipefail
|
||||
cd "$(dirname "$0")/.."
|
||||
|
||||
LIBDMG=/opt/libdmg-hfsplus/build
|
||||
STAGE="$(mktemp -d)"
|
||||
trap 'rm -rf "$STAGE"' EXIT
|
||||
APP="build-output/mac/DashCaddy Installer.app"
|
||||
VERSION=$(node -p "require('./package.json').version")
|
||||
OUT="build-output/DashCaddy Installer-$VERSION.dmg"
|
||||
|
||||
[ -d "$APP" ] || { echo "ERROR: $APP missing — run: npm run build:mac"; exit 1; }
|
||||
[ -x "$LIBDMG/hdutil/hdutil" ] || { echo "ERROR: libdmg-hfsplus not built at $LIBDMG"; exit 1; }
|
||||
modprobe hfsplus 2>/dev/null || { echo "ERROR: hfsplus kernel module missing"; exit 1; }
|
||||
|
||||
echo ">>> staging app + /Applications drag-install link"
|
||||
cp -a "$APP" "$STAGE/DashCaddy Installer.app"
|
||||
ln -s /Applications "$STAGE/Applications"
|
||||
|
||||
echo ">>> creating HFS+ volume inside a 400M image file (no drives touched)"
|
||||
# LIBGUESTFS_BACKEND=direct is deliberate: the appliance must run the host
|
||||
# kernel so the hfsplus module is available; direct backend on a dedicated
|
||||
# build host is accepted (appliance only ever touches image files here).
|
||||
export LIBGUESTFS_BACKEND=direct
|
||||
virt-make-fs --type=hfsplus --size=400M "$STAGE" "$STAGE/vol.hfs"
|
||||
|
||||
echo ">>> verifying volume contents (app + symlink present)"
|
||||
"$LIBDMG/hdutil/hdutil" "$STAGE/vol.hfs" ls /
|
||||
|
||||
echo ">>> compressing to UDIF .dmg"
|
||||
"$LIBDMG/dmg/dmg" dmg "$STAGE/vol.hfs" "$OUT"
|
||||
|
||||
echo ">>> secret-scanning the DMG contents"
|
||||
VERIFY="$STAGE/verify"
|
||||
mkdir -p "$VERIFY"
|
||||
"$LIBDMG/hdutil/hdutil" "$STAGE/vol.hfs" extractall / "$VERIFY"
|
||||
bash scripts/check-artifact-secrets.sh "$VERIFY"
|
||||
|
||||
echo ">>> DONE: $OUT ($(du -h "$OUT" | cut -f1))"
|
||||
file "$OUT"
|
||||
@@ -1,49 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# check-artifact-secrets.sh — fail (exit 1) if an electron-builder output
|
||||
# contains private key material. Belt-and-suspenders behind the
|
||||
# extraResources denylist in package.json (judge polish #5, batch 3a).
|
||||
#
|
||||
# Usage: scripts/check-artifact-secrets.sh <build-output-dir>
|
||||
set -u
|
||||
|
||||
ROOT="${1:?usage: check-artifact-secrets.sh <build-output-dir>}"
|
||||
[ -d "$ROOT" ] || { echo "ERROR: $ROOT is not a directory"; exit 2; }
|
||||
|
||||
fail=0
|
||||
|
||||
# 1. Filename scan: private-key extensions and well-known key filenames.
|
||||
keyfiles=$(find "$ROOT" -type f \( \
|
||||
-name '*.key' -o -name '*.pem' -o -name '*.p12' -o -name '*.pfx' \
|
||||
-o -name '*.jks' -o -name '*.keystore' -o -name '*.ppk' \
|
||||
-o -name 'id_rsa*' -o -name 'id_ed25519*' -o -name 'id_ecdsa*' \
|
||||
-o -name 'id_dsa*' -o -name '*.ovpn' -o -name '*.keytab' \
|
||||
-o -name '*.asc' \
|
||||
\) 2>/dev/null)
|
||||
if [ -n "$keyfiles" ]; then
|
||||
echo "FAIL: key-material filenames found:"
|
||||
echo "$keyfiles"
|
||||
fail=1
|
||||
fi
|
||||
|
||||
# 2. Content scan: PEM private-key headers. Skip Electron asar archives and
|
||||
# large binaries (they were covered by the filename scan + denylist).
|
||||
hits=$(grep -rl --binary-files=text -e 'PRIVATE KEY-----' "$ROOT" \
|
||||
--exclude-dir='*.asar' --exclude='*.asar' 2>/dev/null || true)
|
||||
if [ -n "$hits" ]; then
|
||||
echo "FAIL: private-key content found in:"
|
||||
echo "$hits"
|
||||
fail=1
|
||||
fi
|
||||
|
||||
# 3. Env-file scan: .env files must never ship.
|
||||
envfiles=$(find "$ROOT" -type f \( -name '.env' -o -name '.env.*' \) 2>/dev/null)
|
||||
if [ -n "$envfiles" ]; then
|
||||
echo "FAIL: .env files found:"
|
||||
echo "$envfiles"
|
||||
fail=1
|
||||
fi
|
||||
|
||||
if [ "$fail" -eq 0 ]; then
|
||||
echo "OK: no private key material in $ROOT"
|
||||
fi
|
||||
exit "$fail"
|
||||
@@ -61,20 +61,15 @@ try {
|
||||
|
||||
class ConfigManager {
|
||||
/**
|
||||
* Saves configuration to disk.
|
||||
* @param {Object} config - Configuration object to save
|
||||
* Saves installation configuration to disk
|
||||
* @param {Object} config - Configuration object
|
||||
* @param {string} installPath - Installation directory path
|
||||
* @returns {Promise<Object>} Save result { success, path?, error? }
|
||||
* @returns {Promise<Object>} { success: boolean, path: string }
|
||||
*/
|
||||
async saveConfig(config, installPath) {
|
||||
try {
|
||||
const configPath = path.join(installPath, 'config.json');
|
||||
|
||||
// Ensure the installation directory exists before writing — callers
|
||||
// (wizard flow, property tests) may save into a fresh unique path
|
||||
// without a prior createDirectories() call.
|
||||
await fs.mkdir(installPath, { recursive: true });
|
||||
|
||||
// Add metadata
|
||||
const configWithMetadata = {
|
||||
...config,
|
||||
@@ -274,16 +269,10 @@ class ConfigManager {
|
||||
try {
|
||||
const credPath = path.join(installPath, 'dns-credentials.json');
|
||||
|
||||
// Encrypt sensitive fields. Non-secret fields (server, username, tld)
|
||||
// are stored in plaintext; tld must round-trip — it was previously
|
||||
// dropped here, silently losing the zone suffix a user configured.
|
||||
// Normalize tld to string-or-null so a corrupted/typed credential
|
||||
// object can't smuggle an unexpected type onto disk (judge polish #4).
|
||||
const tldValue = credentials.tld == null ? null : String(credentials.tld);
|
||||
// Encrypt sensitive fields
|
||||
const credentialsToSave = {
|
||||
server: credentials.server,
|
||||
username: credentials.username,
|
||||
tld: tldValue,
|
||||
// Encrypt password and token
|
||||
password: credentials.password ? cryptoUtils.encrypt(credentials.password) : null,
|
||||
token: credentials.token ? cryptoUtils.encrypt(credentials.token) : null,
|
||||
@@ -349,9 +338,6 @@ class ConfigManager {
|
||||
const decrypted = {
|
||||
server: credentials.server,
|
||||
username: credentials.username,
|
||||
// Normalize: string-or-null even if the on-disk file was
|
||||
// hand-edited with an unexpected type (judge polish #4).
|
||||
tld: credentials.tld == null ? null : String(credentials.tld),
|
||||
password: credentials.password && cryptoUtils.isEncrypted(credentials.password)
|
||||
? cryptoUtils.decrypt(credentials.password)
|
||||
: credentials.password,
|
||||
|
||||
@@ -14,11 +14,7 @@ describe('ConfigManager Property Tests', () => {
|
||||
|
||||
beforeEach(async () => {
|
||||
manager = new ConfigManager();
|
||||
// mkdtemp: collision-free even under parallel Jest workers (polish #1).
|
||||
testDir = await fs.mkdtemp(path.join(os.tmpdir(), 'dashcaddy-prop-test-'));
|
||||
// saveConfig/saveDNSCredentials write directly into installPath —
|
||||
// the directory must exist or every save ENOENTs.
|
||||
await fs.mkdir(testDir, { recursive: true });
|
||||
testDir = path.join(os.tmpdir(), `dashcaddy-prop-test-${Date.now()}`);
|
||||
});
|
||||
|
||||
afterEach(async () => {
|
||||
@@ -161,15 +157,11 @@ describe('ConfigManager Property Tests', () => {
|
||||
|
||||
/**
|
||||
* Feature: dashcaddy-installer, Property 4: Directory Structure Creation
|
||||
* For any valid installation path, the installer should create all required
|
||||
* subdirectories (the production REQUIRED_DIRS layout) and verify their
|
||||
* existence. Validates: Requirements 2.5
|
||||
* For any valid installation path, the installer should create all required
|
||||
* subdirectories (config, data, logs, caddyfile) and verify their existence.
|
||||
* Validates: Requirements 2.5
|
||||
*/
|
||||
describe('Property 4: Directory Structure Creation', () => {
|
||||
// REQUIRED_DIRS is the canonical production layout; the Docker Compose
|
||||
// mounts in caddyfile-generator.js depend on it.
|
||||
const { REQUIRED_DIRS } = require('../shared/constants');
|
||||
|
||||
test('createDirectories creates all required directories', async () => {
|
||||
await fc.assert(
|
||||
fc.asyncProperty(
|
||||
@@ -181,8 +173,9 @@ describe('ConfigManager Property Tests', () => {
|
||||
if (!result.success) return true; // Skip if creation failed
|
||||
|
||||
// Verify all required directories exist
|
||||
const requiredDirs = ['config', 'data', 'logs', 'caddyfile'];
|
||||
const checks = await Promise.all(
|
||||
REQUIRED_DIRS.map(async (dir) => {
|
||||
requiredDirs.map(async (dir) => {
|
||||
const dirPath = path.join(installPath, dir);
|
||||
try {
|
||||
await fs.access(dirPath);
|
||||
|
||||
@@ -9,9 +9,8 @@ describe('ConfigManager', () => {
|
||||
|
||||
beforeEach(async () => {
|
||||
manager = new ConfigManager();
|
||||
// mkdtemp gives a collision-free unique dir even under parallel Jest
|
||||
// workers (Date.now() naming could collide — judge polish #1).
|
||||
testDir = await fs.mkdtemp(path.join(os.tmpdir(), 'dashcaddy-test-'));
|
||||
// Create a unique test directory for each test
|
||||
testDir = path.join(os.tmpdir(), `dashcaddy-test-${Date.now()}`);
|
||||
});
|
||||
|
||||
afterEach(async () => {
|
||||
@@ -36,9 +35,8 @@ describe('ConfigManager', () => {
|
||||
expect(result.success).toBe(true);
|
||||
expect(result.path).toContain('config.json');
|
||||
|
||||
// Verify file was created (flat layout: <installPath>/config.json —
|
||||
// matches the Docker Compose mounts in caddyfile-generator.js)
|
||||
const configPath = path.join(testDir, 'config.json');
|
||||
// Verify file was created
|
||||
const configPath = path.join(testDir, 'config', 'config.json');
|
||||
const exists = await fs.access(configPath).then(() => true).catch(() => false);
|
||||
expect(exists).toBe(true);
|
||||
});
|
||||
@@ -70,21 +68,6 @@ describe('ConfigManager', () => {
|
||||
expect(result.error).toBeDefined();
|
||||
}
|
||||
});
|
||||
|
||||
test('creates a nonexistent nested install path before writing (judge polish #7)', async () => {
|
||||
// saveConfig must mkdir the target dir itself: the wizard may pass a
|
||||
// path the user typed that doesn't exist yet. Regression guard for
|
||||
// the ENOENT the property suite caught before the mkdir fix.
|
||||
const nested = path.join(testDir, 'does', 'not', 'exist', 'yet');
|
||||
const config = { installPath: nested, tier: 'basic' };
|
||||
|
||||
const result = await manager.saveConfig(config, nested);
|
||||
|
||||
expect(result.success).toBe(true);
|
||||
const loaded = await manager.loadConfig(nested);
|
||||
expect(loaded.exists).toBe(true);
|
||||
expect(loaded.config.tier).toBe('basic');
|
||||
});
|
||||
});
|
||||
|
||||
describe('loadConfig', () => {
|
||||
@@ -111,8 +94,9 @@ describe('ConfigManager', () => {
|
||||
});
|
||||
|
||||
test('handles corrupted config files', async () => {
|
||||
// Create a corrupted config file (flat layout: <installPath>/config.json)
|
||||
const configPath = path.join(testDir, 'config.json');
|
||||
// Create a corrupted config file
|
||||
const configPath = path.join(testDir, 'config', 'config.json');
|
||||
await fs.mkdir(path.dirname(configPath), { recursive: true });
|
||||
await fs.writeFile(configPath, 'invalid json{', 'utf8');
|
||||
|
||||
const result = await manager.loadConfig(testDir);
|
||||
@@ -129,16 +113,21 @@ describe('ConfigManager', () => {
|
||||
expect(result.success).toBe(true);
|
||||
expect(result.paths.length).toBeGreaterThan(0);
|
||||
|
||||
// Verify directories were created. REQUIRED_DIRS is the canonical
|
||||
// production layout (sites/status dashboard + dashcaddy-api); the
|
||||
// Docker Compose mounts in caddyfile-generator.js depend on it.
|
||||
const { REQUIRED_DIRS } = require('../shared/constants');
|
||||
// Verify directories were created
|
||||
const configDir = path.join(testDir, 'config');
|
||||
const dataDir = path.join(testDir, 'data');
|
||||
const logsDir = path.join(testDir, 'logs');
|
||||
const caddyfileDir = path.join(testDir, 'caddyfile');
|
||||
|
||||
for (const dir of REQUIRED_DIRS) {
|
||||
const dirPath = path.join(testDir, dir);
|
||||
const exists = await fs.access(dirPath).then(() => true).catch(() => false);
|
||||
expect(exists).toBe(true);
|
||||
}
|
||||
const configExists = await fs.access(configDir).then(() => true).catch(() => false);
|
||||
const dataExists = await fs.access(dataDir).then(() => true).catch(() => false);
|
||||
const logsExists = await fs.access(logsDir).then(() => true).catch(() => false);
|
||||
const caddyfileExists = await fs.access(caddyfileDir).then(() => true).catch(() => false);
|
||||
|
||||
expect(configExists).toBe(true);
|
||||
expect(dataExists).toBe(true);
|
||||
expect(logsExists).toBe(true);
|
||||
expect(caddyfileExists).toBe(true);
|
||||
});
|
||||
|
||||
test('handles directory creation errors', async () => {
|
||||
|
||||
@@ -297,14 +297,11 @@ class DependencyChecker {
|
||||
);
|
||||
|
||||
if (!downloadResult.success) {
|
||||
// Fallback to manual instructions if the automated download fails.
|
||||
// The message must steer the user to the manual steps we return
|
||||
// alongside it (contract asserted in dependency-checker.test.js),
|
||||
// not parrot the raw downloader error alone.
|
||||
// Fallback to instructions if download fails
|
||||
return {
|
||||
success: false,
|
||||
automated: false,
|
||||
message: `Automated download failed (${downloadResult.message || 'unknown error'}) — follow the manual instructions below`,
|
||||
message: downloadResult.message || 'Download failed',
|
||||
instructions: this.getDockerInstallInstructions(platform)
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,31 +1,5 @@
|
||||
const fc = require('fast-check');
|
||||
const DependencyChecker = require('./dependency-checker');
|
||||
const { exec } = require('child_process');
|
||||
|
||||
// These property tests must be hermetic: this repo's build box has caddy
|
||||
// (and often docker) actually installed, and installDocker/installCaddy
|
||||
// construct a real DownloadManager that would hit docker.com / GitHub.
|
||||
// Mock child_process + DownloadManager so every property exercises the
|
||||
// same deterministic code paths regardless of host state.
|
||||
jest.mock('child_process');
|
||||
|
||||
jest.mock('./download-manager', () => {
|
||||
return jest.fn().mockImplementation(() => ({
|
||||
downloadDocker: jest.fn().mockResolvedValue({
|
||||
success: false,
|
||||
message: 'Download unavailable in test environment'
|
||||
}),
|
||||
downloadCaddy: jest.fn().mockResolvedValue({
|
||||
success: false,
|
||||
message: 'Download unavailable in test environment'
|
||||
}),
|
||||
extractCaddy: jest.fn().mockResolvedValue({
|
||||
success: false,
|
||||
message: 'Extraction unavailable in test environment'
|
||||
}),
|
||||
cleanup: jest.fn().mockResolvedValue(undefined)
|
||||
}));
|
||||
});
|
||||
|
||||
/**
|
||||
* Feature: dashcaddy-installer, Property 2: Dependency Verification
|
||||
@@ -38,14 +12,6 @@ describe('Property 2: Dependency Verification', () => {
|
||||
|
||||
beforeEach(() => {
|
||||
checker = new DependencyChecker();
|
||||
jest.clearAllMocks();
|
||||
// Default: all commands succeed with empty output. This keeps
|
||||
// checkDocker/checkCaddy/executeCommand/detectLinuxDistro deterministic
|
||||
// (version parsing degrades to 'unknown'/'') and makes the
|
||||
// installCaddy('macos') brew path reach the automated branch.
|
||||
exec.mockImplementation((cmd, opts, callback) => {
|
||||
callback(null, { stdout: '', stderr: '' });
|
||||
});
|
||||
});
|
||||
|
||||
test('checkDocker always returns valid structure', async () => {
|
||||
|
||||
@@ -4,29 +4,6 @@ const { exec } = require('child_process');
|
||||
// Mock child_process
|
||||
jest.mock('child_process');
|
||||
|
||||
// Mock DownloadManager: installDocker/installCaddy construct it inline and
|
||||
// would otherwise hit the real network (docker.com / GitHub releases),
|
||||
// hanging past jest's 5s per-test timeout. Every network/installer operation
|
||||
// is stubbed to fail fast so the code under test exercises its
|
||||
// download-failed → manual-instructions fallback paths deterministically.
|
||||
jest.mock('./download-manager', () => {
|
||||
return jest.fn().mockImplementation(() => ({
|
||||
downloadDocker: jest.fn().mockResolvedValue({
|
||||
success: false,
|
||||
message: 'Download unavailable in test environment'
|
||||
}),
|
||||
downloadCaddy: jest.fn().mockResolvedValue({
|
||||
success: false,
|
||||
message: 'Download unavailable in test environment'
|
||||
}),
|
||||
extractCaddy: jest.fn().mockResolvedValue({
|
||||
success: false,
|
||||
message: 'Extraction unavailable in test environment'
|
||||
}),
|
||||
cleanup: jest.fn().mockResolvedValue(undefined)
|
||||
}));
|
||||
});
|
||||
|
||||
describe('DependencyChecker', () => {
|
||||
let checker;
|
||||
|
||||
|
||||
File diff suppressed because it is too large.
Load diff
@@ -8,30 +8,11 @@ ASSETS_DIR="/var/www/dashcaddy-status/assets"
|
||||
UPDATES_DIR="/opt/dashcaddy/updates"
|
||||
BACKUPS_DIR="/opt/dashcaddy/backups"
|
||||
HOST_IP="172.17.0.1"
|
||||
# DC-118: this host's own routable IPs (comma-sep) — passed to the API so the
|
||||
# caddy-event self-noise filter can drop the host's own curl probes (watchdog,
|
||||
# cron) without blinding the store to external curl traffic. Loopback is
|
||||
# always implicit in the worker; add the tailscale IP when discoverable.
|
||||
SELF_IPS="127.0.0.1"
|
||||
TS_IP="$(tailscale ip -4 2>/dev/null | head -1 || true)"
|
||||
[ -n "$TS_IP" ] && SELF_IPS="${SELF_IPS},${TS_IP}"
|
||||
# Local Technitium (binds 0.0.0.0:53) resolves *.sami + recurses for docker subnet
|
||||
# external fallback. Without this the container only has 8.8.8.8 and every
|
||||
# *.sami health-check probe fails with ENOTFOUND (uptime bars stay empty).
|
||||
DNS_PRIMARY="100.121.150.22" # Technitium (Tailscale IP) — resolves *.sami
|
||||
# DC-121: the fallback must ALSO serve *.sami. Node's tls.connect resolves via
|
||||
# dns.lookup → getaddrinfo → musl, which queries ALL resolv.conf nameservers in
|
||||
# PARALLEL and takes the first reply. With 8.8.8.8 as fallback, Google NXDOMAINs
|
||||
# the internal .sami TLD and wins that race ~2-5% of the time. Measured on DNS2
|
||||
# inside the live container 2026-08-24: dns.lookup 18/400 ENOTFOUND for records
|
||||
# that resolve fine via the primary; c-ares pinned to 8.8.8.8 alone returns
|
||||
# NXDOMAIN 10/10; c-ares pinned to the primary 0/400. (Source of ssl-monitor
|
||||
# "Failed to check cert" warn noise; the git.sami /etc/hosts pin below was a
|
||||
# per-name paperover of this same class.) DNS1's Technitium secondary
|
||||
# (100.71.97.12) serves *.sami AND recurses for external names — both verified
|
||||
# from inside the container — so whichever resolver wins the race, the answer
|
||||
# is correct.
|
||||
DNS_FALLBACK="100.71.97.12" # DNS1 Technitium secondary — serves *.sami + recurses
|
||||
DNS_FALLBACK="8.8.8.8"
|
||||
|
||||
# --- One-time migration from Docker image layer to bind mount --------------
|
||||
# DC-039 follow-up. Before v1.14.10, certain modules (audit-logger, license-
|
||||
@@ -179,7 +160,6 @@ docker run -d --restart unless-stopped --name ${CONTAINER_NAME} \
|
||||
-v ${BACKUPS_DIR}:/app/backups \
|
||||
-v ${CADDYFILE}:/caddyfile \
|
||||
-v /etc/caddy/sites:/etc/caddy/sites:ro \
|
||||
-v /var/log/caddy:/var/log/caddy:ro \
|
||||
-v /var/run/docker.sock:/var/run/docker.sock \
|
||||
-v ${ASSETS_DIR}:/app/assets \
|
||||
-v ${UPDATES_DIR}:/app/updates \
|
||||
@@ -200,8 +180,6 @@ docker run -d --restart unless-stopped --name ${CONTAINER_NAME} \
|
||||
-e HEALTH_CONFIG_FILE=/app/data/health-config.json \
|
||||
-e CADDYFILE_PATH=/caddyfile \
|
||||
-e CADDY_ADMIN_URL=http://${HOST_IP}:2019 \
|
||||
-e CADDY_ACCESS_LOG=/var/log/caddy/access.log \
|
||||
-e DASHCADDY_SELF_IPS="${SELF_IPS}" \
|
||||
-e ASSETS_DIR=/app/assets \
|
||||
-e DASHCADDY_API_SOURCE_DIR=/opt/dashcaddy/dashcaddy-api \
|
||||
-e DASHCADDY_UPDATE_ENABLED=false \
|
||||
|
||||
+17
-49
@@ -3,12 +3,6 @@ const path = require('path');
|
||||
const crypto = require('crypto');
|
||||
const esbuild = require('esbuild');
|
||||
|
||||
// DC-119: single source of truth for the CRLF->LF normalization applied to
|
||||
// every source read before minification (see the long comment in build()).
|
||||
// Exported so tests/build-determinism.test.js pins THE ACTUAL regex, not a
|
||||
// re-implementation that would silently drift if this one changes.
|
||||
const normalizeSource = (s) => s.replace(/\r\n/g, '\n');
|
||||
|
||||
const JS = (...parts) => path.join(__dirname, 'js', ...parts);
|
||||
const DIST = path.join(__dirname, 'dist');
|
||||
const INDEX_HTML = path.join(__dirname, 'index.html');
|
||||
@@ -155,20 +149,7 @@ async function build() {
|
||||
console.warn(` WARN: ${path.relative(__dirname, file)} not found, skipping`);
|
||||
continue;
|
||||
}
|
||||
// DC-119: normalize CRLF -> LF before minifying. Root cause (verified
|
||||
// empirically with esbuild 0.25.12 probes): the production transform
|
||||
// uses sourcemap:'both', which base64-embeds the RAW source bytes as
|
||||
// sourcesContent in the inline map — CR bytes survive into dist, so a
|
||||
// CRLF working copy (Windows dev tree, core.autocrlf=true) and an LF
|
||||
// checkout (DNS2) of the same commit produce different dist bytes and
|
||||
// a different sw.js cache tag. With this normalization both are
|
||||
// byte-identical (sha256-verified). Before it, every Linux rebuild of
|
||||
// a Windows-committed bundle showed phantom drift on `git pull` in
|
||||
// /opt/dashcaddy (the recurring "pre-pull drift" stashes — note those
|
||||
// also contained minified-identifier renames, a second vector from
|
||||
// esbuild version drift across the ^0.25.0 caret range, already
|
||||
// pinned by package-lock.json).
|
||||
parts.push(normalizeSource(fs.readFileSync(file, 'utf8')));
|
||||
parts.push(fs.readFileSync(file, 'utf8'));
|
||||
}
|
||||
const concatenated = parts.join(';\n');
|
||||
|
||||
@@ -216,11 +197,7 @@ async function build() {
|
||||
// the SW's activate handler wipes all older caches, so users never get
|
||||
// stuck on stale precached bundles after a release.
|
||||
function updateServiceWorkerCache() {
|
||||
// DC-119: normalize on read — same rationale as the bundle sources above.
|
||||
// A CRLF sw.js would otherwise keep its CR bytes through the regex
|
||||
// replace, so the written sw.js (and its committed bytes) would differ
|
||||
// per-platform even with an identical cache tag.
|
||||
const sw = normalizeSource(fs.readFileSync(SW_JS, 'utf8'));
|
||||
const sw = fs.readFileSync(SW_JS, 'utf8');
|
||||
const hash = crypto.createHash('sha256');
|
||||
for (const name of Object.keys(bundles)) {
|
||||
hash.update(fs.readFileSync(path.join(DIST, name)));
|
||||
@@ -237,29 +214,20 @@ function updateServiceWorkerCache() {
|
||||
}
|
||||
|
||||
// Watch mode
|
||||
// DC-119: only auto-run when invoked directly (`node build.js`). Requiring
|
||||
// build.js as a module (as tests/build-determinism.test.js does, to pin the
|
||||
// normalizeSource regex) must NOT trigger a full dist rebuild.
|
||||
if (require.main === module) {
|
||||
if (process.argv.includes('--watch')) {
|
||||
console.log(' Watching for changes...\n');
|
||||
build();
|
||||
if (process.argv.includes('--watch')) {
|
||||
console.log(' Watching for changes...\n');
|
||||
build();
|
||||
|
||||
const jsDir = path.join(__dirname, 'js');
|
||||
let debounce = null;
|
||||
fs.watch(jsDir, { recursive: true }, (event, filename) => {
|
||||
if (!filename || !filename.endsWith('.js')) return;
|
||||
clearTimeout(debounce);
|
||||
debounce = setTimeout(() => {
|
||||
console.log(` Changed: ${filename}`);
|
||||
build();
|
||||
}, 200);
|
||||
});
|
||||
} else {
|
||||
build();
|
||||
}
|
||||
const jsDir = path.join(__dirname, 'js');
|
||||
let debounce = null;
|
||||
fs.watch(jsDir, { recursive: true }, (event, filename) => {
|
||||
if (!filename || !filename.endsWith('.js')) return;
|
||||
clearTimeout(debounce);
|
||||
debounce = setTimeout(() => {
|
||||
console.log(` Changed: ${filename}`);
|
||||
build();
|
||||
}, 200);
|
||||
});
|
||||
} else {
|
||||
build();
|
||||
}
|
||||
|
||||
// DC-119: export for tests (normalizeSource is pinned by
|
||||
// tests/build-determinism.test.js). build/bundles stay internal.
|
||||
module.exports = { normalizeSource };
|
||||
Vendored
+95
-122
@@ -90,14 +90,14 @@
|
||||
<button id="logo-save" class="btn-accent">Save</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>`);const k=document.getElementById("logo-modal"),B=document.getElementById("logo-preview-dark"),A=document.getElementById("logo-preview-light"),I=document.getElementById("logo-status"),z=document.getElementById("logo-same-both"),P=document.getElementById("logo-dual-uploads"),M=document.getElementById("logo-single-upload"),D=document.getElementById("logo-upload-dark"),b=document.getElementById("logo-upload-light"),T=document.getElementById("logo-upload-single"),h=document.querySelector("#brand .brand-logo-dark"),H=document.querySelector("#brand .brand-logo-light"),S=document.querySelector(".top-row"),$=document.getElementById("dashboard-title"),f=DC.NAME;let E=null,O=null,L=null,j="left",N=f;z?.addEventListener("change",()=>{z.checked?(P.style.display="none",M.style.display="",E=null,O=null):(P.style.display="flex",M.style.display="none",L=null)});function R(t,e){if(!t||!t.type.startsWith("image/")){showNotification("Please select an image file","warning");return}const a=new FileReader;a.onload=o=>e(o.target.result),a.readAsDataURL(t)}D?.addEventListener("change",t=>{R(t.target.files[0],e=>{E=e,B.src=e,I.textContent="New dark logo ready to save"})}),b?.addEventListener("change",t=>{R(t.target.files[0],e=>{O=e,A.src=e,I.textContent="New light logo ready to save"})}),T?.addEventListener("change",t=>{R(t.target.files[0],e=>{L=e,B.src=e,A.src=e,I.textContent="New logo ready to save (both themes)"})});function u(t){S.setAttribute("data-logo-pos",t),document.querySelectorAll(".logo-pos-btn").forEach(e=>{e.style.background=e.dataset.pos===t?"var(--accent)":"var(--card-bg)",e.style.color=e.dataset.pos===t?"white":"var(--fg)"})}function v(t){N=t||f,document.title=N;const e=document.querySelector(".dashboard-title");e&&(e.textContent=N)}async function w(){try{const t=await fetch("/api/v1/logo");if(t.ok){const e=await t.json();e.customLogoDark&&(h.src=e.customLogoDark,B.src=e.customLogoDark),e.customLogoLight&&(H.src=e.customLogoLight,A.src=e.customLogoLight),!e.customLogoDark&&!e.customLogoLight&&e.customLogo&&(h.src=e.customLogo,H.src=e.customLogo,B.src=e.customLogo,A.src=e.customLogo),e.isDefault||(I.textContent="Using custom logo"),e.position&&(j=e.position,u(e.position)),e.dashboardTitle&&v(e.dashboardTitle)}}catch(t){console.warn("Could not load custom logo:",t.message)}}document.querySelectorAll(".logo-pos-btn").forEach(t=>{t.addEventListener("click",()=>{j=t.dataset.pos,u(j)})}),document.getElementById("brand")?.addEventListener("click",()=>{E=null,O=null,L=null,D&&(D.value=""),b&&(b.value=""),T&&(T.value=""),z&&(z.checked=!1),P.style.display="flex",M.style.display="none",B.src=h.src,A.src=H.src;const t=h.src.includes("custom-logo")||H.src.includes("custom-logo");I.textContent=t?"Using custom logo":"Using default logos",u(j),$.value=N,k.classList.add("show")}),document.getElementById("logo-save")?.addEventListener("click",async()=>{try{const t=$.value.trim()||f,e={position:j,dashboardTitle:t};z?.checked&&L?(e.dataDark=L,e.dataLight=L):(E&&(e.dataDark=E),O&&(e.dataLight=O));const a=await secureFetch("/api/v1/logo",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)});if(a.ok){const o=await a.json(),i="?t="+Date.now();o.pathDark&&(h.src=o.pathDark+i,B.src=o.pathDark+i),o.pathLight&&(H.src=o.pathLight+i,A.src=o.pathLight+i),u(j),v(t),k.classList.remove("show")}else{const o=await a.json();showNotification("Failed to save: "+o.error,"error")}}catch(t){showNotification("Error saving: "+t.message,"error")}}),document.getElementById("logo-reset")?.addEventListener("click",async()=>{if(confirm(`Reset all branding to DashCaddy defaults?
|
||||
</div>`);const k=document.getElementById("logo-modal"),B=document.getElementById("logo-preview-dark"),A=document.getElementById("logo-preview-light"),I=document.getElementById("logo-status"),z=document.getElementById("logo-same-both"),P=document.getElementById("logo-dual-uploads"),M=document.getElementById("logo-single-upload"),D=document.getElementById("logo-upload-dark"),h=document.getElementById("logo-upload-light"),T=document.getElementById("logo-upload-single"),f=document.querySelector("#brand .brand-logo-dark"),H=document.querySelector("#brand .brand-logo-light"),S=document.querySelector(".top-row"),$=document.getElementById("dashboard-title"),w=DC.NAME;let E=null,O=null,C=null,j="left",N=w;z?.addEventListener("change",()=>{z.checked?(P.style.display="none",M.style.display="",E=null,O=null):(P.style.display="flex",M.style.display="none",C=null)});function R(t,e){if(!t||!t.type.startsWith("image/")){showNotification("Please select an image file","warning");return}const a=new FileReader;a.onload=o=>e(o.target.result),a.readAsDataURL(t)}D?.addEventListener("change",t=>{R(t.target.files[0],e=>{E=e,B.src=e,I.textContent="New dark logo ready to save"})}),h?.addEventListener("change",t=>{R(t.target.files[0],e=>{O=e,A.src=e,I.textContent="New light logo ready to save"})}),T?.addEventListener("change",t=>{R(t.target.files[0],e=>{C=e,B.src=e,A.src=e,I.textContent="New logo ready to save (both themes)"})});function u(t){S.setAttribute("data-logo-pos",t),document.querySelectorAll(".logo-pos-btn").forEach(e=>{e.style.background=e.dataset.pos===t?"var(--accent)":"var(--card-bg)",e.style.color=e.dataset.pos===t?"white":"var(--fg)"})}function v(t){N=t||w,document.title=N;const e=document.querySelector(".dashboard-title");e&&(e.textContent=N)}async function x(){try{const t=await fetch("/api/v1/logo");if(t.ok){const e=await t.json();e.customLogoDark&&(f.src=e.customLogoDark,B.src=e.customLogoDark),e.customLogoLight&&(H.src=e.customLogoLight,A.src=e.customLogoLight),!e.customLogoDark&&!e.customLogoLight&&e.customLogo&&(f.src=e.customLogo,H.src=e.customLogo,B.src=e.customLogo,A.src=e.customLogo),e.isDefault||(I.textContent="Using custom logo"),e.position&&(j=e.position,u(e.position)),e.dashboardTitle&&v(e.dashboardTitle)}}catch(t){console.warn("Could not load custom logo:",t.message)}}document.querySelectorAll(".logo-pos-btn").forEach(t=>{t.addEventListener("click",()=>{j=t.dataset.pos,u(j)})}),document.getElementById("brand")?.addEventListener("click",()=>{E=null,O=null,C=null,D&&(D.value=""),h&&(h.value=""),T&&(T.value=""),z&&(z.checked=!1),P.style.display="flex",M.style.display="none",B.src=f.src,A.src=H.src;const t=f.src.includes("custom-logo")||H.src.includes("custom-logo");I.textContent=t?"Using custom logo":"Using default logos",u(j),$.value=N,k.classList.add("show")}),document.getElementById("logo-save")?.addEventListener("click",async()=>{try{const t=$.value.trim()||w,e={position:j,dashboardTitle:t};z?.checked&&C?(e.dataDark=C,e.dataLight=C):(E&&(e.dataDark=E),O&&(e.dataLight=O));const a=await secureFetch("/api/v1/logo",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(e)});if(a.ok){const o=await a.json(),i="?t="+Date.now();o.pathDark&&(f.src=o.pathDark+i,B.src=o.pathDark+i),o.pathLight&&(H.src=o.pathLight+i,A.src=o.pathLight+i),u(j),v(t),k.classList.remove("show")}else{const o=await a.json();showNotification("Failed to save: "+o.error,"error")}}catch(t){showNotification("Error saving: "+t.message,"error")}}),document.getElementById("logo-reset")?.addEventListener("click",async()=>{if(confirm(`Reset all branding to DashCaddy defaults?
|
||||
|
||||
This will reset the logo, favicon, title, and position.`))try{if((await secureFetch("/api/v1/logo",{method:"DELETE"})).ok&&(h.src="/assets/dashcaddy-logo-dark.png",H.src="/assets/dashcaddy-logo-light.png",B.src="/assets/dashcaddy-logo-dark.png",A.src="/assets/dashcaddy-logo-light.png",I.textContent="Using default logos",E=null,O=null,L=null,$.value=f,v(f),j="left",u("left")),(await secureFetch("/api/v1/favicon",{method:"DELETE"})).ok){const a=document.querySelector('link[rel="icon"]'),o=document.getElementById("favicon-preview"),i=document.getElementById("favicon-status");a&&(a.href="/assets/dashcaddy-favicon.ico?t="+Date.now()),o&&(o.src="/assets/dashcaddy-favicon.ico?t="+Date.now()),i&&(i.textContent="Using DashCaddy favicon"),l=null}}catch(t){showNotification("Error resetting branding: "+t.message,"error")}}),wireModal(k,document.getElementById("logo-cancel"));const g=document.getElementById("favicon-preview"),x=document.getElementById("favicon-status"),s=document.getElementById("favicon-upload"),p=document.querySelector('link[rel="icon"]')||document.createElement("link");let l=null;document.querySelector('link[rel="icon"]')||(p.rel="icon",p.href="/assets/dashcaddy-favicon.ico",document.head.appendChild(p));async function m(){try{const t=await fetch("/api/v1/favicon");if(t.ok){const e=await t.json();e.customFavicon&&(p.href=e.customFavicon+"?t="+Date.now(),g.src=e.customFavicon+"?t="+Date.now(),x.textContent="Using custom favicon")}}catch(t){console.warn("Could not load custom favicon:",t.message)}}s?.addEventListener("change",t=>{const e=t.target.files[0];if(!e)return;if(!e.type.match(/^image\/(png|svg\+xml)$/)){showNotification("Please select a PNG or SVG file","warning"),s.value="";return}const a=new FileReader;a.onload=o=>{l=o.target.result,g.src=l,x.textContent="New favicon ready to save"},a.readAsDataURL(e)}),document.getElementById("logo-save")?.addEventListener("click",async()=>{if(l)try{const t=await secureFetch("/api/v1/favicon",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({data:l})});if(t.ok){const e=await t.json();p.href=e.path+"?t="+Date.now(),g.src=e.path+"?t="+Date.now(),x.textContent="Using custom favicon",l=null}else{const e=await t.json();showNotification("Failed to save favicon: "+e.error,"error")}}catch(t){showNotification("Error saving favicon: "+t.message,"error")}}),m(),w();const c=document.getElementById("settings-timezone");c&&(new MutationObserver(()=>{k.classList.contains("show")&&c.options.length===0&&(async()=>{let e;try{const a=await fetch("/api/v1/config");a.ok&&(e=(await a.json()).timezone)}catch{}window.populateTimezoneSelect(c,e)})()}).observe(k,{attributes:!0,attributeFilter:["class"]}),document.getElementById("logo-save")?.addEventListener("click",async()=>{const e=c.value;if(e)try{const a=await fetch("/api/v1/config");if(!a.ok)return;const o=await a.json();o.timezone=e,o.updatedAt=new Date().toISOString(),await secureFetch("/api/v1/config",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(o)})}catch(a){console.warn("Failed to save timezone:",a.message)}}))})(),window.populateTimezoneSelect=function(k,B){const A=Intl.supportedValuesOf("timeZone"),I=B||Intl.DateTimeFormat().resolvedOptions().timeZone||"UTC";k.innerHTML="";for(const z of A){const P=document.createElement("option");P.value=z,P.textContent=z.replace(/_/g," "),z===I&&(P.selected=!0),k.appendChild(P)}},(function(){let k="homelab",B=null;async function A(){try{const v=await fetch("/api/v1/config");if(v.ok&&(B=await v.json(),B&&B.setupComplete))return document.getElementById("setup-wizard").style.display="none",!0}catch(v){console.warn("Could not fetch server config, checking localStorage fallback:",v.message)}return safeGet("dashcaddy-setup")?(document.getElementById("setup-wizard").style.display="none",!0):(document.getElementById("setup-wizard").style.display="flex",!1)}A();const I=document.getElementById("setup-timezone");I&&window.populateTimezoneSelect(I);function z(u){document.querySelectorAll(".setup-step").forEach(w=>{w.style.display="none"});const v=document.getElementById(u);v&&(v.style.display="block")}function P(){const u=document.getElementById("setup-summary-content");if(!u)return;let v='<div style="display: grid; gap: 20px;">';if(k==="homelab"){const g=document.getElementById("setup-tld")?.value?.trim()||".home",x=document.getElementById("setup-ca-name")?.value?.trim()||"",s=document.getElementById("setup-dns-ip")?.value?.trim()||"",p=document.getElementById("setup-dns-port")?.value?.trim()||DC.DEFAULTS.DNS_PORT;v+=`
|
||||
This will reset the logo, favicon, title, and position.`))try{if((await secureFetch("/api/v1/logo",{method:"DELETE"})).ok&&(f.src="/assets/dashcaddy-logo-dark.png",H.src="/assets/dashcaddy-logo-light.png",B.src="/assets/dashcaddy-logo-dark.png",A.src="/assets/dashcaddy-logo-light.png",I.textContent="Using default logos",E=null,O=null,C=null,$.value=w,v(w),j="left",u("left")),(await secureFetch("/api/v1/favicon",{method:"DELETE"})).ok){const a=document.querySelector('link[rel="icon"]'),o=document.getElementById("favicon-preview"),i=document.getElementById("favicon-status");a&&(a.href="/assets/dashcaddy-favicon.ico?t="+Date.now()),o&&(o.src="/assets/dashcaddy-favicon.ico?t="+Date.now()),i&&(i.textContent="Using DashCaddy favicon"),l=null}}catch(t){showNotification("Error resetting branding: "+t.message,"error")}}),wireModal(k,document.getElementById("logo-cancel"));const g=document.getElementById("favicon-preview"),b=document.getElementById("favicon-status"),s=document.getElementById("favicon-upload"),p=document.querySelector('link[rel="icon"]')||document.createElement("link");let l=null;document.querySelector('link[rel="icon"]')||(p.rel="icon",p.href="/assets/dashcaddy-favicon.ico",document.head.appendChild(p));async function m(){try{const t=await fetch("/api/v1/favicon");if(t.ok){const e=await t.json();e.customFavicon&&(p.href=e.customFavicon+"?t="+Date.now(),g.src=e.customFavicon+"?t="+Date.now(),b.textContent="Using custom favicon")}}catch(t){console.warn("Could not load custom favicon:",t.message)}}s?.addEventListener("change",t=>{const e=t.target.files[0];if(!e)return;if(!e.type.match(/^image\/(png|svg\+xml)$/)){showNotification("Please select a PNG or SVG file","warning"),s.value="";return}const a=new FileReader;a.onload=o=>{l=o.target.result,g.src=l,b.textContent="New favicon ready to save"},a.readAsDataURL(e)}),document.getElementById("logo-save")?.addEventListener("click",async()=>{if(l)try{const t=await secureFetch("/api/v1/favicon",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({data:l})});if(t.ok){const e=await t.json();p.href=e.path+"?t="+Date.now(),g.src=e.path+"?t="+Date.now(),b.textContent="Using custom favicon",l=null}else{const e=await t.json();showNotification("Failed to save favicon: "+e.error,"error")}}catch(t){showNotification("Error saving favicon: "+t.message,"error")}}),m(),x();const c=document.getElementById("settings-timezone");c&&(new MutationObserver(()=>{k.classList.contains("show")&&c.options.length===0&&(async()=>{let e;try{const a=await fetch("/api/v1/config");a.ok&&(e=(await a.json()).timezone)}catch{}window.populateTimezoneSelect(c,e)})()}).observe(k,{attributes:!0,attributeFilter:["class"]}),document.getElementById("logo-save")?.addEventListener("click",async()=>{const e=c.value;if(e)try{const a=await fetch("/api/v1/config");if(!a.ok)return;const o=await a.json();o.timezone=e,o.updatedAt=new Date().toISOString(),await secureFetch("/api/v1/config",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(o)})}catch(a){console.warn("Failed to save timezone:",a.message)}}))})(),window.populateTimezoneSelect=function(k,B){const A=Intl.supportedValuesOf("timeZone"),I=B||Intl.DateTimeFormat().resolvedOptions().timeZone||"UTC";k.innerHTML="";for(const z of A){const P=document.createElement("option");P.value=z,P.textContent=z.replace(/_/g," "),z===I&&(P.selected=!0),k.appendChild(P)}},(function(){let k="homelab",B=null;async function A(){try{const v=await fetch("/api/v1/config");if(v.ok&&(B=await v.json(),B&&B.setupComplete))return document.getElementById("setup-wizard").style.display="none",!0}catch(v){console.warn("Could not fetch server config, checking localStorage fallback:",v.message)}return safeGet("dashcaddy-setup")?(document.getElementById("setup-wizard").style.display="none",!0):(document.getElementById("setup-wizard").style.display="flex",!1)}A();const I=document.getElementById("setup-timezone");I&&window.populateTimezoneSelect(I);function z(u){document.querySelectorAll(".setup-step").forEach(x=>{x.style.display="none"});const v=document.getElementById(u);v&&(v.style.display="block")}function P(){const u=document.getElementById("setup-summary-content");if(!u)return;let v='<div style="display: grid; gap: 20px;">';if(k==="homelab"){const g=document.getElementById("setup-tld")?.value?.trim()||".home",b=document.getElementById("setup-ca-name")?.value?.trim()||"",s=document.getElementById("setup-dns-ip")?.value?.trim()||"",p=document.getElementById("setup-dns-port")?.value?.trim()||DC.DEFAULTS.DNS_PORT;v+=`
|
||||
<div>
|
||||
<h3 style="margin: 0 0 12px; color: var(--accent);">Home Lab Configuration</h3>
|
||||
<div style="display: grid; gap: 12px; font-size: 0.95rem;">
|
||||
<div><strong>TLD:</strong> ${g}</div>
|
||||
<div><strong>Certificate Authority:</strong> ${x}</div>
|
||||
<div><strong>Certificate Authority:</strong> ${b}</div>
|
||||
<div><strong>DNS Server:</strong> ${s}:${p}</div>
|
||||
<div><strong>Example URLs:</strong> https://uptime${g}, https://nextcloud${g}</div>
|
||||
</div>
|
||||
@@ -112,22 +112,22 @@ This will reset the logo, favicon, title, and position.`))try{if((await secureFe
|
||||
<div><strong>Example URLs:</strong> http://${g}:8080, http://${g}:3000</div>
|
||||
</div>
|
||||
</div>
|
||||
`}else if(k==="public"){const g=document.getElementById("setup-public-domain")?.value?.trim()||"",x=document.getElementById("setup-public-email")?.value?.trim()||"",s=document.querySelector('input[name="routing-mode"]:checked')?.value||"subdirectory",p=s==="subdirectory"?`https://${g}/sonarr, https://${g}/grafana`:`https://sonarr.${g}, https://grafana.${g}`;v+=`
|
||||
`}else if(k==="public"){const g=document.getElementById("setup-public-domain")?.value?.trim()||"",b=document.getElementById("setup-public-email")?.value?.trim()||"",s=document.querySelector('input[name="routing-mode"]:checked')?.value||"subdirectory",p=s==="subdirectory"?`https://${g}/sonarr, https://${g}/grafana`:`https://sonarr.${g}, https://grafana.${g}`;v+=`
|
||||
<div>
|
||||
<h3 style="margin: 0 0 12px; color: var(--accent);">Public Server</h3>
|
||||
<div style="display: grid; gap: 12px; font-size: 0.95rem;">
|
||||
<div><strong>Domain:</strong> ${g}</div>
|
||||
<div><strong>SSL:</strong> Let's Encrypt</div>
|
||||
<div><strong>Email:</strong> ${x}</div>
|
||||
<div><strong>Email:</strong> ${b}</div>
|
||||
<div><strong>Routing:</strong> ${s==="subdirectory"?"Subdirectory (domain.com/app)":"Subdomain (app.domain.com)"}</div>
|
||||
<div><strong>Example URLs:</strong> ${p}</div>
|
||||
</div>
|
||||
</div>
|
||||
`}const w=document.getElementById("setup-timezone")?.value||Intl.DateTimeFormat().resolvedOptions().timeZone||"UTC";v+=`
|
||||
`}const x=document.getElementById("setup-timezone")?.value||Intl.DateTimeFormat().resolvedOptions().timeZone||"UTC";v+=`
|
||||
<div style="margin-top: 8px; padding-top: 12px; border-top: 1px solid var(--border);">
|
||||
<div style="font-size: 0.95rem;"><strong>Timezone:</strong> ${w.replace(/_/g," ")}</div>
|
||||
<div style="font-size: 0.95rem;"><strong>Timezone:</strong> ${x.replace(/_/g," ")}</div>
|
||||
</div>
|
||||
`,v+="</div>",u.innerHTML=v,z("setup-step-summary")}async function M(u){try{const v=await secureFetch("/api/v1/config",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(u)});return v.ok?(await v.json(),!0):(errorHandler.logError("[SetupWizard] Save Config",new Error(`Server returned ${v.status}`),{function:"saveConfigToServer"}),!1)}catch(v){return errorHandler.logError("[SetupWizard] Save Config",v,{function:"saveConfigToServer"}),!1}}async function D(){const u={setupComplete:!0,configurationType:k,timestamp:new Date().toISOString(),timezone:document.getElementById("setup-timezone")?.value||Intl.DateTimeFormat().resolvedOptions().timeZone||"UTC"};if(k==="homelab"){u.tld=document.getElementById("setup-tld")?.value?.trim()||".home",u.caName=document.getElementById("setup-ca-name")?.value?.trim()||"";const x=document.getElementById("setup-dns-provider")?.value||"technitium";u.dns={provider:x,ip:document.getElementById("setup-dns-ip")?.value?.trim()||"",port:document.getElementById("setup-dns-port")?.value?.trim()||DC.DEFAULTS.DNS_PORT,token:document.getElementById("setup-dns-token")?.value?.trim()||""},u.defaults={dnsType:"private",sslType:"internal",targetIP:"localhost"}}else k==="simple"?(u.defaultIP=document.getElementById("setup-simple-ip")?.value?.trim()||"localhost",u.defaults={dnsType:"none",sslType:"none",targetIP:u.defaultIP}):k==="public"&&(u.domain=document.getElementById("setup-public-domain")?.value?.trim()||"",u.email=document.getElementById("setup-public-email")?.value?.trim()||"",u.routingMode=document.querySelector('input[name="routing-mode"]:checked')?.value||"subdirectory",u.defaults={dnsType:u.routingMode==="subdirectory"?"none":"public",sslType:"letsencrypt",targetIP:"localhost"});const v=await M(u);safeSet("dashcaddy-config",JSON.stringify(u)),safeSet("dashcaddy-setup","completed"),document.getElementById("setup-wizard").style.display="none";const w=k==="homelab"?"Professional Home Lab":k==="simple"?"Simple Setup":"Public Server",g=v?"server (shared across all devices)":"locally (this browser only)";showNotification(`Setup Complete! Configured for: ${w}. Settings saved to: ${g}`,"success",5e3),setTimeout(()=>location.reload(),500)}const b=document.getElementById("setup-step-1-next");b&&(b.onclick=function(u){u.preventDefault();const v=document.querySelector('input[name="config-type"]:checked');v&&(k=v.value),z(k==="homelab"?"setup-step-homelab":k==="simple"?"setup-step-simple":k==="public"?"setup-step-public":"setup-step-homelab")});const T=document.getElementById("setup-skip");T&&(T.onclick=async function(u){u.preventDefault(),confirm("Skip setup? You can run it later from Settings.")&&(await M({setupComplete:!0,skipped:!0,timestamp:new Date().toISOString()}),safeSet("dashcaddy-setup","skipped"),document.getElementById("setup-wizard").style.display="none")});const h=document.getElementById("setup-tld");h&&(h.oninput=function(u){const v=u.target.value||".home",w=document.getElementById("tld-preview"),g=document.getElementById("tld-preview-2");w&&(w.textContent=v),g&&(g.textContent=v)});const H=document.getElementById("setup-homelab-back");H&&(H.onclick=function(u){u.preventDefault(),z("setup-step-1")});const S=document.getElementById("setup-homelab-next");S&&(S.onclick=function(u){u.preventDefault();const v=document.getElementById("setup-tld")?.value?.trim()||"",w=document.getElementById("setup-ca-name")?.value?.trim()||"",g=document.getElementById("setup-dns-ip")?.value?.trim()||"";if(!v||!v.startsWith(".")){showNotification("Please enter a valid TLD starting with a dot (e.g., .home)","warning");return}if(!w){showNotification("Please enter a Certificate Authority name","warning");return}if(!g){showNotification("Please enter your DNS server IP address","warning");return}P()});const $=document.getElementById("setup-simple-back");$&&($.onclick=function(u){u.preventDefault(),z("setup-step-1")});const f=document.getElementById("setup-simple-next");f&&(f.onclick=function(u){u.preventDefault(),P()}),document.querySelectorAll('input[name="routing-mode"]').forEach(function(u){u.onchange=function(){var v=document.getElementById("dns-requirement-note");v&&(v.textContent=this.value==="subdirectory"?"Only one DNS record needed (for the main domain)":"You'll need to configure DNS manually for each subdomain")}});const E=document.getElementById("setup-public-back");E&&(E.onclick=function(u){u.preventDefault(),z("setup-step-1")});const O=document.getElementById("setup-public-next");O&&(O.onclick=function(u){u.preventDefault();const v=document.getElementById("setup-public-domain")?.value?.trim()||"",w=document.getElementById("setup-public-email")?.value?.trim()||"";if(!v){showNotification("Please enter your domain name","warning");return}if(!w||!w.includes("@")){showNotification("Please enter a valid email address","warning");return}P()});const L=document.getElementById("setup-summary-back");L&&(L.onclick=function(u){u.preventDefault(),k==="homelab"?z("setup-step-homela
Line truncated
|
||||
`,v+="</div>",u.innerHTML=v,z("setup-step-summary")}async function M(u){try{const v=await secureFetch("/api/v1/config",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(u)});return v.ok?(await v.json(),!0):(errorHandler.logError("[SetupWizard] Save Config",new Error(`Server returned ${v.status}`),{function:"saveConfigToServer"}),!1)}catch(v){return errorHandler.logError("[SetupWizard] Save Config",v,{function:"saveConfigToServer"}),!1}}async function D(){const u={setupComplete:!0,configurationType:k,timestamp:new Date().toISOString(),timezone:document.getElementById("setup-timezone")?.value||Intl.DateTimeFormat().resolvedOptions().timeZone||"UTC"};if(k==="homelab"){u.tld=document.getElementById("setup-tld")?.value?.trim()||".home",u.caName=document.getElementById("setup-ca-name")?.value?.trim()||"";const b=document.getElementById("setup-dns-provider")?.value||"technitium";u.dns={provider:b,ip:document.getElementById("setup-dns-ip")?.value?.trim()||"",port:document.getElementById("setup-dns-port")?.value?.trim()||DC.DEFAULTS.DNS_PORT,token:document.getElementById("setup-dns-token")?.value?.trim()||""},u.defaults={dnsType:"private",sslType:"internal",targetIP:"localhost"}}else k==="simple"?(u.defaultIP=document.getElementById("setup-simple-ip")?.value?.trim()||"localhost",u.defaults={dnsType:"none",sslType:"none",targetIP:u.defaultIP}):k==="public"&&(u.domain=document.getElementById("setup-public-domain")?.value?.trim()||"",u.email=document.getElementById("setup-public-email")?.value?.trim()||"",u.routingMode=document.querySelector('input[name="routing-mode"]:checked')?.value||"subdirectory",u.defaults={dnsType:u.routingMode==="subdirectory"?"none":"public",sslType:"letsencrypt",targetIP:"localhost"});const v=await M(u);safeSet("dashcaddy-config",JSON.stringify(u)),safeSet("dashcaddy-setup","completed"),document.getElementById("setup-wizard").style.display="none";const x=k==="homelab"?"Professional Home Lab":k==="simple"?"Simple Setup":"Public Server",g=v?"server (shared across all devices)":"locally (this browser only)";showNotification(`Setup Complete! Configured for: ${x}. Settings saved to: ${g}`,"success",5e3),setTimeout(()=>location.reload(),500)}const h=document.getElementById("setup-step-1-next");h&&(h.onclick=function(u){u.preventDefault();const v=document.querySelector('input[name="config-type"]:checked');v&&(k=v.value),z(k==="homelab"?"setup-step-homelab":k==="simple"?"setup-step-simple":k==="public"?"setup-step-public":"setup-step-homelab")});const T=document.getElementById("setup-skip");T&&(T.onclick=async function(u){u.preventDefault(),confirm("Skip setup? You can run it later from Settings.")&&(await M({setupComplete:!0,skipped:!0,timestamp:new Date().toISOString()}),safeSet("dashcaddy-setup","skipped"),document.getElementById("setup-wizard").style.display="none")});const f=document.getElementById("setup-tld");f&&(f.oninput=function(u){const v=u.target.value||".home",x=document.getElementById("tld-preview"),g=document.getElementById("tld-preview-2");x&&(x.textContent=v),g&&(g.textContent=v)});const H=document.getElementById("setup-homelab-back");H&&(H.onclick=function(u){u.preventDefault(),z("setup-step-1")});const S=document.getElementById("setup-homelab-next");S&&(S.onclick=function(u){u.preventDefault();const v=document.getElementById("setup-tld")?.value?.trim()||"",x=document.getElementById("setup-ca-name")?.value?.trim()||"",g=document.getElementById("setup-dns-ip")?.value?.trim()||"";if(!v||!v.startsWith(".")){showNotification("Please enter a valid TLD starting with a dot (e.g., .home)","warning");return}if(!x){showNotification("Please enter a Certificate Authority name","warning");return}if(!g){showNotification("Please enter your DNS server IP address","warning");return}P()});const $=document.getElementById("setup-simple-back");$&&($.onclick=function(u){u.preventDefault(),z("setup-step-1")});const w=document.getElementById("setup-simple-next");w&&(w.onclick=function(u){u.preventDefault(),P()}),document.querySelectorAll('input[name="routing-mode"]').forEach(function(u){u.onchange=function(){var v=document.getElementById("dns-requirement-note");v&&(v.textContent=this.value==="subdirectory"?"Only one DNS record needed (for the main domain)":"You'll need to configure DNS manually for each subdomain")}});const E=document.getElementById("setup-public-back");E&&(E.onclick=function(u){u.preventDefault(),z("setup-step-1")});const O=document.getElementById("setup-public-next");O&&(O.onclick=function(u){u.preventDefault();const v=document.getElementById("setup-public-domain")?.value?.trim()||"",x=document.getElementById("setup-public-email")?.value?.trim()||"";if(!v){showNotification("Please enter your domain name","warning");return}if(!x||!x.includes("@")){showNotification("Please enter a valid email address","warning");return}P()});const C=document.getElementById("setup-summary-back");C&&(C.onclick=function(u){u.preventDefault(),k==="homelab"?z("setup-step-homela
Line truncated
|
||||
<div class="app-selector-content">
|
||||
<h2 style="margin: 0 0 24px; color: var(--fg); text-align: center;">Choose an App</h2>
|
||||
<div id="app-selector-grid" class="app-selector-grid"></div>
|
||||
@@ -333,12 +333,12 @@ This will reset the logo, favicon, title, and position.`))try{if((await secureFe
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>`);const B="custom-apps";let A=null,I=null;const z=document.getElementById("app-selector-modal"),P=document.getElementById("app-selector-grid");async function M(){try{const p=await(await fetch("/api/v1/apps/templates")).json();if(p.success)return A=p.templates,I=p.categories,!0}catch(s){k.logError("[AppSelector] Fetch Templates",s,{function:"fetchApiTemplates"})}return!1}async function D(s){try{return await(await fetch(`/api/v1/apps/ports/${s}/check`)).json()}catch(p){return k.logError("[AppSelector] Check Port",p,{function:"checkPortAvailability"}),{available:!0}}}async function b(s){try{const l=await(await fetch(`/api/v1/apps/ports/${s}/suggest`)).json();if(l.success)return l.suggestedPort}catch(p){k.logError("[AppSelector] Get Suggested Port",p,{function:"getSuggestedPort"})}return s}async function T(){if(P.innerHTML='<div style="text-align: center; padding: 40px; color: var(--muted);">Loading app templates...</div>',!A&&!await M()){P.innerHTML='<div style="text-align: center; padding: 40px; color: var(--error);">Failed to load app templates. Please try again.</div>';return}P.innerHTML="";const s={};for(const[l,m]of Object.entries(A)){const c=m.category||"Other";s[c]||(s[c]=[]),s[c].push({id:l,...m})}const p=I?Object.keys(I):Object.keys(s).sort();for(const l of p){const m=s[l];if(!m||m.length===0)continue;m.sort((e,a)=>(a.popularity||0)-(e.popularity||0));const c=document.createElement("div");c.className="app-category-header";const t=I?.[l]||{};c.innerHTML=`${escapeHtml(t.icon||"")} ${escapeHtml(l)}`,t.color&&(c.style.borderBottomColor=t.color),P.appendChild(c),m.forEach(e=>{const a=document.createElement("div");a.className="app-option";const o=e.isDashboardWidget,i=o&&safeGet("widget-"+e.id+"-enabled")!=="false",n=o?`<div style="font-size: 0.65rem; padding: 2px 6px; border-radius: 4px; margin-top: 4px; background: ${i?"#2ecc7130":"#e74c3c30"}; color: ${i?"#2ecc71":"#e74c3c"}; font-weight: 600;">${i?"ON":"OFF"}</div>`:"",r=!o&&e.difficulty?`<div style="font-size: 0.65rem; padding: 2px 6px; border-radius: 4px; margin-top: 4px; background: ${e.difficulty==="Easy"?"#2ecc71":e.difficulty==="Intermediate"?"#f39c12":"#e74c3c"}20; color: ${e.difficulty==="Easy"?"#2ecc71":e.difficulty==="Intermediate"?"#f39c12":"#e74c3c"};">${escapeHtml(e.difficulty)}</div>`:"";a.innerHTML=`
|
||||
</div>`);const B="custom-apps";let A=null,I=null;const z=document.getElementById("app-selector-modal"),P=document.getElementById("app-selector-grid");async function M(){try{const p=await(await fetch("/api/v1/apps/templates")).json();if(p.success)return A=p.templates,I=p.categories,!0}catch(s){k.logError("[AppSelector] Fetch Templates",s,{function:"fetchApiTemplates"})}return!1}async function D(s){try{return await(await fetch(`/api/v1/apps/ports/${s}/check`)).json()}catch(p){return k.logError("[AppSelector] Check Port",p,{function:"checkPortAvailability"}),{available:!0}}}async function h(s){try{const l=await(await fetch(`/api/v1/apps/ports/${s}/suggest`)).json();if(l.success)return l.suggestedPort}catch(p){k.logError("[AppSelector] Get Suggested Port",p,{function:"getSuggestedPort"})}return s}async function T(){if(P.innerHTML='<div style="text-align: center; padding: 40px; color: var(--muted);">Loading app templates...</div>',!A&&!await M()){P.innerHTML='<div style="text-align: center; padding: 40px; color: var(--error);">Failed to load app templates. Please try again.</div>';return}P.innerHTML="";const s={};for(const[l,m]of Object.entries(A)){const c=m.category||"Other";s[c]||(s[c]=[]),s[c].push({id:l,...m})}const p=I?Object.keys(I):Object.keys(s).sort();for(const l of p){const m=s[l];if(!m||m.length===0)continue;m.sort((e,a)=>(a.popularity||0)-(e.popularity||0));const c=document.createElement("div");c.className="app-category-header";const t=I?.[l]||{};c.innerHTML=`${escapeHtml(t.icon||"")} ${escapeHtml(l)}`,t.color&&(c.style.borderBottomColor=t.color),P.appendChild(c),m.forEach(e=>{const a=document.createElement("div");a.className="app-option";const o=e.isDashboardWidget,i=o&&safeGet("widget-"+e.id+"-enabled")!=="false",n=o?`<div style="font-size: 0.65rem; padding: 2px 6px; border-radius: 4px; margin-top: 4px; background: ${i?"#2ecc7130":"#e74c3c30"}; color: ${i?"#2ecc71":"#e74c3c"}; font-weight: 600;">${i?"ON":"OFF"}</div>`:"",r=!o&&e.difficulty?`<div style="font-size: 0.65rem; padding: 2px 6px; border-radius: 4px; margin-top: 4px; background: ${e.difficulty==="Easy"?"#2ecc71":e.difficulty==="Intermediate"?"#f39c12":"#e74c3c"}20; color: ${e.difficulty==="Easy"?"#2ecc71":e.difficulty==="Intermediate"?"#f39c12":"#e74c3c"};">${escapeHtml(e.difficulty)}</div>`:"";a.innerHTML=`
|
||||
<div class="app-option-icon">${escapeHtml(e.icon||"\u{1F4E6}")}</div>
|
||||
<div class="app-option-name">${escapeHtml(e.name)}</div>
|
||||
<div class="app-option-desc">${escapeHtml(e.description||"")}</div>
|
||||
${n}${r}
|
||||
`,o?a.onclick=()=>h(e,a):a.onclick=()=>H(e),P.appendChild(a)})}window.renderRecipeCards&&await window.renderRecipeCards(P)}function h(s,p){const l="widget-"+s.id+"-enabled",c=!(safeGet(l)!=="false");safeSet(l,String(c));const t=s.widgetSelector;if(t){const a=document.querySelector(t);a&&(a.style.display=c?"":"none")}const e=p.querySelector('div[style*="border-radius: 4px"]');e&&(e.textContent=c?"ON":"OFF",e.style.background=c?"#2ecc7130":"#e74c3c30",e.style.color=c?"#2ecc71":"#e74c3c"),showNotification(`${s.name} widget ${c?"enabled":"disabled"}`,"success",2e3)}async function H(s){const p=document.getElementById("app-deploy-modal"),l=document.getElementById("app-deploy-title"),m=document.getElementById("deploy-subdomain"),c=document.getElementById("deploy-url-preview"),t=document.getElementById("deploy-ip"),e=document.getElementById("deploy-port"),a=document.getElementById("deploy-tailscale-only"),o=document.getElementById("tailscale-status");try{const G=await(await secureFetch("/api/v1/apps/check-existing",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({appId:s.id})})).json();if(G.success&&G.exists){const V=G.container;confirm(`Found existing ${s.name} container:
|
||||
`,o?a.onclick=()=>f(e,a):a.onclick=()=>H(e),P.appendChild(a)})}window.renderRecipeCards&&await window.renderRecipeCards(P)}function f(s,p){const l="widget-"+s.id+"-enabled",c=!(safeGet(l)!=="false");safeSet(l,String(c));const t=s.widgetSelector;if(t){const a=document.querySelector(t);a&&(a.style.display=c?"":"none")}const e=p.querySelector('div[style*="border-radius: 4px"]');e&&(e.textContent=c?"ON":"OFF",e.style.background=c?"#2ecc7130":"#e74c3c30",e.style.color=c?"#2ecc71":"#e74c3c"),showNotification(`${s.name} widget ${c?"enabled":"disabled"}`,"success",2e3)}async function H(s){const p=document.getElementById("app-deploy-modal"),l=document.getElementById("app-deploy-title"),m=document.getElementById("deploy-subdomain"),c=document.getElementById("deploy-url-preview"),t=document.getElementById("deploy-ip"),e=document.getElementById("deploy-port"),a=document.getElementById("deploy-tailscale-only"),o=document.getElementById("tailscale-status");try{const G=await(await secureFetch("/api/v1/apps/check-existing",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({appId:s.id})})).json();if(G.success&&G.exists){const V=G.container;confirm(`Found existing ${s.name} container:
|
||||
|
||||
Container: ${V.name}
|
||||
Status: ${V.status}
|
||||
@@ -347,18 +347,18 @@ Port: ${V.primaryPort||"N/A"}
|
||||
Would you like to use this existing container?
|
||||
|
||||
Click OK to configure DNS/Caddy for the existing container.
|
||||
Click Cancel to deploy a new container.`)&&(s._useExisting=!0,s._existingContainer=V)}}catch{}l.textContent=`Deploy ${s.name}`;const i=s.subdomain||s.id.replace(/-/g,"");m.value=i;const n=document.getElementById("subpath-compat-warning");if(n)if(SITE.routingMode==="subdirectory"){const W=s.subpathSupport||"strip";W==="none"?(n.style.display="block",n.innerHTML='<span style="color: #ff9800;">⚠ <strong>'+s.name+"</strong> does not support subdirectory mode. It may not work correctly at a subpath.</span>"):W==="strip"?(n.style.display="block",n.innerHTML='<span style="color: var(--muted);">ⓘ '+s.name+" has unverified subdirectory support. It may require additional configuration.</span>"):n.style.display="none"}else n.style.display="none";const r=SITE.defaults.dnsType||(SITE.configurationType==="public"?"public":"private"),d=SITE.defaults.sslType||(SITE.configurationType==="public"?"letsencrypt":"internal"),y=document.querySelector(`input[name="dns-type"][value="${r}"]`),C=document.querySelector(`input[name="ssl-type"][value="${d}"]`);y?y.checked=!0:document.querySelector('input[name="dns-type"][value="private"]').checked=!0,C?C.checked=!0:document.querySelector('input[name="ssl-type"][value="internal"]').checked=!0,t.value=SITE.defaults.targetIP||"localhost",a.checked=!1;const U=document.querySelector("#app-deploy-modal .flex-col-gap")?.closest("div"),q=document.querySelector("#app-deploy-modal details"),F=q?.querySelector("div");if(q&&F&&(SITE.configurationType==="public"||SITE.configurationType==="homelab")){const W=document.querySelectorAll('#app-deploy-modal input[name="dns-type"]')[0]?.closest("div.flex-col-gap")?.parentElement,G=document.querySelectorAll('#app-deploy-modal input[name="ssl-type"]')[0]?.closest("div.flex-col-gap")?.parentElement;W&&!W.dataset.moved&&(F.appendChild(W),W.dataset.moved="1"),G&&!G.dataset.moved&&(F.appendChild(G),G.dataset.moved="1")}const _=document.getElementById("media-path-section"),J=document.getElementById("deploy-media-path"),X=document.getElementById("media-path-description");if(s.mediaMount){_.style.display="block",J.value="",J.placeholder="/media/Movies, /media/TVShows or click Browse";const W=document.getElementById("detected-mounts-container"),G=document.getElementById("detected-mounts-list");try{const K=await(await fetch("/api/v1/media/detected-mounts")).json();if(K.success&&K.mounts.length>0){W.style.display="block",G.innerHTML="";const te=[...new Set(K.mounts.map(ee=>ee.hostPath))];J.value=te.join(", "),K.mounts.forEach(ee=>{const Z=document.createElement("button");Z.type="button";const de=te.includes(ee.hostPath);Z.style.cssText=`padding: 8px 14px; font-size: 0.85rem; background: color-mix(in srgb, var(--success) ${de?"40%":"15%"}, var(--card-bg)); border: 1px solid var(--success); border-radius: 6px; cursor: pointer; color: var(--fg);`,Z.innerHTML=`<span style="font-weight: 500;">${escapeHtml(ee.folderName)}</span><br><span style="font-size: 0.7rem; color: var(--muted);">from ${escapeHtml(ee.sourceImage)}</span>`,Z.title=`${ee.hostPath} (from ${ee.sourceContainer})`,Z.onclick=()=>{const le=J.value.split(",").map(ce=>ce.trim()).filter(ce=>ce),pe=le.indexOf(ee.hostPath);pe>=0?(le.splice(pe,1),Z.style.background="color-mix(in srgb, var(--success) 15%, var(--card-bg))"):(le.push(ee.hostPath),Z.style.background="color-mix(in srgb, var(--success) 40%, var(--card-bg))"),J.value=le.join(", ")},G.appendChild(Z)})}else W.style.display="none"}catch{W.style.display="none"}document.getElementById("browse-media-btn").onclick=()=>{openFolderBrowser(J)}}else _.style.display="none",J.value="",document.getElementById("detected-mounts-container").style.display="none";const Q=document.getElementById("plex-claim-section");Q&&(s.id==="plex"||s.claimToken?(Q.style.display="block",document.getElementById("deploy-plex-claim").value=""):Q.style.display="none");const ne=document.getElementById("volume-mounts-section"),oe=document.getElementById("volume-mounts-list");if(oe.innerHTML="",s.docker?.volumes?.length){const W=s.mediaMount?.containerPath,G=s.docker.volumes.filter(V=>!V.includes("{{MEDIA_PATH}}")&&!(W&&V.endsWith(":"+W)));G.length>0?(ne.style.display="block",G.forEach((V,K)=>{const[te,ee]=V.split(":"),Z=document.createElement("div");Z.style.cssText="display: flex; gap: 6px; align-items: center;",Z.innerHTML=`
|
||||
Click Cancel to deploy a new container.`)&&(s._useExisting=!0,s._existingContainer=V)}}catch{}l.textContent=`Deploy ${s.name}`;const i=s.subdomain||s.id.replace(/-/g,"");m.value=i;const n=document.getElementById("subpath-compat-warning");if(n)if(SITE.routingMode==="subdirectory"){const W=s.subpathSupport||"strip";W==="none"?(n.style.display="block",n.innerHTML='<span style="color: #ff9800;">⚠ <strong>'+s.name+"</strong> does not support subdirectory mode. It may not work correctly at a subpath.</span>"):W==="strip"?(n.style.display="block",n.innerHTML='<span style="color: var(--muted);">ⓘ '+s.name+" has unverified subdirectory support. It may require additional configuration.</span>"):n.style.display="none"}else n.style.display="none";const r=SITE.defaults.dnsType||(SITE.configurationType==="public"?"public":"private"),d=SITE.defaults.sslType||(SITE.configurationType==="public"?"letsencrypt":"internal"),y=document.querySelector(`input[name="dns-type"][value="${r}"]`),L=document.querySelector(`input[name="ssl-type"][value="${d}"]`);y?y.checked=!0:document.querySelector('input[name="dns-type"][value="private"]').checked=!0,L?L.checked=!0:document.querySelector('input[name="ssl-type"][value="internal"]').checked=!0,t.value=SITE.defaults.targetIP||"localhost",a.checked=!1;const U=document.querySelector("#app-deploy-modal .flex-col-gap")?.closest("div"),q=document.querySelector("#app-deploy-modal details"),F=q?.querySelector("div");if(q&&F&&(SITE.configurationType==="public"||SITE.configurationType==="homelab")){const W=document.querySelectorAll('#app-deploy-modal input[name="dns-type"]')[0]?.closest("div.flex-col-gap")?.parentElement,G=document.querySelectorAll('#app-deploy-modal input[name="ssl-type"]')[0]?.closest("div.flex-col-gap")?.parentElement;W&&!W.dataset.moved&&(F.appendChild(W),W.dataset.moved="1"),G&&!G.dataset.moved&&(F.appendChild(G),G.dataset.moved="1")}const _=document.getElementById("media-path-section"),J=document.getElementById("deploy-media-path"),X=document.getElementById("media-path-description");if(s.mediaMount){_.style.display="block",J.value="",J.placeholder="/media/Movies, /media/TVShows or click Browse";const W=document.getElementById("detected-mounts-container"),G=document.getElementById("detected-mounts-list");try{const K=await(await fetch("/api/v1/media/detected-mounts")).json();if(K.success&&K.mounts.length>0){W.style.display="block",G.innerHTML="";const te=[...new Set(K.mounts.map(ee=>ee.hostPath))];J.value=te.join(", "),K.mounts.forEach(ee=>{const Z=document.createElement("button");Z.type="button";const de=te.includes(ee.hostPath);Z.style.cssText=`padding: 8px 14px; font-size: 0.85rem; background: color-mix(in srgb, var(--success) ${de?"40%":"15%"}, var(--card-bg)); border: 1px solid var(--success); border-radius: 6px; cursor: pointer; color: var(--fg);`,Z.innerHTML=`<span style="font-weight: 500;">${escapeHtml(ee.folderName)}</span><br><span style="font-size: 0.7rem; color: var(--muted);">from ${escapeHtml(ee.sourceImage)}</span>`,Z.title=`${ee.hostPath} (from ${ee.sourceContainer})`,Z.onclick=()=>{const le=J.value.split(",").map(ce=>ce.trim()).filter(ce=>ce),pe=le.indexOf(ee.hostPath);pe>=0?(le.splice(pe,1),Z.style.background="color-mix(in srgb, var(--success) 15%, var(--card-bg))"):(le.push(ee.hostPath),Z.style.background="color-mix(in srgb, var(--success) 40%, var(--card-bg))"),J.value=le.join(", ")},G.appendChild(Z)})}else W.style.display="none"}catch{W.style.display="none"}document.getElementById("browse-media-btn").onclick=()=>{openFolderBrowser(J)}}else _.style.display="none",J.value="",document.getElementById("detected-mounts-container").style.display="none";const Q=document.getElementById("plex-claim-section");Q&&(s.id==="plex"||s.claimToken?(Q.style.display="block",document.getElementById("deploy-plex-claim").value=""):Q.style.display="none");const ne=document.getElementById("volume-mounts-section"),oe=document.getElementById("volume-mounts-list");if(oe.innerHTML="",s.docker?.volumes?.length){const W=s.mediaMount?.containerPath,G=s.docker.volumes.filter(V=>!V.includes("{{MEDIA_PATH}}")&&!(W&&V.endsWith(":"+W)));G.length>0?(ne.style.display="block",G.forEach((V,K)=>{const[te,ee]=V.split(":"),Z=document.createElement("div");Z.style.cssText="display: flex; gap: 6px; align-items: center;",Z.innerHTML=`
|
||||
<input type="text" class="vol-host-path" data-container-path="${ee}" value="${te}"
|
||||
style="flex: 1; padding: 8px; background: var(--card-bg); color: var(--fg); border: 1px solid var(--border); border-radius: 6px; font-size: 0.85rem;" />
|
||||
<span style="color: var(--muted); font-size: 0.85rem; white-space: nowrap;">\u2192 ${ee}</span>
|
||||
<button type="button" class="vol-browse-btn" style="padding: 8px 10px; background: var(--accent); color: white; border: none; border-radius: 6px; cursor: pointer; font-size: 0.8rem;">\u{1F4C2}</button>
|
||||
`,oe.appendChild(Z),Z.querySelector(".vol-browse-btn").onclick=()=>{const de=Z.querySelector(".vol-host-path");openFolderBrowser(de)}})):ne.style.display="none"}else ne.style.display="none";const se=s.defaultPort||8080;e.value="",e.placeholder=`Default: ${se}`;let Y=document.getElementById("deploy-port-status");Y||(Y=document.createElement("div"),Y.id="deploy-port-status",Y.style.cssText="font-size: 0.8rem; margin-top: 4px;",e.parentNode.appendChild(Y));async function ie(){const W=e.value||se;Y.innerHTML='<span style="color: var(--muted);">Checking port...</span>';const G=await D(W);if(G.available)Y.innerHTML=`<span style="color: #4caf50;">Port ${escapeHtml(String(W))} is available</span>`;else{const V=await b(se);Y.innerHTML=`
|
||||
`,oe.appendChild(Z),Z.querySelector(".vol-browse-btn").onclick=()=>{const de=Z.querySelector(".vol-host-path");openFolderBrowser(de)}})):ne.style.display="none"}else ne.style.display="none";const se=s.defaultPort||8080;e.value="",e.placeholder=`Default: ${se}`;let Y=document.getElementById("deploy-port-status");Y||(Y=document.createElement("div"),Y.id="deploy-port-status",Y.style.cssText="font-size: 0.8rem; margin-top: 4px;",e.parentNode.appendChild(Y));async function ie(){const W=e.value||se;Y.innerHTML='<span style="color: var(--muted);">Checking port...</span>';const G=await D(W);if(G.available)Y.innerHTML=`<span style="color: #4caf50;">Port ${escapeHtml(String(W))} is available</span>`;else{const V=await h(se);Y.innerHTML=`
|
||||
<span style="color: #e74c3c;">Port ${escapeHtml(W)} in use by ${escapeHtml(G.conflict?.usedBy||"unknown")}</span>
|
||||
`;const K=document.createElement("button");K.type="button",K.textContent=`Use ${V}`,K.style.cssText="margin-left: 8px; padding: 2px 8px; font-size: 0.75rem; cursor: pointer;",K.onclick=()=>{document.getElementById("deploy-port").value=V,Y.innerHTML=`<span style="color: #4caf50;">Using suggested port ${escapeHtml(String(V))}</span>`},Y.appendChild(K)}}let re;e.oninput=function(){clearTimeout(re),re=setTimeout(ie,500)},ie();try{const G=await(await fetch("/api/v1/tailscale/status")).json();G.success&&G.installed&&G.connected?o.innerHTML=`
|
||||
<span style="color: #4caf50;">Connected</span>
|
||||
<span style="color: var(--muted); margin-left: 8px;">${G.self?.hostname} (${G.self?.ip})</span>
|
||||
<span style="color: var(--muted); margin-left: 8px;">| ${G.deviceCount} devices</span>
|
||||
`:G.installed?o.innerHTML='<span style="color: #ff9800;">Not connected</span>':(o.innerHTML='<span style="color: var(--muted);">Not available</span>',a.disabled=!0)}catch{o.innerHTML='<span style="color: var(--muted);">Could not check status</span>'}function ae(){const W=m.value||"subdomain",G=document.querySelector('input[name="dns-type"]:checked').value,V=document.querySelector('input[name="ssl-type"]:checked').value;let K="";if(SITE.routingMode==="subdirectory"&&SITE.domain)K=`https://${SITE.domain}/${W}`;else if(G==="private")K=`${V==="none"?"http":"https"}://${buildDomain(W)}`;else if(G==="public"){const te=V==="none"?"http":"https",ee=SITE.domain||W;K=SITE.domain?`${te}://${W}.${SITE.domain}`:`${te}://${W}`}else{const te=e.value||s.defaultPort||DC.DEFAULTS.SERVICE_PORT;K=`http://${t.value}:${te}`}c.textContent=K}m.oninput=ae,t.oninput=ae,e.oninput=ae,document.querySelectorAll('input[name="dns-type"]').forEach(W=>{W.onchange=ae}),document.querySelectorAll('input[name="ssl-type"]').forEach(W=>{W.onchange=ae}),ae(),z.classList.remove("show"),p.classList.add("show"),p.dataset.appTemplate=JSON.stringify(s)}async function S(s){const p=s.appTemplate,l=safeGetJSON(B,[]),m=p._useExisting&&p._existingContainer,c=l.find(t=>t.id===s.subdomain);if(!(c&&!m&&!confirm(`An app with subdomain "${s.subdomain}" already exists. Redeploy?`))){if(c){const t=l.indexOf(c);l.splice(t,1),safeSet(B,JSON.stringify(l))}if(m)s.port=p._existingContainer.primaryPort;else{const t=s.port||p.defaultPort||8080;showNotification(`Checking port ${t} availability...`,"info",0);const e=await D(t);if(!e.available){const a=await b(p.defaultPort||8080);if(confirm(`Port ${t} is already in use by ${e.conflict?.usedBy||"another container"}.
|
||||
`:G.installed?o.innerHTML='<span style="color: #ff9800;">Not connected</span>':(o.innerHTML='<span style="color: var(--muted);">Not available</span>',a.disabled=!0)}catch{o.innerHTML='<span style="color: var(--muted);">Could not check status</span>'}function ae(){const W=m.value||"subdomain",G=document.querySelector('input[name="dns-type"]:checked').value,V=document.querySelector('input[name="ssl-type"]:checked').value;let K="";if(SITE.routingMode==="subdirectory"&&SITE.domain)K=`https://${SITE.domain}/${W}`;else if(G==="private")K=`${V==="none"?"http":"https"}://${buildDomain(W)}`;else if(G==="public"){const te=V==="none"?"http":"https",ee=SITE.domain||W;K=SITE.domain?`${te}://${W}.${SITE.domain}`:`${te}://${W}`}else{const te=e.value||s.defaultPort||DC.DEFAULTS.SERVICE_PORT;K=`http://${t.value}:${te}`}c.textContent=K}m.oninput=ae,t.oninput=ae,e.oninput=ae,document.querySelectorAll('input[name="dns-type"]').forEach(W=>{W.onchange=ae}),document.querySelectorAll('input[name="ssl-type"]').forEach(W=>{W.onchange=ae}),ae(),z.classList.remove("show"),p.classList.add("show"),p.dataset.appTemplate=JSON.stringify(s)}async function S(s){const p=s.appTemplate,l=safeGetJSON(B,[]),m=p._useExisting&&p._existingContainer,c=l.find(t=>t.id===s.subdomain);if(!(c&&!m&&!confirm(`An app with subdomain "${s.subdomain}" already exists. Redeploy?`))){if(c){const t=l.indexOf(c);l.splice(t,1),safeSet(B,JSON.stringify(l))}if(m)s.port=p._existingContainer.primaryPort;else{const t=s.port||p.defaultPort||8080;showNotification(`Checking port ${t} availability...`,"info",0);const e=await D(t);if(!e.available){const a=await h(p.defaultPort||8080);if(confirm(`Port ${t} is already in use by ${e.conflict?.usedBy||"another container"}.
|
||||
|
||||
Would you like to use port ${a} instead?`))s.port=a;else{showNotification("Deployment cancelled - port conflict","error",5e3);return}}}showNotification(m?`Configuring ${p.name} with existing container...`:`Deploying ${p.name}...`,"info",0);try{const t={appId:p.id,config:{subdomain:s.subdomain,ip:s.ip,createDns:s.dnsType==="private",port:s.port||p.defaultPort||null,sslType:s.sslType,dnsType:s.dnsType,tailscaleOnly:s.tailscaleOnly||!1,mediaPath:s.mediaPath||null,plexClaimToken:s.plexClaimToken||null,customVolumes:s.customVolumes||null}};m&&(t.config.useExisting=!0,t.config.existingContainerId=p._existingContainer.id,t.config.existingPort=p._existingContainer.primaryPort,!s.port&&p._existingContainer.primaryPort&&(t.config.port=p._existingContainer.primaryPort));const a=await(await secureFetch("/api/v1/apps/deploy",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(t)})).json();if(a.success){const o={id:s.subdomain,name:p.name,logo:`/assets/${p.id}.png`,containerId:a.containerId,url:a.url,ip:s.ip,appTemplate:p.id,tailscaleOnly:s.tailscaleOnly||!1};l.push(o),safeSet(B,JSON.stringify(l)),window.APPS&&!window.APPS.some(n=>n.id===p.id)&&(window.APPS.push(o),typeof window.buildGrid=="function"&&window.buildGrid(),typeof window.refreshAll=="function"&&setTimeout(()=>window.refreshAll(),500));let i=a.usedExisting?`${p.name} configured with existing container!
|
||||
URL: ${a.url}`:`${p.name} deployed successfully!
|
||||
@@ -366,19 +366,19 @@ URL: ${a.url}`;a.warning&&(i+=`
|
||||
|
||||
\u26A0 Warning: ${a.warning}`),showNotification(i,"success",8e3),delete p._useExisting,delete p._existingContainer,a.url&&a.url.startsWith("https://")&&$(a.url,p.name),a.setupInstructions&&a.setupInstructions.length>0&&setTimeout(()=>{const n=a.setupInstructions.join(`
|
||||
`);showNotification(`Setup Instructions for ${p.name}: ${n}`,"info",1e4)},1e3)}else throw new Error(a.error||"Deployment failed")}catch(t){k.logError("[AppSelector] Deployment",t,{function:"deploy"}),showNotification(`Failed to deploy ${p.name}: ${t.message}`,"error",8e3)}}}async function $(s,p){showNotification(`\u23F3 Generating SSL certificate for ${p}...`,"warning",6e4);let l=0;const m=12,c=async()=>{l++;try{const t=await fetch(s,{method:"HEAD",mode:"no-cors"});return showNotification(`\u2705 ${p} is ready! SSL certificate generated.`,"success",5e3),!0}catch{return l<m?setTimeout(c,5e3):showNotification(`\u26A0\uFE0F ${p} deployed but SSL certificate may still be generating.
|
||||
Try refreshing in a moment if you see a certificate error.`,"warning",1e4),!1}};setTimeout(c,3e3)}function f(){safeGetJSON(B,[]).forEach(p=>{window.APPS.some(l=>l.id===p.id)||window.APPS.push(p)})}document.getElementById("add-service-btn")?.addEventListener("click",()=>{T(),z.classList.add("show")}),wireModal(z,document.getElementById("app-selector-cancel"));const E=document.getElementById("app-deploy-modal");document.getElementById("app-deploy-cancel")?.addEventListener("click",()=>{E.classList.remove("show")}),document.getElementById("app-deploy-confirm")?.addEventListener("click",()=>{const s=JSON.parse(E.dataset.appTemplate),p=document.getElementById("deploy-media-path").value.trim(),l=[];document.querySelectorAll("#volume-mounts-list .vol-host-path").forEach(c=>{l.push({hostPath:c.value.trim(),containerPath:c.dataset.containerPath})});const m={appTemplate:s,subdomain:document.getElementById("deploy-subdomain").value.trim(),dnsType:document.querySelector('input[name="dns-type"]:checked').value,sslType:document.querySelector('input[name="ssl-type"]:checked').value,ip:document.getElementById("deploy-ip").value.trim(),port:document.getElementById("deploy-port").value.trim(),tailscaleOnly:document.getElementById("deploy-tailscale-only").checked,mediaPath:p||null,plexClaimToken:document.getElementById("deploy-plex-claim")?.value.trim()||null,customVolumes:l.length>0?l:null,resources:{cpus:parseFloat(document.getElementById("deploy-cpu-limit").value)||0,memory:parseFloat(document.getElementById("deploy-memory-limit").value)||0}};if(!m.subdomain){showNotification("Please enter a subdomain or domain name","warning");return}if(s.mediaMount?.required&&!p){showNotification("Please enter a media library path for this application","warning");return}E.classList.remove("show"),S(m)}),wireModal(E);const O=document.getElementById("folder-browser-modal"),L=document.getElementById("folder-browser-path"),j=document.getElementById("folder-browser-list"),N=document.getElementById("folder-browser-selected"),R=document.getElementById("folder-browser-selected-list");let u="",v=[],w=null;window.openFolderBrowser=function(s){w=s,v=s.value.split(",").map(p=>p.trim()).filter(p=>p),u="",x(),g(""),O.classList.add("show")};async function g(s){L.textContent=s||"Select a drive...",j.innerHTML='<div style="padding: 20px; text-align: center; color: var(--muted);">Loading...</div>';try{const l=await(await fetch(`/api/v1/browse/directories?path=${encodeURIComponent(s)}`)).json();if(!l.success){j.innerHTML=`<div style="padding: 20px; text-align: center; color: var(--error);">Error: ${escapeHtml(l.error)}</div>`;return}u=l.path||"",L.textContent=u||"Select a drive...";let m="";l.parent&&l.parent!==l.path&&(m+=`<div class="folder-item" data-path="${escapeHtml(l.parent)}" style="padding: 12px 16px; border-bottom: 1px solid var(--border); cursor: pointer; display: flex; align-items: center; gap: 10px;">
|
||||
Try refreshing in a moment if you see a certificate error.`,"warning",1e4),!1}};setTimeout(c,3e3)}function w(){safeGetJSON(B,[]).forEach(p=>{window.APPS.some(l=>l.id===p.id)||window.APPS.push(p)})}document.getElementById("add-service-btn")?.addEventListener("click",()=>{T(),z.classList.add("show")}),wireModal(z,document.getElementById("app-selector-cancel"));const E=document.getElementById("app-deploy-modal");document.getElementById("app-deploy-cancel")?.addEventListener("click",()=>{E.classList.remove("show")}),document.getElementById("app-deploy-confirm")?.addEventListener("click",()=>{const s=JSON.parse(E.dataset.appTemplate),p=document.getElementById("deploy-media-path").value.trim(),l=[];document.querySelectorAll("#volume-mounts-list .vol-host-path").forEach(c=>{l.push({hostPath:c.value.trim(),containerPath:c.dataset.containerPath})});const m={appTemplate:s,subdomain:document.getElementById("deploy-subdomain").value.trim(),dnsType:document.querySelector('input[name="dns-type"]:checked').value,sslType:document.querySelector('input[name="ssl-type"]:checked').value,ip:document.getElementById("deploy-ip").value.trim(),port:document.getElementById("deploy-port").value.trim(),tailscaleOnly:document.getElementById("deploy-tailscale-only").checked,mediaPath:p||null,plexClaimToken:document.getElementById("deploy-plex-claim")?.value.trim()||null,customVolumes:l.length>0?l:null,resources:{cpus:parseFloat(document.getElementById("deploy-cpu-limit").value)||0,memory:parseFloat(document.getElementById("deploy-memory-limit").value)||0}};if(!m.subdomain){showNotification("Please enter a subdomain or domain name","warning");return}if(s.mediaMount?.required&&!p){showNotification("Please enter a media library path for this application","warning");return}E.classList.remove("show"),S(m)}),wireModal(E);const O=document.getElementById("folder-browser-modal"),C=document.getElementById("folder-browser-path"),j=document.getElementById("folder-browser-list"),N=document.getElementById("folder-browser-selected"),R=document.getElementById("folder-browser-selected-list");let u="",v=[],x=null;window.openFolderBrowser=function(s){x=s,v=s.value.split(",").map(p=>p.trim()).filter(p=>p),u="",b(),g(""),O.classList.add("show")};async function g(s){C.textContent=s||"Select a drive...",j.innerHTML='<div style="padding: 20px; text-align: center; color: var(--muted);">Loading...</div>';try{const l=await(await fetch(`/api/v1/browse/directories?path=${encodeURIComponent(s)}`)).json();if(!l.success){j.innerHTML=`<div style="padding: 20px; text-align: center; color: var(--error);">Error: ${escapeHtml(l.error)}</div>`;return}u=l.path||"",C.textContent=u||"Select a drive...";let m="";l.parent&&l.parent!==l.path&&(m+=`<div class="folder-item" data-path="${escapeHtml(l.parent)}" style="padding: 12px 16px; border-bottom: 1px solid var(--border); cursor: pointer; display: flex; align-items: center; gap: 10px;">
|
||||
<span style="font-size: 1.2rem;">\u2B06\uFE0F</span>
|
||||
<span style="color: var(--muted);">.. Parent Directory</span>
|
||||
</div>`),l.items.length===0&&!l.parent?m+='<div style="padding: 20px; text-align: center; color: var(--muted);">No browseable drives configured. Check your docker-compose.yml volume mounts.</div>':l.items.length===0?m+='<div style="padding: 20px; text-align: center; color: var(--muted);">No subfolders found</div>':l.items.forEach(c=>{const t=c.type==="drive"?"\u{1F4BE}":"\u{1F4C1}",e=v.includes(c.path),a=e?"background: color-mix(in srgb, var(--success) 20%, transparent);":"";m+=`<div class="folder-item" data-path="${escapeHtml(c.path)}" style="padding: 12px 16px; border-bottom: 1px solid var(--border); cursor: pointer; display: flex; align-items: center; gap: 10px; ${a}">
|
||||
<span style="font-size: 1.2rem;">${t}</span>
|
||||
<span style="flex: 1;">${escapeHtml(c.name)}</span>
|
||||
${e?'<span style="color: var(--success);">\u2713</span>':""}
|
||||
</div>`}),j.innerHTML=m,j.querySelectorAll(".folder-item").forEach(c=>{c.addEventListener("click",()=>{g(c.dataset.path)}),c.addEventListener("mouseenter",()=>{c.style.background="var(--card-bg)"}),c.addEventListener("mouseleave",()=>{const t=v.includes(c.dataset.path);c.style.background=t?"color-mix(in srgb, var(--success) 20%, transparent)":""})})}catch(p){j.innerHTML=`<div style="padding: 20px; text-align: center; color: var(--error);">Failed to load: ${escapeHtml(p.message)}</div>`}}function x(){if(v.length===0){N.style.display="none";return}N.style.display="block",R.innerHTML=v.map(s=>`
|
||||
</div>`}),j.innerHTML=m,j.querySelectorAll(".folder-item").forEach(c=>{c.addEventListener("click",()=>{g(c.dataset.path)}),c.addEventListener("mouseenter",()=>{c.style.background="var(--card-bg)"}),c.addEventListener("mouseleave",()=>{const t=v.includes(c.dataset.path);c.style.background=t?"color-mix(in srgb, var(--success) 20%, transparent)":""})})}catch(p){j.innerHTML=`<div style="padding: 20px; text-align: center; color: var(--error);">Failed to load: ${escapeHtml(p.message)}</div>`}}function b(){if(v.length===0){N.style.display="none";return}N.style.display="block",R.innerHTML=v.map(s=>`
|
||||
<span style="padding: 6px 12px; background: var(--card-bg); border: 1px solid var(--success); border-radius: 4px; display: flex; align-items: center; gap: 6px;">
|
||||
${escapeHtml(s)}
|
||||
<button type="button" onclick="removeSelectedFolder('${escapeHtml(s)}')" style="background: none; border: none; cursor: pointer; color: var(--error); font-size: 1rem; padding: 0;">\xD7</button>
|
||||
</span>
|
||||
`).join("")}window.removeSelectedFolder=function(s){v=v.filter(p=>p!==s),x(),g(u)},document.getElementById("folder-browser-select-current").addEventListener("click",()=>{u&&!v.includes(u)&&(v.push(u),x(),g(u))}),wireModal(O,document.getElementById("folder-browser-cancel")),document.getElementById("folder-browser-done").addEventListener("click",()=>{w&&(w.value=v.join(", ")),O.classList.remove("show")}),f()})(),(function(){injectModal("recipe-deploy-modal",`<div id="recipe-deploy-modal" class="weather-modal">
|
||||
`).join("")}window.removeSelectedFolder=function(s){v=v.filter(p=>p!==s),b(),g(u)},document.getElementById("folder-browser-select-current").addEventListener("click",()=>{u&&!v.includes(u)&&(v.push(u),b(),g(u))}),wireModal(O,document.getElementById("folder-browser-cancel")),document.getElementById("folder-browser-done").addEventListener("click",()=>{x&&(x.value=v.join(", ")),O.classList.remove("show")}),w()})(),(function(){injectModal("recipe-deploy-modal",`<div id="recipe-deploy-modal" class="weather-modal">
|
||||
<div class="weather-modal-content" style="min-width: 620px; max-width: 740px;">
|
||||
<h3 id="recipe-deploy-title">Deploy Recipe</h3>
|
||||
|
||||
@@ -445,31 +445,31 @@ Try refreshing in a moment if you see a certificate error.`,"warning",1e4),!1}};
|
||||
<button id="recipe-next" class="btn-accent-solid">Next</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>`);let k=null,B=null,A=null,I=1,z=!1;const P=document.getElementById("recipe-deploy-modal"),M=document.getElementById("recipe-cancel"),D=document.getElementById("recipe-prev"),b=document.getElementById("recipe-next");wireModal(P,M);async function T(){try{const u=await fetch("/api/v1/recipes/templates"),v=await u.json();if(v.success)return k=v.templates,B=v.categories,!0;if(u.status===403)return z=!1,!1}catch(u){console.warn("Failed to fetch recipe templates:",u.message)}return!1}async function h(){try{z=(await(await fetch("/api/v1/license/feature/recipes")).json()).available}catch{z=!1}return z}window.renderRecipeCards=async function(u){await h();let v;if(z&&k?v=k:v=H(),!v||v.length===0)return;const w=document.createElement("div");w.className="app-category-header",w.innerHTML="\u{1F9EA} Recipes",w.style.borderBottomColor="#8e44ad",u.appendChild(w);const g=Array.isArray(v)?v:Object.values(v);g.sort((x,s)=>(s.popularity||0)-(x.popularity||0));for(const x of g){const s=document.createElement("div");s.className="app-option",s.style.position="relative";const p=`<div style="font-size: 0.65rem; padding: 2px 6px; border-radius: 4px; margin-top: 4px; background: rgba(142,68,173,0.2); color: #a855f7;">${x.componentCount||x.components?.length||"?"} apps</div>`,l=z?"":'<div style="position: absolute; top: 6px; right: 6px; font-size: 0.65rem; padding: 2px 8px; border-radius: 10px; background: rgba(241,196,15,0.2); color: #f1c40f; font-weight: 600;">PREMIUM</div>';s.innerHTML=`
|
||||
</div>`);let k=null,B=null,A=null,I=1,z=!1;const P=document.getElementById("recipe-deploy-modal"),M=document.getElementById("recipe-cancel"),D=document.getElementById("recipe-prev"),h=document.getElementById("recipe-next");wireModal(P,M);async function T(){try{const u=await fetch("/api/v1/recipes/templates"),v=await u.json();if(v.success)return k=v.templates,B=v.categories,!0;if(u.status===403)return z=!1,!1}catch(u){console.warn("Failed to fetch recipe templates:",u.message)}return!1}async function f(){try{z=(await(await fetch("/api/v1/license/feature/recipes")).json()).available}catch{z=!1}return z}window.renderRecipeCards=async function(u){await f();let v;if(z&&k?v=k:v=H(),!v||v.length===0)return;const x=document.createElement("div");x.className="app-category-header",x.innerHTML="\u{1F9EA} Recipes",x.style.borderBottomColor="#8e44ad",u.appendChild(x);const g=Array.isArray(v)?v:Object.values(v);g.sort((b,s)=>(s.popularity||0)-(b.popularity||0));for(const b of g){const s=document.createElement("div");s.className="app-option",s.style.position="relative";const p=`<div style="font-size: 0.65rem; padding: 2px 6px; border-radius: 4px; margin-top: 4px; background: rgba(142,68,173,0.2); color: #a855f7;">${b.componentCount||b.components?.length||"?"} apps</div>`,l=z?"":'<div style="position: absolute; top: 6px; right: 6px; font-size: 0.65rem; padding: 2px 8px; border-radius: 10px; background: rgba(241,196,15,0.2); color: #f1c40f; font-weight: 600;">PREMIUM</div>';s.innerHTML=`
|
||||
${l}
|
||||
<div class="app-option-icon">${escapeHtml(x.icon||"\u{1F9EA}")}</div>
|
||||
<div class="app-option-name">${escapeHtml(x.name)}</div>
|
||||
<div class="app-option-desc">${escapeHtml(x.description||"")}</div>
|
||||
<div class="app-option-icon">${escapeHtml(b.icon||"\u{1F9EA}")}</div>
|
||||
<div class="app-option-name">${escapeHtml(b.name)}</div>
|
||||
<div class="app-option-desc">${escapeHtml(b.description||"")}</div>
|
||||
${p}
|
||||
`,s.onclick=()=>{if(!z){showNotification("Recipes require a DashCaddy Premium license. Click the License button to activate.","warning",5e3),window.openLicenseModal&&window.openLicenseModal();return}S(x)},u.appendChild(s)}};function H(){return[{id:"htpc-suite",name:"HTPC Suite",icon:"\u{1F3AC}",description:"Complete media automation: find, download, organize, and stream",componentCount:6,popularity:98},{id:"nextcloud-complete",name:"Nextcloud Complete",icon:"\u2601\uFE0F",description:"Full productivity suite: cloud storage, office editing, and collaboration",componentCount:4,popularity:90},{id:"smart-home",name:"Smart Home Hub",icon:"\u{1F3E0}",description:"Home automation: control, automate, and monitor IoT devices",componentCount:4,popularity:88},{id:"dev-environment",name:"Dev Environment",icon:"\u{1F4BB}",description:"Self-hosted development workflow: Git, CI/CD, IDE, and database",componentCount:4,popularity:82}]}function S(u){A=u,I=1;const v=document.getElementById("app-selector-modal");v&&v.classList.remove("show"),document.getElementById("recipe-deploy-title").textContent=`Deploy ${u.name}`,$(),f(),P.classList.add("show")}function $(){document.querySelectorAll("#recipe-steps .recipe-step").forEach(u=>{const v=parseInt(u.dataset.step);u.classList.toggle("active",v===I),u.classList.toggle("completed",v<I)});for(let u=1;u<=4;u++){const v=document.getElementById(`recipe-step-${u}`);v&&(v.style.display=u===I?"":"none")}D.style.display=I>1&&I<4?"":"none",I===4?(b.style.display="none",M.textContent="Close"):I===3?(b.textContent="\u{1F680} Deploy",b.style.display="",M.textContent="Cancel"):(b.textContent="Next",b.style.display="",M.textContent="Cancel")}function f(){const u=document.getElementById("recipe-component-list");u.innerHTML="";const v=A.components||[];for(const w of v){const g=document.createElement("div");g.style.cssText="display: flex; align-items: center; gap: 12px; padding: 12px; border-radius: 8px; background: var(--card-bg); border: 1px solid var(--border);";const x=w.required,s=w.internal;g.innerHTML=`
|
||||
<input type="checkbox" ${x?"checked disabled":"checked"} data-component-id="${w.id}"
|
||||
`,s.onclick=()=>{if(!z){showNotification("Recipes require a DashCaddy Premium license. Click the License button to activate.","warning",5e3),window.openLicenseModal&&window.openLicenseModal();return}S(b)},u.appendChild(s)}};function H(){return[{id:"htpc-suite",name:"HTPC Suite",icon:"\u{1F3AC}",description:"Complete media automation: find, download, organize, and stream",componentCount:6,popularity:98},{id:"nextcloud-complete",name:"Nextcloud Complete",icon:"\u2601\uFE0F",description:"Full productivity suite: cloud storage, office editing, and collaboration",componentCount:4,popularity:90},{id:"smart-home",name:"Smart Home Hub",icon:"\u{1F3E0}",description:"Home automation: control, automate, and monitor IoT devices",componentCount:4,popularity:88},{id:"dev-environment",name:"Dev Environment",icon:"\u{1F4BB}",description:"Self-hosted development workflow: Git, CI/CD, IDE, and database",componentCount:4,popularity:82}]}function S(u){A=u,I=1;const v=document.getElementById("app-selector-modal");v&&v.classList.remove("show"),document.getElementById("recipe-deploy-title").textContent=`Deploy ${u.name}`,$(),w(),P.classList.add("show")}function $(){document.querySelectorAll("#recipe-steps .recipe-step").forEach(u=>{const v=parseInt(u.dataset.step);u.classList.toggle("active",v===I),u.classList.toggle("completed",v<I)});for(let u=1;u<=4;u++){const v=document.getElementById(`recipe-step-${u}`);v&&(v.style.display=u===I?"":"none")}D.style.display=I>1&&I<4?"":"none",I===4?(h.style.display="none",M.textContent="Close"):I===3?(h.textContent="\u{1F680} Deploy",h.style.display="",M.textContent="Cancel"):(h.textContent="Next",h.style.display="",M.textContent="Cancel")}function w(){const u=document.getElementById("recipe-component-list");u.innerHTML="";const v=A.components||[];for(const x of v){const g=document.createElement("div");g.style.cssText="display: flex; align-items: center; gap: 12px; padding: 12px; border-radius: 8px; background: var(--card-bg); border: 1px solid var(--border);";const b=x.required,s=x.internal;g.innerHTML=`
|
||||
<input type="checkbox" ${b?"checked disabled":"checked"} data-component-id="${x.id}"
|
||||
style="width: 18px; height: 18px; accent-color: var(--accent);" />
|
||||
<div style="flex: 1;">
|
||||
<div style="font-weight: 600; font-size: 0.9rem;">${escapeHtml(w.role||w.id)}</div>
|
||||
<div style="font-weight: 600; font-size: 0.9rem;">${escapeHtml(x.role||x.id)}</div>
|
||||
<div style="font-size: 0.78rem; color: var(--muted);">
|
||||
${w.templateRef?escapeHtml(w.templateRef):"Built-in"}
|
||||
${x?'<span style="color: var(--accent); margin-left: 6px;">Required</span>':'<span style="color: var(--muted); margin-left: 6px;">Optional</span>'}
|
||||
${x.templateRef?escapeHtml(x.templateRef):"Built-in"}
|
||||
${b?'<span style="color: var(--accent); margin-left: 6px;">Required</span>':'<span style="color: var(--muted); margin-left: 6px;">Optional</span>'}
|
||||
${s?'<span style="color: var(--muted); margin-left: 6px;">(Internal)</span>':""}
|
||||
</div>
|
||||
${w.note?`<div style="font-size: 0.75rem; color: var(--warn-fg); margin-top: 4px;">\u26A0 ${escapeHtml(w.note)}</div>`:""}
|
||||
${x.note?`<div style="font-size: 0.75rem; color: var(--warn-fg); margin-top: 4px;">\u26A0 ${escapeHtml(x.note)}</div>`:""}
|
||||
</div>
|
||||
`,u.appendChild(g)}}function E(){const u=document.getElementById("recipe-volumes-section"),v=document.getElementById("recipe-volume-list"),w=A.sharedVolumes;if(w&&Object.keys(w).length>0){u.style.display="",v.innerHTML="";for(const[g,x]of Object.entries(w)){const s=document.createElement("div");s.style.cssText="display: grid; gap: 4px;",s.innerHTML=`
|
||||
<label style="font-weight: 500; font-size: 0.85rem;">${escapeHtml(x.label||g)}</label>
|
||||
<input type="text" data-volume-key="${g}" value="${escapeHtml(x.defaultPath||"")}"
|
||||
placeholder="${escapeHtml(x.defaultPath||"/path")}"
|
||||
`,u.appendChild(g)}}function E(){const u=document.getElementById("recipe-volumes-section"),v=document.getElementById("recipe-volume-list"),x=A.sharedVolumes;if(x&&Object.keys(x).length>0){u.style.display="",v.innerHTML="";for(const[g,b]of Object.entries(x)){const s=document.createElement("div");s.style.cssText="display: grid; gap: 4px;",s.innerHTML=`
|
||||
<label style="font-weight: 500; font-size: 0.85rem;">${escapeHtml(b.label||g)}</label>
|
||||
<input type="text" data-volume-key="${g}" value="${escapeHtml(b.defaultPath||"")}"
|
||||
placeholder="${escapeHtml(b.defaultPath||"/path")}"
|
||||
style="width: 100%; padding: 8px 12px; background: var(--card-bg); color: var(--fg); border: 1px solid var(--border); border-radius: 6px; font-family: monospace; font-size: 0.85rem;" />
|
||||
<div class="form-hint-sm">${escapeHtml(x.description||"")}</div>
|
||||
`,v.appendChild(s)}}else u.style.display="none"}function O(){const u=document.getElementById("recipe-review-content"),v=L(),w=document.querySelectorAll("#recipe-volume-list input[data-volume-key]"),g={};w.forEach(l=>{g[l.dataset.volumeKey]=l.value});const x=document.getElementById("recipe-timezone").value||"UTC",s=document.getElementById("recipe-ip").value||"host.docker.internal",p=document.getElementById("recipe-tailscale").checked;u.innerHTML=`
|
||||
<div class="form-hint-sm">${escapeHtml(b.description||"")}</div>
|
||||
`,v.appendChild(s)}}else u.style.display="none"}function O(){const u=document.getElementById("recipe-review-content"),v=C(),x=document.querySelectorAll("#recipe-volume-list input[data-volume-key]"),g={};x.forEach(l=>{g[l.dataset.volumeKey]=l.value});const b=document.getElementById("recipe-timezone").value||"UTC",s=document.getElementById("recipe-ip").value||"host.docker.internal",p=document.getElementById("recipe-tailscale").checked;u.innerHTML=`
|
||||
<div style="font-weight: 600; font-size: 1rem; margin-bottom: 12px;">${escapeHtml(A.name)}</div>
|
||||
<div style="color: var(--muted); margin-bottom: 16px;">${escapeHtml(A.description||"")}</div>
|
||||
|
||||
@@ -488,15 +488,15 @@ Try refreshing in a moment if you see a certificate error.`,"warning",1e4),!1}};
|
||||
</div>`:""}
|
||||
|
||||
<div style="font-size: 0.85rem; color: var(--muted);">
|
||||
Timezone: ${escapeHtml(x)} • IP: ${escapeHtml(s)} ${p?"• Tailscale only":""}
|
||||
Timezone: ${escapeHtml(b)} • IP: ${escapeHtml(s)} ${p?"• Tailscale only":""}
|
||||
</div>
|
||||
|
||||
${A.network?`<div style="font-size: 0.85rem; color: var(--muted); margin-top: 4px;">Docker network: <code>${escapeHtml(A.network.name)}</code></div>`:""}
|
||||
`}function L(){const u=document.querySelectorAll("#recipe-component-list input[data-component-id]"),v=new Set;u.forEach(g=>{g.checked&&v.add(g.dataset.componentId)});const w=A.components||[];return w.filter(g=>g.required).forEach(g=>v.add(g.id)),w.filter(g=>v.has(g.id))}async function j(){const u=document.getElementById("recipe-progress-list"),v=document.getElementById("recipe-deploy-result");v.style.display="none",u.innerHTML="";const w=L();for(const p of w){const l=document.createElement("div");l.id=`recipe-progress-${p.id}`,l.style.cssText="display: flex; align-items: center; gap: 10px; padding: 10px 12px; border-radius: 6px; background: var(--card-bg); border: 1px solid var(--border); font-size: 0.85rem;",l.innerHTML=`
|
||||
`}function C(){const u=document.querySelectorAll("#recipe-component-list input[data-component-id]"),v=new Set;u.forEach(g=>{g.checked&&v.add(g.dataset.componentId)});const x=A.components||[];return x.filter(g=>g.required).forEach(g=>v.add(g.id)),x.filter(g=>v.has(g.id))}async function j(){const u=document.getElementById("recipe-progress-list"),v=document.getElementById("recipe-deploy-result");v.style.display="none",u.innerHTML="";const x=C();for(const p of x){const l=document.createElement("div");l.id=`recipe-progress-${p.id}`,l.style.cssText="display: flex; align-items: center; gap: 10px; padding: 10px 12px; border-radius: 6px; background: var(--card-bg); border: 1px solid var(--border); font-size: 0.85rem;",l.innerHTML=`
|
||||
<span class="recipe-progress-icon" style="font-size: 1.1rem;">\u23F3</span>
|
||||
<span style="flex:1; font-weight: 500;">${escapeHtml(p.role||p.id)}</span>
|
||||
<span class="recipe-progress-status" style="color: var(--muted);">Queued</span>
|
||||
`,u.appendChild(l)}const g=document.querySelectorAll("#recipe-volume-list input[data-volume-key]"),x={};g.forEach(p=>{x[p.dataset.volumeKey]=p.value});const s={selectedComponents:w.map(p=>p.id),sharedConfig:{ip:document.getElementById("recipe-ip").value||"host.docker.internal",timezone:document.getElementById("recipe-timezone").value||"UTC",tailscaleOnly:document.getElementById("recipe-tailscale").checked,volumes:x},componentOverrides:{}};for(const p of w)N(p.id,"deploying","Deploying...");try{const l=await(await secureFetch("/api/v1/recipes/deploy",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({recipeId:A.id,config:s})})).json();if(l.success){for(const m of l.deployed||[])N(m.id,"success",m.url?`Running \u2192 ${m.url}`:"Running");for(const m of l.errors||[])N(m.componentId,"error",m.error);v.style.display="",v.innerHTML=`
|
||||
`,u.appendChild(l)}const g=document.querySelectorAll("#recipe-volume-list input[data-volume-key]"),b={};g.forEach(p=>{b[p.dataset.volumeKey]=p.value});const s={selectedComponents:x.map(p=>p.id),sharedConfig:{ip:document.getElementById("recipe-ip").value||"host.docker.internal",timezone:document.getElementById("recipe-timezone").value||"UTC",tailscaleOnly:document.getElementById("recipe-tailscale").checked,volumes:b},componentOverrides:{}};for(const p of x)N(p.id,"deploying","Deploying...");try{const l=await(await secureFetch("/api/v1/recipes/deploy",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({recipeId:A.id,config:s})})).json();if(l.success){for(const m of l.deployed||[])N(m.id,"success",m.url?`Running \u2192 ${m.url}`:"Running");for(const m of l.errors||[])N(m.componentId,"error",m.error);v.style.display="",v.innerHTML=`
|
||||
<div style="padding: 14px; border-radius: 8px; background: rgba(46,204,113,0.1); border: 1px solid rgba(46,204,113,0.3);">
|
||||
<div style="font-weight: 600; color: var(--ok-fg); margin-bottom: 6px;">${escapeHtml(l.message||"Deployed!")}</div>
|
||||
${l.setupInstructions?`<div style="font-size: 0.8rem; color: var(--muted); margin-top: 8px;">
|
||||
@@ -508,7 +508,7 @@ Try refreshing in a moment if you see a certificate error.`,"warning",1e4),!1}};
|
||||
<strong>Deployment failed:</strong> ${escapeHtml(l.error||"Unknown error")}
|
||||
</div>`,showNotification(`Recipe deployment failed: ${l.error}`,"error",5e3)}catch(p){v.style.display="",v.innerHTML=`<div style="padding: 14px; border-radius: 8px; background: rgba(231,76,60,0.1); border: 1px solid rgba(231,76,60,0.3); color: var(--bad-fg);">
|
||||
<strong>Network error:</strong> ${escapeHtml(p.message)}
|
||||
</div>`}}function N(u,v,w){const g=document.getElementById(`recipe-progress-${u}`);if(!g)return;const x=g.querySelector(".recipe-progress-icon"),s=g.querySelector(".recipe-progress-status");v==="deploying"?(x.textContent="\u23F3",s.style.color="var(--accent)"):v==="success"?(x.textContent="\u2705",s.style.color="var(--ok-fg)"):v==="error"&&(x.textContent="\u274C",s.style.color="var(--bad-fg)"),s.textContent=w}b.addEventListener("click",()=>{if(I===3){I=4,$(),j();return}I<3&&(I++,$(),I===2&&E(),I===3&&O())}),D.addEventListener("click",()=>{I>1&&I<4&&(I--,$())}),window.groupRecipeCards=function(){const u=document.querySelectorAll(".service-card[data-recipe-id]");if(u.length===0)return;const v={};u.forEach(w=>{const g=w.dataset.recipeId;v[g]||(v[g]=[]),v[g].push(w)});for(const[w,g]of Object.entries(v))g.length<2||g.forEach((x,s)=>{if(x.style.borderLeft="3px solid rgba(142,68,173,0.5)",s===0){let p=x.querySelector(".recipe-group-label");p||(p=document.createElement("div"),p.className="recipe-group-label",p.style.cssText="position: absolute; top: -8px; left: 12px; font-size: 0.6rem; padding: 1px 8px; border-radius: 8px; background: rgba(142,68,173,0.3); color: #d4a5ff; font-weight: 600; text-transform: uppercase; letter-spacing: 0.5px;",p.textContent=w.replace(/-/g," "),x.style.position="relative",x.appendChild(p))}})},window.manageRecipe=async function(u,v){const w=`/api/v1/recipes/${u}/${v}`,g=v==="remove"?"DELETE":"POST",x=v==="remove"?`/api/v1/recipes/${u}`:w;if(!(v==="remove"&&!confirm(`Remove the entire ${u} recipe? This will delete all containers and configuration.`)))try{const p=await(await secureFetch(x,{method:g})).json();p.success?(showNotification(`Recipe ${v}: ${p.results?.filter(l=>l.status!=="failed").length||0} components processed`,"success",4e3),window.loadServices&&window.loadServices()):showNotification(`Recipe ${v} failed: ${p.error}`,"error",5e3)}catch(s){showNotification(`Network error: ${s.message}`,"error",5e3)}};const R=document.createElement("style");R.textContent=`
|
||||
</div>`}}function N(u,v,x){const g=document.getElementById(`recipe-progress-${u}`);if(!g)return;const b=g.querySelector(".recipe-progress-icon"),s=g.querySelector(".recipe-progress-status");v==="deploying"?(b.textContent="\u23F3",s.style.color="var(--accent)"):v==="success"?(b.textContent="\u2705",s.style.color="var(--ok-fg)"):v==="error"&&(b.textContent="\u274C",s.style.color="var(--bad-fg)"),s.textContent=x}h.addEventListener("click",()=>{if(I===3){I=4,$(),j();return}I<3&&(I++,$(),I===2&&E(),I===3&&O())}),D.addEventListener("click",()=>{I>1&&I<4&&(I--,$())}),window.groupRecipeCards=function(){const u=document.querySelectorAll(".service-card[data-recipe-id]");if(u.length===0)return;const v={};u.forEach(x=>{const g=x.dataset.recipeId;v[g]||(v[g]=[]),v[g].push(x)});for(const[x,g]of Object.entries(v))g.length<2||g.forEach((b,s)=>{if(b.style.borderLeft="3px solid rgba(142,68,173,0.5)",s===0){let p=b.querySelector(".recipe-group-label");p||(p=document.createElement("div"),p.className="recipe-group-label",p.style.cssText="position: absolute; top: -8px; left: 12px; font-size: 0.6rem; padding: 1px 8px; border-radius: 8px; background: rgba(142,68,173,0.3); color: #d4a5ff; font-weight: 600; text-transform: uppercase; letter-spacing: 0.5px;",p.textContent=x.replace(/-/g," "),b.style.position="relative",b.appendChild(p))}})},window.manageRecipe=async function(u,v){const x=`/api/v1/recipes/${u}/${v}`,g=v==="remove"?"DELETE":"POST",b=v==="remove"?`/api/v1/recipes/${u}`:x;if(!(v==="remove"&&!confirm(`Remove the entire ${u} recipe? This will delete all containers and configuration.`)))try{const p=await(await secureFetch(b,{method:g})).json();p.success?(showNotification(`Recipe ${v}: ${p.results?.filter(l=>l.status!=="failed").length||0} components processed`,"success",4e3),window.loadServices&&window.loadServices()):showNotification(`Recipe ${v} failed: ${p.error}`,"error",5e3)}catch(s){showNotification(`Network error: ${s.message}`,"error",5e3)}};const R=document.createElement("style");R.textContent=`
|
||||
.recipe-step {
|
||||
flex: 1;
|
||||
text-align: center;
|
||||
@@ -550,7 +550,7 @@ Try refreshing in a moment if you see a certificate error.`,"warning",1e4),!1}};
|
||||
.recipe-step-panel {
|
||||
min-height: 180px;
|
||||
}
|
||||
`,document.head.appendChild(R),h()})(),(function(){document.getElementById("reload-caddy-top")?.addEventListener("click",async()=>{const k=document.getElementById("reload-caddy-top"),B=k.textContent;try{k.textContent="\u23F3 Reloading...",k.disabled=!0;const A=await secureFetch("/api/v1/caddy/reload",{method:"POST",headers:{"Content-Type":"application/json"}}),I=await A.json();if(A.ok&&I.success)k.textContent="\u2705 Reloaded!",setTimeout(()=>{k.textContent=B,k.disabled=!1},2e3);else throw new Error(I.error||"Reload failed")}catch(A){k.textContent="\u274C Failed",showNotification(`Failed to reload Caddy: ${A.message}`,"error"),setTimeout(()=>{k.textContent=B,k.disabled=!1},2e3)}})})(),(function(){injectModal("error-log-modal",`<div id="error-log-modal" class="weather-modal">
|
||||
`,document.head.appendChild(R),f()})(),(function(){document.getElementById("reload-caddy-top")?.addEventListener("click",async()=>{const k=document.getElementById("reload-caddy-top"),B=k.textContent;try{k.textContent="\u23F3 Reloading...",k.disabled=!0;const A=await secureFetch("/api/v1/caddy/reload",{method:"POST",headers:{"Content-Type":"application/json"}}),I=await A.json();if(A.ok&&I.success)k.textContent="\u2705 Reloaded!",setTimeout(()=>{k.textContent=B,k.disabled=!1},2e3);else throw new Error(I.error||"Reload failed")}catch(A){k.textContent="\u274C Failed",showNotification(`Failed to reload Caddy: ${A.message}`,"error"),setTimeout(()=>{k.textContent=B,k.disabled=!1},2e3)}})})(),(function(){injectModal("error-log-modal",`<div id="error-log-modal" class="weather-modal">
|
||||
<div class="weather-modal-content" style="min-width: 950px; max-width: 1150px;">
|
||||
<h3>\u{1F4CB} Error Logs</h3>
|
||||
<p class="modal-subtitle">
|
||||
@@ -597,8 +597,8 @@ Try refreshing in a moment if you see a certificate error.`,"warning",1e4),!1}};
|
||||
<button id="error-log-close">Close</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>`);const k=document.getElementById("error-log-modal"),B=document.getElementById("view-error-logs"),A=document.getElementById("error-log-refresh"),I=document.getElementById("error-log-clear"),z=document.getElementById("error-log-close"),P=document.getElementById("error-log-level"),M=document.getElementById("error-log-context"),D=document.getElementById("error-log-search"),b=document.getElementById("error-log-since"),T=document.getElementById("error-log-until"),h=document.getElementById("error-log-container"),H=document.getElementById("error-log-load-more"),S=document.getElementById("error-log-total"),$=50;let f=0,E=null,O=0,L=[];function j(x){if(!x)return null;const s=new Date(x);return isNaN(s.getTime())?null:s.toISOString()}async function N(){try{const x=await fetch("/api/v1/error-logs/contexts");if(!x.ok)return;const s=await x.json();if(!s.success||!Array.isArray(s.contexts))return;L=s.contexts;const p=M.value;M.innerHTML='<option value="">All</option>';for(const l of s.contexts){const m=document.createElement("option");m.value=l.name,m.textContent=`${l.name} (${l.count})`,M.appendChild(m)}p&&s.contexts.some(l=>l.name===p)&&(M.value=p)}catch{}}function R(){const x=new URLSearchParams;x.set("limit",String($)),x.set("offset",String(f)),P.value&&x.set("level",P.value),M.value&&x.set("context",M.value);const s=j(b.value),p=j(T.value);s&&x.set("since",s),p&&x.set("until",p);const l=(D.value||"").trim();return l&&x.set("search",l),x}async function u(x){try{x?(E&&E.abort(),E=new AbortController):(E&&E.abort(),E=new AbortController,f=0,O++,h.innerHTML='<div class="panel-empty"><span class="brand-spinner"></span> Loading...</div>');const s=O,p=R(),l=await fetch("/api/v1/error-logs?"+p.toString(),{signal:E.signal});if(!l.ok){h.innerHTML=`<div class="panel-empty" style="color: var(--bad-fg);">Failed: HTTP ${l.status}</div>`,H.style.display="none",S.textContent="";return}const m=await l.json();if(!m.success){h.innerHTML=`<div class="panel-empty" style="color: var(--bad-fg);">Failed: ${escapeHtml(m.error||"unknown")}</div>`,H.style.display="none",S.textContent="";return}if(!x&&s!==O)return;const c=Array.isArray(m.logs)?m.logs:[];if(c.length===0&&!x){const e=m.filters&&(m.filters.level||m.filters.context||m.filters.search||m.filters.since||m.filters.until)?"No error log entries match your filters.":"\u2705 No errors logged! Everything is working smoothly.";h.innerHTML=`<div class="panel-empty"><span class="empty-icon">\u{1F4CB}</span>${escapeHtml(e)}</div>`,H.style.display="none",S.textContent=m.total?`${m.total} total`:"";return}let t="";x||(t='<table style="width: 100%; border-collapse: collapse; font-size: 0.82rem;">',t+='<tr style="border-bottom: 1px solid var(--border); color: var(--muted);">',t+='<th style="padding: 6px; text-align: left; width: 160px;">When</th>',t+='<th style="padding: 6px; text-align: left; width: 80px;">Level</th>',t+='<th style="padding: 6px; text-align: left; width: 140px;">Context</th>',t+='<th style="padding: 6px; text-align: left;">Message</th>',t+='<th style="padding: 6px; text-align: left; width: 110px;">IP</th>',t+="</tr>");for(const e of c){const a=(e.level||"?").toUpperCase(),o=a==="ERR"?"var(--bad-fg)":a==="WARN"?"var(--warn-fg, #f0c674)":"var(--muted)",i=e.timestamp?new Date(e.timestamp).toLocaleString():"\u2014",n=e.context||"\u2014",r=(e.error||"").split(`
|
||||
`)[0],d=e.request&&e.request.ip||"";t+='<tr style="border-bottom: 1px solid var(--border); cursor: pointer;" class="error-log-row">',t+=`<td style="padding: 6px; color: var(--muted);" title="${escapeHtml(e.timestamp||"")}">${escapeHtml(i)}</td>`,t+=`<td style="padding: 6px;"><span style="color: ${o}; font-weight: 600;">${escapeHtml(a)}</span></td>`,t+=`<td style="padding: 6px; font-family: monospace; font-size: 0.78rem;">${escapeHtml(n)}</td>`,t+=`<td style="padding: 6px;">${escapeHtml(r)}</td>`,t+=`<td style="padding: 6px; font-family: monospace; font-size: 0.78rem;">${escapeHtml(d)}</td>`,t+="</tr>",e.detail&&(t+=`<tr class="error-log-detail" style="display: none;"><td colspan="5" style="padding: 6px 6px 10px; font-size: 0.78rem; color: var(--muted);"><pre style="margin: 0; white-space: pre-wrap; font-family: monospace; max-height: 320px; overflow: auto;">${escapeHtml(e.detail)}</pre></td></tr>`)}if(!x)t+="</table>",h.innerHTML=t;else{const e=h.querySelector("table");e&&e.insertAdjacentHTML("beforeend",t)}f+=c.length,H.style.display=m.hasMore?"":"none",S.textContent=`${m.total} total${m.hasMore?" (showing "+f+")":""}`,h.querySelectorAll(".error-log-row").forEach(e=>{e.dataset.wired||(e.dataset.wired="true",e.addEventListener("click",()=>{const a=e.nextElementSibling;a&&a.classList.contains("error-log-detail")&&(a.style.display=a.style.display==="none"?"":"none")}))})}catch(s){if(s&&s.name==="AbortError")return;h.innerHTML=`<div class="panel-empty" style="color: var(--bad-fg);">Failed: ${escapeHtml(s.message)}</div>`,S.textContent=""}}async function v(){if(confirm("Clear the entire error log? This cannot be undone."))try{const s=await(await secureFetch("/api/v1/error-logs",{method:"DELETE",headers:{"content-type":"application/json"},body:JSON.stringify({confirm:"CLEAR"})})).json();s.success?(await N(),u(!1),showNotification("\u2705 Error logs cleared","success",3e3)):showNotification("\u274C "+(s.error||"Clear failed"),"error",4e3)}catch(x){showNotification("\u274C "+x.message,"error",4e3)}}let w;function g(){P?.addEventListener("change",()=>u(!1)),M?.addEventListener("change",()=>u(!1)),D?.addEventListener("input",()=>{clearTimeout(w),w=setTimeout(()=>u(!1),250)});let x;[b,T].forEach(s=>{s?.addEventListener("change",()=>{clearTimeout(x),x=setTimeout(()=>u(!1),250)})}),A?.addEventListener("click",()=>u(!1)),H?.addEventListener("click",()=>u(!0)),I?.addEventListener("click",v),wireModal(k,z)}B?.addEventListener("click",async()=>{k?.classList.add("show"),await N(),u(!1)}),g()})(),(function(){injectModal("container-logs-modal",`<div id="container-logs-modal" class="weather-modal" style="z-index: 1001;">
|
||||
</div>`);const k=document.getElementById("error-log-modal"),B=document.getElementById("view-error-logs"),A=document.getElementById("error-log-refresh"),I=document.getElementById("error-log-clear"),z=document.getElementById("error-log-close"),P=document.getElementById("error-log-level"),M=document.getElementById("error-log-context"),D=document.getElementById("error-log-search"),h=document.getElementById("error-log-since"),T=document.getElementById("error-log-until"),f=document.getElementById("error-log-container"),H=document.getElementById("error-log-load-more"),S=document.getElementById("error-log-total"),$=50;let w=0,E=null,O=0,C=[];function j(b){if(!b)return null;const s=new Date(b);return isNaN(s.getTime())?null:s.toISOString()}async function N(){try{const b=await fetch("/api/v1/error-logs/contexts");if(!b.ok)return;const s=await b.json();if(!s.success||!Array.isArray(s.contexts))return;C=s.contexts;const p=M.value;M.innerHTML='<option value="">All</option>';for(const l of s.contexts){const m=document.createElement("option");m.value=l.name,m.textContent=`${l.name} (${l.count})`,M.appendChild(m)}p&&s.contexts.some(l=>l.name===p)&&(M.value=p)}catch{}}function R(){const b=new URLSearchParams;b.set("limit",String($)),b.set("offset",String(w)),P.value&&b.set("level",P.value),M.value&&b.set("context",M.value);const s=j(h.value),p=j(T.value);s&&b.set("since",s),p&&b.set("until",p);const l=(D.value||"").trim();return l&&b.set("search",l),b}async function u(b){try{b?(E&&E.abort(),E=new AbortController):(E&&E.abort(),E=new AbortController,w=0,O++,f.innerHTML='<div class="panel-empty"><span class="brand-spinner"></span> Loading...</div>');const s=O,p=R(),l=await fetch("/api/v1/error-logs?"+p.toString(),{signal:E.signal});if(!l.ok){f.innerHTML=`<div class="panel-empty" style="color: var(--bad-fg);">Failed: HTTP ${l.status}</div>`,H.style.display="none",S.textContent="";return}const m=await l.json();if(!m.success){f.innerHTML=`<div class="panel-empty" style="color: var(--bad-fg);">Failed: ${escapeHtml(m.error||"unknown")}</div>`,H.style.display="none",S.textContent="";return}if(!b&&s!==O)return;const c=Array.isArray(m.logs)?m.logs:[];if(c.length===0&&!b){const e=m.filters&&(m.filters.level||m.filters.context||m.filters.search||m.filters.since||m.filters.until)?"No error log entries match your filters.":"\u2705 No errors logged! Everything is working smoothly.";f.innerHTML=`<div class="panel-empty"><span class="empty-icon">\u{1F4CB}</span>${escapeHtml(e)}</div>`,H.style.display="none",S.textContent=m.total?`${m.total} total`:"";return}let t="";b||(t='<table style="width: 100%; border-collapse: collapse; font-size: 0.82rem;">',t+='<tr style="border-bottom: 1px solid var(--border); color: var(--muted);">',t+='<th style="padding: 6px; text-align: left; width: 160px;">When</th>',t+='<th style="padding: 6px; text-align: left; width: 80px;">Level</th>',t+='<th style="padding: 6px; text-align: left; width: 140px;">Context</th>',t+='<th style="padding: 6px; text-align: left;">Message</th>',t+='<th style="padding: 6px; text-align: left; width: 110px;">IP</th>',t+="</tr>");for(const e of c){const a=(e.level||"?").toUpperCase(),o=a==="ERR"?"var(--bad-fg)":a==="WARN"?"var(--warn-fg, #f0c674)":"var(--muted)",i=e.timestamp?new Date(e.timestamp).toLocaleString():"\u2014",n=e.context||"\u2014",r=(e.error||"").split(`
|
||||
`)[0],d=e.request&&e.request.ip||"";t+='<tr style="border-bottom: 1px solid var(--border); cursor: pointer;" class="error-log-row">',t+=`<td style="padding: 6px; color: var(--muted);" title="${escapeHtml(e.timestamp||"")}">${escapeHtml(i)}</td>`,t+=`<td style="padding: 6px;"><span style="color: ${o}; font-weight: 600;">${escapeHtml(a)}</span></td>`,t+=`<td style="padding: 6px; font-family: monospace; font-size: 0.78rem;">${escapeHtml(n)}</td>`,t+=`<td style="padding: 6px;">${escapeHtml(r)}</td>`,t+=`<td style="padding: 6px; font-family: monospace; font-size: 0.78rem;">${escapeHtml(d)}</td>`,t+="</tr>",e.detail&&(t+=`<tr class="error-log-detail" style="display: none;"><td colspan="5" style="padding: 6px 6px 10px; font-size: 0.78rem; color: var(--muted);"><pre style="margin: 0; white-space: pre-wrap; font-family: monospace; max-height: 320px; overflow: auto;">${escapeHtml(e.detail)}</pre></td></tr>`)}if(!b)t+="</table>",f.innerHTML=t;else{const e=f.querySelector("table");e&&e.insertAdjacentHTML("beforeend",t)}w+=c.length,H.style.display=m.hasMore?"":"none",S.textContent=`${m.total} total${m.hasMore?" (showing "+w+")":""}`,f.querySelectorAll(".error-log-row").forEach(e=>{e.dataset.wired||(e.dataset.wired="true",e.addEventListener("click",()=>{const a=e.nextElementSibling;a&&a.classList.contains("error-log-detail")&&(a.style.display=a.style.display==="none"?"":"none")}))})}catch(s){if(s&&s.name==="AbortError")return;f.innerHTML=`<div class="panel-empty" style="color: var(--bad-fg);">Failed: ${escapeHtml(s.message)}</div>`,S.textContent=""}}async function v(){if(confirm("Clear the entire error log? This cannot be undone."))try{const s=await(await secureFetch("/api/v1/error-logs",{method:"DELETE",headers:{"content-type":"application/json"},body:JSON.stringify({confirm:"CLEAR"})})).json();s.success?(await N(),u(!1),showNotification("\u2705 Error logs cleared","success",3e3)):showNotification("\u274C "+(s.error||"Clear failed"),"error",4e3)}catch(b){showNotification("\u274C "+b.message,"error",4e3)}}let x;function g(){P?.addEventListener("change",()=>u(!1)),M?.addEventListener("change",()=>u(!1)),D?.addEventListener("input",()=>{clearTimeout(x),x=setTimeout(()=>u(!1),250)});let b;[h,T].forEach(s=>{s?.addEventListener("change",()=>{clearTimeout(b),b=setTimeout(()=>u(!1),250)})}),A?.addEventListener("click",()=>u(!1)),H?.addEventListener("click",()=>u(!0)),I?.addEventListener("click",v),wireModal(k,z)}B?.addEventListener("click",async()=>{k?.classList.add("show"),await N(),u(!1)}),g()})(),(function(){injectModal("container-logs-modal",`<div id="container-logs-modal" class="weather-modal" style="z-index: 1001;">
|
||||
<div class="weather-modal-content" style="min-width: 900px; max-width: 95vw; height: 80vh; display: flex; flex-direction: column;">
|
||||
<div class="logs-header" style="display: flex; justify-content: space-between; align-items: center; padding-bottom: 12px; border-bottom: 1px solid var(--border); margin-bottom: 12px;">
|
||||
<div>
|
||||
@@ -648,14 +648,14 @@ Try refreshing in a moment if you see a certificate error.`,"warning",1e4),!1}};
|
||||
<button id="cl-close-btn" class="btn-secondary">Close</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>`);const k=document.getElementById("container-logs-modal"),B=document.getElementById("cl-container-select"),A=document.getElementById("cl-log-content"),I=document.getElementById("cl-log-search"),z=document.getElementById("cl-log-tail"),P=document.getElementById("cl-refresh"),M=document.getElementById("cl-stream"),D=document.getElementById("cl-download"),b=document.getElementById("cl-clear-search"),T=document.getElementById("cl-close"),h=document.getElementById("cl-close-btn"),H=document.getElementById("cl-stream-status"),S=document.getElementById("cl-stream-indicator"),$=document.getElementById("cl-stream-text"),f=document.getElementById("cl-line-count"),E=document.getElementById("cl-filter-count"),O=document.getElementById("cl-image"),L=document.getElementById("cl-status"),j=document.getElementById("cl-created");let N=null,R=[],u=[],v=null,w=!1,g=null;function x(r){if(!r)return"-";const d=new Date(r);return isNaN(d.getTime())?r:d.toLocaleString()}function s(r){if(!r)return"";const d=document.createElement("div");return d.textContent=r,d.innerHTML}function p(r,d){const y=r.stream==="stderr"?"log-stderr":"log-stdout",C=r.stream==="stderr"?"\u26A0\uFE0F":"\u{1F4E4}";return`
|
||||
</div>`);const k=document.getElementById("container-logs-modal"),B=document.getElementById("cl-container-select"),A=document.getElementById("cl-log-content"),I=document.getElementById("cl-log-search"),z=document.getElementById("cl-log-tail"),P=document.getElementById("cl-refresh"),M=document.getElementById("cl-stream"),D=document.getElementById("cl-download"),h=document.getElementById("cl-clear-search"),T=document.getElementById("cl-close"),f=document.getElementById("cl-close-btn"),H=document.getElementById("cl-stream-status"),S=document.getElementById("cl-stream-indicator"),$=document.getElementById("cl-stream-text"),w=document.getElementById("cl-line-count"),E=document.getElementById("cl-filter-count"),O=document.getElementById("cl-image"),C=document.getElementById("cl-status"),j=document.getElementById("cl-created");let N=null,R=[],u=[],v=null,x=!1,g=null;function b(r){if(!r)return"-";const d=new Date(r);return isNaN(d.getTime())?r:d.toLocaleString()}function s(r){if(!r)return"";const d=document.createElement("div");return d.textContent=r,d.innerHTML}function p(r,d){const y=r.stream==="stderr"?"log-stderr":"log-stdout",L=r.stream==="stderr"?"\u26A0\uFE0F":"\u{1F4E4}";return`
|
||||
<div class="log-entry ${y}" data-index="${d}" style="padding: 4px 8px; border-bottom: 1px solid #333; display: flex; gap: 8px;">
|
||||
<span class="log-line-num" style="color: #666; min-width: 40px; text-align: right; user-select: none;">${d+1}</span>
|
||||
<span class="log-stream-icon" style="color: ${r.stream==="stderr"?"#f59e0b":"#22c55e"};">${C}</span>
|
||||
<span class="log-stream-icon" style="color: ${r.stream==="stderr"?"#f59e0b":"#22c55e"};">${L}</span>
|
||||
<span class="log-text" style="flex: 1; white-space: pre-wrap; word-break: break-all; color: #e5e5e5;">${s(r.text)}</span>
|
||||
</div>
|
||||
`}function l(r,d=""){if(!r||r.length===0){A.innerHTML='<div class="logs-loading" style="color: var(--muted); text-align: center; padding: 40px;">No logs available</div>',f.textContent="0 lines",E.textContent="0 filtered";return}if(R=r,u=d?r.filter(y=>y.text&&y.text.toLowerCase().includes(d.toLowerCase())):r,f.textContent=`${r.length} lines`,E.textContent=d?`${u.length} of ${r.length} shown`:`${r.length} shown`,u.length===0){A.innerHTML=`<div class="logs-loading" style="color: var(--muted); text-align: center; padding: 40px;">No logs match "${s(d)}"</div>`;return}A.innerHTML=u.map((y,C)=>p(y,C)).join(""),A.scrollTop=A.scrollHeight}async function m(){try{const d=(await getJSON("/api/v1/logs/containers")).containers||[],y=B.value;B.innerHTML='<option value="">Select a container...</option>',d.forEach(C=>{const U=document.createElement("option");U.value=C.id,U.textContent=`${C.name} (${C.image.split(":")[0]}) - ${C.status}`,U.dataset.name=C.name,U.dataset.image=C.image,U.dataset.status=C.status,U.dataset.created=C.created,B.appendChild(U)}),y&&B.querySelector(`option[value="${y}"]`)&&(B.value=y,c(y))}catch(r){console.error("Failed to load containers:",r)}}function c(r){const d=B.querySelector(`option[value="${r}"]`);d&&(O.textContent=d.dataset.image||"-",L.textContent=d.dataset.status||"-",L.style.color=d.dataset.status==="running"?"var(--ok-fg, #4ade80)":"var(--bad-fg, #ef4444)",j.textContent=x(d.dataset.created))}async function t(){const r=B.value;if(!r){A.innerHTML='<div class="logs-loading" style="color: var(--muted); text-align: center; padding: 40px;">Select a container to view logs</div>';return}a(),N=r,c(r);const d=z.value,y=I.value.trim();A.innerHTML='<div class="logs-loading" style="color: var(--muted); text-align: center; padding: 40px;">Loading logs...</div>';try{const C=`/api/v1/logs/container/${r}${d!=="all"?`?tail=${d}`:""}`,U=await getJSON(C);U.logs&&U.logs.length>0?l(U.logs,y):(A.innerHTML='<div class="logs-loading" style="color: var(--muted); text-align: center; padding: 40px;">No logs found for this container</div>',f.textContent="0 lines",E.textContent="0 filtered")}catch(C){A.innerHTML=`<div class="logs-loading" style="color: var(--bad-fg, #ef4444); text-align: center; padding: 40px;">Error loading logs: ${s(C.message)}</div>`}}function e(){const r=B.value;if(!r)return;a(),w=!0,M.textContent="\u23F9 Stop",H.style.display="flex",S.textContent="\u{1F7E2}",$.textContent="Connecting...";const d=`/api/v1/logs/stream/${r}`;v=new EventSource(d),v.onopen=()=>{S.textContent="\u{1F7E2}",$.textContent="Connected - streaming logs"},v.onmessage=y=>{try{const C=JSON.parse(y.data);if(C.error){S.textContent="\u{1F534}",$.textContent=`Error: ${C.error}`;return}R.push(C),u.push(C),f.textContent=`${R.length} lines`,E.textContent=`${u.length} shown`;const U=I.value.trim();if(!U||C.text&&C.text.toLowerCase().includes(U.toLowerCase())){const q=document.createElement("div");q.innerHTML=p(C,u.length-1);const F=q.firstElementChild;F.style.background="#1a3a1a",A.appendChild(F),A.scrollTop=A.scrollHeight}}catch(C){console.error("Error parsing log:",C)}},v.onerror=()=>{S.textContent="\u{1F534}",$.textContent="Disconnected",w=!1,M.textContent="\u25B6 Stream"},k._eventSource=v}function a(){v&&(v.close(),v=null),k._eventSource&&(k._eventSource.close(),k._eventSource=null),w=!1,M.textContent="\u25B6 Stream",H.style.display="none"}function o(){if(!R||R.length===0){showNotification("No logs to download","error");return}const r=B.querySelector(`option[value="${N}"]`)?.dataset.name||N,d=new Date().toISOString().replace(/[:.]/g,"-"),y=`${r}-logs-${d}.txt`,C=R.map(_=>{const J=_.timestamp||"",X=_.stream==="stderr"?"[ERR]":"[OUT]";return`${J?J+" ":""}${X} ${_.text}`}).join(`
|
||||
`),U=new Blob([C],{type:"text/plain"}),q=URL.createObjectURL(U),F=document.createElement("a");F.href=q,F.download=y,document.body.appendChild(F),F.click(),document.body.removeChild(F),URL.revokeObjectURL(q),showNotification(`Downloaded ${R.length} log lines`,"success")}B?.addEventListener("change",()=>{t()}),z?.addEventListener("change",()=>{t()}),P?.addEventListener("click",()=>{t()}),M?.addEventListener("click",()=>{w?a():e()}),D?.addEventListener("click",()=>{o()}),b?.addEventListener("click",()=>{I.value="",l(R,"")}),I?.addEventListener("input",()=>{clearTimeout(g),g=setTimeout(()=>{l(R,I.value.trim())},300)}),I?.addEventListener("keydown",r=>{r.key==="Escape"&&(I.value="",l(R,""))}),document.getElementById("view-container-logs")?.addEventListener("click",()=>{k.classList.add("show"),m()});function n(){a(),k.classList.remove("show")}T?.addEventListener("click",n),h?.addEventListener("click",n),document.addEventListener("keydown",r=>{r.key==="Escape"&&k.classList.contains("show")&&n()}),k.addEventListener("click",r=>{r.target===k&&n()}),window.openContainerLogsModal=function(r,d){k.classList.add("show"),m().then(()=>{const y=Array.from(B.options).find(C=>C.value===r||C.dataset.name===d);y?(B.value=y.value,c(y.value),t()):r?(N=r,O.textContent=d||r,L.textContent="-",j.textContent="-",t()):A.innerHTML='<div class="logs-loading" style="color: var(--muted); text-align: center; padding: 40px;">Select a container to view logs</div>'})}})(),(function(){"use strict";const k=[{unit:"caddy",label:"Caddy (reverse proxy)"},{unit:"dashcaddy-api",label:"DashCaddy API (host systemd unit, not this container)"},{unit:"docker",label:"Docker daemon"},{unit:"ssh",label:"SSH server"},{unit:"systemd-journald",label:"systemd-journald"},{unit:"tailscaled",label:"Tailscale"},{unit:"networkd-dispatcher",label:"Networkd dispatcher"}];injectModal("journald-modal",`
|
||||
`}function l(r,d=""){if(!r||r.length===0){A.innerHTML='<div class="logs-loading" style="color: var(--muted); text-align: center; padding: 40px;">No logs available</div>',w.textContent="0 lines",E.textContent="0 filtered";return}if(R=r,u=d?r.filter(y=>y.text&&y.text.toLowerCase().includes(d.toLowerCase())):r,w.textContent=`${r.length} lines`,E.textContent=d?`${u.length} of ${r.length} shown`:`${r.length} shown`,u.length===0){A.innerHTML=`<div class="logs-loading" style="color: var(--muted); text-align: center; padding: 40px;">No logs match "${s(d)}"</div>`;return}A.innerHTML=u.map((y,L)=>p(y,L)).join(""),A.scrollTop=A.scrollHeight}async function m(){try{const d=(await getJSON("/api/v1/logs/containers")).containers||[],y=B.value;B.innerHTML='<option value="">Select a container...</option>',d.forEach(L=>{const U=document.createElement("option");U.value=L.id,U.textContent=`${L.name} (${L.image.split(":")[0]}) - ${L.status}`,U.dataset.name=L.name,U.dataset.image=L.image,U.dataset.status=L.status,U.dataset.created=L.created,B.appendChild(U)}),y&&B.querySelector(`option[value="${y}"]`)&&(B.value=y,c(y))}catch(r){console.error("Failed to load containers:",r)}}function c(r){const d=B.querySelector(`option[value="${r}"]`);d&&(O.textContent=d.dataset.image||"-",C.textContent=d.dataset.status||"-",C.style.color=d.dataset.status==="running"?"var(--ok-fg, #4ade80)":"var(--bad-fg, #ef4444)",j.textContent=b(d.dataset.created))}async function t(){const r=B.value;if(!r){A.innerHTML='<div class="logs-loading" style="color: var(--muted); text-align: center; padding: 40px;">Select a container to view logs</div>';return}a(),N=r,c(r);const d=z.value,y=I.value.trim();A.innerHTML='<div class="logs-loading" style="color: var(--muted); text-align: center; padding: 40px;">Loading logs...</div>';try{const L=`/api/v1/logs/container/${r}${d!=="all"?`?tail=${d}`:""}`,U=await getJSON(L);U.logs&&U.logs.length>0?l(U.logs,y):(A.innerHTML='<div class="logs-loading" style="color: var(--muted); text-align: center; padding: 40px;">No logs found for this container</div>',w.textContent="0 lines",E.textContent="0 filtered")}catch(L){A.innerHTML=`<div class="logs-loading" style="color: var(--bad-fg, #ef4444); text-align: center; padding: 40px;">Error loading logs: ${s(L.message)}</div>`}}function e(){const r=B.value;if(!r)return;a(),x=!0,M.textContent="\u23F9 Stop",H.style.display="flex",S.textContent="\u{1F7E2}",$.textContent="Connecting...";const d=`/api/v1/logs/stream/${r}`;v=new EventSource(d),v.onopen=()=>{S.textContent="\u{1F7E2}",$.textContent="Connected - streaming logs"},v.onmessage=y=>{try{const L=JSON.parse(y.data);if(L.error){S.textContent="\u{1F534}",$.textContent=`Error: ${L.error}`;return}R.push(L),u.push(L),w.textContent=`${R.length} lines`,E.textContent=`${u.length} shown`;const U=I.value.trim();if(!U||L.text&&L.text.toLowerCase().includes(U.toLowerCase())){const q=document.createElement("div");q.innerHTML=p(L,u.length-1);const F=q.firstElementChild;F.style.background="#1a3a1a",A.appendChild(F),A.scrollTop=A.scrollHeight}}catch(L){console.error("Error parsing log:",L)}},v.onerror=()=>{S.textContent="\u{1F534}",$.textContent="Disconnected",x=!1,M.textContent="\u25B6 Stream"},k._eventSource=v}function a(){v&&(v.close(),v=null),k._eventSource&&(k._eventSource.close(),k._eventSource=null),x=!1,M.textContent="\u25B6 Stream",H.style.display="none"}function o(){if(!R||R.length===0){showNotification("No logs to download","error");return}const r=B.querySelector(`option[value="${N}"]`)?.dataset.name||N,d=new Date().toISOString().replace(/[:.]/g,"-"),y=`${r}-logs-${d}.txt`,L=R.map(_=>{const J=_.timestamp||"",X=_.stream==="stderr"?"[ERR]":"[OUT]";return`${J?J+" ":""}${X} ${_.text}`}).join(`
|
||||
`),U=new Blob([L],{type:"text/plain"}),q=URL.createObjectURL(U),F=document.createElement("a");F.href=q,F.download=y,document.body.appendChild(F),F.click(),document.body.removeChild(F),URL.revokeObjectURL(q),showNotification(`Downloaded ${R.length} log lines`,"success")}B?.addEventListener("change",()=>{t()}),z?.addEventListener("change",()=>{t()}),P?.addEventListener("click",()=>{t()}),M?.addEventListener("click",()=>{x?a():e()}),D?.addEventListener("click",()=>{o()}),h?.addEventListener("click",()=>{I.value="",l(R,"")}),I?.addEventListener("input",()=>{clearTimeout(g),g=setTimeout(()=>{l(R,I.value.trim())},300)}),I?.addEventListener("keydown",r=>{r.key==="Escape"&&(I.value="",l(R,""))}),document.getElementById("view-container-logs")?.addEventListener("click",()=>{k.classList.add("show"),m()});function n(){a(),k.classList.remove("show")}T?.addEventListener("click",n),f?.addEventListener("click",n),document.addEventListener("keydown",r=>{r.key==="Escape"&&k.classList.contains("show")&&n()}),k.addEventListener("click",r=>{r.target===k&&n()}),window.openContainerLogsModal=function(r,d){k.classList.add("show"),m().then(()=>{const y=Array.from(B.options).find(L=>L.value===r||L.dataset.name===d);y?(B.value=y.value,c(y.value),t()):r?(N=r,O.textContent=d||r,C.textContent="-",j.textContent="-",t()):A.innerHTML='<div class="logs-loading" style="color: var(--muted); text-align: center; padding: 40px;">Select a container to view logs</div>'})}})(),(function(){"use strict";const k=[{unit:"caddy",label:"Caddy (reverse proxy)"},{unit:"dashcaddy-api",label:"DashCaddy API (host systemd unit, not this container)"},{unit:"docker",label:"Docker daemon"},{unit:"ssh",label:"SSH server"},{unit:"systemd-journald",label:"systemd-journald"},{unit:"tailscaled",label:"Tailscale"},{unit:"networkd-dispatcher",label:"Networkd dispatcher"}];injectModal("journald-modal",`
|
||||
<div id="journald-modal" class="weather-modal" style="z-index: 1002;">
|
||||
<div class="weather-modal-content" style="min-width: 900px; max-width: 95vw; height: 80vh; display: flex; flex-direction: column;">
|
||||
<div class="logs-header" style="display: flex; justify-content: space-between; align-items: center; padding-bottom: 12px; border-bottom: 1px solid var(--border); margin-bottom: 12px;">
|
||||
@@ -698,7 +698,7 @@ Try refreshing in a moment if you see a certificate error.`,"warning",1e4),!1}};
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
`);const B=document.getElementById("journald-modal"),A=document.getElementById("jd-unit-select"),I=document.getElementById("jd-search"),z=document.getElementById("jd-tail"),P=document.getElementById("jd-refresh"),M=document.getElementById("jd-stream"),D=document.getElementById("jd-clear-search"),b=document.getElementById("jd-close"),T=document.getElementById("jd-close-btn"),h=document.getElementById("jd-content"),H=document.getElementById("jd-line-count"),S=document.getElementById("jd-filter-count"),$=document.getElementById("jd-overflow"),f=document.getElementById("jd-unit-display"),E=document.getElementById("jd-stream-state");let O=!1,L=[],j=!1,N=null,R=null;function u(c){const t=document.createElement("div");return t.textContent=String(c),t.innerHTML}function v(c){O=c,A.innerHTML="",k.forEach(t=>{const e=document.createElement("option");e.value=t.unit,e.textContent=t.label+" ("+t.unit+")",A.appendChild(e)}),A.disabled=!c,c?(P.disabled=!1,M.disabled=!1):(h.innerHTML='<div class="logs-loading" style="color: var(--muted); text-align: center; padding: 40px;">journald bind-mount not available in this container.<br/><small>Requires <code>/var/log/journal</code> + <code>/usr/bin/journalctl</code> mounted (start.sh).</small></div>',P.disabled=!0,M.disabled=!0)}async function w(){try{const c=await fetch("/api/v1/logs/journal/units");if(!c.ok){v(!1);return}const t=await c.json();v(!!t.available)}catch{v(!1)}}function g(){const c=(I.value||"").trim().toLowerCase(),t=c?L.filter(e=>(e.textContent||"").toLowerCase().includes(c)):L;if(t.length===0)h.innerHTML='<div class="logs-loading" style="color: var(--muted); text-align: center; padding: 40px;">No entries'+(c?` matching "${u(c)}"`:"")+"</div>";else{const e=t.map(o=>{const i=o.timestamp?u(o.timestamp):"\u2014",n=u(o.textContent);return`<div class="jd-line" style="padding: 1px 0; line-height: 1.4; color: #d4d4d4;"><span style="color: var(--muted); margin-right: 8px;">${i}</span>${n}</div>`}).join("");h.innerHTML=e,h.scrollHeight-h.scrollTop-h.clientHeight<80&&(h.scrollTop=h.scrollHeight)}H.textContent=`${L.length} entries`,S.textContent=c?`${t.length} of ${L.length} shown`:`${L.length} shown`}async function x(){if(!O)return;p();const c=A.value;if(!c)return;const t=Math.max(1,Math.min(5e3,Number(z.value)||200)),e=(I.value||"").trim();h.innerHTML='<div class="logs-loading" style="color: var(--muted); text-align: center; padding: 40px;">Loading\u2026</div>';try{const a=new URL("/api/v1/logs/journal",window.location.origin);a.searchParams.set("unit",c),a.searchParams.set("tail",String(t)),e&&a.searchParams.set("search",e);const o=await fetch(a.toString()),i=await o.json();if(!o.ok||!i.success){h.innerHTML='<div class="logs-loading" style="color: var(--bad-fg, #ef4444); text-align: center; padding: 40px;">Failed: '+u(i&&i.error||"HTTP "+o.status)+"</div>";return}f.textContent=c,L=(i.entries||[]).map(n=>({timestamp:n.timestamp,unit:n.unit,textContent:n.text||""})),$.style.display="none",g()}catch(a){h.innerHTML='<div class="logs-loading" style="color: var(--bad-fg, #ef4444); text-align: center; padding: 40px;">Error: '+u(a.message)+"</div>"}}function s(){if(!O)return;p();const c=A.value;if(!c)return;const t=(I.value||"").trim();f.textContent=c,M.textContent="\u23F8 Stop",M.classList.add("streaming"),E.textContent="streaming",E.style.color="var(--ok-fg, #4ade80)",L=[],g(),$.style.display="none";const e=new URL("/api/v1/logs/journal/stream",window.location.origin);e.searchParams.set("unit",c),t&&e.searchParams.set("search",t),N=new EventSource(e.toString()),N.onmessage=a=>{try{const o=JSON.parse(a.data);if(o.error){/stream (exceeded|line cap)/.test(o.error)&&($.style.display="",p()),h.innerHTML+='<div class="jd-line" style="color: var(--bad-fg, #ef4444); padding: 4px 0;">\u26A0 '+u(o.error)+"</div>",h.scrollTop=h.scrollHeight;return}L.push({timestamp:o.timestamp,unit:o.unit||c,textContent:o.text||""}),L.length>5e3&&(L=L.slice(L.length-5e3),$.style.display=""),g()}catch{}},N.onerror=()=>{},j=!0}function p(){if(j=!1,N){try{N.close()}catch{}N=null}M.textContent="\u25B6 Stream",M.classList.remove("streaming"),E.textContent="disconnected",E.style.color="var(--muted)"}function l(){p(),B.classList.remove("show")}P.addEventListener("click",x),M.addEventListener("click",()=>j?p():s()),D.addEventListener("click",()=>{I.value="",g()}),I.addEventListener("input",()=>{clearTimeout(R),R=setTimeout(g,200)}),I.addEventListener("keydown",c=>{c.key==="Escape"&&(I.value="",g())}),b.addEventListener("click",l),T.addEventListener("click",l),B.addEventListener("click",c=>{c.target===B&&l()}),document.addEventListener("keydown",c=>{c.key==="Escape"&&B.classList.contains("show")&&l()}),A.addEventListener("change",()=>{L.length>0&&x()});function m(){B.classList.add("show"),w()}window.openJournaldModal=m,document.getElementById("view-journald-logs")?.addEventListener("click",m)})(),(function(){injectModal("snapshot-modal",`<div id="snapshot-modal" class="weather-modal">
|
||||
`);const B=document.getElementById("journald-modal"),A=document.getElementById("jd-unit-select"),I=document.getElementById("jd-search"),z=document.getElementById("jd-tail"),P=document.getElementById("jd-refresh"),M=document.getElementById("jd-stream"),D=document.getElementById("jd-clear-search"),h=document.getElementById("jd-close"),T=document.getElementById("jd-close-btn"),f=document.getElementById("jd-content"),H=document.getElementById("jd-line-count"),S=document.getElementById("jd-filter-count"),$=document.getElementById("jd-overflow"),w=document.getElementById("jd-unit-display"),E=document.getElementById("jd-stream-state");let O=!1,C=[],j=!1,N=null,R=null;function u(c){const t=document.createElement("div");return t.textContent=String(c),t.innerHTML}function v(c){O=c,A.innerHTML="",k.forEach(t=>{const e=document.createElement("option");e.value=t.unit,e.textContent=t.label+" ("+t.unit+")",A.appendChild(e)}),A.disabled=!c,c?(P.disabled=!1,M.disabled=!1):(f.innerHTML='<div class="logs-loading" style="color: var(--muted); text-align: center; padding: 40px;">journald bind-mount not available in this container.<br/><small>Requires <code>/var/log/journal</code> + <code>/usr/bin/journalctl</code> mounted (start.sh).</small></div>',P.disabled=!0,M.disabled=!0)}async function x(){try{const c=await fetch("/api/v1/logs/journal/units");if(!c.ok){v(!1);return}const t=await c.json();v(!!t.available)}catch{v(!1)}}function g(){const c=(I.value||"").trim().toLowerCase(),t=c?C.filter(e=>(e.textContent||"").toLowerCase().includes(c)):C;if(t.length===0)f.innerHTML='<div class="logs-loading" style="color: var(--muted); text-align: center; padding: 40px;">No entries'+(c?` matching "${u(c)}"`:"")+"</div>";else{const e=t.map(o=>{const i=o.timestamp?u(o.timestamp):"\u2014",n=u(o.textContent);return`<div class="jd-line" style="padding: 1px 0; line-height: 1.4; color: #d4d4d4;"><span style="color: var(--muted); margin-right: 8px;">${i}</span>${n}</div>`}).join("");f.innerHTML=e,f.scrollHeight-f.scrollTop-f.clientHeight<80&&(f.scrollTop=f.scrollHeight)}H.textContent=`${C.length} entries`,S.textContent=c?`${t.length} of ${C.length} shown`:`${C.length} shown`}async function b(){if(!O)return;p();const c=A.value;if(!c)return;const t=Math.max(1,Math.min(5e3,Number(z.value)||200)),e=(I.value||"").trim();f.innerHTML='<div class="logs-loading" style="color: var(--muted); text-align: center; padding: 40px;">Loading\u2026</div>';try{const a=new URL("/api/v1/logs/journal",window.location.origin);a.searchParams.set("unit",c),a.searchParams.set("tail",String(t)),e&&a.searchParams.set("search",e);const o=await fetch(a.toString()),i=await o.json();if(!o.ok||!i.success){f.innerHTML='<div class="logs-loading" style="color: var(--bad-fg, #ef4444); text-align: center; padding: 40px;">Failed: '+u(i&&i.error||"HTTP "+o.status)+"</div>";return}w.textContent=c,C=(i.entries||[]).map(n=>({timestamp:n.timestamp,unit:n.unit,textContent:n.text||""})),$.style.display="none",g()}catch(a){f.innerHTML='<div class="logs-loading" style="color: var(--bad-fg, #ef4444); text-align: center; padding: 40px;">Error: '+u(a.message)+"</div>"}}function s(){if(!O)return;p();const c=A.value;if(!c)return;const t=(I.value||"").trim();w.textContent=c,M.textContent="\u23F8 Stop",M.classList.add("streaming"),E.textContent="streaming",E.style.color="var(--ok-fg, #4ade80)",C=[],g(),$.style.display="none";const e=new URL("/api/v1/logs/journal/stream",window.location.origin);e.searchParams.set("unit",c),t&&e.searchParams.set("search",t),N=new EventSource(e.toString()),N.onmessage=a=>{try{const o=JSON.parse(a.data);if(o.error){/stream (exceeded|line cap)/.test(o.error)&&($.style.display="",p()),f.innerHTML+='<div class="jd-line" style="color: var(--bad-fg, #ef4444); padding: 4px 0;">\u26A0 '+u(o.error)+"</div>",f.scrollTop=f.scrollHeight;return}C.push({timestamp:o.timestamp,unit:o.unit||c,textContent:o.text||""}),C.length>5e3&&(C=C.slice(C.length-5e3),$.style.display=""),g()}catch{}},N.onerror=()=>{},j=!0}function p(){if(j=!1,N){try{N.close()}catch{}N=null}M.textContent="\u25B6 Stream",M.classList.remove("streaming"),E.textContent="disconnected",E.style.color="var(--muted)"}function l(){p(),B.classList.remove("show")}P.addEventListener("click",b),M.addEventListener("click",()=>j?p():s()),D.addEventListener("click",()=>{I.value="",g()}),I.addEventListener("input",()=>{clearTimeout(R),R=setTimeout(g,200)}),I.addEventListener("keydown",c=>{c.key==="Escape"&&(I.value="",g())}),h.addEventListener("click",l),T.addEventListener("click",l),B.addEventListener("click",c=>{c.target===B&&l()}),document.addEventListener("keydown",c=>{c.key==="Escape"&&B.classList.contains("show")&&l()}),A.addEventListener("change",()=>{C.length>0&&b()});function m(){B.classList.add("show"),x()}window.openJournaldModal=m,document.getElementById("view-journald-logs")?.addEventListener("click",m)})(),(function(){injectModal("snapshot-modal",`<div id="snapshot-modal" class="weather-modal">
|
||||
<div class="weather-modal-content" style="min-width: 700px; max-width: 850px;">
|
||||
<h3>\u{1F4BE} Container Snapshots</h3>
|
||||
<p class="modal-subtitle">
|
||||
@@ -752,7 +752,7 @@ Try refreshing in a moment if you see a certificate error.`,"warning",1e4),!1}};
|
||||
<button id="snapshot-close">Close</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>`);const k=document.getElementById("snapshot-modal"),B=document.getElementById("snapshot-btn"),A=document.getElementById("snapshot-close"),I=document.getElementById("snapshot-container-select"),z=document.getElementById("snapshot-details"),P=document.getElementById("snapshot-create-btn"),M=document.getElementById("snapshot-create-status");let D=null;async function b(){try{const f=await(await fetch("/api/v1/containers")).json();if(!f.success||!f.containers)return;I.innerHTML='<option value="">-- Select a container --</option>';for(const E of f.containers){const O=document.createElement("option");O.value=E.id,O.textContent=`${E.name||E.id} (${E.image||"unknown"})`,O.dataset.name=E.name,O.dataset.image=E.image,O.dataset.status=E.status,O.dataset.created=E.created,I.appendChild(O)}}catch($){console.error("Failed to load containers:",$)}}function T($){if(!$||!$.value){z.style.display="none",D=null;return}D=$.value,document.getElementById("snapshot-image").textContent=$.dataset.image||"-",document.getElementById("snapshot-status").textContent=$.dataset.status||"-",document.getElementById("snapshot-created").textContent=$.dataset.created?new Date($.dataset.created*1e3).toLocaleString():"-",document.getElementById("snapshot-id").textContent=$.value.substring(0,12),z.style.display=""}async function h(){if(!D){M.textContent="Please select a container first",M.style.color="var(--bad-fg)";return}const $=document.getElementById("snapshot-name").value.trim();if(!$){M.textContent="Please enter a snapshot name",M.style.color="var(--bad-fg)";return}const f=document.getElementById("snapshot-leave-running").checked;P.disabled=!0,P.textContent="Creating...",M.textContent="";try{const O=await(await fetch(`/api/v1/containers/${encodeURIComponent(D)}/checkpoint`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({name:$,leaveRunning:f})})).json();O.success?(M.textContent=`\u2713 Snapshot "${$}" created successfully`,M.style.color="var(--ok-fg)",document.getElementById("snapshot-name").value=""):(M.textContent=`\u2717 Failed: ${O.error||"Unknown error"}`,M.style.color="var(--bad-fg)")}catch(E){M.textContent=`\u2717 Error: ${E.message}`,M.style.color="var(--bad-fg)"}finally{P.disabled=!1,P.textContent="\u{1F4BE} Create Snapshot"}}function H(){k.classList.add("show"),b()}function S(){k.classList.remove("show"),z.style.display="none",D=null,I.selectedIndex=0}B?.addEventListener("click",H),A?.addEventListener("click",S),wireModal(k,A),I?.addEventListener("change",$=>{const f=I.options[I.selectedIndex];T(f)}),P?.addEventListener("click",h),k?.querySelectorAll(".panel-tab").forEach($=>{$.addEventListener("click",()=>{k.querySelectorAll(".panel-tab").forEach(f=>f.classList.remove("active")),k.querySelectorAll(".panel-section").forEach(f=>f.classList.remove("active")),$.classList.add("active"),k.querySelector(`#${$.dataset.panel}`).classList.add("active")})})})(),(function(){injectModal("arr-setup-modal",`<div id="arr-setup-modal" class="weather-modal">
|
||||
</div>`);const k=document.getElementById("snapshot-modal"),B=document.getElementById("snapshot-btn"),A=document.getElementById("snapshot-close"),I=document.getElementById("snapshot-container-select"),z=document.getElementById("snapshot-details"),P=document.getElementById("snapshot-create-btn"),M=document.getElementById("snapshot-create-status");let D=null;async function h(){try{const w=await(await fetch("/api/v1/containers")).json();if(!w.success||!w.containers)return;I.innerHTML='<option value="">-- Select a container --</option>';for(const E of w.containers){const O=document.createElement("option");O.value=E.id,O.textContent=`${E.name||E.id} (${E.image||"unknown"})`,O.dataset.name=E.name,O.dataset.image=E.image,O.dataset.status=E.status,O.dataset.created=E.created,I.appendChild(O)}}catch($){console.error("Failed to load containers:",$)}}function T($){if(!$||!$.value){z.style.display="none",D=null;return}D=$.value,document.getElementById("snapshot-image").textContent=$.dataset.image||"-",document.getElementById("snapshot-status").textContent=$.dataset.status||"-",document.getElementById("snapshot-created").textContent=$.dataset.created?new Date($.dataset.created*1e3).toLocaleString():"-",document.getElementById("snapshot-id").textContent=$.value.substring(0,12),z.style.display=""}async function f(){if(!D){M.textContent="Please select a container first",M.style.color="var(--bad-fg)";return}const $=document.getElementById("snapshot-name").value.trim();if(!$){M.textContent="Please enter a snapshot name",M.style.color="var(--bad-fg)";return}const w=document.getElementById("snapshot-leave-running").checked;P.disabled=!0,P.textContent="Creating...",M.textContent="";try{const O=await(await fetch(`/api/v1/containers/${encodeURIComponent(D)}/checkpoint`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({name:$,leaveRunning:w})})).json();O.success?(M.textContent=`\u2713 Snapshot "${$}" created successfully`,M.style.color="var(--ok-fg)",document.getElementById("snapshot-name").value=""):(M.textContent=`\u2717 Failed: ${O.error||"Unknown error"}`,M.style.color="var(--bad-fg)")}catch(E){M.textContent=`\u2717 Error: ${E.message}`,M.style.color="var(--bad-fg)"}finally{P.disabled=!1,P.textContent="\u{1F4BE} Create Snapshot"}}function H(){k.classList.add("show"),h()}function S(){k.classList.remove("show"),z.style.display="none",D=null,I.selectedIndex=0}B?.addEventListener("click",H),A?.addEventListener("click",S),wireModal(k,A),I?.addEventListener("change",$=>{const w=I.options[I.selectedIndex];T(w)}),P?.addEventListener("click",f),k?.querySelectorAll(".panel-tab").forEach($=>{$.addEventListener("click",()=>{k.querySelectorAll(".panel-tab").forEach(w=>w.classList.remove("active")),k.querySelectorAll(".panel-section").forEach(w=>w.classList.remove("active")),$.classList.add("active"),k.querySelector(`#${$.dataset.panel}`).classList.add("active")})})})(),(function(){injectModal("arr-setup-modal",`<div id="arr-setup-modal" class="weather-modal">
|
||||
<div class="weather-modal-content" style="min-width: 600px; max-width: 720px;">
|
||||
<h3>\u{1F3AC} Smart Arr Connect</h3>
|
||||
<p style="color: var(--muted); margin: 0 0 16px; font-size: 0.9rem;">
|
||||
@@ -831,7 +831,7 @@ Try refreshing in a moment if you see a certificate error.`,"warning",1e4),!1}};
|
||||
<button id="arr-setup-cancel">Close</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>`);const k=document.getElementById("arr-setup-modal"),B=document.getElementById("arr-setup-btn"),A=document.getElementById("arr-setup-cancel"),I=document.getElementById("smart-connect-btn"),z=document.getElementById("smart-phase-detect"),P=document.getElementById("smart-phase-credentials"),M=document.getElementById("smart-phase-progress"),D=document.getElementById("smart-phase-results"),b=document.getElementById("smart-detect-results"),T=document.getElementById("smart-credential-inputs"),h=document.getElementById("smart-progress-steps"),H=document.getElementById("smart-results-content"),S=document.getElementById("smart-plex-libraries"),$=document.getElementById("smart-retry-btn");let f=null;const E={plex:"\u{1F3AC}",radarr:"\u{1F3AC}",sonarr:"\u{1F4FA}",prowlarr:"\u{1F50D}",seerr:"\u{1F4CB}"},O={plex:"Plex",radarr:"Radarr (Movies)",sonarr:"Sonarr (TV)",prowlarr:"Prowlarr (Indexers)",seerr:"Seerr"};function L(g){z.style.display=g==="detect"?"block":"none",P.style.display=g==="credentials"?"block":"none",M.style.display=g==="progress"?"block":"none",D.style.display=g==="results"?"block":"none"}function j(g){const x={connected:{bg:"var(--ok-fg)",icon:"✓",text:"Connected"},needs_key:{bg:"#f39c12",icon:"🔑",text:"Needs API Key"},not_found:{bg:"var(--muted)",icon:"—",text:"Not Found"},error:{bg:"var(--bad-fg)",icon:"✗",text:"Error"}},s=x[g]||x.not_found;return`<span style="display: inline-flex; align-items: center; gap: 4px; padding: 2px 8px; border-radius: 4px; font-size: 0.75rem; background: color-mix(in srgb, ${s.bg} 20%, transparent); color: ${s.bg};">${s.icon} ${s.text}</span>`}async function N(){L("detect"),b.style.display="none";try{if(f=await(await fetch("/api/v1/arr/smart-detect")).json(),!f.success){b.innerHTML=`<div style="padding: 12px; color: var(--bad-fg);">Detection failed: ${escapeHtml(f.error)}</div>`,b.style.display="block";return}let x='<div style="display: flex; flex-direction: column; gap: 8px;">';for(const[p,l]of Object.entries(f.services)){const m=E[p]||"\u{1F4E6}",c=O[p]||p,t=l.source?`<span style="font-size: 0.7rem; color: var(--muted); padding: 1px 6px; background: var(--card-bg); border-radius: 3px;">${escapeHtml(l.source)}</span>`:"",e=l.version?`<span style="font-size: 0.7rem; color: var(--muted);">v${escapeHtml(l.version)}</span>`:"",a=(l.hasApiKey||l.hasToken)&&l.status==="connected"?'<span style="font-size: 0.7rem; color: var(--ok-fg);">Key saved</span>':"";x+=`<div style="display: flex; align-items: center; gap: 10px; padding: 10px 12px; background: var(--card-base); border-radius: 8px; border: 1px solid var(--border);">
|
||||
</div>`);const k=document.getElementById("arr-setup-modal"),B=document.getElementById("arr-setup-btn"),A=document.getElementById("arr-setup-cancel"),I=document.getElementById("smart-connect-btn"),z=document.getElementById("smart-phase-detect"),P=document.getElementById("smart-phase-credentials"),M=document.getElementById("smart-phase-progress"),D=document.getElementById("smart-phase-results"),h=document.getElementById("smart-detect-results"),T=document.getElementById("smart-credential-inputs"),f=document.getElementById("smart-progress-steps"),H=document.getElementById("smart-results-content"),S=document.getElementById("smart-plex-libraries"),$=document.getElementById("smart-retry-btn");let w=null;const E={plex:"\u{1F3AC}",radarr:"\u{1F3AC}",sonarr:"\u{1F4FA}",prowlarr:"\u{1F50D}",seerr:"\u{1F4CB}"},O={plex:"Plex",radarr:"Radarr (Movies)",sonarr:"Sonarr (TV)",prowlarr:"Prowlarr (Indexers)",seerr:"Seerr"};function C(g){z.style.display=g==="detect"?"block":"none",P.style.display=g==="credentials"?"block":"none",M.style.display=g==="progress"?"block":"none",D.style.display=g==="results"?"block":"none"}function j(g){const b={connected:{bg:"var(--ok-fg)",icon:"✓",text:"Connected"},needs_key:{bg:"#f39c12",icon:"🔑",text:"Needs API Key"},not_found:{bg:"var(--muted)",icon:"—",text:"Not Found"},error:{bg:"var(--bad-fg)",icon:"✗",text:"Error"}},s=b[g]||b.not_found;return`<span style="display: inline-flex; align-items: center; gap: 4px; padding: 2px 8px; border-radius: 4px; font-size: 0.75rem; background: color-mix(in srgb, ${s.bg} 20%, transparent); color: ${s.bg};">${s.icon} ${s.text}</span>`}async function N(){C("detect"),h.style.display="none";try{if(w=await(await fetch("/api/v1/arr/smart-detect")).json(),!w.success){h.innerHTML=`<div style="padding: 12px; color: var(--bad-fg);">Detection failed: ${escapeHtml(w.error)}</div>`,h.style.display="block";return}let b='<div style="display: flex; flex-direction: column; gap: 8px;">';for(const[p,l]of Object.entries(w.services)){const m=E[p]||"\u{1F4E6}",c=O[p]||p,t=l.source?`<span style="font-size: 0.7rem; color: var(--muted); padding: 1px 6px; background: var(--card-bg); border-radius: 3px;">${escapeHtml(l.source)}</span>`:"",e=l.version?`<span style="font-size: 0.7rem; color: var(--muted);">v${escapeHtml(l.version)}</span>`:"",a=(l.hasApiKey||l.hasToken)&&l.status==="connected"?'<span style="font-size: 0.7rem; color: var(--ok-fg);">Key saved</span>':"";b+=`<div style="display: flex; align-items: center; gap: 10px; padding: 10px 12px; background: var(--card-base); border-radius: 8px; border: 1px solid var(--border);">
|
||||
<span style="font-size: 1.1rem;">${m}</span>
|
||||
<div style="flex: 1;">
|
||||
<div style="font-weight: 500; font-size: 0.9rem;">${c}</div>
|
||||
@@ -840,10 +840,10 @@ Try refreshing in a moment if you see a certificate error.`,"warning",1e4),!1}};
|
||||
</div>
|
||||
</div>
|
||||
${j(l.status)}
|
||||
</div>`}x+="</div>";const s=f.summary;x+=`<div style="margin-top: 12px; padding: 10px; background: color-mix(in srgb, var(--accent) 8%, transparent); border-radius: 8px; font-size: 0.85rem;">
|
||||
</div>`}b+="</div>";const s=w.summary;b+=`<div style="margin-top: 12px; padding: 10px; background: color-mix(in srgb, var(--accent) 8%, transparent); border-radius: 8px; font-size: 0.85rem;">
|
||||
${escapeHtml(String(s.fullyConnected))}/${escapeHtml(String(s.totalDetected+(5-s.totalDetected)))} services detected ·
|
||||
${escapeHtml(String(s.fullyConnected))} connected${s.needsApiKey>0?` · <strong>${escapeHtml(String(s.needsApiKey))} needs API key</strong>`:""}
|
||||
</div>`,b.innerHTML=x,b.style.display="block",R(f),setTimeout(()=>{L("credentials")},800)}catch(g){b.innerHTML=`<div style="padding: 12px; color: var(--bad-fg);">Error: ${escapeHtml(g.message)}</div>`,b.style.display="block"}}function R(g){let x="";const s=g.services,p=["radarr","sonarr","prowlarr"];for(const c of p){const t=s[c];if(!t||t.status==="not_found"&&!t.url)continue;const e=E[c],a=O[c],o=t.status==="connected";x+=`<div style="margin-bottom: 10px; padding: 12px; background: var(--card-base); border-radius: 8px; border: 1px solid ${o?"var(--ok-fg)":"var(--border)"};">
|
||||
</div>`,h.innerHTML=b,h.style.display="block",R(w),setTimeout(()=>{C("credentials")},800)}catch(g){h.innerHTML=`<div style="padding: 12px; color: var(--bad-fg);">Error: ${escapeHtml(g.message)}</div>`,h.style.display="block"}}function R(g){let b="";const s=g.services,p=["radarr","sonarr","prowlarr"];for(const c of p){const t=s[c];if(!t||t.status==="not_found"&&!t.url)continue;const e=E[c],a=O[c],o=t.status==="connected";b+=`<div style="margin-bottom: 10px; padding: 12px; background: var(--card-base); border-radius: 8px; border: 1px solid ${o?"var(--ok-fg)":"var(--border)"};">
|
||||
<div style="display: flex; align-items: center; gap: 8px; margin-bottom: 8px;">
|
||||
<span style="font-size: 1.1rem;">${e}</span>
|
||||
<span style="font-weight: 500;">${a}</span>
|
||||
@@ -864,7 +864,7 @@ Try refreshing in a moment if you see a certificate error.`,"warning",1e4),!1}};
|
||||
</div>
|
||||
</div>
|
||||
<button onclick="smartTestConnection('${c}')" style="margin-top: 8px; padding: 4px 12px; font-size: 0.75rem; cursor: pointer;">Test</button>
|
||||
</div>`}const l=s.plex;if(l){const c=l.status==="connected";x+=`<div style="padding: 10px 12px; background: var(--card-base); border-radius: 8px; border: 1px solid ${c?"var(--ok-fg)":"var(--border)"}; margin-bottom: 10px;">
|
||||
</div>`}const l=s.plex;if(l){const c=l.status==="connected";b+=`<div style="padding: 10px 12px; background: var(--card-base); border-radius: 8px; border: 1px solid ${c?"var(--ok-fg)":"var(--border)"}; margin-bottom: 10px;">
|
||||
<div style="display: flex; align-items: center; gap: 8px;">
|
||||
<span style="font-size: 1.1rem;">\u{1F3AC}</span>
|
||||
<span style="font-weight: 500;">Plex</span>
|
||||
@@ -875,26 +875,26 @@ Try refreshing in a moment if you see a certificate error.`,"warning",1e4),!1}};
|
||||
Configured: ${e.radarr?"✓ Radarr":"✗ Radarr"} ·
|
||||
${e.sonarr?"✓ Sonarr":"✗ Sonarr"} ·
|
||||
${e.plex?"✓ Plex":"✗ Plex"}
|
||||
</div>`}x+=`<div style="padding: 10px 12px; background: var(--card-base); border-radius: 8px; border: 1px solid ${c?"var(--ok-fg)":"var(--border)"};">
|
||||
</div>`}b+=`<div style="padding: 10px 12px; background: var(--card-base); border-radius: 8px; border: 1px solid ${c?"var(--ok-fg)":"var(--border)"};">
|
||||
<div style="display: flex; align-items: center; gap: 8px;">
|
||||
<span style="font-size: 1.1rem;">\u{1F4CB}</span>
|
||||
<span style="font-weight: 500;">Seerr</span>
|
||||
${j(m.status)}
|
||||
</div>
|
||||
${t}
|
||||
</div>`}T.innerHTML=x}window.smartTestConnection=async function(g){const x=document.getElementById(`smart-${g}-url`),s=document.getElementById(`smart-${g}-key`),p=document.getElementById(`smart-${g}-status`),l=x?.value.trim(),m=s?.value.trim();if(!l||!m){p.innerHTML='<span style="color: var(--bad-fg);">Enter URL and API key</span>';return}p.innerHTML='<span class="brand-spinner"></span>';try{const t=await(await secureFetch("/api/v1/arr/test-connection",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({service:g,url:l,apiKey:m})})).json();t.success?p.innerHTML=`<span style="color: var(--ok-fg);">✓ ${escapeHtml(t.appName||"Connected")} v${escapeHtml(t.version||"")}</span>`:p.innerHTML=`<span style="color: var(--bad-fg);">✗ ${escapeHtml(t.error)}</span>`}catch(c){p.innerHTML=`<span style="color: var(--bad-fg);">✗ ${escapeHtml(c.message)}</span>`}};async function u(){L("progress"),h.innerHTML='<div style="text-align: center; padding: 20px;"><span class="brand-spinner"></span><div style="color: var(--muted); margin-top: 8px;">Connecting services...</div></div>';const g={};for(const s of["radarr","sonarr","prowlarr"]){const p=document.getElementById(`smart-${s}-url`)?.value.trim(),l=document.getElementById(`smart-${s}-key`)?.value.trim();l&&p?g[s]={apiKey:l,url:p}:l&&(g[s]={apiKey:l})}const x={services:Object.keys(g).length>0?g:void 0,configurePlex:document.getElementById("smart-opt-plex")?.checked,configureProwlarr:document.getElementById("smart-opt-prowlarr")?.checked,configureSeerr:document.getElementById("smart-opt-seerr")?.checked,saveCredentials:document.getElementById("smart-opt-save")?.checked};try{const p=await(await secureFetch("/api/v1/arr/smart-connect",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(x)})).json();let l="";for(const m of p.steps||[]){const c=m.status==="success"?'<span style="color: var(--ok-fg);">✓</span>':'<span style="color: var(--bad-fg);">✗</span>',t=m.status==="success"?"var(--muted)":"var(--bad-fg)";l+=`<div style="display: flex; align-items: center; gap: 8px; padding: 6px 10px; background: var(--card-base); border-radius: 6px; font-size: 0.85rem;">
|
||||
</div>`}T.innerHTML=b}window.smartTestConnection=async function(g){const b=document.getElementById(`smart-${g}-url`),s=document.getElementById(`smart-${g}-key`),p=document.getElementById(`smart-${g}-status`),l=b?.value.trim(),m=s?.value.trim();if(!l||!m){p.innerHTML='<span style="color: var(--bad-fg);">Enter URL and API key</span>';return}p.innerHTML='<span class="brand-spinner"></span>';try{const t=await(await secureFetch("/api/v1/arr/test-connection",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({service:g,url:l,apiKey:m})})).json();t.success?p.innerHTML=`<span style="color: var(--ok-fg);">✓ ${escapeHtml(t.appName||"Connected")} v${escapeHtml(t.version||"")}</span>`:p.innerHTML=`<span style="color: var(--bad-fg);">✗ ${escapeHtml(t.error)}</span>`}catch(c){p.innerHTML=`<span style="color: var(--bad-fg);">✗ ${escapeHtml(c.message)}</span>`}};async function u(){C("progress"),f.innerHTML='<div style="text-align: center; padding: 20px;"><span class="brand-spinner"></span><div style="color: var(--muted); margin-top: 8px;">Connecting services...</div></div>';const g={};for(const s of["radarr","sonarr","prowlarr"]){const p=document.getElementById(`smart-${s}-url`)?.value.trim(),l=document.getElementById(`smart-${s}-key`)?.value.trim();l&&p?g[s]={apiKey:l,url:p}:l&&(g[s]={apiKey:l})}const b={services:Object.keys(g).length>0?g:void 0,configurePlex:document.getElementById("smart-opt-plex")?.checked,configureProwlarr:document.getElementById("smart-opt-prowlarr")?.checked,configureSeerr:document.getElementById("smart-opt-seerr")?.checked,saveCredentials:document.getElementById("smart-opt-save")?.checked};try{const p=await(await secureFetch("/api/v1/arr/smart-connect",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(b)})).json();let l="";for(const m of p.steps||[]){const c=m.status==="success"?'<span style="color: var(--ok-fg);">✓</span>':'<span style="color: var(--bad-fg);">✗</span>',t=m.status==="success"?"var(--muted)":"var(--bad-fg)";l+=`<div style="display: flex; align-items: center; gap: 8px; padding: 6px 10px; background: var(--card-base); border-radius: 6px; font-size: 0.85rem;">
|
||||
${c}
|
||||
<span>${escapeHtml(m.step)}</span>
|
||||
<span style="margin-left: auto; font-size: 0.75rem; color: ${t};">${escapeHtml(m.details||"")}</span>
|
||||
</div>`}h.innerHTML=l,setTimeout(()=>v(p),500)}catch(s){h.innerHTML=`<div style="padding: 12px; color: var(--bad-fg);">Connection error: ${escapeHtml(s.message)}</div>`}}function v(g){L("results");const x=g.summary||{},s=x.failed===0&&x.succeeded>0,p=s?"var(--ok-fg)":"#f39c12",l=s?"✓":"⚠",m=s?"All Connected!":`${escapeHtml(String(x.succeeded))}/${escapeHtml(String(x.totalSteps))} Steps Succeeded`;let c=`<div style="text-align: center; padding: 16px; background: color-mix(in srgb, ${p} 12%, transparent); border-radius: 10px; border: 1px solid ${p}; margin-bottom: 12px;">
|
||||
</div>`}f.innerHTML=l,setTimeout(()=>v(p),500)}catch(s){f.innerHTML=`<div style="padding: 12px; color: var(--bad-fg);">Connection error: ${escapeHtml(s.message)}</div>`}}function v(g){C("results");const b=g.summary||{},s=b.failed===0&&b.succeeded>0,p=s?"var(--ok-fg)":"#f39c12",l=s?"✓":"⚠",m=s?"All Connected!":`${escapeHtml(String(b.succeeded))}/${escapeHtml(String(b.totalSteps))} Steps Succeeded`;let c=`<div style="text-align: center; padding: 16px; background: color-mix(in srgb, ${p} 12%, transparent); border-radius: 10px; border: 1px solid ${p}; margin-bottom: 12px;">
|
||||
<div style="font-size: 1.5rem; color: ${p};">${l}</div>
|
||||
<div style="font-size: 1.1rem; font-weight: 600; color: ${p};">${m}</div>
|
||||
<div style="font-size: 0.85rem; color: var(--muted); margin-top: 4px;">${escapeHtml(String(x.succeeded))} succeeded, ${escapeHtml(String(x.failed))} failed</div>
|
||||
<div style="font-size: 0.85rem; color: var(--muted); margin-top: 4px;">${escapeHtml(String(b.succeeded))} succeeded, ${escapeHtml(String(b.failed))} failed</div>
|
||||
</div>`;c+='<div style="display: flex; flex-direction: column; gap: 4px;">';for(const t of g.steps||[]){const e=t.status==="success"?'<span style="color: var(--ok-fg);">✓</span>':'<span style="color: var(--bad-fg);">✗</span>';c+=`<div style="display: flex; align-items: center; gap: 8px; padding: 4px 8px; font-size: 0.8rem;">
|
||||
${e} ${escapeHtml(t.step)} <span style="margin-left: auto; color: var(--muted); font-size: 0.75rem;">${escapeHtml(t.details||"")}</span>
|
||||
</div>`}c+="</div>",H.innerHTML=c,$.style.display=x.failed>0?"block":"none",g.steps?.some(t=>t.step.includes("Plex")&&t.status==="success")&&w()}async function w(){try{const x=await(await fetch("/api/v1/plex/libraries")).json();if(x.success&&x.libraries?.length>0){let s=`<div style="padding: 12px; background: var(--card-base); border-radius: 8px; border: 1px solid var(--border);">
|
||||
<h4 style="margin: 0 0 8px; font-size: 0.85rem; color: var(--accent);">\u{1F3AC} ${escapeHtml(x.serverName)} Libraries</h4>
|
||||
<div style="display: flex; flex-wrap: wrap; gap: 8px;">`;for(const p of x.libraries){const l=p.type==="movie"?"\u{1F3AC}":p.type==="show"?"\u{1F4FA}":"\u{1F3B5}";s+=`<div style="padding: 8px 12px; background: var(--card-bg); border-radius: 6px; font-size: 0.85rem;">
|
||||
</div>`}c+="</div>",H.innerHTML=c,$.style.display=b.failed>0?"block":"none",g.steps?.some(t=>t.step.includes("Plex")&&t.status==="success")&&x()}async function x(){try{const b=await(await fetch("/api/v1/plex/libraries")).json();if(b.success&&b.libraries?.length>0){let s=`<div style="padding: 12px; background: var(--card-base); border-radius: 8px; border: 1px solid var(--border);">
|
||||
<h4 style="margin: 0 0 8px; font-size: 0.85rem; color: var(--accent);">\u{1F3AC} ${escapeHtml(b.serverName)} Libraries</h4>
|
||||
<div style="display: flex; flex-wrap: wrap; gap: 8px;">`;for(const p of b.libraries){const l=p.type==="movie"?"\u{1F3AC}":p.type==="show"?"\u{1F4FA}":"\u{1F3B5}";s+=`<div style="padding: 8px 12px; background: var(--card-bg); border-radius: 6px; font-size: 0.85rem;">
|
||||
${l} <strong>${escapeHtml(p.title)}</strong>
|
||||
<span style="color: var(--muted); font-size: 0.75rem;">${escapeHtml(String(p.count))} items</span>
|
||||
</div>`}s+="</div></div>",S.innerHTML=s,S.style.display="block"}}catch{}}B?.addEventListener("click",()=>{k.classList.add("show"),S.style.display="none",N()}),wireModal(k,A),I?.addEventListener("click",u),$?.addEventListener("click",u)})(),(function(){const k=new ErrorHandler;injectModal("notifications-modal",`<div id="notifications-modal" class="weather-modal">
|
||||
@@ -1063,33 +1063,6 @@ Try refreshing in a moment if you see a certificate error.`,"warning",1e4),!1}};
|
||||
<label class="checkbox-label-sm">
|
||||
<input type="checkbox" id="event-deploy-failed" checked /> Deployment Failed
|
||||
</label>
|
||||
<label class="checkbox-label-sm">
|
||||
<input type="checkbox" id="event-ssl-cert-expiry" checked /> SSL Expiry
|
||||
</label>
|
||||
<label class="checkbox-label-sm">
|
||||
<input type="checkbox" id="event-dns-propagation" checked /> DNS Propagation
|
||||
</label>
|
||||
<label class="checkbox-label-sm">
|
||||
<input type="checkbox" id="event-drift-detected" checked /> Config Drift
|
||||
</label>
|
||||
<label class="checkbox-label-sm">
|
||||
<input type="checkbox" id="event-dependency-restart" checked /> Dependency Restarts
|
||||
</label>
|
||||
<label class="checkbox-label-sm">
|
||||
<input type="checkbox" id="event-recipe-removed" checked /> Recipe Removed
|
||||
</label>
|
||||
<label class="checkbox-label-sm">
|
||||
<input type="checkbox" id="event-workflow" checked /> Workflow Actions
|
||||
</label>
|
||||
<label class="checkbox-label-sm">
|
||||
<input type="checkbox" id="event-backup-complete" checked /> Backup Complete
|
||||
</label>
|
||||
<label class="checkbox-label-sm">
|
||||
<input type="checkbox" id="event-backup-failed" checked /> Backup Failed
|
||||
</label>
|
||||
<label class="checkbox-label-sm">
|
||||
<input type="checkbox" id="event-update-available" checked /> Updates
|
||||
</label>
|
||||
<label class="checkbox-label-sm" style="grid-column: 1 / -1;">
|
||||
<input type="checkbox" id="event-resource-alert" checked /> Resource Alerts
|
||||
</label>
|
||||
@@ -1109,7 +1082,7 @@ Try refreshing in a moment if you see a certificate error.`,"warning",1e4),!1}};
|
||||
<button id="notifications-save" class="btn-accent">Save Settings</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>`);const B=document.getElementById("notifications-modal"),A=document.getElementById("manage-notifications"),I=document.getElementById("notifications-save"),z=document.getElementById("notifications-cancel");["discord","telegram","ntfy","email"].forEach(S=>{const $=document.getElementById(`${S}-enabled`),f=document.getElementById(`${S}-config`);$?.addEventListener("change",()=>{f.style.display=$.checked?"block":"none"})});const P=document.getElementById("health-check-enabled"),M=document.getElementById("health-check-config");P?.addEventListener("change",()=>{M.style.opacity=P.checked?"1":"0.5"});async function D(){try{const $=await(await fetch("/api/v1/notifications/config")).json();if($.success){const f=$.config;document.getElementById("notifications-enabled").checked=f.enabled,document.getElementById("discord-enabled").checked=f.providers?.discord?.enabled||!1,document.getElementById("telegram-enabled").checked=f.providers?.telegram?.enabled||!1,document.getElementById("ntfy-enabled").checked=f.providers?.ntfy?.enabled||!1,document.getElementById("email-enabled").checked=f.providers?.email?.enabled||!1,document.getElementById("discord-config").style.display=f.providers?.discord?.enabled?"block":"none",document.getElementById("telegram-config").style.display=f.providers?.telegram?.enabled?"block":"none",document.getElementById("ntfy-config").style.display=f.providers?.ntfy?.enabled?"block":"none",document.getElementById("email-config").style.display=f.providers?.email?.enabled?"block":"none",f.providers?.ntfy?.serverUrl&&(document.getElementById("ntfy-server").value=f.providers.ntfy.serverUrl),f.providers?.email?.host&&(document.getElementById("email-host").value=f.providers.email.host),f.providers?.email?.from&&(document.getElementById("email-from").value=f.providers.email.from),f.providers?.email?.to&&(document.getElementById("email-to").value=f.providers.email.to),f.providers?.email?.port&&(document.getElementById("email-port").value=f.providers.email.port),f.providers?.email?.secure!==void 0&&(document.getElementById("email-secure").checked=f.providers.email.secure===!0),f.providers?.email?.username&&(document.getElementById("email-user").value=f.providers.email.username);const E=document.getElementById("email-pass");f.providers?.email?.hasPassword?(E.value="",E.placeholder="saved \u2014 leave blank to keep"):E.placeholder="app password",document.getElementById("health-check-enabled").checked=f.healthCheck?.enabled||!1,f.healthCheck?.intervalMinutes&&(document.getElementById("health-check-interval").value=f.healthCheck.intervalMinutes),f.healthCheck?.lastCheck&&(document.getElementById("health-check-status").textContent=`Last check: ${new Date(f.healthCheck.lastCheck).toLocaleString()}`),document.getElementById("event-container-down").checked=f.events?.["container-down"]!==!1,document.getElementById("event-container-up").checked=f.events?.["container-up"]===!0,document.getElementById("event-deploy-success").checked=f.events?.["deploy-success"]!==!1,document.getElementById("event-deploy-failed").checked=f.events?.["deploy-failed"]!==!1,document.getElementById("event-ssl-cert-expiry").checked=f.events?.["ssl-cert-expiry"]!==!1,document.getElementById("event-dns-propagation").checked=f.events?.["dns-propagation"]!==!1,document.getElementById("event-drift-detected").checked=f.events?.["drift-detected"]!==!1,document.getElementById("event-dependency-restart").checked=f.events?.["dependency-restart"]!==!1,document.getElementById("event-recipe-removed").checked=f.events?.["recipe-removed"]!==!1,document.getElementById("event-workflow").checked=f.events?.workflow!==!1,document.getElementById("event-backup-complete").checked=f.events?.["backup-complete"]!==!1,document.getElementById("event-backup-failed").checked=f.events?.["backup-failed"]!==!1,document.getElementById("event-update-available").checked=f.events?.["update-available"]!==!1,document.getElementById("event-resource-alert").checked=f.events?.alert!==!1}}catch(S){k.logError("[Notifications] Load Config",S,{function:"loadConfig"})}}async function b(){try{const $=await(await fetch("/api/v1/notifications/history?limit=10")).json(),f=document.getElementById("notification-history");$.success&&$.history?.length>0?f.innerHTML=$.history.map(E=>{const O=new Date(E.timestamp).toLocaleString();return`
|
||||
</div>`);const B=document.getElementById("notifications-modal"),A=document.getElementById("manage-notifications"),I=document.getElementById("notifications-save"),z=document.getElementById("notifications-cancel");["discord","telegram","ntfy","email"].forEach(S=>{const $=document.getElementById(`${S}-enabled`),w=document.getElementById(`${S}-config`);$?.addEventListener("change",()=>{w.style.display=$.checked?"block":"none"})});const P=document.getElementById("health-check-enabled"),M=document.getElementById("health-check-config");P?.addEventListener("change",()=>{M.style.opacity=P.checked?"1":"0.5"});async function D(){try{const $=await(await fetch("/api/v1/notifications/config")).json();if($.success){const w=$.config;document.getElementById("notifications-enabled").checked=w.enabled,document.getElementById("discord-enabled").checked=w.providers?.discord?.enabled||!1,document.getElementById("telegram-enabled").checked=w.providers?.telegram?.enabled||!1,document.getElementById("ntfy-enabled").checked=w.providers?.ntfy?.enabled||!1,document.getElementById("email-enabled").checked=w.providers?.email?.enabled||!1,document.getElementById("discord-config").style.display=w.providers?.discord?.enabled?"block":"none",document.getElementById("telegram-config").style.display=w.providers?.telegram?.enabled?"block":"none",document.getElementById("ntfy-config").style.display=w.providers?.ntfy?.enabled?"block":"none",document.getElementById("email-config").style.display=w.providers?.email?.enabled?"block":"none",w.providers?.ntfy?.serverUrl&&(document.getElementById("ntfy-server").value=w.providers.ntfy.serverUrl),w.providers?.email?.host&&(document.getElementById("email-host").value=w.providers.email.host),w.providers?.email?.from&&(document.getElementById("email-from").value=w.providers.email.from),w.providers?.email?.to&&(document.getElementById("email-to").value=w.providers.email.to),w.providers?.email?.port&&(document.getElementById("email-port").value=w.providers.email.port),w.providers?.email?.secure!==void 0&&(document.getElementById("email-secure").checked=w.providers.email.secure===!0),w.providers?.email?.username&&(document.getElementById("email-user").value=w.providers.email.username);const E=document.getElementById("email-pass");w.providers?.email?.hasPassword?(E.value="",E.placeholder="saved \u2014 leave blank to keep"):E.placeholder="app password",document.getElementById("health-check-enabled").checked=w.healthCheck?.enabled||!1,w.healthCheck?.intervalMinutes&&(document.getElementById("health-check-interval").value=w.healthCheck.intervalMinutes),w.healthCheck?.lastCheck&&(document.getElementById("health-check-status").textContent=`Last check: ${new Date(w.healthCheck.lastCheck).toLocaleString()}`),document.getElementById("event-container-down").checked=w.events?.["container-down"]!==!1,document.getElementById("event-container-up").checked=w.events?.["container-up"]===!0,document.getElementById("event-deploy-success").checked=w.events?.["deploy-success"]!==!1,document.getElementById("event-deploy-failed").checked=w.events?.["deploy-failed"]!==!1,document.getElementById("event-resource-alert").checked=w.events?.alert!==!1}}catch(S){k.logError("[Notifications] Load Config",S,{function:"loadConfig"})}}async function h(){try{const $=await(await fetch("/api/v1/notifications/history?limit=10")).json(),w=document.getElementById("notification-history");$.success&&$.history?.length>0?w.innerHTML=$.history.map(E=>{const O=new Date(E.timestamp).toLocaleString();return`
|
||||
<div style="padding: 6px 8px; border-bottom: 1px solid var(--border); display: flex; gap: 8px; align-items: flex-start;">
|
||||
<span style="color: ${{success:"var(--ok-fg)",error:"var(--bad-fg)",warning:"#f39c12",info:"var(--accent)"}[E.type]||"var(--muted)"}">${E.type==="success"?"\u2713":E.type==="error"?"\u2717":"\u2139"}</span>
|
||||
<div style="flex: 1; min-width: 0;">
|
||||
@@ -1117,7 +1090,7 @@ Try refreshing in a moment if you see a certificate error.`,"warning",1e4),!1}};
|
||||
<div style="font-size: 0.7rem; color: var(--muted);">${O}</div>
|
||||
</div>
|
||||
</div>
|
||||
`}).join(""):f.innerHTML='<div style="color: var(--muted); text-align: center; padding: 20px;">No notifications yet</div>'}catch(S){k.logError("[Notifications] Load History",S,{function:"loadHistory"})}}async function T(){try{const S={enabled:document.getElementById("notifications-enabled").checked,providers:{discord:{enabled:document.getElementById("discord-enabled").checked,webhookUrl:document.getElementById("discord-webhook").value.trim()},telegram:{enabled:document.getElementById("telegram-enabled").checked,botToken:document.getElementById("telegram-bot-token").value.trim(),chatId:document.getElementById("telegram-chat-id").value.trim()},ntfy:{enabled:document.getElementById("ntfy-enabled").checked,serverUrl:document.getElementById("ntfy-server").value.trim()||"https://ntfy.sh",topic:document.getElementById("ntfy-topic").value.trim()},email:{enabled:document.getElementById("email-enabled").checked,host:document.getElementById("email-host").value.trim(),port:parseInt(document.getElementById("email-port").value)||587,secure:document.getElementById("email-secure").checked,username:document.getElementById("email-user").value.trim(),password:document.getElementById("email-pass").value.trim(),from:document.getElementById("email-from").value.trim(),to:document.getElementById("email-to").value.trim()}},events:{"container-down":document.getElementById("event-container-down").checked,"container-up":document.getElementById("event-container-up").checked,"deploy-success":document.getElementById("event-deploy-success").checked,"deploy-failed":document.getElementById("event-deploy-failed").checked,"ssl-cert-expiry":document.getElementById("event-ssl-cert-expiry").checked,"dns-propagation":document.getElementById("event-dns-propagation").checked,"drift-detected":document.getElementById("event-drift-detected").checked,"dependency-restart":document.getElementById("event-dependency-restart").checked,"recipe-removed":document.getElementById("event-recipe-removed").checked,workflow:document.getElementById("event-workflow").checked,"backup-complete":document.getElementById("event-backup-complete").checked,"backup-failed":document.getElementById("event-backup-failed").checked,"update-available":document.getElementById("event-update-available").checked,alert:document.getElementById("event-resource-alert").checked},healthCheck:{enabled:document.getElementById("health-check-enabled").checked,intervalMinutes:parseInt(document.getElementById("health-check-interval").value)||5}},f=await(await secureFetch("/api/v1/notifications/config",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(S)})).json();f.success?(showNotification("Notification settings saved","success",3e3),B.classList.remove("show")):showNotification(`Failed to save: ${f.error}`,"error",3e3)}catch(S){showNotification(`Error: ${S.message}`,"error",3e3)}}async function h(S){try{const f=await(await secureFetch("/api/v1/notifications/test",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({provider:S})})).json();f.success?showNotification(`Test ${S} notification sent!`,"success",3e3):showNotification(`Test failed: ${f.error}`,"error",3e3)}catch($){showNotification(`Error: ${$.message}`,"error",3e3)}}document.getElementById("discord-test")?.addEventListener("click",()=>h("discord")),document.getElementById("telegram-test")?.addEventListener("click",()=>h("telegram")),document.getElementById("ntfy-test")?.addEventListener("click",()=>h("ntfy")),document.getElementById("email-test")?.addEventListener("click",()=>h("email")),document.getElementById("health-check-now")?.addEventListener("click",async()=>{try{const $=await(await secureFetch("/api/v1/notifications/health-check",{method:"POST"})).json();$.success&&(document.getElementById("health-check-status").textContent=`Last check: ${new Date($.lastCheck).toLocaleString()} (${$.containersMonitored} containers)`,showNotification("Health check completed","success",2e3))}catch(S){showNotification(`Error: ${S.message}`,"error",3e3)}}),A?.addEventListener("click",()=>{B.classList.add("show"),D(),b()}),I?.addEventListener("click",T),document.getElementById("notifications-send-test")?.addEventListener("click",async()=>{const S=document.getElementById("notifications-send-test"),$=S.textContent;S.textContent="Sending...",S.disabled=!0;try{const E=await(await secureFetch("/api/v1/notifications/send",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({event:"test",data:{message:"This is a test notification from DashCaddy."},type:"info"})})).json();E.success?(showNotification("Test notification sent!","success",3e3),H()):showNotification(`Test failed: ${E.results?.map(O=>`${O.provider}: ${O.error||"ok"}`).join(", ")}`,"error",5e3)}catch(f){showNotification(`Error: ${f.message}`,"error",3e3)}finally{S.textContent=$,S.disabled=!1}});async function H(){try{const $=await(await fetch("/api/v1/notifications/status")).json();if($.success&&$.lastSent){
Line truncated
|
||||
`}).join(""):w.innerHTML='<div style="color: var(--muted); text-align: center; padding: 20px;">No notifications yet</div>'}catch(S){k.logError("[Notifications] Load History",S,{function:"loadHistory"})}}async function T(){try{const S={enabled:document.getElementById("notifications-enabled").checked,providers:{discord:{enabled:document.getElementById("discord-enabled").checked,webhookUrl:document.getElementById("discord-webhook").value.trim()},telegram:{enabled:document.getElementById("telegram-enabled").checked,botToken:document.getElementById("telegram-bot-token").value.trim(),chatId:document.getElementById("telegram-chat-id").value.trim()},ntfy:{enabled:document.getElementById("ntfy-enabled").checked,serverUrl:document.getElementById("ntfy-server").value.trim()||"https://ntfy.sh",topic:document.getElementById("ntfy-topic").value.trim()},email:{enabled:document.getElementById("email-enabled").checked,host:document.getElementById("email-host").value.trim(),port:parseInt(document.getElementById("email-port").value)||587,secure:document.getElementById("email-secure").checked,username:document.getElementById("email-user").value.trim(),password:document.getElementById("email-pass").value.trim(),from:document.getElementById("email-from").value.trim(),to:document.getElementById("email-to").value.trim()}},events:{"container-down":document.getElementById("event-container-down").checked,"container-up":document.getElementById("event-container-up").checked,"deploy-success":document.getElementById("event-deploy-success").checked,"deploy-failed":document.getElementById("event-deploy-failed").checked,alert:document.getElementById("event-resource-alert").checked},healthCheck:{enabled:document.getElementById("health-check-enabled").checked,intervalMinutes:parseInt(document.getElementById("health-check-interval").value)||5}},w=await(await secureFetch("/api/v1/notifications/config",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(S)})).json();w.success?(showNotification("Notification settings saved","success",3e3),B.classList.remove("show")):showNotification(`Failed to save: ${w.error}`,"error",3e3)}catch(S){showNotification(`Error: ${S.message}`,"error",3e3)}}async function f(S){try{const w=await(await secureFetch("/api/v1/notifications/test",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({provider:S})})).json();w.success?showNotification(`Test ${S} notification sent!`,"success",3e3):showNotification(`Test failed: ${w.error}`,"error",3e3)}catch($){showNotification(`Error: ${$.message}`,"error",3e3)}}document.getElementById("discord-test")?.addEventListener("click",()=>f("discord")),document.getElementById("telegram-test")?.addEventListener("click",()=>f("telegram")),document.getElementById("ntfy-test")?.addEventListener("click",()=>f("ntfy")),document.getElementById("email-test")?.addEventListener("click",()=>f("email")),document.getElementById("health-check-now")?.addEventListener("click",async()=>{try{const $=await(await secureFetch("/api/v1/notifications/health-check",{method:"POST"})).json();$.success&&(document.getElementById("health-check-status").textContent=`Last check: ${new Date($.lastCheck).toLocaleString()} (${$.containersMonitored} containers)`,showNotification("Health check completed","success",2e3))}catch(S){showNotification(`Error: ${S.message}`,"error",3e3)}}),A?.addEventListener("click",()=>{B.classList.add("show"),D(),h()}),I?.addEventListener("click",T),document.getElementById("notifications-send-test")?.addEventListener("click",async()=>{const S=document.getElementById("notifications-send-test"),$=S.textContent;S.textContent="Sending...",S.disabled=!0;try{const E=await(await secureFetch("/api/v1/notifications/send",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({event:"test",data:{message:"This is a test notification from DashCaddy."},type:"info"})})).json();E.success?(showNotification("Test notification sent!","success",3e3),H()):showNotification(`Test failed: ${E.results?.map(O=>`${O.provider}: ${O.error||"ok"}`).join(", ")}`,"error",5e3)}catch(w){showNotification(`Error: ${w.message}`,"error",3e3)}finally{S.textContent=$,S.disabled=!1}});async function H(){try{const $=await(await fetch("/api/v1/notifications/status")).json();if($.success&&$.lastSent){const w=document.getElementById("last-notification-sent");w&&(w.textContent=`Last sent: ${new Date($.lastSent).toLocaleString()}`)}}catch{}}wireModal(B,z)})(),(function(){document.addEventListener("click",k=>{const B=k.target.closest(".panel-tab");if(!B)return;const A=B.dataset.panel;if(!A)return;const I=B.closest(".panel-tabs"),z=I.closest(".weather-modal-content");I.querySelectorAll(".panel-tab").forEach(M=>M.classList.remove("active")),B.classList.add("active"),z.querySelectorAll(".panel-section").forEach(M=>M.classList.remove("active"));const P=z.querySelector("#"+A);P&&P.classList.add("active")})})(),(function(){var k=["dashcaddy_site_config","da
Line truncated
|
||||
<div class="weather-modal-content" style="min-width: 550px; max-width: 650px;">
|
||||
<h3>\u{1F4BE} Backup & Restore</h3>
|
||||
<p class="modal-subtitle">
|
||||
@@ -1223,7 +1196,7 @@ Try refreshing in a moment if you see a certificate error.`,"warning",1e4),!1}};
|
||||
<button id="backup-cancel">Close</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>`);var P=document.getElementById("backup-modal"),M=document.getElementById("backup-restore-btn"),D=document.getElementById("backup-cancel"),b=document.getElementById("backup-export-btn"),T=document.getElementById("backup-select-file"),h=document.getElementById("backup-file-input"),H=document.getElementById("backup-file-name"),S=document.getElementById("backup-preview"),$=document.getElementById("backup-preview-content"),f=document.getElementById("backup-do-restore-btn"),E=document.getElementById("backup-result"),O=document.getElementById("backup-schedules-container"),L=document.getElementById("backup-history-container"),j=document.getElementById("backup-disk-container"),N=document.getElementById("pointintime-container"),R=null;M?.addEventListener("click",function(){P.classList.add("show"),E&&(E.style.display="none"),S&&(S.style.display="none"),H&&(H.style.display="none"),R=null}),wireModal(P,D),b?.addEventListener("click",async function(){b.disabled=!0,b.innerHTML='<span class="brand-spinner"></span> Exporting...';try{var e=await fetch("/api/v1/backup/export"),a=await e.json();a.browserState=B();var o=new Blob([JSON.stringify(a,null,2)],{type:"application/json"}),i=URL.createObjectURL(o),n=document.createElement("a");n.href=i,n.download="dashcaddy-backup-"+new Date().toISOString().split("T")[0]+".json",document.body.appendChild(n),n.click(),document.body.removeChild(n),URL.revokeObjectURL(i);var r=Object.keys(a.browserState).length,d=a.themes?Object.keys(a.themes).length:0;E.innerHTML="\u2705 Full backup downloaded \u2014 server config + "+r+" browser settings"+(d?" + "+d+" themes":""),E.style.display="block",E.style.background="color-mix(in srgb, var(--ok-fg) 15%, transparent)",E.style.border="1px solid var(--ok-fg)"}catch(y){E.innerHTML="\u274C Export failed: "+escapeHtml(y.message),E.style.display="block",E.style.background="color-mix(in srgb, var(--bad-fg) 15%, transparent)",E.style.border="1px solid var(--bad-fg)"}b.disabled=!1,b.innerHTML="\u2B07\uFE0F Download Full Backup"}),T?.addEventListener("click",function(){h.click()}),h?.addEventListener("change",async function(e){var a=e.target.files[0];if(a){H.textContent="\u{1F4C4} "+a.name,H.style.display="block",E.style.display="none";try{var o=await a.text(),i=JSON.parse(o);if(I(i)){R=i;var n='<div style="margin-bottom: 8px; color: var(--muted); font-size: 0.8rem;">Legacy format (v'+escapeHtml(i.version)+")</div>";n+='<div style="display: flex; flex-wrap: wrap; gap: 6px;">',i.services?.length&&(n+='<span style="padding: 4px 8px; background: var(--base); border-radius: 4px; font-size: 0.8rem;">\u{1F4CB} '+i.services.length+" services</span>"),i.customApps?.length&&(n+='<span style="padding: 4px 8px; background: var(--base); border-radius: 4px; font-size: 0.8rem;">\u{1F4E6} '+i.customApps.length+" custom apps</span>"),i.theme&&(n+='<span style="padding: 4px 8px; background: var(--base); border-radius: 4px; font-size: 0.8rem;">\u{1F3A8} Theme: '+escapeHtml(i.theme)+"</span>"),i.userThemes&&(n+='<span style="padding: 4px 8px; background: var(--base); border-radius: 4px; font-size: 0.8rem;">\u{1F3A8} '+Object.keys(i.userThemes).length+" custom themes</span>"),n+="</div>",$.innerHTML=n,S.style.display="block";return}var r=await secureFetch("/api/v1/backup/preview",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(i)}),d=await r.json();if(d.success){R=i;var n='<div style="margin-bottom: 8px; color: var(--muted); font-size: 0.8rem;">Exported: '+new Date(i.exportedAt).toLocaleString()+" (v"+escapeHtml(i.version)+")</div>";n+='<div style="margin-bottom: 6px; font-size: 0.75rem; color: var(--muted); text-transform: uppercase; letter-spacing: 0.5px;">Server Config</div>',n+='<div style="display: flex; flex-wrap: wrap; gap: 6px; margin-bottom: 10px;">';for(var y in d.preview.files){var C=d.preview.files[y],U=C.action==="create"?"\u{1F195}":"\u{1F4DD}";n+='<span style="padding: 4px 8px; background: var(--base); border-radius: 4px; font-size: 0.8rem;">'+U+" "+escapeHtml(C.description)+"</span>"}n+="</div>",d.preview.serviceCount&&(n+='<div style="font-size: 0.8rem; color: var(--accent); margin-bottom: 6px;">'+d.preview.serviceCount+" services</div>"),d.preview.themeCount&&(n+='<div style="font-size: 0.8rem; color: var(--accent); margin-bottom: 6px;">\u{1F3A8} '+d.preview.themeCount+" custom themes</div>"),d.preview.browserStateCount&&(n+='<div style="margin-top: 6px; font-size: 0.75rem; color: var(--muted); text-transform: uppercase; letter-spacing: 0.5px;">Browser Preferences</div>',n+='<div style="font-size: 0.8rem; color: var(--accent);">\u{1F5A5}\uFE0F '+d.preview.browserStateCount+" saved settings (theme, weather, clock, widgets, etc.)</div>"),$.innerHTML=n,S.style.display="block"}else E.innerHTML="\u26A0\uFE0F Invalid backup file: "+escapeHtml(d.error),E.style.display="block",E.style.background="color-mix(in srgb, #f39c12 15%, transparent)",E.style.border="1px solid #f39c12",S.style.display="none"}catch(q){E.innerHTML="\u274CLine truncated
|
||||
</div>`);var P=document.getElementById("backup-modal"),M=document.getElementById("backup-restore-btn"),D=document.getElementById("backup-cancel"),h=document.getElementById("backup-export-btn"),T=document.getElementById("backup-select-file"),f=document.getElementById("backup-file-input"),H=document.getElementById("backup-file-name"),S=document.getElementById("backup-preview"),$=document.getElementById("backup-preview-content"),w=document.getElementById("backup-do-restore-btn"),E=document.getElementById("backup-result"),O=document.getElementById("backup-schedules-container"),C=document.getElementById("backup-history-container"),j=document.getElementById("backup-disk-container"),N=document.getElementById("pointintime-container"),R=null;M?.addEventListener("click",function(){P.classList.add("show"),E&&(E.style.display="none"),S&&(S.style.display="none"),H&&(H.style.display="none"),R=null}),wireModal(P,D),h?.addEventListener("click",async function(){h.disabled=!0,h.innerHTML='<span class="brand-spinner"></span> Exporting...';try{var e=await fetch("/api/v1/backup/export"),a=await e.json();a.browserState=B();var o=new Blob([JSON.stringify(a,null,2)],{type:"application/json"}),i=URL.createObjectURL(o),n=document.createElement("a");n.href=i,n.download="dashcaddy-backup-"+new Date().toISOString().split("T")[0]+".json",document.body.appendChild(n),n.click(),document.body.removeChild(n),URL.revokeObjectURL(i);var r=Object.keys(a.browserState).length,d=a.themes?Object.keys(a.themes).length:0;E.innerHTML="\u2705 Full backup downloaded \u2014 server config + "+r+" browser settings"+(d?" + "+d+" themes":""),E.style.display="block",E.style.background="color-mix(in srgb, var(--ok-fg) 15%, transparent)",E.style.border="1px solid var(--ok-fg)"}catch(y){E.innerHTML="\u274C Export failed: "+escapeHtml(y.message),E.style.display="block",E.style.background="color-mix(in srgb, var(--bad-fg) 15%, transparent)",E.style.border="1px solid var(--bad-fg)"}h.disabled=!1,h.innerHTML="\u2B07\uFE0F Download Full Backup"}),T?.addEventListener("click",function(){f.click()}),f?.addEventListener("change",async function(e){var a=e.target.files[0];if(a){H.textContent="\u{1F4C4} "+a.name,H.style.display="block",E.style.display="none";try{var o=await a.text(),i=JSON.parse(o);if(I(i)){R=i;var n='<div style="margin-bottom: 8px; color: var(--muted); font-size: 0.8rem;">Legacy format (v'+escapeHtml(i.version)+")</div>";n+='<div style="display: flex; flex-wrap: wrap; gap: 6px;">',i.services?.length&&(n+='<span style="padding: 4px 8px; background: var(--base); border-radius: 4px; font-size: 0.8rem;">\u{1F4CB} '+i.services.length+" services</span>"),i.customApps?.length&&(n+='<span style="padding: 4px 8px; background: var(--base); border-radius: 4px; font-size: 0.8rem;">\u{1F4E6} '+i.customApps.length+" custom apps</span>"),i.theme&&(n+='<span style="padding: 4px 8px; background: var(--base); border-radius: 4px; font-size: 0.8rem;">\u{1F3A8} Theme: '+escapeHtml(i.theme)+"</span>"),i.userThemes&&(n+='<span style="padding: 4px 8px; background: var(--base); border-radius: 4px; font-size: 0.8rem;">\u{1F3A8} '+Object.keys(i.userThemes).length+" custom themes</span>"),n+="</div>",$.innerHTML=n,S.style.display="block";return}var r=await secureFetch("/api/v1/backup/preview",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(i)}),d=await r.json();if(d.success){R=i;var n='<div style="margin-bottom: 8px; color: var(--muted); font-size: 0.8rem;">Exported: '+new Date(i.exportedAt).toLocaleString()+" (v"+escapeHtml(i.version)+")</div>";n+='<div style="margin-bottom: 6px; font-size: 0.75rem; color: var(--muted); text-transform: uppercase; letter-spacing: 0.5px;">Server Config</div>',n+='<div style="display: flex; flex-wrap: wrap; gap: 6px; margin-bottom: 10px;">';for(var y in d.preview.files){var L=d.preview.files[y],U=L.action==="create"?"\u{1F195}":"\u{1F4DD}";n+='<span style="padding: 4px 8px; background: var(--base); border-radius: 4px; font-size: 0.8rem;">'+U+" "+escapeHtml(L.description)+"</span>"}n+="</div>",d.preview.serviceCount&&(n+='<div style="font-size: 0.8rem; color: var(--accent); margin-bottom: 6px;">'+d.preview.serviceCount+" services</div>"),d.preview.themeCount&&(n+='<div style="font-size: 0.8rem; color: var(--accent); margin-bottom: 6px;">\u{1F3A8} '+d.preview.themeCount+" custom themes</div>"),d.preview.browserStateCount&&(n+='<div style="margin-top: 6px; font-size: 0.75rem; color: var(--muted); text-transform: uppercase; letter-spacing: 0.5px;">Browser Preferences</div>',n+='<div style="font-size: 0.8rem; color: var(--accent);">\u{1F5A5}\uFE0F '+d.preview.browserStateCount+" saved settings (theme, weather, clock, widgets, etc.)</div>"),$.innerHTML=n,S.style.display="block"}else E.innerHTML="\u26A0\uFE0F Invalid backup file: "+escapeHtml(d.error),E.style.display="block",E.style.background="color-mix(in srgb, #f39c12 15%, transparent)",E.style.border="1px solid #f39c12",S.style.display="none"}catch(q){E.innerHTML="\u274CLine truncated
|
||||
|
||||
This will replace current configuration, credentials, and data. Containers will be restarted.`))try{var o=await secureFetch("/api/v1/apps/"+encodeURIComponent(e)+"/revert/"+encodeURIComponent(a),{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({restartContainers:!0})}),i=await o.json();i.success?(showNotification(e+" restored to "+a,"success"),setTimeout(function(){location.reload()},1500)):showNotification("Restore failed: "+(i.error||"Unknown"),"error")}catch(n){showNotification("Restore error: "+n.message,"error")}}})(),(function(){injectModal("stats-modal",`<div id="stats-modal" class="weather-modal">
|
||||
<div class="weather-modal-content" style="min-width: 750px; max-width: 950px;">
|
||||
@@ -1305,7 +1278,7 @@ This will replace current configuration, credentials, and data. Containers will
|
||||
<button id="stats-cancel">Close</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>`);const k=document.getElementById("stats-modal"),B=document.getElementById("container-stats-btn"),A=document.getElementById("stats-cancel"),I=document.getElementById("stats-refresh-btn"),z=document.getElementById("stats-auto-refresh"),P=document.getElementById("stats-container"),M=document.getElementById("stats-aggregated-container"),D=document.getElementById("stats-alerts-container"),b=document.getElementById("stats-last-update");let T=null,h=null;function H(l){if(l===0||!l)return"0 B";const m=1024,c=["B","KB","MB","GB"],t=Math.floor(Math.log(l)/Math.log(m));return parseFloat((l/Math.pow(m,t)).toFixed(1))+" "+c[t]}function S(l){return l<30?"#2ecc71":l<70?"#f39c12":"#e74c3c"}function $(l){return l<50?"#2ecc71":l<80?"#f39c12":"#e74c3c"}async function f(){try{let l=null,m=!1;try{const e=await(await fetch("/api/v1/monitoring/stats")).json();e.success&&e.stats&&(l=e.stats,m=!0,h=e.stats)}catch{}if(!m){const e=await(await fetch("/api/v1/stats/containers")).json();if(e.success&&e.stats){l={};for(const a of e.stats)l[a.name]={name:a.name,current:{cpu:a.cpu,memory:{percent:a.memory.percent,usage:a.memory.used,limit:a.memory.limit,usageMB:Math.round(a.memory.used/1048576),limitMB:Math.round(a.memory.limit/1048576)},network:{rxBytes:a.network.rx,txBytes:a.network.tx,rxMB:(a.network.rx/1048576).toFixed(1),txMB:(a.network.tx/1048576).toFixed(1)},disk:{readMB:0,writeMB:0}},status:a.status};h=l}}if(!l||Object.keys(l).length===0){P.innerHTML='<div style="text-align: center; padding: 40px; color: var(--muted);">No running containers found</div>';return}let c='<div style="display: flex; flex-direction: column; gap: 8px;">';for(const[t,e]of Object.entries(l)){const a=e.current||e,o=a.cpu?.percent||0,i=a.memory?.percent||0,n=S(o),r=$(i),d=a.memory?.usage||a.memory?.used||0,y=a.memory?.limit||0,C=a.network?.rxBytes||a.network?.rx||0,U=a.network?.txBytes||a.network?.tx||0,q=e.aggregated;c+=`
|
||||
</div>`);const k=document.getElementById("stats-modal"),B=document.getElementById("container-stats-btn"),A=document.getElementById("stats-cancel"),I=document.getElementById("stats-refresh-btn"),z=document.getElementById("stats-auto-refresh"),P=document.getElementById("stats-container"),M=document.getElementById("stats-aggregated-container"),D=document.getElementById("stats-alerts-container"),h=document.getElementById("stats-last-update");let T=null,f=null;function H(l){if(l===0||!l)return"0 B";const m=1024,c=["B","KB","MB","GB"],t=Math.floor(Math.log(l)/Math.log(m));return parseFloat((l/Math.pow(m,t)).toFixed(1))+" "+c[t]}function S(l){return l<30?"#2ecc71":l<70?"#f39c12":"#e74c3c"}function $(l){return l<50?"#2ecc71":l<80?"#f39c12":"#e74c3c"}async function w(){try{let l=null,m=!1;try{const e=await(await fetch("/api/v1/monitoring/stats")).json();e.success&&e.stats&&(l=e.stats,m=!0,f=e.stats)}catch{}if(!m){const e=await(await fetch("/api/v1/stats/containers")).json();if(e.success&&e.stats){l={};for(const a of e.stats)l[a.name]={name:a.name,current:{cpu:a.cpu,memory:{percent:a.memory.percent,usage:a.memory.used,limit:a.memory.limit,usageMB:Math.round(a.memory.used/1048576),limitMB:Math.round(a.memory.limit/1048576)},network:{rxBytes:a.network.rx,txBytes:a.network.tx,rxMB:(a.network.rx/1048576).toFixed(1),txMB:(a.network.tx/1048576).toFixed(1)},disk:{readMB:0,writeMB:0}},status:a.status};f=l}}if(!l||Object.keys(l).length===0){P.innerHTML='<div style="text-align: center; padding: 40px; color: var(--muted);">No running containers found</div>';return}let c='<div style="display: flex; flex-direction: column; gap: 8px;">';for(const[t,e]of Object.entries(l)){const a=e.current||e,o=a.cpu?.percent||0,i=a.memory?.percent||0,n=S(o),r=$(i),d=a.memory?.usage||a.memory?.used||0,y=a.memory?.limit||0,L=a.network?.rxBytes||a.network?.rx||0,U=a.network?.txBytes||a.network?.tx||0,q=e.aggregated;c+=`
|
||||
<div style="padding: 12px; background: var(--card-base); border-radius: 8px; border: 1px solid var(--border);">
|
||||
<div style="display: flex; align-items: center; gap: 12px; margin-bottom: 10px;">
|
||||
<span style="font-weight: 600; flex: 1;">${e.name||t}</span>
|
||||
@@ -1335,13 +1308,13 @@ This will replace current configuration, credentials, and data. Containers will
|
||||
<div>
|
||||
<div style="font-size: 0.7rem; color: var(--muted); margin-bottom: 4px;">Network</div>
|
||||
<div style="font-size: 0.8rem;">
|
||||
<span style="color: #3498db;">\u2193 ${H(C)}</span>
|
||||
<span style="color: #3498db;">\u2193 ${H(L)}</span>
|
||||
<span style="color: var(--muted); margin: 0 4px;">/</span>
|
||||
<span style="color: #e74c3c;">\u2191 ${H(U)}</span>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>`}c+="</div>",P.innerHTML=c,b.textContent="Updated: "+new Date().toLocaleTimeString()}catch(l){P.innerHTML=`<div style="text-align: center; padding: 40px; color: var(--bad-fg);">\u274C Failed to load stats: ${escapeHtml(l.message)}</div>`}}async function E(){if(!M)return;const l=h;if(!l||Object.keys(l).length===0){M.innerHTML='<div class="panel-empty"><span class="empty-icon">\u{1F4C8}</span>No monitoring data available. Open the Live Stats tab first.</div>';return}let m='<div style="display: flex; flex-direction: column; gap: 12px;">';for(const[c,t]of Object.entries(l)){const e=t.aggregated;e&&(m+=`<div style="padding: 12px; background: var(--card-base); border-radius: 8px; border: 1px solid var(--border);">
|
||||
</div>`}c+="</div>",P.innerHTML=c,h.textContent="Updated: "+new Date().toLocaleTimeString()}catch(l){P.innerHTML=`<div style="text-align: center; padding: 40px; color: var(--bad-fg);">\u274C Failed to load stats: ${escapeHtml(l.message)}</div>`}}async function E(){if(!M)return;const l=f;if(!l||Object.keys(l).length===0){M.innerHTML='<div class="panel-empty"><span class="empty-icon">\u{1F4C8}</span>No monitoring data available. Open the Live Stats tab first.</div>';return}let m='<div style="display: flex; flex-direction: column; gap: 12px;">';for(const[c,t]of Object.entries(l)){const e=t.aggregated;e&&(m+=`<div style="padding: 12px; background: var(--card-base); border-radius: 8px; border: 1px solid var(--border);">
|
||||
<div style="font-weight: 600; margin-bottom: 10px;">${t.name||c}</div>
|
||||
<div style="display: grid; grid-template-columns: repeat(4, 1fr); gap: 8px;">
|
||||
<div class="stat-mini-card"><span class="stat-val">${e.cpu?.avg?.toFixed(1)||0}%</span><span class="stat-lbl">Avg CPU</span></div>
|
||||
@@ -1350,7 +1323,7 @@ This will replace current configuration, credentials, and data. Containers will
|
||||
<div class="stat-mini-card"><span class="stat-val">${e.memory?.max?.toFixed(1)||0}%</span><span class="stat-lbl">Max Mem</span></div>
|
||||
</div>
|
||||
${e.dataPoints?`<div style="font-size: 0.7rem; color: var(--muted); margin-top: 6px;">${e.dataPoints} data points over ${e.timeRange||24}h</div>`:""}
|
||||
</div>`)}m+="</div>",M.innerHTML=m}async function O(){if(!D)return;D.innerHTML='<div class="panel-empty"><span class="brand-spinner"></span> Loading alerts...</div>';const l=h;if(!l||Object.keys(l).length===0){D.innerHTML='<div class="panel-empty"><span class="empty-icon">\u{1F514}</span>No containers found. Open the Live Stats tab first.</div>';return}let m=!1;try{m=(await(await fetch("/api/v1/license/feature/resource-alerts")).json()).available}catch{m=!1}let c=[];try{const r=await(await fetch("/api/v1/monitoring/alerts?limit=50")).json();r.success&&(c=r.history||[])}catch{}let t={};try{const r=await(await fetch("/api/v1/monitoring/alerts/config")).json();r.success&&(t=r.configs||{})}catch{}const a=Object.entries(l).map(([n,r])=>{const d=t[n]||{cpuThreshold:80,memoryThreshold:90,diskIOThreshold:50,autoRestart:!1,enabled:!1};return`
|
||||
</div>`)}m+="</div>",M.innerHTML=m}async function O(){if(!D)return;D.innerHTML='<div class="panel-empty"><span class="brand-spinner"></span> Loading alerts...</div>';const l=f;if(!l||Object.keys(l).length===0){D.innerHTML='<div class="panel-empty"><span class="empty-icon">\u{1F514}</span>No containers found. Open the Live Stats tab first.</div>';return}let m=!1;try{m=(await(await fetch("/api/v1/license/feature/resource-alerts")).json()).available}catch{m=!1}let c=[];try{const r=await(await fetch("/api/v1/monitoring/alerts?limit=50")).json();r.success&&(c=r.history||[])}catch{}let t={};try{const r=await(await fetch("/api/v1/monitoring/alerts/config")).json();r.success&&(t=r.configs||{})}catch{}const a=Object.entries(l).map(([n,r])=>{const d=t[n]||{cpuThreshold:80,memoryThreshold:90,diskIOThreshold:50,autoRestart:!1,enabled:!1};return`
|
||||
<tr data-container="${n}">
|
||||
<td style="font-weight: 600; padding: 8px;">${r.name||n}</td>
|
||||
<td style="padding: 4px 8px;"><input type="number" class="alert-cpu" value="${d.cpuThreshold??80}" min="0" max="100" style="width: 60px; font-size: 0.8rem; padding: 2px 4px;" ${m?"":"disabled"} /></td>
|
||||
@@ -1423,7 +1396,7 @@ This will replace current configuration, credentials, and data. Containers will
|
||||
</div>
|
||||
`:'<div style="color: var(--muted); text-align: center; padding: 20px;">No alerts recorded yet.</div>'}
|
||||
</div>
|
||||
`,document.getElementById("save-all-alerts")?.addEventListener("click",async()=>{const n={};document.querySelectorAll("#stats-alerts-container tr[data-container]").forEach(r=>{const d=r.dataset.container;n[d]={cpuThreshold:parseInt(r.querySelector(".alert-cpu")?.value)||80,memoryThreshold:parseInt(r.querySelector(".alert-mem")?.value)||90,diskIOThreshold:parseInt(r.querySelector(".alert-disk")?.value)||50,autoRestart:!!r.querySelector(".alert-autorestart")?.checked,enabled:!0}});try{const d=await(await secureFetch("/api/v1/monitoring/alerts/config",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({configs:n})})).json(),y=document.getElementById("save-all-alerts");y.textContent=d.success?"\u2705 Saved":"\u274C Failed",setTimeout(()=>{y.textContent="Save All"},2e3)}catch{const d=document.getElementById("save-all-alerts");d.textContent="\u274C Error",setTimeout(()=>{d.textContent="Save All"},2e3)}}),document.getElementById("go-to-notifications")?.addEventListener("click",n=>{n.preventDefault(),k.classList.remove("show"),j(),document.getElementById("manage-notifications")?.click()}),document.querySelectorAll(".alert-test-btn").forEach(n=>{n.addEventListener("click",async()=>{const r=n.textContent;n.textContent="...";try{await secureFetch(`/api/v1/monitoring/alerts/${n.dataset.container}/test`,{method:"POST"}),n.textContent="\u2705",showNotification("Test alert sent for "+n.dataset.name,"success",3e3)}catch{n.textContent="\u274C"}setTimeout(()=>{n.textContent=r},2e3)})}),document.getElementById("upgrade-for-alerts")?.addEventListener("click",()=>{k.classList.remove("show"),j(),typeof openLicenseModal=="function"&&openLicenseModal()})}function L(){T&&clearInterval(T),z?.checked&&(T=setInterval(f,DC.POLL.STATS))}function j(){T&&(clearInterval(T),T=null)}B?.addEventListener("click",()=>{k.classList.add("show"),f(),L()}),A?.addEventListener("click",()=>{k.classList.remove("show"),j()}),k?.addEventListener("click",l=>{l.target===k&&(k.classList.remove("show"),j())}),I?.addEventListener("click",f),z?.addEventListener("change",()=>{z.checked?L():j()}),document.querySelector('[data-panel="stats-aggregated"]')?.addEventListener("click",E),document.querySelector('[data-panel="stats-alerts"]')?.addEventListener("click",O);const N=document.getElementById("stats-history-container"),R=document.getElementById("stats-history-container-area"),u=document.querySelectorAll(".stats-range-btn");let v="1h";function w(l){switch(l){case"1h":return 3600*1e3;case"24h":return 1440*60*1e3;case"7d":return 10080*60*1e3;case"30d":return 720*60*60*1e3;case"1y":return 365*24*60*60*1e3;default:return 3600*1e3}}function g(l){return l==="raw"?"live (10s samples)":l==="hourly"?"hourly average":l==="daily"?"daily average":l}function x(l,m,c,t,e){if(!l||l.length===0)return`<div style="text-align: center; color: var(--muted); padding: 20px;">No data for ${escapeHtml(t)}</div>`;const a=l.map(m).filter(_=>_!=null);if(a.length===0)return`<div style="text-align: center; color: var(--muted); padding: 20px;">No data for ${escapeHtml(t)}</div>`;const o=Math.max(...a,1),i=Math.min(...a,0),n=o-i||1,r=600,d=80,y=4,C=(r-y*2)/Math.max(a.length-1,1),U=a.map((_,J)=>{const X=y+J*C,Q=d-y-(_-i)/n*(d-y*2);return`${X.toFixed(1)},${Q.toFixed(1)}`}).join(" "),q=a[a.length-1],F=a.reduce((_,J)=>_+J,0)/a.length;return`
|
||||
`,document.getElementById("save-all-alerts")?.addEventListener("click",async()=>{const n={};document.querySelectorAll("#stats-alerts-container tr[data-container]").forEach(r=>{const d=r.dataset.container;n[d]={cpuThreshold:parseInt(r.querySelector(".alert-cpu")?.value)||80,memoryThreshold:parseInt(r.querySelector(".alert-mem")?.value)||90,diskIOThreshold:parseInt(r.querySelector(".alert-disk")?.value)||50,autoRestart:!!r.querySelector(".alert-autorestart")?.checked,enabled:!0}});try{const d=await(await secureFetch("/api/v1/monitoring/alerts/config",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({configs:n})})).json(),y=document.getElementById("save-all-alerts");y.textContent=d.success?"\u2705 Saved":"\u274C Failed",setTimeout(()=>{y.textContent="Save All"},2e3)}catch{const d=document.getElementById("save-all-alerts");d.textContent="\u274C Error",setTimeout(()=>{d.textContent="Save All"},2e3)}}),document.getElementById("go-to-notifications")?.addEventListener("click",n=>{n.preventDefault(),k.classList.remove("show"),j(),document.getElementById("manage-notifications")?.click()}),document.querySelectorAll(".alert-test-btn").forEach(n=>{n.addEventListener("click",async()=>{const r=n.textContent;n.textContent="...";try{await secureFetch(`/api/v1/monitoring/alerts/${n.dataset.container}/test`,{method:"POST"}),n.textContent="\u2705",showNotification("Test alert sent for "+n.dataset.name,"success",3e3)}catch{n.textContent="\u274C"}setTimeout(()=>{n.textContent=r},2e3)})}),document.getElementById("upgrade-for-alerts")?.addEventListener("click",()=>{k.classList.remove("show"),j(),typeof openLicenseModal=="function"&&openLicenseModal()})}function C(){T&&clearInterval(T),z?.checked&&(T=setInterval(w,DC.POLL.STATS))}function j(){T&&(clearInterval(T),T=null)}B?.addEventListener("click",()=>{k.classList.add("show"),w(),C()}),A?.addEventListener("click",()=>{k.classList.remove("show"),j()}),k?.addEventListener("click",l=>{l.target===k&&(k.classList.remove("show"),j())}),I?.addEventListener("click",w),z?.addEventListener("change",()=>{z.checked?C():j()}),document.querySelector('[data-panel="stats-aggregated"]')?.addEventListener("click",E),document.querySelector('[data-panel="stats-alerts"]')?.addEventListener("click",O);const N=document.getElementById("stats-history-container"),R=document.getElementById("stats-history-container-area"),u=document.querySelectorAll(".stats-range-btn");let v="1h";function x(l){switch(l){case"1h":return 3600*1e3;case"24h":return 1440*60*1e3;case"7d":return 10080*60*1e3;case"30d":return 720*60*60*1e3;case"1y":return 365*24*60*60*1e3;default:return 3600*1e3}}function g(l){return l==="raw"?"live (10s samples)":l==="hourly"?"hourly average":l==="daily"?"daily average":l}function b(l,m,c,t,e){if(!l||l.length===0)return`<div style="text-align: center; color: var(--muted); padding: 20px;">No data for ${escapeHtml(t)}</div>`;const a=l.map(m).filter(_=>_!=null);if(a.length===0)return`<div style="text-align: center; color: var(--muted); padding: 20px;">No data for ${escapeHtml(t)}</div>`;const o=Math.max(...a,1),i=Math.min(...a,0),n=o-i||1,r=600,d=80,y=4,L=(r-y*2)/Math.max(a.length-1,1),U=a.map((_,J)=>{const X=y+J*L,Q=d-y-(_-i)/n*(d-y*2);return`${X.toFixed(1)},${Q.toFixed(1)}`}).join(" "),q=a[a.length-1],F=a.reduce((_,J)=>_+J,0)/a.length;return`
|
||||
<div style="margin-bottom: 14px;">
|
||||
<div style="display: flex; align-items: baseline; gap: 12px; margin-bottom: 4px;">
|
||||
<span style="font-weight: 600; font-size: 0.9rem;">${escapeHtml(t)}</span>
|
||||
@@ -1433,11 +1406,11 @@ This will replace current configuration, credentials, and data. Containers will
|
||||
<polyline fill="none" stroke="${c}" stroke-width="1.5" points="${U}" />
|
||||
</svg>
|
||||
</div>
|
||||
`}function s(){if(!N)return;const l=h||{},m=N.value,c=Object.entries(l);if(c.length===0){N.innerHTML='<option value="">No containers</option>';return}N.innerHTML=c.map(([t,e])=>`<option value="${escapeHtml(t)}">${escapeHtml(e.name||t)}</option>`).join(""),m&&l[m]&&(N.value=m)}async function p(){if(!R||!N)return;const l=N.value;if(!l){R.innerHTML='<div class="panel-empty"><span class="empty-icon">\u{1F4CA}</span>No container selected.</div>';return}const m=Date.now(),c=m-w(v);R.innerHTML='<div class="panel-empty"><span class="brand-spinner"></span> Loading history...</div>';try{const e=await(await fetch(`/api/v1/monitoring/history/${encodeURIComponent(l)}?startTime=${c}&endTime=${m}`)).json();if(!e.success)throw new Error(e.error||"Failed to load history");const a=e.samples||[],o=e.tier||"raw";if(a.length===0){R.innerHTML=`<div class="panel-empty"><span class="empty-icon">\u{1F4CA}</span>No data for the last ${v}. Tier: ${g(o)}.</div>`;return}const i=o==="raw",n=i?U=>U.cpu?.percent:U=>U.cpu?.avg,r=i?U=>U.memory?.percent:U=>U.memory?.avgPercent,d=i?U=>U.network?.rxMB||0:U=>U.network?.rxMB||0,y=i?U=>U.network?.txMB||0:U=>U.network?.txMB||0;let C=`
|
||||
`}function s(){if(!N)return;const l=f||{},m=N.value,c=Object.entries(l);if(c.length===0){N.innerHTML='<option value="">No containers</option>';return}N.innerHTML=c.map(([t,e])=>`<option value="${escapeHtml(t)}">${escapeHtml(e.name||t)}</option>`).join(""),m&&l[m]&&(N.value=m)}async function p(){if(!R||!N)return;const l=N.value;if(!l){R.innerHTML='<div class="panel-empty"><span class="empty-icon">\u{1F4CA}</span>No container selected.</div>';return}const m=Date.now(),c=m-x(v);R.innerHTML='<div class="panel-empty"><span class="brand-spinner"></span> Loading history...</div>';try{const e=await(await fetch(`/api/v1/monitoring/history/${encodeURIComponent(l)}?startTime=${c}&endTime=${m}`)).json();if(!e.success)throw new Error(e.error||"Failed to load history");const a=e.samples||[],o=e.tier||"raw";if(a.length===0){R.innerHTML=`<div class="panel-empty"><span class="empty-icon">\u{1F4CA}</span>No data for the last ${v}. Tier: ${g(o)}.</div>`;return}const i=o==="raw",n=i?U=>U.cpu?.percent:U=>U.cpu?.avg,r=i?U=>U.memory?.percent:U=>U.memory?.avgPercent,d=i?U=>U.network?.rxMB||0:U=>U.network?.rxMB||0,y=i?U=>U.network?.txMB||0:U=>U.network?.txMB||0;let L=`
|
||||
<div style="font-size: 0.75rem; color: var(--muted); margin-bottom: 8px;">
|
||||
${a.length} samples \xB7 ${escapeHtml(g(o))} \xB7 ${new Date(c).toLocaleString()} \u2192 ${new Date(m).toLocaleString()}
|
||||
</div>
|
||||
`;C+=x(a,n,"#2ecc71","CPU","%"),C+=x(a,r,"#3498db","Memory","%"),C+=x(a,d,"#9b59b6","Network RX"," MB"),C+=x(a,y,"#e67e22","Network TX"," MB"),R.innerHTML=C}catch(t){R.innerHTML=`<div class="panel-empty"><span class="empty-icon">\u26A0\uFE0F</span>Failed to load history: ${escapeHtml(t.message)}</div>`}}u.forEach(l=>{l.addEventListener("click",()=>{u.forEach(m=>m.classList.remove("active")),l.classList.add("active"),v=l.dataset.range,p()})}),N?.addEventListener("change",p),document.querySelector('[data-panel="stats-history"]')?.addEventListener("click",()=>{s(),p()})})(),(function(){injectModal("health-modal",`<div id="health-modal" class="weather-modal">
|
||||
`;L+=b(a,n,"#2ecc71","CPU","%"),L+=b(a,r,"#3498db","Memory","%"),L+=b(a,d,"#9b59b6","Network RX"," MB"),L+=b(a,y,"#e67e22","Network TX"," MB"),R.innerHTML=L}catch(t){R.innerHTML=`<div class="panel-empty"><span class="empty-icon">\u26A0\uFE0F</span>Failed to load history: ${escapeHtml(t.message)}</div>`}}u.forEach(l=>{l.addEventListener("click",()=>{u.forEach(m=>m.classList.remove("active")),l.classList.add("active"),v=l.dataset.range,p()})}),N?.addEventListener("change",p),document.querySelector('[data-panel="stats-history"]')?.addEventListener("click",()=>{s(),p()})})(),(function(){injectModal("health-modal",`<div id="health-modal" class="weather-modal">
|
||||
<div class="weather-modal-content" style="min-width: 800px; max-width: 1000px;">
|
||||
<h3>\u{1F3E5} Health Check Dashboard</h3>
|
||||
<p class="modal-subtitle">
|
||||
@@ -1561,7 +1534,7 @@ This will replace current configuration, credentials, and data. Containers will
|
||||
<button id="health-cancel">Close</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>`);const k=document.getElementById("health-modal"),B=document.getElementById("health-check-btn"),A=document.getElementById("health-cancel"),I=document.getElementById("health-refresh-btn"),z=document.getElementById("health-status-container"),P=document.getElementById("health-incidents-container"),M=document.getElementById("health-config-container"),D=document.getElementById("health-last-update"),b=document.getElementById("health-add-btn"),T=document.getElementById("health-config-form"),h=document.getElementById("health-form-title"),H=document.getElementById("health-form-cancel"),S=document.getElementById("health-form-save"),$="dashcaddy-health-settings",f={retentionDays:30,pollingInterval:60,statsPollingInterval:30,maxEntriesPerService:500,diskUsageThreshold:80},E=document.getElementById("health-global-save"),O=document.getElementById("health-global-reset"),L=document.getElementById("health-global-status"),j=document.getElementById("health-setting-retention"),N=document.getElementById("health-setting-interval"),R=document.getElementById("health-setting-stats-interval"),u=document.getElementById("health-setting-max-entries"),v=document.getElementById("health-setting-disk-threshold");function w(){try{const i=safeGet($),n=i?JSON.parse(i):{};return Object.assign({},f,n)}catch{return Object.assign({},f)}}function g(){const i=w();j&&(j.value=i.retentionDays),N&&(N.value=i.pollingInterval),R&&(R.value=i.statsPollingInterval),u&&(u.value=i.maxEntriesPerService),v&&(v.value=i.diskUsageThreshold)}function x(){const i={retentionDays:Math.max(1,Math.min(3650,parseInt(j?.value)||f.retentionDays)),pollingInterval:Math.max(5,Math.min(3600,parseInt(N?.value)||f.pollingInterval)),statsPollingInterval:Math.max(5,Math.min(3600,parseInt(R?.value)||f.statsPollingInterval)),maxEntriesPerService:Math.max(10,Math.min(1e5,parseInt(u?.value)||f.maxEntriesPerService)),diskUsageThreshold:Math.max(50,Math.min(99,parseInt(v?.value)||f.diskUsageThreshold))};try{safeSet($,JSON.stringify(i)),g(),L&&(L.textContent="Saved \u2713",L.style.color="var(--ok-fg)",setTimeout(()=>{L&&(L.textContent="")},2500)),typeof showNotification=="function"&&showNotification("Global health settings saved","success")}catch(n){L&&(L.textContent="Save failed",L.style.color="var(--bad-fg)"),typeof showNotification=="function"&&showNotification("Failed to save settings: "+n.message,"error")}}function s(){try{safeSet($,JSON.stringify(f))}catch{}g(),L&&(L.textContent="Reset to defaults \u2713",L.style.color="var(--ok-fg)",setTimeout(()=>{L&&(L.textContent="")},2500))}g(),E?.addEventListener("click",x),O?.addEventListener("click",s);let p=null;function l(i){return i>=99.9?"var(--ok-fg)":i>=95?"#f39c12":"var(--bad-fg)"}function m(i){const n={critical:"var(--bad-fg)",high:"#ff6b6b",medium:"#f39c12",low:"var(--muted)"};return`<span style="padding: 2px 8px; border-radius: 4px; font-size: 0.75rem; background: ${n[i]||"var(--muted)"}20; color: ${n[i]||"var(--muted)"};">${i}</span>`}async function c(){try{const n=await(await fetch("/api/v1/health-checks/status")).json();if(!n.success||!n.status||Object.keys(n.status).length===0){z.innerHTML='<div class="panel-empty"><span class="empty-icon">\u{1F3E5}</span>No health checks configured. Go to the Configure tab to add services.</div>';return}const r=Object.values(n.status);let d='<table style="width: 100%; border-collapse: collapse; font-size: 0.85rem;">';d+='<tr style="border-bottom: 1px solid var(--border); color: var(--muted); text-align: left;">',d+='<th style="padding: 8px;">Service</th><th style="padding: 8px;">Status</th>',d+='<th style="padding: 8px;">Uptime 24h</th><th style="padding: 8px;">Uptime 7d</th>',d+='<th style="padding: 8px;">Avg Response</th><th style="padding: 8px;">Last Check</th></tr>';for(const y of r){const C=y.status==="up",U=C?"var(--dot-ok)":"var(--dot-bad)",q=y.uptime?.["24h"]??"-",F=y.uptime?.["7d"]??"-",_=y.avgResponseTime!=null?Math.round(y.avgResponseTime)+"ms":"-",J=y.timestamp?timeAgo(y.timestamp):"-";d+=`<tr style="border-bottom: 1px solid var(--border); cursor: pointer;" data-health-id="${escapeHtml(y.serviceId)}">`,d+=`<td style="padding: 8px; font-weight: 500;">${escapeHtml(y.name||y.serviceId)}</td>`,d+=`<td style="padding: 8px;"><span style="display: inline-block; width: 8px; height: 8px; border-radius: 50%; background: ${U}; margin-right: 6px;"></span>${C?"Up":"Down"}</td>`,d+=`<td style="padding: 8px; color: ${typeof q=="number"?l(q):"var(--muted)"};">${typeof q=="number"?q.toFixed(1)+"%":q}</td>`,d+=`<td style="padding: 8px; color: ${typeof F=="number"?l(F):"var(--muted)"};">${typeof F=="number"?F.toFixed(1)+"%":F}</td>`,d+=`<td style="padding: 8px;">${_}</td>`,d+=`<td style="padding: 8px; color: var(--muted);">${J}</td>`,d+="</tr>",d+=`<tr id="health-detail-${escapeHtml(y.serviceId)}" style="display: none;"><td colspan="6" style="padding: 12px; background: var(--bg); border-bottom: 1px solid var(--border);"><div class="panel-empty"><span class="brand-spinner"></span> Loading Line truncated
|
||||
</div>`);const k=document.getElementById("health-modal"),B=document.getElementById("health-check-btn"),A=document.getElementById("health-cancel"),I=document.getElementById("health-refresh-btn"),z=document.getElementById("health-status-container"),P=document.getElementById("health-incidents-container"),M=document.getElementById("health-config-container"),D=document.getElementById("health-last-update"),h=document.getElementById("health-add-btn"),T=document.getElementById("health-config-form"),f=document.getElementById("health-form-title"),H=document.getElementById("health-form-cancel"),S=document.getElementById("health-form-save"),$="dashcaddy-health-settings",w={retentionDays:30,pollingInterval:60,statsPollingInterval:30,maxEntriesPerService:500,diskUsageThreshold:80},E=document.getElementById("health-global-save"),O=document.getElementById("health-global-reset"),C=document.getElementById("health-global-status"),j=document.getElementById("health-setting-retention"),N=document.getElementById("health-setting-interval"),R=document.getElementById("health-setting-stats-interval"),u=document.getElementById("health-setting-max-entries"),v=document.getElementById("health-setting-disk-threshold");function x(){try{const i=safeGet($),n=i?JSON.parse(i):{};return Object.assign({},w,n)}catch{return Object.assign({},w)}}function g(){const i=x();j&&(j.value=i.retentionDays),N&&(N.value=i.pollingInterval),R&&(R.value=i.statsPollingInterval),u&&(u.value=i.maxEntriesPerService),v&&(v.value=i.diskUsageThreshold)}function b(){const i={retentionDays:Math.max(1,Math.min(3650,parseInt(j?.value)||w.retentionDays)),pollingInterval:Math.max(5,Math.min(3600,parseInt(N?.value)||w.pollingInterval)),statsPollingInterval:Math.max(5,Math.min(3600,parseInt(R?.value)||w.statsPollingInterval)),maxEntriesPerService:Math.max(10,Math.min(1e5,parseInt(u?.value)||w.maxEntriesPerService)),diskUsageThreshold:Math.max(50,Math.min(99,parseInt(v?.value)||w.diskUsageThreshold))};try{safeSet($,JSON.stringify(i)),g(),C&&(C.textContent="Saved \u2713",C.style.color="var(--ok-fg)",setTimeout(()=>{C&&(C.textContent="")},2500)),typeof showNotification=="function"&&showNotification("Global health settings saved","success")}catch(n){C&&(C.textContent="Save failed",C.style.color="var(--bad-fg)"),typeof showNotification=="function"&&showNotification("Failed to save settings: "+n.message,"error")}}function s(){try{safeSet($,JSON.stringify(w))}catch{}g(),C&&(C.textContent="Reset to defaults \u2713",C.style.color="var(--ok-fg)",setTimeout(()=>{C&&(C.textContent="")},2500))}g(),E?.addEventListener("click",b),O?.addEventListener("click",s);let p=null;function l(i){return i>=99.9?"var(--ok-fg)":i>=95?"#f39c12":"var(--bad-fg)"}function m(i){const n={critical:"var(--bad-fg)",high:"#ff6b6b",medium:"#f39c12",low:"var(--muted)"};return`<span style="padding: 2px 8px; border-radius: 4px; font-size: 0.75rem; background: ${n[i]||"var(--muted)"}20; color: ${n[i]||"var(--muted)"};">${i}</span>`}async function c(){try{const n=await(await fetch("/api/v1/health-checks/status")).json();if(!n.success||!n.status||Object.keys(n.status).length===0){z.innerHTML='<div class="panel-empty"><span class="empty-icon">\u{1F3E5}</span>No health checks configured. Go to the Configure tab to add services.</div>';return}const r=Object.values(n.status);let d='<table style="width: 100%; border-collapse: collapse; font-size: 0.85rem;">';d+='<tr style="border-bottom: 1px solid var(--border); color: var(--muted); text-align: left;">',d+='<th style="padding: 8px;">Service</th><th style="padding: 8px;">Status</th>',d+='<th style="padding: 8px;">Uptime 24h</th><th style="padding: 8px;">Uptime 7d</th>',d+='<th style="padding: 8px;">Avg Response</th><th style="padding: 8px;">Last Check</th></tr>';for(const y of r){const L=y.status==="up",U=L?"var(--dot-ok)":"var(--dot-bad)",q=y.uptime?.["24h"]??"-",F=y.uptime?.["7d"]??"-",_=y.avgResponseTime!=null?Math.round(y.avgResponseTime)+"ms":"-",J=y.timestamp?timeAgo(y.timestamp):"-";d+=`<tr style="border-bottom: 1px solid var(--border); cursor: pointer;" data-health-id="${escapeHtml(y.serviceId)}">`,d+=`<td style="padding: 8px; font-weight: 500;">${escapeHtml(y.name||y.serviceId)}</td>`,d+=`<td style="padding: 8px;"><span style="display: inline-block; width: 8px; height: 8px; border-radius: 50%; background: ${U}; margin-right: 6px;"></span>${L?"Up":"Down"}</td>`,d+=`<td style="padding: 8px; color: ${typeof q=="number"?l(q):"var(--muted)"};">${typeof q=="number"?q.toFixed(1)+"%":q}</td>`,d+=`<td style="padding: 8px; color: ${typeof F=="number"?l(F):"var(--muted)"};">${typeof F=="number"?F.toFixed(1)+"%":F}</td>`,d+=`<td style="padding: 8px;">${_}</td>`,d+=`<td style="padding: 8px; color: var(--muted);">${J}</td>`,d+="</tr>",d+=`<tr id="health-detail-${escapeHtml(y.serviceId)}" style="display: none;"><td colspan="6" style="padding: 12px; background: var(--bg); border-bottom: 1px solid var(--border);"><div class="panel-empty"><span class="brand-spinner"></span> Loading Line truncated
|
||||
<div style="display: grid; grid-template-columns: repeat(4, 1fr); gap: 12px; font-size: 0.82rem;">
|
||||
<div><span style="color: var(--muted);">Total Checks</span><br><strong>${_.totalChecks||0}</strong></div>
|
||||
<div><span style="color: var(--muted);">Uptime</span><br><strong style="color: ${l(_.uptime||0)};">${(_.uptime||0).toFixed(2)}%</strong></div>
|
||||
@@ -1571,14 +1544,14 @@ This will replace current configuration, credentials, and data. Containers will
|
||||
<div><span style="color: var(--muted);">Max Response</span><br><strong>${Math.round(J.max||0)}ms</strong></div>
|
||||
<div><span style="color: var(--muted);">Up Checks</span><br><strong style="color: var(--ok-fg);">${_.upChecks||0}</strong></div>
|
||||
<div><span style="color: var(--muted);">Down Checks</span><br><strong style="color: var(--bad-fg);">${_.downChecks||0}</strong></div>
|
||||
</div>`}else U.querySelector("td").innerHTML='<div class="panel-empty">No detailed stats available for this period.</div>'}catch(q){U.querySelector("td").innerHTML=`<div class="panel-empty" style="color: var(--bad-fg);">Failed: ${escapeHtml(q.message)}</div>`}}})})}catch(i){z.innerHTML=`<div class="panel-empty" style="color: var(--bad-fg);">Failed to load health status: ${escapeHtml(i.message)}</div>`}}async function t(){try{const[i,n]=await Promise.all([fetch("/api/v1/health-checks/incidents"),fetch("/api/v1/health-checks/incidents/history?limit=50")]),r=await i.json(),d=await n.json();let y="";const C=r.success&&r.incidents?r.incidents:[];if(C.length>0){y+='<div style="margin-bottom: 16px;"><h4 style="color: var(--bad-fg); margin: 0 0 8px;">Open Incidents ('+C.length+")</h4>";for(const q of C)y+=`<div style="padding: 10px 12px; margin-bottom: 8px; border: 1px solid var(--bad-fg)30; border-radius: 8px; background: var(--bad-bg);">
|
||||
</div>`}else U.querySelector("td").innerHTML='<div class="panel-empty">No detailed stats available for this period.</div>'}catch(q){U.querySelector("td").innerHTML=`<div class="panel-empty" style="color: var(--bad-fg);">Failed: ${escapeHtml(q.message)}</div>`}}})})}catch(i){z.innerHTML=`<div class="panel-empty" style="color: var(--bad-fg);">Failed to load health status: ${escapeHtml(i.message)}</div>`}}async function t(){try{const[i,n]=await Promise.all([fetch("/api/v1/health-checks/incidents"),fetch("/api/v1/health-checks/incidents/history?limit=50")]),r=await i.json(),d=await n.json();let y="";const L=r.success&&r.incidents?r.incidents:[];if(L.length>0){y+='<div style="margin-bottom: 16px;"><h4 style="color: var(--bad-fg); margin: 0 0 8px;">Open Incidents ('+L.length+")</h4>";for(const q of L)y+=`<div style="padding: 10px 12px; margin-bottom: 8px; border: 1px solid var(--bad-fg)30; border-radius: 8px; background: var(--bad-bg);">
|
||||
<div style="display: flex; justify-content: space-between; align-items: center;">
|
||||
<span style="font-weight: 500;">${escapeHtml(q.serviceId)}</span>
|
||||
<span>${m(q.severity)}</span>
|
||||
</div>
|
||||
<div style="font-size: 0.82rem; color: var(--muted); margin-top: 4px;">${escapeHtml(q.message)}</div>
|
||||
<div style="font-size: 0.75rem; color: var(--muted); margin-top: 4px;">Started ${timeAgo(q.createdAt)} \xB7 ${q.occurrences||1} occurrence(s)</div>
|
||||
</div>`;y+="</div>"}else y+='<div style="padding: 12px; margin-bottom: 16px; border: 1px solid var(--ok-fg)30; border-radius: 8px; background: var(--ok-bg); text-align: center; color: var(--ok-fg); font-size: 0.9rem;">All services operational \u2014 no open incidents</div>';const U=d.success&&d.history?d.history:[];if(U.length>0){y+='<h4 style="margin: 0 0 8px; color: var(--muted);">Incident History</h4>',y+='<table style="width: 100%; border-collapse: collapse; font-size: 0.82rem;">',y+='<tr style="border-bottom: 1px solid var(--border); color: var(--muted);"><th style="padding: 6px; text-align: left;">Service</th><th style="padding: 6px; text-align: left;">Type</th><th style="padding: 6px; text-align: left;">Severity</th><th style="padding: 6px; text-align: left;">Status</th><th style="padding: 6px; text-align: left;">Duration</th><th style="padding: 6px; text-align: left;">When</th></tr>';for(const q of U){const F=q.status==="resolved",_=F&&q.duration?q.duration<6e4?Math.round(q.duration/1e3)+"s":Math.round(q.duration/6e4)+"m":"-";y+='<tr style="border-bottom: 1px solid var(--border);">',y+=`<td style="padding: 6px;">${escapeHtml(q.serviceId)}</td>`,y+=`<td style="padding: 6px;">${escapeHtml(q.type)}</td>`,y+=`<td style="padding: 6px;">${m(q.severity)}</td>`,y+=`<td style="padding: 6px;"><span style="color: ${F?"var(--ok-fg)":"var(--bad-fg)"};">${q.status}</span></td>`,y+=`<td style="padding: 6px;">${_}</td>`,y+=`<td style="padding: 6px; color: var(--muted);">${timeAgo(q.createdAt)}</td>`,y+="</tr>"}y+="</table>"}P.innerHTML=y||'<div class="panel-empty"><span class="empty-icon">\u{1F6A8}</span>No incidents recorded yet.</div>'}catch(i){P.innerHTML=`<div class="panel-empty" style="color: var(--bad-fg);">Failed: ${escapeHtml(i.message)}</div>`}}async function e(){try{const n=await(await fetch("/api/v1/health-checks/status")).json(),r=n.success&&n.status?Object.values(n.status):[];if(r.length===0){M.innerHTML='<div class="panel-empty"><span class="empty-icon">\u2699\uFE0F</span>No health checks configured yet. Click "Add Health Check" below.</div>';return}let d='<table style="width: 100%; border-collapse: collapse; font-size: 0.85rem;">';d+='<tr style="border-bottom: 1px solid var(--border); color: var(--muted);"><th style="padding: 8px; text-align: left;">Service</th><th style="padding: 8px; text-align: left;">Status</th><th style="padding: 8px; text-align: left;">SLA Target</th><th style="padding: 8px; text-align: right;">Actions</th></tr>';for(const y of r){const C=y.status==="up";d+='<tr style="border-bottom: 1px solid var(--border);">',d+=`<td style="padding: 8px; font-weight: 500;">${escapeHtml(y.name||y.serviceId)}</td>`,d+=`<td style="padding: 8px; color: ${C?"var(--ok-fg)":"var(--bad-fg)"};">${C?"Up":"Down"}</td>`,d+=`<td style="padding: 8px;">${y.sla?.target?y.sla.target+"%":"-"}</td>`,d+='<td style="padding: 8px; text-align: right;">',d+=`<button onclick="document.dispatchEvent(new CustomEvent('health-edit', {detail:'${escapeHtml(y.serviceId)}'}))" style="padding: 4px 10px; font-size: 0.78rem; margin-right: 4px;">Edit</button>`,d+=`<button onclick="document.dispatchEvent(new CustomEvent('health-delete', {detail:'${escapeHtml(y.serviceId)}'}))" style="padding: 4px 10px; font-size: 0.78rem; color: var(--bad-fg); border-color: var(--bad-fg);">Delete</button>`,d+="</td></tr>"}d+="</table>",M.innerHTML=d}catch(i){M.innerHTML=`<div class="panel-empty" style="color: var(--bad-fg);">Failed: ${escapeHtml(i.message)}</div>`}}function a(i,n,r,d,y,C,U){p=i||null,h.textContent=i?"Edit Health Check":"Add Health Check",document.getElementById("health-form-id").value=i||"",document.getElementById("health-form-id").disabled=!!i,document.getElementById("health-form-name").value=n||"",document.getElementById("health-form-url").value=r||"",document.getElementById("health-form-timeout").value=d||1e4,document.getElementById("health-form-codes").value=y||"200",document.getElementById("health-form-sla").value=C||99.9,document.getElementById("health-form-slow").value=U||5e3,T.style.display="",b.style.display="none"}function o(){T.style.display="none",b.style.display="",p=null}b?.addEventListener("click",()=>a("","","",1e4,"200",99.9,5e3)),H?.addEventListener("click",o),S?.addEventListener("click",async()=>{const i=p||document.getElementById("health-form-id").value.trim();if(!i)return showNotification("Service ID is required","warning");const n=document.getElementById("health-form-url").value.trim();if(!n)return showNotification("URL is required","warning");const r=document.getElementById("health-form-codes").value.split(",").map(y=>parseInt(y.trim())).filter(Boolean),d={name:document.getElementById("health-form-name").value.trim()||i,url:n,timeout:parseInt(document.getElementById("health-form-timeout").value)||1e4,expectedStatusCodes:r.length?r:[200],sla:{target:parseFloat(document.getElementById("health-form-sla").value)||99.9},slowResponseThreshold:parseInt(document.getElementById("health-form-slow").value)|Line truncated
|
||||
</div>`;y+="</div>"}else y+='<div style="padding: 12px; margin-bottom: 16px; border: 1px solid var(--ok-fg)30; border-radius: 8px; background: var(--ok-bg); text-align: center; color: var(--ok-fg); font-size: 0.9rem;">All services operational \u2014 no open incidents</div>';const U=d.success&&d.history?d.history:[];if(U.length>0){y+='<h4 style="margin: 0 0 8px; color: var(--muted);">Incident History</h4>',y+='<table style="width: 100%; border-collapse: collapse; font-size: 0.82rem;">',y+='<tr style="border-bottom: 1px solid var(--border); color: var(--muted);"><th style="padding: 6px; text-align: left;">Service</th><th style="padding: 6px; text-align: left;">Type</th><th style="padding: 6px; text-align: left;">Severity</th><th style="padding: 6px; text-align: left;">Status</th><th style="padding: 6px; text-align: left;">Duration</th><th style="padding: 6px; text-align: left;">When</th></tr>';for(const q of U){const F=q.status==="resolved",_=F&&q.duration?q.duration<6e4?Math.round(q.duration/1e3)+"s":Math.round(q.duration/6e4)+"m":"-";y+='<tr style="border-bottom: 1px solid var(--border);">',y+=`<td style="padding: 6px;">${escapeHtml(q.serviceId)}</td>`,y+=`<td style="padding: 6px;">${escapeHtml(q.type)}</td>`,y+=`<td style="padding: 6px;">${m(q.severity)}</td>`,y+=`<td style="padding: 6px;"><span style="color: ${F?"var(--ok-fg)":"var(--bad-fg)"};">${q.status}</span></td>`,y+=`<td style="padding: 6px;">${_}</td>`,y+=`<td style="padding: 6px; color: var(--muted);">${timeAgo(q.createdAt)}</td>`,y+="</tr>"}y+="</table>"}P.innerHTML=y||'<div class="panel-empty"><span class="empty-icon">\u{1F6A8}</span>No incidents recorded yet.</div>'}catch(i){P.innerHTML=`<div class="panel-empty" style="color: var(--bad-fg);">Failed: ${escapeHtml(i.message)}</div>`}}async function e(){try{const n=await(await fetch("/api/v1/health-checks/status")).json(),r=n.success&&n.status?Object.values(n.status):[];if(r.length===0){M.innerHTML='<div class="panel-empty"><span class="empty-icon">\u2699\uFE0F</span>No health checks configured yet. Click "Add Health Check" below.</div>';return}let d='<table style="width: 100%; border-collapse: collapse; font-size: 0.85rem;">';d+='<tr style="border-bottom: 1px solid var(--border); color: var(--muted);"><th style="padding: 8px; text-align: left;">Service</th><th style="padding: 8px; text-align: left;">Status</th><th style="padding: 8px; text-align: left;">SLA Target</th><th style="padding: 8px; text-align: right;">Actions</th></tr>';for(const y of r){const L=y.status==="up";d+='<tr style="border-bottom: 1px solid var(--border);">',d+=`<td style="padding: 8px; font-weight: 500;">${escapeHtml(y.name||y.serviceId)}</td>`,d+=`<td style="padding: 8px; color: ${L?"var(--ok-fg)":"var(--bad-fg)"};">${L?"Up":"Down"}</td>`,d+=`<td style="padding: 8px;">${y.sla?.target?y.sla.target+"%":"-"}</td>`,d+='<td style="padding: 8px; text-align: right;">',d+=`<button onclick="document.dispatchEvent(new CustomEvent('health-edit', {detail:'${escapeHtml(y.serviceId)}'}))" style="padding: 4px 10px; font-size: 0.78rem; margin-right: 4px;">Edit</button>`,d+=`<button onclick="document.dispatchEvent(new CustomEvent('health-delete', {detail:'${escapeHtml(y.serviceId)}'}))" style="padding: 4px 10px; font-size: 0.78rem; color: var(--bad-fg); border-color: var(--bad-fg);">Delete</button>`,d+="</td></tr>"}d+="</table>",M.innerHTML=d}catch(i){M.innerHTML=`<div class="panel-empty" style="color: var(--bad-fg);">Failed: ${escapeHtml(i.message)}</div>`}}function a(i,n,r,d,y,L,U){p=i||null,f.textContent=i?"Edit Health Check":"Add Health Check",document.getElementById("health-form-id").value=i||"",document.getElementById("health-form-id").disabled=!!i,document.getElementById("health-form-name").value=n||"",document.getElementById("health-form-url").value=r||"",document.getElementById("health-form-timeout").value=d||1e4,document.getElementById("health-form-codes").value=y||"200",document.getElementById("health-form-sla").value=L||99.9,document.getElementById("health-form-slow").value=U||5e3,T.style.display="",h.style.display="none"}function o(){T.style.display="none",h.style.display="",p=null}h?.addEventListener("click",()=>a("","","",1e4,"200",99.9,5e3)),H?.addEventListener("click",o),S?.addEventListener("click",async()=>{const i=p||document.getElementById("health-form-id").value.trim();if(!i)return showNotification("Service ID is required","warning");const n=document.getElementById("health-form-url").value.trim();if(!n)return showNotification("URL is required","warning");const r=document.getElementById("health-form-codes").value.split(",").map(y=>parseInt(y.trim())).filter(Boolean),d={name:document.getElementById("health-form-name").value.trim()||i,url:n,timeout:parseInt(document.getElementById("health-form-timeout").value)||1e4,expectedStatusCodes:r.length?r:[200],sla:{target:parseFloat(document.getElementById("health-form-sla").value)||99.9},slowResponseThreshold:parseInt(document.getElementById("health-form-slow").value)|Line truncated
|
||||
<div class="weather-modal-content" style="min-width: 750px; max-width: 950px;">
|
||||
<h3>\u2B06\uFE0F Update Management</h3>
|
||||
<p class="modal-subtitle">
|
||||
@@ -1652,17 +1625,17 @@ This will replace current configuration, credentials, and data. Containers will
|
||||
<button id="updates-cancel">Close</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>`);const k=document.getElementById("updates-modal"),B=document.getElementById("updates-btn"),A=document.getElementById("updates-cancel"),I=document.getElementById("updates-check-btn"),z=document.getElementById("updates-available-container"),P=document.getElementById("updates-history-container"),M=document.getElementById("updates-auto-container"),D=document.getElementById("updates-last-check");async function b(){try{const t=await(await fetch("/api/v1/updates/available")).json();if(!t.success)throw new Error(t.error);const e=t.updates||[];if(e.length===0){z.innerHTML='<div class="panel-empty"><span class="empty-icon">\u2705</span>All containers are up to date.</div>',D.textContent="",document.getElementById("updates-update-all-btn").style.display="none",document.getElementById("updates-count-badge").style.display="none",window._pendingUpdates=[];return}let a='<table style="width: 100%; border-collapse: collapse; font-size: 0.85rem;">';a+='<tr style="border-bottom: 1px solid var(--border); color: var(--muted);"><th style="padding: 8px; text-align: left;">Container</th><th style="padding: 8px; text-align: left;">Image</th><th style="padding: 8px; text-align: left;">Current</th><th style="padding: 8px; text-align: left;">Latest</th><th style="padding: 8px; text-align: right;">Actions</th></tr>';for(const n of e){const r=(()=>{const d=window.APPS||[];for(const y of d)if(y.containerId===n.containerId||y.name===n.containerName||y.id===n.containerName)return y.id;return n.containerName})();a+=`<tr data-app-id="${escapeHtml(r)}" style="border-bottom: 1px solid var(--border);">`,a+=`<td style="padding: 8px; font-weight: 500;">${escapeHtml(n.containerName)}</td>`,a+=`<td style="padding: 8px; color: var(--muted);">${escapeHtml(n.imageName)}</td>`,a+=`<td style="padding: 8px;"><code style="font-size: 0.78rem; background: var(--bg); padding: 2px 6px; border-radius: 4px;">${escapeHtml(n.currentDigest)}</code></td>`,a+=`<td style="padding: 8px;"><code style="font-size: 0.78rem; background: var(--ok-bg); color: var(--ok-fg); padding: 2px 6px; border-radius: 4px;">${escapeHtml(n.latestDigest)}</code></td>`,a+='<td style="padding: 8px; text-align: right;">',a+=`<button class="update-now-btn" data-id="${escapeHtml(n.containerId)}" data-name="${escapeHtml(n.containerName)}" style="padding: 4px 10px; font-size: 0.78rem; background: var(--accent); color: var(--bg); border-color: var(--accent); margin-right: 4px;">Update</button>`,a+=`<button class="rollback-btn" data-id="${escapeHtml(n.containerId)}" data-name="${escapeHtml(n.containerName)}" style="padding: 4px 10px; font-size: 0.78rem;">Rollback</button>`,a+="</td></tr>"}a+="</table>",z.innerHTML=a,D.textContent=e.length+" update(s) available";const o=document.getElementById("updates-count-badge"),i=document.getElementById("updates-update-all-btn");o&&(o.textContent=e.length+" pending",o.style.display=""),i&&e.length>0&&(i.style.display=""),window._pendingUpdates=e,z.querySelectorAll(".update-now-btn").forEach(n=>{n.addEventListener("click",async()=>{const r=n.dataset.id,d=n.dataset.name;if(confirm(`Update "${d}" to the latest version? The container will restart.`)){n.textContent="Updating...",n.disabled=!0;try{const C=await(await secureFetch(`/api/v1/updates/update/${encodeURIComponent(r)}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({autoRollback:!0})})).json();if(C.success)n.textContent="Done!",n.style.background="var(--ok-fg)",setTimeout(()=>b(),2e3);else throw new Error(C.error||"Update failed")}catch(y){n.textContent="Failed",n.style.color="var(--bad-fg)",showNotification("Update error: "+y.message,"error"),setTimeout(()=>{n.textContent="Update",n.disabled=!1,n.style.color="",n.style.background=""},3e3)}}})}),z.querySelectorAll(".rollback-btn").forEach(n=>{n.addEventListener("click",async()=>{const r=n.dataset.id,d=n.dataset.name;if(confirm(`Rollback "${d}" to its previous version?`)){n.textContent="Rolling back...",n.disabled=!0;try{const C=await(await secureFetch(`/api/v1/updates/rollback/${encodeURIComponent(r)}`,{method:"POST"})).json();if(C.success)n.textContent="Rolled back!",setTimeout(()=>b(),2e3);else throw new Error(C.error||"Rollback failed")}catch(y){n.textContent="Failed",showNotification("Rollback error: "+y.message,"error"),setTimeout(()=>{n.textContent="Rollback",n.disabled=!1},3e3)}}})})}catch(c){z.innerHTML=`<div class="panel-empty" style="color: var(--bad-fg);">Failed: ${escapeHtml(c.message)}</div>`}}async function T(){const c=window._pendingUpdates||[];if(!c.length)return;const t=document.getElementById("updates-update-all-btn");if(!confirm(`Update all ${c.length} containers? Each will restart.`))return;t.textContent="\u23F3 Updating...",t.disabled=!0;let e=0,a=0;for(const o of c)try{(await(await secureFetch(`/api/v1/updates/update/${encodeURIComponent(o.containerId)}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({autoRollback:!0})})).json()).success?e++:a++}catch{a++}t.textCLine truncated
|
||||
</div>`);const k=document.getElementById("updates-modal"),B=document.getElementById("updates-btn"),A=document.getElementById("updates-cancel"),I=document.getElementById("updates-check-btn"),z=document.getElementById("updates-available-container"),P=document.getElementById("updates-history-container"),M=document.getElementById("updates-auto-container"),D=document.getElementById("updates-last-check");async function h(){try{const t=await(await fetch("/api/v1/updates/available")).json();if(!t.success)throw new Error(t.error);const e=t.updates||[];if(e.length===0){z.innerHTML='<div class="panel-empty"><span class="empty-icon">\u2705</span>All containers are up to date.</div>',D.textContent="",document.getElementById("updates-update-all-btn").style.display="none",document.getElementById("updates-count-badge").style.display="none",window._pendingUpdates=[];return}let a='<table style="width: 100%; border-collapse: collapse; font-size: 0.85rem;">';a+='<tr style="border-bottom: 1px solid var(--border); color: var(--muted);"><th style="padding: 8px; text-align: left;">Container</th><th style="padding: 8px; text-align: left;">Image</th><th style="padding: 8px; text-align: left;">Current</th><th style="padding: 8px; text-align: left;">Latest</th><th style="padding: 8px; text-align: right;">Actions</th></tr>';for(const n of e){const r=(()=>{const d=window.APPS||[];for(const y of d)if(y.containerId===n.containerId||y.name===n.containerName||y.id===n.containerName)return y.id;return n.containerName})();a+=`<tr data-app-id="${escapeHtml(r)}" style="border-bottom: 1px solid var(--border);">`,a+=`<td style="padding: 8px; font-weight: 500;">${escapeHtml(n.containerName)}</td>`,a+=`<td style="padding: 8px; color: var(--muted);">${escapeHtml(n.imageName)}</td>`,a+=`<td style="padding: 8px;"><code style="font-size: 0.78rem; background: var(--bg); padding: 2px 6px; border-radius: 4px;">${escapeHtml(n.currentDigest)}</code></td>`,a+=`<td style="padding: 8px;"><code style="font-size: 0.78rem; background: var(--ok-bg); color: var(--ok-fg); padding: 2px 6px; border-radius: 4px;">${escapeHtml(n.latestDigest)}</code></td>`,a+='<td style="padding: 8px; text-align: right;">',a+=`<button class="update-now-btn" data-id="${escapeHtml(n.containerId)}" data-name="${escapeHtml(n.containerName)}" style="padding: 4px 10px; font-size: 0.78rem; background: var(--accent); color: var(--bg); border-color: var(--accent); margin-right: 4px;">Update</button>`,a+=`<button class="rollback-btn" data-id="${escapeHtml(n.containerId)}" data-name="${escapeHtml(n.containerName)}" style="padding: 4px 10px; font-size: 0.78rem;">Rollback</button>`,a+="</td></tr>"}a+="</table>",z.innerHTML=a,D.textContent=e.length+" update(s) available";const o=document.getElementById("updates-count-badge"),i=document.getElementById("updates-update-all-btn");o&&(o.textContent=e.length+" pending",o.style.display=""),i&&e.length>0&&(i.style.display=""),window._pendingUpdates=e,z.querySelectorAll(".update-now-btn").forEach(n=>{n.addEventListener("click",async()=>{const r=n.dataset.id,d=n.dataset.name;if(confirm(`Update "${d}" to the latest version? The container will restart.`)){n.textContent="Updating...",n.disabled=!0;try{const L=await(await secureFetch(`/api/v1/updates/update/${encodeURIComponent(r)}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({autoRollback:!0})})).json();if(L.success)n.textContent="Done!",n.style.background="var(--ok-fg)",setTimeout(()=>h(),2e3);else throw new Error(L.error||"Update failed")}catch(y){n.textContent="Failed",n.style.color="var(--bad-fg)",showNotification("Update error: "+y.message,"error"),setTimeout(()=>{n.textContent="Update",n.disabled=!1,n.style.color="",n.style.background=""},3e3)}}})}),z.querySelectorAll(".rollback-btn").forEach(n=>{n.addEventListener("click",async()=>{const r=n.dataset.id,d=n.dataset.name;if(confirm(`Rollback "${d}" to its previous version?`)){n.textContent="Rolling back...",n.disabled=!0;try{const L=await(await secureFetch(`/api/v1/updates/rollback/${encodeURIComponent(r)}`,{method:"POST"})).json();if(L.success)n.textContent="Rolled back!",setTimeout(()=>h(),2e3);else throw new Error(L.error||"Rollback failed")}catch(y){n.textContent="Failed",showNotification("Rollback error: "+y.message,"error"),setTimeout(()=>{n.textContent="Rollback",n.disabled=!1},3e3)}}})})}catch(c){z.innerHTML=`<div class="panel-empty" style="color: var(--bad-fg);">Failed: ${escapeHtml(c.message)}</div>`}}async function T(){const c=window._pendingUpdates||[];if(!c.length)return;const t=document.getElementById("updates-update-all-btn");if(!confirm(`Update all ${c.length} containers? Each will restart.`))return;t.textContent="\u23F3 Updating...",t.disabled=!0;let e=0,a=0;for(const o of c)try{(await(await secureFetch(`/api/v1/updates/update/${encodeURIComponent(o.containerId)}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({autoRollback:!0})})).json()).success?e++:a++}catch{a++}t.textCLine truncated
|
||||
<select class="auto-schedule" data-id="${escapeHtml(y)}" style="padding: 4px 8px; border-radius: 4px; border: 1px solid var(--border); background: var(--bg); color: var(--fg); font-size: 0.82rem;">
|
||||
<option value=""${U?"":" selected"}>Disabled</option>
|
||||
<option value="daily"${U==="daily"?" selected":""}>Daily</option>
|
||||
<option value="weekly"${U==="weekly"?" selected":""}>Weekly</option>
|
||||
<option value="monthly"${U==="monthly"?" selected":""}>Monthly</option>
|
||||
</select></td>`,n+=`<td style="padding: 8px;"><input type="text" class="auto-window" data-id="${escapeHtml(y)}" value="${escapeHtml(F)}" placeholder="02:00-04:00" style="width: 90px; padding: 3px 6px; font-size: 0.78rem; border: 1px solid var(--border); border-radius: 4px; background: var(--bg); color: var(--fg);" /></td>`,n+=`<td style="padding: 8px;"><input type="checkbox" class="auto-rollback" data-id="${escapeHtml(y)}"${q?" checked":""} /></td>`,n+=`<td style="padding: 8px; font-size: 0.78rem; color: var(--muted);">${_}</td>`,n+=`<td style="padding: 8px; text-align: right;"><button class="save-auto-btn" data-id="${escapeHtml(y)}" data-name="${escapeHtml(d)}" style="padding: 4px 10px; font-size: 0.78rem;">Save</button></td>`,n+="</tr>"}n+="</table>",M.innerHTML=n,M.querySelectorAll(".save-auto-btn").forEach(r=>{r.addEventListener("click",async()=>{const d=r.dataset.id,y=r.closest("tr"),C=y.querySelector(".auto-schedule").value,U=y.querySelector(".auto-rollback").checked,q=y.querySelector(".auto-window").value.trim();r.textContent="Saving...",r.disabled=!0;try{const _=await(await secureFetch(`/api/v1/updates/auto-update/${encodeURIComponent(d)}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({enabled:!!C,schedule:C||"weekly",autoRollback:U,maintenanceWindow:q||void 0})})).json();if(_.success)r.textContent="\u2713 Saved";else throw new Error(_.error)}catch(F){r.textContent="\u2717 Error",showNotification("Save error: "+F.message,"error")}setTimeout(()=>{r.textContent="Save",r.disabled=!1},2e3)})})}catch(c){M.innerHTML=`<div class="panel-empty" style="color: var(--bad-fg);">Failed: ${escapeHtml(c.message)}</div>`}}const $=document.getElementById("dashcaddy-current-version"),f=document.getElementById("dashcaddy-update-badge"),E=document.getElementById("dashcaddy-update-details"),O=document.getElementById("dashcaddy-new-version"),L=document.getElementById("dashcaddy-changelog"),j=document.getElementById("dashcaddy-apply-btn"),N=document.getElementById("dashcaddy-check-btn"),R=document.getElementById("dashcaddy-rollback-btn"),u=document.getElementById("dashcaddy-status-bar"),v=document.getElementById("dashcaddy-history-container");let w=null;function g(c,t){u&&(u.style.display="block",u.style.background=t==="error"?"var(--bad-bg)":t==="success"?"var(--ok-bg)":"var(--bg)",u.style.color=t==="error"?"var(--bad-fg)":t==="success"?"var(--ok-fg)":"var(--fg)",u.textContent=c)}async function x(){try{const t=await(await fetch("/api/v1/system/version")).json();if(t.success){const e=t.commit&&t.commit!=="unknown"?t.commit:null;$.textContent="v"+t.version+(e?" ("+e.substring(0,7)+")":"")}}catch{$.textContent="Unable to fetch version"}}async function s(c){c||(N.textContent="Checking...",N.disabled=!0);try{const e=await(await fetch("/api/v1/system/update-check")).json();if(w=e,e.success&&e.available&&e.remote){f.style.display="",E.style.display="",O.textContent="v"+e.remote.version,L.textContent=e.remote.changelog||"No changelog available.";const a=document.getElementById("updates-btn");if(a&&!a.querySelector(".update-dot")){const i=document.createElement("span");i.className="update-dot",i.style.cssText="position:absolute;top:2px;right:2px;width:8px;height:8px;border-radius:50%;background:var(--accent);",a.style.position="relative",a.appendChild(i)}const o=document.getElementById("updates-dashcaddy-tab");if(o&&!o.querySelector(".update-dot")){const i=document.createElement("span");i.className="update-dot",i.style.cssText="display:inline-block;width:6px;height:6px;border-radius:50%;background:var(--accent);margin-left:4px;vertical-align:middle;",o.appendChild(i)}}else f.style.display="none",E.style.display="none",await x(),c||g("You are running the latest version.","success");c||(N.textContent="Check for Updates",N.disabled=!1)}catch(t){c||(g("Failed to check: "+t.message,"error"),N.textContent="Check for Updates",N.disabled=!1)}}async function p(){if(!confirm("Apply DashCaddy update? The API container will restart."))return!1;j.textContent="Updating...",j.disabled=!0,g("Downloading and applying update...","info");try{const t=await(await secureFetch("/api/v1/system/update-apply",{method:"POST"})).json();if(t.success)return g("Update initiated: v"+(t.fromVersion||"?")+" \u2192 v"+(t.toVersion||"?")+". The container will restart shortly.","success"),j.textContent="Applied!",document.querySelectorAll(".update-dot").forEach(e=>e.remove()),!0;throw new Error(t.error||"Update failed")}catch(c){throw g("Update failed: "+c.message,"error"),j.textContent="Update Now",j.disabled=!1,c}}async function l(){try{const t=await(await fetch("/api/v1/system/update-history")).json(),e=t.success&&t.history?t.history:[];if(e.length===0){v.innerHTML='<div class="panel-empty"><span class="empty-icon">\u{1F4E6}</span>No self-update history.</div>';return}let a='<table style="width: 100%; border-collapse: collapse; font-size: 0.82rem;">';a+='<tr style="border-bottom: 1px solid var(--border); color: var(--mutLine truncated
|
||||
</select></td>`,n+=`<td style="padding: 8px;"><input type="text" class="auto-window" data-id="${escapeHtml(y)}" value="${escapeHtml(F)}" placeholder="02:00-04:00" style="width: 90px; padding: 3px 6px; font-size: 0.78rem; border: 1px solid var(--border); border-radius: 4px; background: var(--bg); color: var(--fg);" /></td>`,n+=`<td style="padding: 8px;"><input type="checkbox" class="auto-rollback" data-id="${escapeHtml(y)}"${q?" checked":""} /></td>`,n+=`<td style="padding: 8px; font-size: 0.78rem; color: var(--muted);">${_}</td>`,n+=`<td style="padding: 8px; text-align: right;"><button class="save-auto-btn" data-id="${escapeHtml(y)}" data-name="${escapeHtml(d)}" style="padding: 4px 10px; font-size: 0.78rem;">Save</button></td>`,n+="</tr>"}n+="</table>",M.innerHTML=n,M.querySelectorAll(".save-auto-btn").forEach(r=>{r.addEventListener("click",async()=>{const d=r.dataset.id,y=r.closest("tr"),L=y.querySelector(".auto-schedule").value,U=y.querySelector(".auto-rollback").checked,q=y.querySelector(".auto-window").value.trim();r.textContent="Saving...",r.disabled=!0;try{const _=await(await secureFetch(`/api/v1/updates/auto-update/${encodeURIComponent(d)}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({enabled:!!L,schedule:L||"weekly",autoRollback:U,maintenanceWindow:q||void 0})})).json();if(_.success)r.textContent="\u2713 Saved";else throw new Error(_.error)}catch(F){r.textContent="\u2717 Error",showNotification("Save error: "+F.message,"error")}setTimeout(()=>{r.textContent="Save",r.disabled=!1},2e3)})})}catch(c){M.innerHTML=`<div class="panel-empty" style="color: var(--bad-fg);">Failed: ${escapeHtml(c.message)}</div>`}}const $=document.getElementById("dashcaddy-current-version"),w=document.getElementById("dashcaddy-update-badge"),E=document.getElementById("dashcaddy-update-details"),O=document.getElementById("dashcaddy-new-version"),C=document.getElementById("dashcaddy-changelog"),j=document.getElementById("dashcaddy-apply-btn"),N=document.getElementById("dashcaddy-check-btn"),R=document.getElementById("dashcaddy-rollback-btn"),u=document.getElementById("dashcaddy-status-bar"),v=document.getElementById("dashcaddy-history-container");let x=null;function g(c,t){u&&(u.style.display="block",u.style.background=t==="error"?"var(--bad-bg)":t==="success"?"var(--ok-bg)":"var(--bg)",u.style.color=t==="error"?"var(--bad-fg)":t==="success"?"var(--ok-fg)":"var(--fg)",u.textContent=c)}async function b(){try{const t=await(await fetch("/api/v1/system/version")).json();if(t.success){const e=t.commit&&t.commit!=="unknown"?t.commit:null;$.textContent="v"+t.version+(e?" ("+e.substring(0,7)+")":"")}}catch{$.textContent="Unable to fetch version"}}async function s(c){c||(N.textContent="Checking...",N.disabled=!0);try{const e=await(await fetch("/api/v1/system/update-check")).json();if(x=e,e.success&&e.available&&e.remote){w.style.display="",E.style.display="",O.textContent="v"+e.remote.version,C.textContent=e.remote.changelog||"No changelog available.";const a=document.getElementById("updates-btn");if(a&&!a.querySelector(".update-dot")){const i=document.createElement("span");i.className="update-dot",i.style.cssText="position:absolute;top:2px;right:2px;width:8px;height:8px;border-radius:50%;background:var(--accent);",a.style.position="relative",a.appendChild(i)}const o=document.getElementById("updates-dashcaddy-tab");if(o&&!o.querySelector(".update-dot")){const i=document.createElement("span");i.className="update-dot",i.style.cssText="display:inline-block;width:6px;height:6px;border-radius:50%;background:var(--accent);margin-left:4px;vertical-align:middle;",o.appendChild(i)}}else w.style.display="none",E.style.display="none",await b(),c||g("You are running the latest version.","success");c||(N.textContent="Check for Updates",N.disabled=!1)}catch(t){c||(g("Failed to check: "+t.message,"error"),N.textContent="Check for Updates",N.disabled=!1)}}async function p(){if(!confirm("Apply DashCaddy update? The API container will restart."))return!1;j.textContent="Updating...",j.disabled=!0,g("Downloading and applying update...","info");try{const t=await(await secureFetch("/api/v1/system/update-apply",{method:"POST"})).json();if(t.success)return g("Update initiated: v"+(t.fromVersion||"?")+" \u2192 v"+(t.toVersion||"?")+". The container will restart shortly.","success"),j.textContent="Applied!",document.querySelectorAll(".update-dot").forEach(e=>e.remove()),!0;throw new Error(t.error||"Update failed")}catch(c){throw g("Update failed: "+c.message,"error"),j.textContent="Update Now",j.disabled=!1,c}}async function l(){try{const t=await(await fetch("/api/v1/system/update-history")).json(),e=t.success&&t.history?t.history:[];if(e.length===0){v.innerHTML='<div class="panel-empty"><span class="empty-icon">\u{1F4E6}</span>No self-update history.</div>';return}let a='<table style="width: 100%; border-collapse: collapse; font-size: 0.82rem;">';a+='<tr style="border-bottom: 1px solid var(--border); color: var(--mutLine truncated
|
||||
`+e.join(`
|
||||
`)+`
|
||||
|
||||
Enter version to rollback to:`);if(!a)return;if(!e.includes(a)){showNotification("Invalid version: "+a,"error");return}if(!confirm("Rollback DashCaddy to v"+a+"? The container will restart."))return;g("Rolling back to v"+a+"...","info");const i=await(await secureFetch("/api/v1/system/rollback",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({version:a})})).json();if(i.success)g("Rollback to v"+a+" initiated. Container will restart.","success");else throw new Error(i.error||"Rollback failed")}catch(c){g("Rollback failed: "+c.message,"error")}}N?.addEventListener("click",()=>s(!1)),j?.addEventListener("click",()=>p().catch(()=>{})),R?.addEventListener("click",m),I?.addEventListener("click",h),B?.addEventListener("click",()=>{k?.classList.add("show"),b()}),wireModal(k,A),window.openUpdateModal=function(c){k?.classList.add("show"),b().then(()=>{if(!c)return;const t=z.querySelector(`[data-app-id="${c}"]`);t&&(t.scrollIntoView({behavior:"smooth",block:"center"}),t.style.background="rgba(249,115,22,0.15)",setTimeout(()=>{t.style.background=""},3e3))})},document.querySelector('[data-panel="updates-history"]')?.addEventListener("click",H),document.querySelector('[data-panel="updates-auto"]')?.addEventListener("click",S),document.querySelector('[data-panel="updates-dashcaddy"]')?.addEventListener("click",()=>{x(),l(),w||s(!0)}),window.dcApplyUpdate=p,window.dcCheckForUpdate=s,setTimeout(()=>s(!0),5e3)})(),(function(){injectModal("docker-resources-modal",`<div id="docker-resources-modal" class="weather-modal">
|
||||
Enter version to rollback to:`);if(!a)return;if(!e.includes(a)){showNotification("Invalid version: "+a,"error");return}if(!confirm("Rollback DashCaddy to v"+a+"? The container will restart."))return;g("Rolling back to v"+a+"...","info");const i=await(await secureFetch("/api/v1/system/rollback",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({version:a})})).json();if(i.success)g("Rollback to v"+a+" initiated. Container will restart.","success");else throw new Error(i.error||"Rollback failed")}catch(c){g("Rollback failed: "+c.message,"error")}}N?.addEventListener("click",()=>s(!1)),j?.addEventListener("click",()=>p().catch(()=>{})),R?.addEventListener("click",m),I?.addEventListener("click",f),B?.addEventListener("click",()=>{k?.classList.add("show"),h()}),wireModal(k,A),window.openUpdateModal=function(c){k?.classList.add("show"),h().then(()=>{if(!c)return;const t=z.querySelector(`[data-app-id="${c}"]`);t&&(t.scrollIntoView({behavior:"smooth",block:"center"}),t.style.background="rgba(249,115,22,0.15)",setTimeout(()=>{t.style.background=""},3e3))})},document.querySelector('[data-panel="updates-history"]')?.addEventListener("click",H),document.querySelector('[data-panel="updates-auto"]')?.addEventListener("click",S),document.querySelector('[data-panel="updates-dashcaddy"]')?.addEventListener("click",()=>{b(),l(),x||s(!0)}),window.dcApplyUpdate=p,window.dcCheckForUpdate=s,setTimeout(()=>s(!0),5e3)})(),(function(){injectModal("docker-resources-modal",`<div id="docker-resources-modal" class="weather-modal">
|
||||
<div class="weather-modal-content" style="min-width: 750px; max-width: 950px;">
|
||||
<h3>\u{1F433} Docker Resources</h3>
|
||||
<p class="modal-subtitle">Manage volumes, networks, and view disk usage.</p>
|
||||
@@ -1711,7 +1684,7 @@ Enter version to rollback to:`);if(!a)return;if(!e.includes(a)){showNotification
|
||||
<button id="dr-close">Close</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>`);const k=document.getElementById("docker-resources-modal"),B=document.getElementById("docker-resources-btn"),A=document.getElementById("dr-close");function I(D){if(!D||D===0)return"0 B";const b=["B","KB","MB","GB","TB"],T=Math.floor(Math.log(Math.abs(D))/Math.log(1024));return(D/Math.pow(1024,T)).toFixed(1)+" "+b[T]}async function z(){const D=document.getElementById("dr-vol-list");try{const T=(await getJSON("/api/v1/docker/volumes")).volumes||[];if(T.length===0){D.innerHTML='<div class="panel-empty"><span class="empty-icon">\u{1F4E6}</span>No volumes found.</div>';return}let h='<table style="width: 100%; border-collapse: collapse; font-size: 0.82rem;">';h+='<tr style="border-bottom: 1px solid var(--border); color: var(--muted);"><th style="padding: 6px; text-align: left;">Name</th><th style="padding: 6px;">Driver</th><th style="padding: 6px;">Scope</th><th style="padding: 6px; text-align: right;">Actions</th></tr>';for(const H of T){const S=H.name==="buildkit"||H.name.length===64;h+='<tr style="border-bottom: 1px solid var(--border);">',h+=`<td style="padding: 6px; font-weight: 500; max-width: 300px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap;" title="${escapeHtml(H.name)}">${escapeHtml(H.name.length>40?H.name.substring(0,37)+"...":H.name)}</td>`,h+=`<td style="padding: 6px; text-align: center; color: var(--muted);">${escapeHtml(H.driver)}</td>`,h+=`<td style="padding: 6px; text-align: center; color: var(--muted);">${escapeHtml(H.scope)}</td>`,h+='<td style="padding: 6px; text-align: right;">',S||(h+=`<button class="dr-vol-del" data-name="${escapeHtml(H.name)}" style="padding: 3px 8px; font-size: 0.75rem; color: var(--bad-fg);">Delete</button>`),h+="</td></tr>"}h+="</table>",D.innerHTML=h,D.querySelectorAll(".dr-vol-del").forEach(H=>{H.addEventListener("click",async()=>{if(confirm(`Delete volume "${H.dataset.name}"? Data will be lost.`)){H.textContent="...",H.disabled=!0;try{await deleteAPI(`/api/v1/docker/volumes/${encodeURIComponent(H.dataset.name)}?force=true`),z()}catch(S){showNotification("Delete failed: "+S.message,"error"),H.textContent="Delete",H.disabled=!1}}})})}catch(b){D.innerHTML=`<div class="panel-empty" style="color: var(--bad-fg);">Failed: ${escapeHtml(b.message)}</div>`}}document.getElementById("dr-vol-create")?.addEventListener("click",async()=>{const D=document.getElementById("dr-vol-name"),b=D.value.trim();if(!b){showNotification("Enter a volume name","warning");return}try{await postJSON("/api/v1/docker/volumes",{name:b}),D.value="",showNotification(`Volume "${b}" created`,"success"),z()}catch(T){showNotification("Create failed: "+T.message,"error")}});async function P(){const D=document.getElementById("dr-net-list");try{const T=(await getJSON("/api/v1/docker/networks")).networks||[];if(T.length===0){D.innerHTML='<div class="panel-empty"><span class="empty-icon">\u{1F310}</span>No networks found.</div>';return}let h='<table style="width: 100%; border-collapse: collapse; font-size: 0.82rem;">';h+='<tr style="border-bottom: 1px solid var(--border); color: var(--muted);"><th style="padding: 6px; text-align: left;">Name</th><th style="padding: 6px;">Driver</th><th style="padding: 6px;">Scope</th><th style="padding: 6px;">Containers</th><th style="padding: 6px; text-align: right;">Actions</th></tr>';for(const H of T){const S=["bridge","host","none"].includes(H.name);h+='<tr style="border-bottom: 1px solid var(--border);">',h+=`<td style="padding: 6px; font-weight: 500;">${escapeHtml(H.name)}</td>`,h+=`<td style="padding: 6px; text-align: center; color: var(--muted);">${escapeHtml(H.driver)}</td>`,h+=`<td style="padding: 6px; text-align: center; color: var(--muted);">${escapeHtml(H.scope)}</td>`,h+=`<td style="padding: 6px; text-align: center;">${H.containers}</td>`,h+='<td style="padding: 6px; text-align: right;">',S||(h+=`<button class="dr-net-del" data-id="${escapeHtml(H.id)}" data-name="${escapeHtml(H.name)}" style="padding: 3px 8px; font-size: 0.75rem; color: var(--bad-fg);">Delete</button>`),h+="</td></tr>"}h+="</table>",D.innerHTML=h,D.querySelectorAll(".dr-net-del").forEach(H=>{H.addEventListener("click",async()=>{if(confirm(`Delete network "${H.dataset.name}"?`)){H.textContent="...",H.disabled=!0;try{await deleteAPI(`/api/v1/docker/networks/${encodeURIComponent(H.dataset.id)}`),P()}catch(S){showNotification("Delete failed: "+S.message,"error"),H.textContent="Delete",H.disabled=!1}}})})}catch(b){D.innerHTML=`<div class="panel-empty" style="color: var(--bad-fg);">Failed: ${escapeHtml(b.message)}</div>`}}document.getElementById("dr-net-create")?.addEventListener("click",async()=>{const D=document.getElementById("dr-net-name"),b=document.getElementById("dr-net-driver"),T=D.value.trim();if(!T){showNotification("Enter a network name","warning");return}try{await postJSON("/api/v1/docker/networks",{name:T,driver:b.value}),D.value="",showNotification(`Network "${T}" created`,"success"),P()}catch(h){showNotification("Create failed: "+h.message,"error")}});async fuLine truncated
|
||||
</div>`);const k=document.getElementById("docker-resources-modal"),B=document.getElementById("docker-resources-btn"),A=document.getElementById("dr-close");function I(D){if(!D||D===0)return"0 B";const h=["B","KB","MB","GB","TB"],T=Math.floor(Math.log(Math.abs(D))/Math.log(1024));return(D/Math.pow(1024,T)).toFixed(1)+" "+h[T]}async function z(){const D=document.getElementById("dr-vol-list");try{const T=(await getJSON("/api/v1/docker/volumes")).volumes||[];if(T.length===0){D.innerHTML='<div class="panel-empty"><span class="empty-icon">\u{1F4E6}</span>No volumes found.</div>';return}let f='<table style="width: 100%; border-collapse: collapse; font-size: 0.82rem;">';f+='<tr style="border-bottom: 1px solid var(--border); color: var(--muted);"><th style="padding: 6px; text-align: left;">Name</th><th style="padding: 6px;">Driver</th><th style="padding: 6px;">Scope</th><th style="padding: 6px; text-align: right;">Actions</th></tr>';for(const H of T){const S=H.name==="buildkit"||H.name.length===64;f+='<tr style="border-bottom: 1px solid var(--border);">',f+=`<td style="padding: 6px; font-weight: 500; max-width: 300px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap;" title="${escapeHtml(H.name)}">${escapeHtml(H.name.length>40?H.name.substring(0,37)+"...":H.name)}</td>`,f+=`<td style="padding: 6px; text-align: center; color: var(--muted);">${escapeHtml(H.driver)}</td>`,f+=`<td style="padding: 6px; text-align: center; color: var(--muted);">${escapeHtml(H.scope)}</td>`,f+='<td style="padding: 6px; text-align: right;">',S||(f+=`<button class="dr-vol-del" data-name="${escapeHtml(H.name)}" style="padding: 3px 8px; font-size: 0.75rem; color: var(--bad-fg);">Delete</button>`),f+="</td></tr>"}f+="</table>",D.innerHTML=f,D.querySelectorAll(".dr-vol-del").forEach(H=>{H.addEventListener("click",async()=>{if(confirm(`Delete volume "${H.dataset.name}"? Data will be lost.`)){H.textContent="...",H.disabled=!0;try{await deleteAPI(`/api/v1/docker/volumes/${encodeURIComponent(H.dataset.name)}?force=true`),z()}catch(S){showNotification("Delete failed: "+S.message,"error"),H.textContent="Delete",H.disabled=!1}}})})}catch(h){D.innerHTML=`<div class="panel-empty" style="color: var(--bad-fg);">Failed: ${escapeHtml(h.message)}</div>`}}document.getElementById("dr-vol-create")?.addEventListener("click",async()=>{const D=document.getElementById("dr-vol-name"),h=D.value.trim();if(!h){showNotification("Enter a volume name","warning");return}try{await postJSON("/api/v1/docker/volumes",{name:h}),D.value="",showNotification(`Volume "${h}" created`,"success"),z()}catch(T){showNotification("Create failed: "+T.message,"error")}});async function P(){const D=document.getElementById("dr-net-list");try{const T=(await getJSON("/api/v1/docker/networks")).networks||[];if(T.length===0){D.innerHTML='<div class="panel-empty"><span class="empty-icon">\u{1F310}</span>No networks found.</div>';return}let f='<table style="width: 100%; border-collapse: collapse; font-size: 0.82rem;">';f+='<tr style="border-bottom: 1px solid var(--border); color: var(--muted);"><th style="padding: 6px; text-align: left;">Name</th><th style="padding: 6px;">Driver</th><th style="padding: 6px;">Scope</th><th style="padding: 6px;">Containers</th><th style="padding: 6px; text-align: right;">Actions</th></tr>';for(const H of T){const S=["bridge","host","none"].includes(H.name);f+='<tr style="border-bottom: 1px solid var(--border);">',f+=`<td style="padding: 6px; font-weight: 500;">${escapeHtml(H.name)}</td>`,f+=`<td style="padding: 6px; text-align: center; color: var(--muted);">${escapeHtml(H.driver)}</td>`,f+=`<td style="padding: 6px; text-align: center; color: var(--muted);">${escapeHtml(H.scope)}</td>`,f+=`<td style="padding: 6px; text-align: center;">${H.containers}</td>`,f+='<td style="padding: 6px; text-align: right;">',S||(f+=`<button class="dr-net-del" data-id="${escapeHtml(H.id)}" data-name="${escapeHtml(H.name)}" style="padding: 3px 8px; font-size: 0.75rem; color: var(--bad-fg);">Delete</button>`),f+="</td></tr>"}f+="</table>",D.innerHTML=f,D.querySelectorAll(".dr-net-del").forEach(H=>{H.addEventListener("click",async()=>{if(confirm(`Delete network "${H.dataset.name}"?`)){H.textContent="...",H.disabled=!0;try{await deleteAPI(`/api/v1/docker/networks/${encodeURIComponent(H.dataset.id)}`),P()}catch(S){showNotification("Delete failed: "+S.message,"error"),H.textContent="Delete",H.disabled=!1}}})})}catch(h){D.innerHTML=`<div class="panel-empty" style="color: var(--bad-fg);">Failed: ${escapeHtml(h.message)}</div>`}}document.getElementById("dr-net-create")?.addEventListener("click",async()=>{const D=document.getElementById("dr-net-name"),h=document.getElementById("dr-net-driver"),T=D.value.trim();if(!T){showNotification("Enter a network name","warning");return}try{await postJSON("/api/v1/docker/networks",{name:T,driver:h.value}),D.value="",showNotification(`Network "${T}" created`,"success"),P()}catch(f){showNotification("Create failed: "+f.message,"error")}});async fuLine truncated
|
||||
<div class="weather-modal-content" style="min-width: 650px; max-width: 800px;">
|
||||
<h3>\u{1F4E6} Import Docker Compose</h3>
|
||||
<p class="modal-subtitle">Paste a docker-compose.yml to import and deploy services.</p>
|
||||
@@ -1752,7 +1725,7 @@ Enter version to rollback to:`);if(!a)return;if(!e.includes(a)){showNotification
|
||||
<div id="compose-progress-content"></div>
|
||||
</div>
|
||||
</div>
|
||||
</div>`);const k=document.getElementById("compose-import-modal"),B=document.getElementById("compose-import-btn"),A=document.getElementById("compose-cancel");wireModal(k,A);let I=null;function z(M){document.getElementById("compose-step-paste").style.display=M==="paste"?"":"none",document.getElementById("compose-step-preview").style.display=M==="preview"?"":"none",document.getElementById("compose-step-progress").style.display=M==="progress"?"":"none"}B?.addEventListener("click",()=>{z("paste"),I=null,document.getElementById("compose-yaml").value="",document.getElementById("compose-stack-name").value="",k?.classList.add("show")}),document.getElementById("compose-file-upload")?.addEventListener("change",M=>{const D=M.target.files[0];if(!D)return;const b=new FileReader;b.onload=()=>{document.getElementById("compose-yaml").value=b.result},b.readAsText(D)}),document.getElementById("compose-parse-btn")?.addEventListener("click",async()=>{const M=document.getElementById("compose-yaml").value.trim(),D=document.getElementById("compose-stack-name").value.trim()||"stack";if(!M){showNotification("Paste a docker-compose.yml","warning");return}const b=document.getElementById("compose-parse-btn"),T=b.textContent;b.textContent="Parsing...",b.disabled=!0;try{const h=await postJSON("/api/v1/apps/import-compose",{yaml:M,stackName:D});I=h,I.stackName=D,P(h),z("preview")}catch(h){showNotification("Parse failed: "+h.message,"error")}finally{b.textContent=T,b.disabled=!1}});function P(M){const D=document.getElementById("compose-preview-content");let b="";M.networks&&M.networks.length>0&&(b+=`<div style="margin-bottom: 12px; font-size: 0.82rem; color: var(--muted);">Networks: ${M.networks.map(T=>`<code>${escapeHtml(T)}</code>`).join(", ")}</div>`),M.volumes&&M.volumes.length>0&&(b+=`<div style="margin-bottom: 12px; font-size: 0.82rem; color: var(--muted);">Volumes: ${M.volumes.map(T=>`<code>${escapeHtml(T)}</code>`).join(", ")}</div>`),b+=`<div style="font-weight: 600; margin-bottom: 8px;">${M.services.length} service(s)</div>`,b+='<div class="scroll-container" style="max-height: 350px;">';for(const T of M.services){const h=T.skip?"var(--bad-fg)":"var(--border)";if(b+=`<div style="padding: 10px 14px; border: 1px solid ${h}; border-radius: 8px; margin-bottom: 8px; background: var(--bg);">`,b+=`<div style="font-weight: 600; font-size: 0.9rem;">${escapeHtml(T.name)}`,T.skip&&(b+=` <span style="color: var(--bad-fg); font-weight: 400; font-size: 0.78rem;">\u2014 skipped: ${escapeHtml(T.reason)}</span>`),b+="</div>",!T.skip&&(b+=`<div style="font-size: 0.8rem; color: var(--muted); margin-top: 4px;">Image: <code>${escapeHtml(T.image)}</code></div>`,T.ports?.length&&(b+=`<div style="font-size: 0.8rem; color: var(--muted);">Ports: ${T.ports.map(H=>`${H.host}:${H.container}`).join(", ")}</div>`),T.volumes?.length&&(b+=`<div style="font-size: 0.8rem; color: var(--muted);">Volumes: ${T.volumes.length}</div>`),Object.keys(T.environment||{}).length&&(b+=`<div style="font-size: 0.8rem; color: var(--muted);">Env vars: ${Object.keys(T.environment).length}</div>`),T.envFileWarning&&(b+=`<div style="font-size: 0.78rem; color: var(--bad-fg);">\u26A0 ${escapeHtml(T.envFileWarning)}</div>`),T.resources?.cpus||T.resources?.memory)){const H=[];T.resources.cpus&&H.push(`CPU: ${T.resources.cpus}`),T.resources.memory&&H.push(`Mem: ${T.resources.memory}MB`),b+=`<div style="font-size: 0.8rem; color: var(--muted);">Limits: ${H.join(", ")}</div>`}b+="</div>"}b+="</div>",D.innerHTML=b}document.getElementById("compose-back-btn")?.addEventListener("click",()=>z("paste")),document.getElementById("compose-deploy-btn")?.addEventListener("click",async()=>{if(!I)return;const M=document.getElementById("compose-deploy-btn");M.textContent="Deploying...",M.disabled=!0,z("progress");const D=document.getElementById("compose-progress-content");D.innerHTML='<div class="panel-empty"><span class="brand-spinner"></span> Deploying services...</div>';try{const b=await postJSON("/api/v1/apps/deploy-compose",{services:I.services,networks:I.networks,stackName:I.stackName});let T=`<div style="font-weight: 600; margin-bottom: 12px;">Stack "${escapeHtml(b.stackName)}" \u2014 Deployment Complete</div>`;T+='<div class="scroll-container" style="max-height: 350px;">';for(const h of b.results){const H=h.status==="deployed"||h.status==="created"?"\u2705":h.status==="exists"?"\u26A1":h.status==="skipped"?"\u23ED":"\u274C";T+='<div style="padding: 8px 12px; border-bottom: 1px solid var(--border); font-size: 0.85rem;">',T+=`${H} <strong>${escapeHtml(h.name)}</strong> (${h.type}) \u2014 ${escapeHtml(h.status)}`,h.error&&(T+=` <span style="color: var(--bad-fg);">${escapeHtml(h.error)}</span>`),h.subdomain&&(T+=` \u2192 <code>${escapeHtml(h.subdomain)}</code>`),h.reason&&(T+=` <span style="color: var(--muted);">(${escapeHtml(h.reason)})</span>`),T+="</div>"}T+="</div>",T+='<div class="weather-modal-buttons modal-footer-bar" style="margin-top: 16px;"><button id="compose-done-btn">Done</button></div>Line truncated
|
||||
</div>`);const k=document.getElementById("compose-import-modal"),B=document.getElementById("compose-import-btn"),A=document.getElementById("compose-cancel");wireModal(k,A);let I=null;function z(M){document.getElementById("compose-step-paste").style.display=M==="paste"?"":"none",document.getElementById("compose-step-preview").style.display=M==="preview"?"":"none",document.getElementById("compose-step-progress").style.display=M==="progress"?"":"none"}B?.addEventListener("click",()=>{z("paste"),I=null,document.getElementById("compose-yaml").value="",document.getElementById("compose-stack-name").value="",k?.classList.add("show")}),document.getElementById("compose-file-upload")?.addEventListener("change",M=>{const D=M.target.files[0];if(!D)return;const h=new FileReader;h.onload=()=>{document.getElementById("compose-yaml").value=h.result},h.readAsText(D)}),document.getElementById("compose-parse-btn")?.addEventListener("click",async()=>{const M=document.getElementById("compose-yaml").value.trim(),D=document.getElementById("compose-stack-name").value.trim()||"stack";if(!M){showNotification("Paste a docker-compose.yml","warning");return}const h=document.getElementById("compose-parse-btn"),T=h.textContent;h.textContent="Parsing...",h.disabled=!0;try{const f=await postJSON("/api/v1/apps/import-compose",{yaml:M,stackName:D});I=f,I.stackName=D,P(f),z("preview")}catch(f){showNotification("Parse failed: "+f.message,"error")}finally{h.textContent=T,h.disabled=!1}});function P(M){const D=document.getElementById("compose-preview-content");let h="";M.networks&&M.networks.length>0&&(h+=`<div style="margin-bottom: 12px; font-size: 0.82rem; color: var(--muted);">Networks: ${M.networks.map(T=>`<code>${escapeHtml(T)}</code>`).join(", ")}</div>`),M.volumes&&M.volumes.length>0&&(h+=`<div style="margin-bottom: 12px; font-size: 0.82rem; color: var(--muted);">Volumes: ${M.volumes.map(T=>`<code>${escapeHtml(T)}</code>`).join(", ")}</div>`),h+=`<div style="font-weight: 600; margin-bottom: 8px;">${M.services.length} service(s)</div>`,h+='<div class="scroll-container" style="max-height: 350px;">';for(const T of M.services){const f=T.skip?"var(--bad-fg)":"var(--border)";if(h+=`<div style="padding: 10px 14px; border: 1px solid ${f}; border-radius: 8px; margin-bottom: 8px; background: var(--bg);">`,h+=`<div style="font-weight: 600; font-size: 0.9rem;">${escapeHtml(T.name)}`,T.skip&&(h+=` <span style="color: var(--bad-fg); font-weight: 400; font-size: 0.78rem;">\u2014 skipped: ${escapeHtml(T.reason)}</span>`),h+="</div>",!T.skip&&(h+=`<div style="font-size: 0.8rem; color: var(--muted); margin-top: 4px;">Image: <code>${escapeHtml(T.image)}</code></div>`,T.ports?.length&&(h+=`<div style="font-size: 0.8rem; color: var(--muted);">Ports: ${T.ports.map(H=>`${H.host}:${H.container}`).join(", ")}</div>`),T.volumes?.length&&(h+=`<div style="font-size: 0.8rem; color: var(--muted);">Volumes: ${T.volumes.length}</div>`),Object.keys(T.environment||{}).length&&(h+=`<div style="font-size: 0.8rem; color: var(--muted);">Env vars: ${Object.keys(T.environment).length}</div>`),T.envFileWarning&&(h+=`<div style="font-size: 0.78rem; color: var(--bad-fg);">\u26A0 ${escapeHtml(T.envFileWarning)}</div>`),T.resources?.cpus||T.resources?.memory)){const H=[];T.resources.cpus&&H.push(`CPU: ${T.resources.cpus}`),T.resources.memory&&H.push(`Mem: ${T.resources.memory}MB`),h+=`<div style="font-size: 0.8rem; color: var(--muted);">Limits: ${H.join(", ")}</div>`}h+="</div>"}h+="</div>",D.innerHTML=h}document.getElementById("compose-back-btn")?.addEventListener("click",()=>z("paste")),document.getElementById("compose-deploy-btn")?.addEventListener("click",async()=>{if(!I)return;const M=document.getElementById("compose-deploy-btn");M.textContent="Deploying...",M.disabled=!0,z("progress");const D=document.getElementById("compose-progress-content");D.innerHTML='<div class="panel-empty"><span class="brand-spinner"></span> Deploying services...</div>';try{const h=await postJSON("/api/v1/apps/deploy-compose",{services:I.services,networks:I.networks,stackName:I.stackName});let T=`<div style="font-weight: 600; margin-bottom: 12px;">Stack "${escapeHtml(h.stackName)}" \u2014 Deployment Complete</div>`;T+='<div class="scroll-container" style="max-height: 350px;">';for(const f of h.results){const H=f.status==="deployed"||f.status==="created"?"\u2705":f.status==="exists"?"\u26A1":f.status==="skipped"?"\u23ED":"\u274C";T+='<div style="padding: 8px 12px; border-bottom: 1px solid var(--border); font-size: 0.85rem;">',T+=`${H} <strong>${escapeHtml(f.name)}</strong> (${f.type}) \u2014 ${escapeHtml(f.status)}`,f.error&&(T+=` <span style="color: var(--bad-fg);">${escapeHtml(f.error)}</span>`),f.subdomain&&(T+=` \u2192 <code>${escapeHtml(f.subdomain)}</code>`),f.reason&&(T+=` <span style="color: var(--muted);">(${escapeHtml(f.reason)})</span>`),T+="</div>"}T+="</div>",T+='<div class="weather-modal-buttons modal-footer-bar" style="margin-top: 16px;"><button id="compose-done-btn">Done</button></div>Line truncated
|
||||
<div class="weather-modal-buttons modal-footer-bar" style="margin-top: 16px;"><button id="compose-retry-btn">Back</button></div>`,document.getElementById("compose-retry-btn")?.addEventListener("click",()=>z("paste"))}finally{M.textContent="Deploy All",M.disabled=!1}})})(),(function(){injectModal("exec-modal",`<div id="exec-modal" class="weather-modal">
|
||||
<div class="weather-modal-content" style="min-width: 700px; max-width: 900px; padding-bottom: 0;">
|
||||
<h3 id="exec-title">Terminal</h3>
|
||||
@@ -1761,11 +1734,11 @@ Enter version to rollback to:`);if(!a)return;if(!e.includes(a)){showNotification
|
||||
<button id="exec-close">Close</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>`);const k=document.getElementById("exec-modal"),B=document.getElementById("exec-terminal"),A=document.getElementById("exec-close");let I=null,z=null,P=null;function M(){if(z){try{z.close()}catch{}z=null}if(I){try{I.dispose()}catch{}I=null}P=null,B.innerHTML=""}function D(b,T){if(M(),document.getElementById("exec-title").textContent=`Terminal \u2014 ${T||b}`,k?.classList.add("show"),typeof Terminal>"u"){B.innerHTML='<div style="color: #f44; padding: 20px; font-family: monospace;">xterm.js not loaded</div>';return}I=new Terminal({cursorBlink:!0,fontSize:14,fontFamily:"'Cascadia Code', 'Fira Code', 'Consolas', monospace",theme:{background:"#1e1e1e",foreground:"#d4d4d4",cursor:"#aeafad",selectionBackground:"#264f78"},scrollback:5e3}),typeof FitAddon<"u"&&(P=new FitAddon.FitAddon,I.loadAddon(P)),I.open(B),P&&setTimeout(()=>P.fit(),50);const h=location.protocol==="https:"?"wss:":"ws:";z=new WebSocket(`${h}//${location.host}/ws/exec/${encodeURIComponent(b)}`),z.binaryType="arraybuffer",z.onopen=()=>{if(I.writeln("\x1B[32mConnecting...\x1B[0m"),P){const S=P.proposeDimensions();S&&z.send(JSON.stringify({type:"resize",cols:S.cols,rows:S.rows}))}},z.onmessage=S=>{if(typeof S.data=="string"){try{const $=JSON.parse(S.data);if($.type==="connected"){I.writeln(`\x1B[32mConnected (${$.shell})\x1B[0m\r
|
||||
</div>`);const k=document.getElementById("exec-modal"),B=document.getElementById("exec-terminal"),A=document.getElementById("exec-close");let I=null,z=null,P=null;function M(){if(z){try{z.close()}catch{}z=null}if(I){try{I.dispose()}catch{}I=null}P=null,B.innerHTML=""}function D(h,T){if(M(),document.getElementById("exec-title").textContent=`Terminal \u2014 ${T||h}`,k?.classList.add("show"),typeof Terminal>"u"){B.innerHTML='<div style="color: #f44; padding: 20px; font-family: monospace;">xterm.js not loaded</div>';return}I=new Terminal({cursorBlink:!0,fontSize:14,fontFamily:"'Cascadia Code', 'Fira Code', 'Consolas', monospace",theme:{background:"#1e1e1e",foreground:"#d4d4d4",cursor:"#aeafad",selectionBackground:"#264f78"},scrollback:5e3}),typeof FitAddon<"u"&&(P=new FitAddon.FitAddon,I.loadAddon(P)),I.open(B),P&&setTimeout(()=>P.fit(),50);const f=location.protocol==="https:"?"wss:":"ws:";z=new WebSocket(`${f}//${location.host}/ws/exec/${encodeURIComponent(h)}`),z.binaryType="arraybuffer",z.onopen=()=>{if(I.writeln("\x1B[32mConnecting...\x1B[0m"),P){const S=P.proposeDimensions();S&&z.send(JSON.stringify({type:"resize",cols:S.cols,rows:S.rows}))}},z.onmessage=S=>{if(typeof S.data=="string"){try{const $=JSON.parse(S.data);if($.type==="connected"){I.writeln(`\x1B[32mConnected (${$.shell})\x1B[0m\r
|
||||
`);return}if($.type==="error"){I.writeln(`\x1B[31mError: ${$.message}\x1B[0m`);return}if($.type==="exit"){I.writeln(`\r
|
||||
\x1B[33mSession ended.\x1B[0m`);return}}catch{}I.write(S.data)}else I.write(new Uint8Array(S.data))},z.onclose=()=>{I&&I.writeln(`\r
|
||||
\x1B[33mDisconnected.\x1B[0m`)},z.onerror=()=>{I&&I.writeln(`\r
|
||||
\x1B[31mConnection error.\x1B[0m`)},I.onData(S=>{z&&z.readyState===WebSocket.OPEN&&z.send(S)}),I.onResize(({cols:S,rows:$})=>{z&&z.readyState===WebSocket.OPEN&&z.send(JSON.stringify({type:"resize",cols:S,rows:$}))});const H=()=>{P&&P.fit()};window.addEventListener("resize",H),k._resizeHandler=H}A?.addEventListener("click",()=>{M(),k._resizeHandler&&window.removeEventListener("resize",k._resizeHandler),k?.classList.remove("show")}),k?.addEventListener("click",b=>{b.target===k&&(M(),k._resizeHandler&&window.removeEventListener("resize",k._resizeHandler),k?.classList.remove("show"))}),window.openExecModal=D})(),(function(){injectModal("audit-modal",`<div id="audit-modal" class="weather-modal">
|
||||
\x1B[31mConnection error.\x1B[0m`)},I.onData(S=>{z&&z.readyState===WebSocket.OPEN&&z.send(S)}),I.onResize(({cols:S,rows:$})=>{z&&z.readyState===WebSocket.OPEN&&z.send(JSON.stringify({type:"resize",cols:S,rows:$}))});const H=()=>{P&&P.fit()};window.addEventListener("resize",H),k._resizeHandler=H}A?.addEventListener("click",()=>{M(),k._resizeHandler&&window.removeEventListener("resize",k._resizeHandler),k?.classList.remove("show")}),k?.addEventListener("click",h=>{h.target===k&&(M(),k._resizeHandler&&window.removeEventListener("resize",k._resizeHandler),k?.classList.remove("show"))}),window.openExecModal=D})(),(function(){injectModal("audit-modal",`<div id="audit-modal" class="weather-modal">
|
||||
<div class="weather-modal-content" style="min-width: 950px; max-width: 1150px;">
|
||||
<h3>\u{1F4DC} Audit Log</h3>
|
||||
<p class="modal-subtitle">
|
||||
@@ -1811,7 +1784,7 @@ Enter version to rollback to:`);if(!a)return;if(!e.includes(a)){showNotification
|
||||
<button id="audit-cancel">Close</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>`);const k=document.getElementById("audit-modal"),B=document.getElementById("audit-log-btn"),A=document.getElementById("audit-cancel"),I=document.getElementById("audit-refresh-btn"),z=document.getElementById("audit-clear-btn"),P=document.getElementById("audit-filter"),M=document.getElementById("audit-outcome-filter"),D=document.getElementById("audit-since"),b=document.getElementById("audit-until"),T=document.getElementById("audit-log-container"),h=document.getElementById("audit-load-more");let H=0,S=null,$=0;const f=50;function E(N){if(!N)return null;const R=new Date(N);return isNaN(R.getTime())?null:R.toISOString()}async function O(N){try{N?(S&&S.abort(),S=new AbortController):(S&&S.abort(),S=new AbortController,H=0,$++,T.innerHTML='<div class="panel-empty"><span class="brand-spinner"></span> Loading...</div>');const R=$,u=new URLSearchParams;u.set("limit",String(f)),u.set("offset",String(H));const v=P.value,w=M.value,g=E(D.value),x=E(b.value);v&&u.set("action",v),w&&u.set("outcome",w),g&&u.set("since",g),x&&u.set("until",x);const s=await fetch("/api/v1/audit-logs?"+u.toString(),{signal:S.signal});if(!s.ok){T.innerHTML=`<div class="panel-empty" style="color: var(--bad-fg);">Failed: HTTP ${s.status}</div>`,h.style.display="none";return}const p=await s.json();if(!p.success){T.innerHTML=`<div class="panel-empty" style="color: var(--bad-fg);">Failed: ${escapeHtml(p.error||"unknown")}</div>`,h.style.display="none";return}if(!N&&R!==$)return;const l=Array.isArray(p.entries)?p.entries:[];if(l.length===0&&!N){const c=p.filters&&(p.filters.action||p.filters.outcome||p.filters.since||p.filters.until)?"No entries match your filters.":"No audit log entries yet. Actions will be logged automatically.";T.innerHTML=`<div class="panel-empty"><span class="empty-icon">\u{1F4DC}</span>${escapeHtml(c)}</div>`,h.style.display="none";return}let m="";N||(m='<table style="width: 100%; border-collapse: collapse; font-size: 0.82rem;">',m+='<tr style="border-bottom: 1px solid var(--border); color: var(--muted);">',m+='<th style="padding: 6px; text-align: left;">When</th>',m+='<th style="padding: 6px; text-align: left;">Actor</th>',m+='<th style="padding: 6px; text-align: left;">IP</th>',m+='<th style="padding: 6px; text-align: left;">Action</th>',m+='<th style="padding: 6px; text-align: left;">Resource</th>',m+='<th style="padding: 6px; text-align: left;">Result</th>',m+="</tr>");for(const c of l){const t=c.outcome==="success",e=L(c);m+='<tr style="border-bottom: 1px solid var(--border); cursor: pointer;" class="audit-row">',m+=`<td style="padding: 6px; color: var(--muted);" title="${escapeHtml(c.timestamp||"")}">${timeAgo(c.timestamp)}</td>`,m+=`<td style="padding: 6px; font-size: 0.78rem;">${e}</td>`,m+=`<td style="padding: 6px; font-family: monospace; font-size: 0.78rem;">${escapeHtml(c.ip||"-")}</td>`,m+=`<td style="padding: 6px; font-weight: 500;">${escapeHtml(c.action||"-")}</td>`,m+=`<td style="padding: 6px;">${escapeHtml(c.resource||"-")}</td>`,m+=`<td style="padding: 6px;"><span style="color: ${t?"var(--ok-fg)":"var(--bad-fg)"};">${t?"\u2713":"\u2717"} ${escapeHtml(c.outcome||"")}</span></td>`,m+="</tr>",c.details&&Object.keys(c.details).length>0&&(m+=`<tr class="audit-detail" style="display: none;"><td colspan="6" style="padding: 6px 6px 10px; font-size: 0.78rem; color: var(--muted);"><pre style="margin: 0; white-space: pre-wrap; font-family: monospace;">${escapeHtml(JSON.stringify(c.details,null,2))}</pre></td></tr>`)}if(!N)m+="</table>",T.innerHTML=m;else{const c=T.querySelector("table");c&&c.insertAdjacentHTML("beforeend",m)}H+=l.length,h.style.display=p.hasMore?"":"none",T.querySelectorAll(".audit-row").forEach(c=>{c.dataset.wired||(c.dataset.wired="true",c.addEventListener("click",()=>{const t=c.nextElementSibling;t&&t.classList.contains("audit-detail")&&(t.style.display=t.style.display==="none"?"":"none")}))})}catch(R){if(R&&R.name==="AbortError")return;T.innerHTML=`<div class="panel-empty" style="color: var(--bad-fg);">Failed: ${escapeHtml(R.message)}</div>`}}function L(N){const R=N.details||{},u=R.userEmail,v=R.userId,w=R.userRole,g=R.viaProvider;if(u){const x=w?` <span style="color: var(--muted); font-size: 0.72rem;">[${escapeHtml(w)}${g?"/"+escapeHtml(g):""}]</span>`:"";return`${escapeHtml(u)}${x}`}return v?`<span style="font-family: monospace; color: var(--muted);">${escapeHtml(v)}</span>`:N.ip?'<span style="color: var(--muted);">anon</span>':'<span style="color: var(--muted);">system</span>'}B?.addEventListener("click",()=>{k?.classList.add("show"),O(!1)}),wireModal(k,A),I?.addEventListener("click",()=>O(!1)),P?.addEventListener("change",()=>O(!1)),M?.addEventListener("change",()=>O(!1));let j;[D,b].forEach(N=>{N?.addEventListener("change",()=>{clearTimeout(j),j=setTimeout(()=>O(!1),250)})}),h?.addEventListener("click",()=>O(!0)),z?.addEventListener("click",async()=>{if(confirm("Clear the entire audit log? This cannot be undone."))try{const R=await(await secureFetch("/api/v1/audit-logs",{method:"DELETE"Line truncated
|
||||
</div>`);const k=document.getElementById("audit-modal"),B=document.getElementById("audit-log-btn"),A=document.getElementById("audit-cancel"),I=document.getElementById("audit-refresh-btn"),z=document.getElementById("audit-clear-btn"),P=document.getElementById("audit-filter"),M=document.getElementById("audit-outcome-filter"),D=document.getElementById("audit-since"),h=document.getElementById("audit-until"),T=document.getElementById("audit-log-container"),f=document.getElementById("audit-load-more");let H=0,S=null,$=0;const w=50;function E(N){if(!N)return null;const R=new Date(N);return isNaN(R.getTime())?null:R.toISOString()}async function O(N){try{N?(S&&S.abort(),S=new AbortController):(S&&S.abort(),S=new AbortController,H=0,$++,T.innerHTML='<div class="panel-empty"><span class="brand-spinner"></span> Loading...</div>');const R=$,u=new URLSearchParams;u.set("limit",String(w)),u.set("offset",String(H));const v=P.value,x=M.value,g=E(D.value),b=E(h.value);v&&u.set("action",v),x&&u.set("outcome",x),g&&u.set("since",g),b&&u.set("until",b);const s=await fetch("/api/v1/audit-logs?"+u.toString(),{signal:S.signal});if(!s.ok){T.innerHTML=`<div class="panel-empty" style="color: var(--bad-fg);">Failed: HTTP ${s.status}</div>`,f.style.display="none";return}const p=await s.json();if(!p.success){T.innerHTML=`<div class="panel-empty" style="color: var(--bad-fg);">Failed: ${escapeHtml(p.error||"unknown")}</div>`,f.style.display="none";return}if(!N&&R!==$)return;const l=Array.isArray(p.entries)?p.entries:[];if(l.length===0&&!N){const c=p.filters&&(p.filters.action||p.filters.outcome||p.filters.since||p.filters.until)?"No entries match your filters.":"No audit log entries yet. Actions will be logged automatically.";T.innerHTML=`<div class="panel-empty"><span class="empty-icon">\u{1F4DC}</span>${escapeHtml(c)}</div>`,f.style.display="none";return}let m="";N||(m='<table style="width: 100%; border-collapse: collapse; font-size: 0.82rem;">',m+='<tr style="border-bottom: 1px solid var(--border); color: var(--muted);">',m+='<th style="padding: 6px; text-align: left;">When</th>',m+='<th style="padding: 6px; text-align: left;">Actor</th>',m+='<th style="padding: 6px; text-align: left;">IP</th>',m+='<th style="padding: 6px; text-align: left;">Action</th>',m+='<th style="padding: 6px; text-align: left;">Resource</th>',m+='<th style="padding: 6px; text-align: left;">Result</th>',m+="</tr>");for(const c of l){const t=c.outcome==="success",e=C(c);m+='<tr style="border-bottom: 1px solid var(--border); cursor: pointer;" class="audit-row">',m+=`<td style="padding: 6px; color: var(--muted);" title="${escapeHtml(c.timestamp||"")}">${timeAgo(c.timestamp)}</td>`,m+=`<td style="padding: 6px; font-size: 0.78rem;">${e}</td>`,m+=`<td style="padding: 6px; font-family: monospace; font-size: 0.78rem;">${escapeHtml(c.ip||"-")}</td>`,m+=`<td style="padding: 6px; font-weight: 500;">${escapeHtml(c.action||"-")}</td>`,m+=`<td style="padding: 6px;">${escapeHtml(c.resource||"-")}</td>`,m+=`<td style="padding: 6px;"><span style="color: ${t?"var(--ok-fg)":"var(--bad-fg)"};">${t?"\u2713":"\u2717"} ${escapeHtml(c.outcome||"")}</span></td>`,m+="</tr>",c.details&&Object.keys(c.details).length>0&&(m+=`<tr class="audit-detail" style="display: none;"><td colspan="6" style="padding: 6px 6px 10px; font-size: 0.78rem; color: var(--muted);"><pre style="margin: 0; white-space: pre-wrap; font-family: monospace;">${escapeHtml(JSON.stringify(c.details,null,2))}</pre></td></tr>`)}if(!N)m+="</table>",T.innerHTML=m;else{const c=T.querySelector("table");c&&c.insertAdjacentHTML("beforeend",m)}H+=l.length,f.style.display=p.hasMore?"":"none",T.querySelectorAll(".audit-row").forEach(c=>{c.dataset.wired||(c.dataset.wired="true",c.addEventListener("click",()=>{const t=c.nextElementSibling;t&&t.classList.contains("audit-detail")&&(t.style.display=t.style.display==="none"?"":"none")}))})}catch(R){if(R&&R.name==="AbortError")return;T.innerHTML=`<div class="panel-empty" style="color: var(--bad-fg);">Failed: ${escapeHtml(R.message)}</div>`}}function C(N){const R=N.details||{},u=R.userEmail,v=R.userId,x=R.userRole,g=R.viaProvider;if(u){const b=x?` <span style="color: var(--muted); font-size: 0.72rem;">[${escapeHtml(x)}${g?"/"+escapeHtml(g):""}]</span>`:"";return`${escapeHtml(u)}${b}`}return v?`<span style="font-family: monospace; color: var(--muted);">${escapeHtml(v)}</span>`:N.ip?'<span style="color: var(--muted);">anon</span>':'<span style="color: var(--muted);">system</span>'}B?.addEventListener("click",()=>{k?.classList.add("show"),O(!1)}),wireModal(k,A),I?.addEventListener("click",()=>O(!1)),P?.addEventListener("change",()=>O(!1)),M?.addEventListener("change",()=>O(!1));let j;[D,h].forEach(N=>{N?.addEventListener("change",()=>{clearTimeout(j),j=setTimeout(()=>O(!1),250)})}),f?.addEventListener("click",()=>O(!0)),z?.addEventListener("click",async()=>{if(confirm("Clear the entire audit log? This cannot be undone."))try{const R=await(await secureFetch("/api/v1/audit-logs",{method:"DELETE"Line truncated
|
||||
<div class="weather-modal-content" style="min-width: 980px; max-width: 1280px;">
|
||||
<h3>\u{1F6E1}\uFE0F Security Center</h3>
|
||||
<p class="modal-subtitle">
|
||||
@@ -1890,14 +1863,14 @@ Enter version to rollback to:`);if(!a)return;if(!e.includes(a)){showNotification
|
||||
<button id="sec-cancel">Close</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>`);const k=document.getElementById("security-modal"),B=document.getElementById("security-center-btn"),A=document.getElementById("sec-cancel"),I=k.querySelectorAll(".sec-tab"),z=k.querySelectorAll(".sec-panel");let P=[],M=[],D=null;I.forEach(s=>{s.addEventListener("click",()=>{I.forEach(p=>p.classList.toggle("active",p===s)),z.forEach(p=>p.style.display=p.dataset.panel===s.dataset.tab?"":"none"),s.dataset.tab==="overview"&&H(),s.dataset.tab==="events"&&j(),s.dataset.tab==="hosts"&&v()})}),B&&B.addEventListener("click",()=>{k.classList.add("show"),H(),T()}),A.addEventListener("click",b),k.addEventListener("click",s=>{s.target===k&&b()});function b(){k.classList.remove("show"),h()}function T(){if(h(),!!document.getElementById("sec-live-tail").checked&&!(typeof EventSource>"u"))try{D=new EventSource("/api/v1/security/events/stream"),D.addEventListener("init",s=>{try{P=JSON.parse(s.data).events||[],N()}catch{}}),D.addEventListener("security",s=>{try{const p=JSON.parse(s.data);P.unshift(p),P.length>500&&(P.length=500);const l=k.querySelector(".sec-tab.active")?.dataset?.tab;l==="events"?N():l==="overview"&&H()}catch{}}),D.onerror=()=>{}}catch(s){console.warn("[security] SSE failed:",s.message)}}function h(){if(D){try{D.close()}catch{}D=null}}document.getElementById("sec-live-tail").addEventListener("change",()=>{k.classList.contains("show")&&T()});async function H(){try{const s=new Date(Date.now()-864e5).toISOString(),[p,l,m]=await Promise.all([fetch(`/api/v1/security/events/stats?since=${encodeURIComponent(s)}`),fetch("/api/v1/security/hosts"),fetch(`/api/v1/security/events?limit=1&since=${encodeURIComponent(s)}`)]),c=(await p.json()).data||{},t=(await l.json()).data?.hosts||[],e=(await m.json()).data?.total||0;document.querySelector('#sec-stats [data-key="total"]').textContent=`${e} events (24h)`,document.querySelector('#sec-stats [data-key="warn"]').textContent=`${c.by_severity?.warn||0} warnings`,document.querySelector('#sec-stats [data-key="error"]').textContent=`${c.by_severity?.error||0} errors`,document.querySelector('#sec-stats [data-key="denied"]').textContent=`${c.by_outcome?.denied||0} denied`,document.querySelector('#sec-stats [data-key="hosts"]').textContent=`${t.length} hosts`,S("sec-top-actors",c.top_actors||[]),S("sec-top-targets",c.top_targets||[])}catch(s){console.warn("[security] refreshOverview failed:",s.message)}}function S(s,p){const l=document.getElementById(s);if(!p.length){l.innerHTML='<div class="panel-empty">No data</div>';return}l.innerHTML='<table style="width:100%;font-size:0.85rem;">'+p.map(m=>`<tr><td style="padding:3px 0;word-break:break-all;">${g(String(m.key))}</td><td style="text-align:right;color:var(--muted);">${m.count}</td></tr>`).join("")+"</table>"}const $=document.getElementById("sec-filter-source"),f=document.getElementById("sec-filter-severity"),E=document.getElementById("sec-filter-host"),O=document.getElementById("sec-filter-actor"),L=document.getElementById("sec-refresh-btn");[$,f,E].forEach(s=>s.addEventListener("change",j)),O.addEventListener("input",x(j,250)),L.addEventListener("click",j);async function j(){try{const s=new URLSearchParams;s.set("limit","200"),$.value&&s.set("source_type",$.value),f.value&&s.set("severity",f.value),E.value&&s.set("source_host",E.value),O.value&&s.set("actor_prefix",O.value),P=(await(await fetch(`/api/v1/security/events?${s}`)).json()).data.events||[],N(),(!E.options.length||E.options.length===1)&&await u()}catch(s){document.getElementById("sec-events-container").innerHTML='<div class="panel-empty">Load failed: '+g(s.message)+"</div>"}}function N(){const s=document.getElementById("sec-events-container");if(!P.length){s.innerHTML='<div class="panel-empty">No events</div>';return}s.innerHTML=P.slice(0,200).map(R).join("")}function R(s){const p=s.severity||"info",l={critical:"#c0392b",error:"#e74c3c",warn:"#f39c12",notice:"#3498db",info:"#7f8c8d"}[p]||"#7f8c8d",m=s.ts?new Date(s.ts).toLocaleTimeString():"",c=s.source_type||"",t=s.actor||"\u2014",e=s.target||"",a=s.action||"",o=s.outcome||"";return`<div class="sec-event-row" style="display:grid;grid-template-columns:84px 80px 1fr 1fr 100px 90px;gap:8px;padding:5px 8px;border-bottom:1px solid var(--border);font-size:0.82rem;align-items:center;">
|
||||
</div>`);const k=document.getElementById("security-modal"),B=document.getElementById("security-center-btn"),A=document.getElementById("sec-cancel"),I=k.querySelectorAll(".sec-tab"),z=k.querySelectorAll(".sec-panel");let P=[],M=[],D=null;I.forEach(s=>{s.addEventListener("click",()=>{I.forEach(p=>p.classList.toggle("active",p===s)),z.forEach(p=>p.style.display=p.dataset.panel===s.dataset.tab?"":"none"),s.dataset.tab==="overview"&&H(),s.dataset.tab==="events"&&j(),s.dataset.tab==="hosts"&&v()})}),B&&B.addEventListener("click",()=>{k.classList.add("show"),H(),T()}),A.addEventListener("click",h),k.addEventListener("click",s=>{s.target===k&&h()});function h(){k.classList.remove("show"),f()}function T(){if(f(),!!document.getElementById("sec-live-tail").checked&&!(typeof EventSource>"u"))try{D=new EventSource("/api/v1/security/events/stream"),D.addEventListener("init",s=>{try{P=JSON.parse(s.data).events||[],N()}catch{}}),D.addEventListener("security",s=>{try{const p=JSON.parse(s.data);P.unshift(p),P.length>500&&(P.length=500);const l=k.querySelector(".sec-tab.active")?.dataset?.tab;l==="events"?N():l==="overview"&&H()}catch{}}),D.onerror=()=>{}}catch(s){console.warn("[security] SSE failed:",s.message)}}function f(){if(D){try{D.close()}catch{}D=null}}document.getElementById("sec-live-tail").addEventListener("change",()=>{k.classList.contains("show")&&T()});async function H(){try{const s=new Date(Date.now()-864e5).toISOString(),[p,l,m]=await Promise.all([fetch(`/api/v1/security/events/stats?since=${encodeURIComponent(s)}`),fetch("/api/v1/security/hosts"),fetch(`/api/v1/security/events?limit=1&since=${encodeURIComponent(s)}`)]),c=(await p.json()).data||{},t=(await l.json()).data?.hosts||[],e=(await m.json()).data?.total||0;document.querySelector('#sec-stats [data-key="total"]').textContent=`${e} events (24h)`,document.querySelector('#sec-stats [data-key="warn"]').textContent=`${c.by_severity?.warn||0} warnings`,document.querySelector('#sec-stats [data-key="error"]').textContent=`${c.by_severity?.error||0} errors`,document.querySelector('#sec-stats [data-key="denied"]').textContent=`${c.by_outcome?.denied||0} denied`,document.querySelector('#sec-stats [data-key="hosts"]').textContent=`${t.length} hosts`,S("sec-top-actors",c.top_actors||[]),S("sec-top-targets",c.top_targets||[])}catch(s){console.warn("[security] refreshOverview failed:",s.message)}}function S(s,p){const l=document.getElementById(s);if(!p.length){l.innerHTML='<div class="panel-empty">No data</div>';return}l.innerHTML='<table style="width:100%;font-size:0.85rem;">'+p.map(m=>`<tr><td style="padding:3px 0;word-break:break-all;">${g(String(m.key))}</td><td style="text-align:right;color:var(--muted);">${m.count}</td></tr>`).join("")+"</table>"}const $=document.getElementById("sec-filter-source"),w=document.getElementById("sec-filter-severity"),E=document.getElementById("sec-filter-host"),O=document.getElementById("sec-filter-actor"),C=document.getElementById("sec-refresh-btn");[$,w,E].forEach(s=>s.addEventListener("change",j)),O.addEventListener("input",b(j,250)),C.addEventListener("click",j);async function j(){try{const s=new URLSearchParams;s.set("limit","200"),$.value&&s.set("source_type",$.value),w.value&&s.set("severity",w.value),E.value&&s.set("source_host",E.value),O.value&&s.set("actor_prefix",O.value),P=(await(await fetch(`/api/v1/security/events?${s}`)).json()).data.events||[],N(),(!E.options.length||E.options.length===1)&&await u()}catch(s){document.getElementById("sec-events-container").innerHTML='<div class="panel-empty">Load failed: '+g(s.message)+"</div>"}}function N(){const s=document.getElementById("sec-events-container");if(!P.length){s.innerHTML='<div class="panel-empty">No events</div>';return}s.innerHTML=P.slice(0,200).map(R).join("")}function R(s){const p=s.severity||"info",l={critical:"#c0392b",error:"#e74c3c",warn:"#f39c12",notice:"#3498db",info:"#7f8c8d"}[p]||"#7f8c8d",m=s.ts?new Date(s.ts).toLocaleTimeString():"",c=s.source_type||"",t=s.actor||"\u2014",e=s.target||"",a=s.action||"",o=s.outcome||"";return`<div class="sec-event-row" style="display:grid;grid-template-columns:84px 80px 1fr 1fr 100px 90px;gap:8px;padding:5px 8px;border-bottom:1px solid var(--border);font-size:0.82rem;align-items:center;">
|
||||
<span style="color:${l};font-weight:600;">${g(p)}</span>
|
||||
<span style="color:var(--muted);font-size:0.75rem;">${g(c)}</span>
|
||||
<span title="${g(t)}" style="overflow:hidden;text-overflow:ellipsis;white-space:nowrap;">${g(t)}</span>
|
||||
<span title="${g(e)}" style="overflow:hidden;text-overflow:ellipsis;white-space:nowrap;">${g(a)} ${g(e)}</span>
|
||||
<span style="color:var(--muted);font-size:0.75rem;">${g(o)}</span>
|
||||
<span style="color:var(--muted);font-size:0.75rem;text-align:right;">${g(m)}</span>
|
||||
</div>`}async function u(){try{const p=(await(await fetch("/api/v1/security/hosts")).json()).data?.hosts||[],l=E.value;E.innerHTML='<option value="">All hosts</option>'+p.map(m=>`<option value="${g(m.id)}">${g(m.label||m.id)}</option>`).join(""),l&&(E.value=l)}catch{}}document.getElementById("sec-host-register-btn").addEventListener("click",w),document.getElementById("sec-hosts-refresh").addEventListener("click",v);async function v(){try{const p=(await(await fetch("/api/v1/security/hosts")).json()).data?.hosts||[];M=p;const l=document.getElementById("sec-hosts-container");if(!p.length){l.innerHTML='<div class="panel-empty">No hosts registered. Click \u2795 Register Host to add one.</div>';return}l.innerHTML=p.map(m=>{const c=m.enabled?m.last_seen_at?Date.now()-Date.parse(m.last_seen_at)>18e5?"\u{1F7E1} stale":"\u{1F7E2} online":"\u26AA registered":"\u{1F534} disabled";return`<div style="padding:10px 12px;border-bottom:1px solid var(--border);display:flex;justify-content:space-between;align-items:center;">
|
||||
</div>`}async function u(){try{const p=(await(await fetch("/api/v1/security/hosts")).json()).data?.hosts||[],l=E.value;E.innerHTML='<option value="">All hosts</option>'+p.map(m=>`<option value="${g(m.id)}">${g(m.label||m.id)}</option>`).join(""),l&&(E.value=l)}catch{}}document.getElementById("sec-host-register-btn").addEventListener("click",x),document.getElementById("sec-hosts-refresh").addEventListener("click",v);async function v(){try{const p=(await(await fetch("/api/v1/security/hosts")).json()).data?.hosts||[];M=p;const l=document.getElementById("sec-hosts-container");if(!p.length){l.innerHTML='<div class="panel-empty">No hosts registered. Click \u2795 Register Host to add one.</div>';return}l.innerHTML=p.map(m=>{const c=m.enabled?m.last_seen_at?Date.now()-Date.parse(m.last_seen_at)>18e5?"\u{1F7E1} stale":"\u{1F7E2} online":"\u26AA registered":"\u{1F534} disabled";return`<div style="padding:10px 12px;border-bottom:1px solid var(--border);display:flex;justify-content:space-between;align-items:center;">
|
||||
<div>
|
||||
<strong>${g(m.label||m.id)}</strong>
|
||||
<span style="color:var(--muted);margin-left:8px;font-size:0.8rem;">${g(m.type)}</span>
|
||||
@@ -1911,7 +1884,7 @@ Enter version to rollback to:`);if(!a)return;if(!e.includes(a)){showNotification
|
||||
<span style="font-size:0.85rem;margin-right:12px;">${c}</span>
|
||||
${m.id==="self"?"":`<button class="btn-sm sec-host-del" data-id="${g(m.id)}" style="color:var(--bad-fg);">Remove</button>`}
|
||||
</div>
|
||||
</div>`}).join(""),l.querySelectorAll(".sec-host-del").forEach(m=>{m.addEventListener("click",async()=>{confirm(`Remove host ${m.dataset.id}? Events already received will remain in the store.`)&&(await fetch(`/api/v1/security/hosts/${encodeURIComponent(m.dataset.id)}`,{method:"DELETE"}),v())})})}catch(s){document.getElementById("sec-hosts-container").innerHTML='<div class="panel-empty">Load failed: '+g(s.message)+"</div>"}}async function w(){const s=prompt("Host id (lowercase, no spaces):");if(!s)return;const p=prompt("Display label:",s)||s,l=prompt('Type ("dashcaddy", "service", or "agent"):',"agent")||"agent";try{const m=await fetch("/api/v1/security/hosts",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({id:s,label:p,type:l})}),c=await m.json();if(!m.ok){alert("Failed: "+(c?.error?.message||m.statusText));return}alert(`\u2705 Host registered!
|
||||
</div>`}).join(""),l.querySelectorAll(".sec-host-del").forEach(m=>{m.addEventListener("click",async()=>{confirm(`Remove host ${m.dataset.id}? Events already received will remain in the store.`)&&(await fetch(`/api/v1/security/hosts/${encodeURIComponent(m.dataset.id)}`,{method:"DELETE"}),v())})})}catch(s){document.getElementById("sec-hosts-container").innerHTML='<div class="panel-empty">Load failed: '+g(s.message)+"</div>"}}async function x(){const s=prompt("Host id (lowercase, no spaces):");if(!s)return;const p=prompt("Display label:",s)||s,l=prompt('Type ("dashcaddy", "service", or "agent"):',"agent")||"agent";try{const m=await fetch("/api/v1/security/hosts",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({id:s,label:p,type:l})}),c=await m.json();if(!m.ok){alert("Failed: "+(c?.error?.message||m.statusText));return}alert(`\u2705 Host registered!
|
||||
|
||||
id: ${c.data.host.id}
|
||||
label: ${c.data.host.label}
|
||||
@@ -1922,7 +1895,7 @@ type: ${c.data.host.type}
|
||||
${c.data.api_key}
|
||||
|
||||
Send this key as: Authorization: Bearer <api_key>
|
||||
To endpoint: POST /api/v1/security/events/ingest or /events/batch`),v()}catch(m){alert("Failed: "+m.message)}}function g(s){return String(s).replace(/[&<>"']/g,p=>({"&":"&","<":"<",">":">",'"':""","'":"'"})[p])}function x(s,p){let l;return function(){clearTimeout(l),l=setTimeout(()=>s.apply(this,arguments),p)}}})(),(function(){const k=new ErrorHandler;injectModal("weather-modal",`<div id="weather-modal" class="weather-modal"><div class="weather-modal-content"><h3>Weather Settings</h3>
|
||||
To endpoint: POST /api/v1/security/events/ingest or /events/batch`),v()}catch(m){alert("Failed: "+m.message)}}function g(s){return String(s).replace(/[&<>"']/g,p=>({"&":"&","<":"<",">":">",'"':""","'":"'"})[p])}function b(s,p){let l;return function(){clearTimeout(l),l=setTimeout(()=>s.apply(this,arguments),p)}}})(),(function(){const k=new ErrorHandler;injectModal("weather-modal",`<div id="weather-modal" class="weather-modal"><div class="weather-modal-content"><h3>Weather Settings</h3>
|
||||
<label for="weather-location-input">Location:</label>
|
||||
<input type="text" id="weather-location-input" placeholder="City name or ZIP (e.g., Hamburg, 90210)" maxlength="100">
|
||||
<div style="font-size: 0.78rem; color: var(--muted); margin-top: 4px;">Enter a city name, postal code, or “City, Country”</div>
|
||||
@@ -1933,23 +1906,23 @@ To endpoint: POST /api/v1/security/events/ingest or /events/batch`),v()}catch(m)
|
||||
<label class="weather-unit-option"><input type="radio" name="weather-unit-radio" value="metric"><span class="weather-unit-card">°C / km/h</span></label>
|
||||
</div>
|
||||
</div>
|
||||
<div class="weather-modal-buttons"><button id="weather-cancel">Cancel</button><button id="weather-save">Save</button></div></div></div>`);const B="weather-location",A="weather-zip",I="weather-geo",z="weather-unit";!safeGet(B)&&safeGet(A)&&safeSet(B,safeGet(A));function P(){return safeGet(z)||"imperial"}function M(){return{icon:document.querySelector(".weather-icon"),temp:document.querySelector(".weather-temp"),condition:document.querySelector(".weather-condition"),location:document.querySelector(".weather-location"),wind:document.querySelector(".weather-wind")}}const D={0:"Clear sky",1:"Mainly clear",2:"Partly cloudy",3:"Overcast",45:"Fog",48:"Rime fog",51:"Light drizzle",53:"Drizzle",55:"Dense drizzle",56:"Freezing drizzle",57:"Dense freezing drizzle",61:"Light rain",63:"Moderate rain",65:"Heavy rain",66:"Light freezing rain",67:"Heavy freezing rain",71:"Light snow",73:"Moderate snow",75:"Heavy snow",77:"Snow grains",80:"Light showers",81:"Moderate showers",82:"Violent showers",85:"Light snow showers",86:"Heavy snow showers",95:"Thunderstorm",96:"Thunderstorm with hail",99:"Severe thunderstorm"},b={0:"\u2600\uFE0F",1:"\u{1F324}\uFE0F",2:"\u26C5",3:"\u2601\uFE0F",45:"\u{1F32B}\uFE0F",48:"\u{1F32B}\uFE0F",51:"\u{1F326}\uFE0F",53:"\u{1F326}\uFE0F",55:"\u{1F326}\uFE0F",56:"\u{1F328}\uFE0F",57:"\u{1F328}\uFE0F",61:"\u{1F326}\uFE0F",63:"\u{1F327}\uFE0F",65:"\u{1F327}\uFE0F",66:"\u{1F328}\uFE0F",67:"\u{1F328}\uFE0F",71:"\u{1F328}\uFE0F",73:"\u2744\uFE0F",75:"\u2744\uFE0F",77:"\u2744\uFE0F",80:"\u{1F326}\uFE0F",81:"\u{1F327}\uFE0F",82:"\u{1F327}\uFE0F",85:"\u{1F328}\uFE0F",86:"\u2744\uFE0F",95:"\u26C8\uFE0F",96:"\u26C8\uFE0F",99:"\u26C8\uFE0F"},T=["N","NNE","NE","ENE","E","ESE","SE","SSE","S","SSW","SW","WSW","W","WNW","NW","NNW"];function h(L){return T[Math.round(L/22.5)%16]}async function H(L){const j=safeGet(I);if(j)try{const w=JSON.parse(j);if(w.query===L)return w}catch{}const N=await fetch(`https://geocoding-api.open-meteo.com/v1/search?name=${encodeURIComponent(L)}&count=1&language=en&format=json`);if(!N.ok)throw new Error("Geocoding failed");const R=await N.json();if(!R.results||!R.results.length)throw new Error("Location not found");const u=R.results[0],v={query:L,lat:u.latitude,lon:u.longitude,city:u.name,state:u.admin1||"",country:u.country||"",countryCode:u.country_code||""};return safeSet(I,JSON.stringify(v)),v}function S(L){return L.countryCode==="US"&&L.state?`${L.city}, ${L.state}`:L.country?`${L.city}, ${L.country}`:L.city}async function $(L){try{const j=await H(L),N=P(),R=N==="metric"?"celsius":"fahrenheit",u=N==="metric"?"kmh":"mph",v=`https://api.open-meteo.com/v1/forecast?latitude=${j.lat}&longitude=${j.lon}¤t=temperature_2m,weather_code,wind_speed_10m,wind_direction_10m&temperature_unit=${R}&wind_speed_unit=${u}`,w=await fetch(v);if(!w.ok)throw new Error("Weather fetch failed");const x=(await w.json()).current,s=x.weather_code;return{temp:Math.round(x.temperature_2m),condition:D[s]||"Unknown",icon:b[s]||"\u{1F324}\uFE0F",locationStr:S(j),windSpeed:Math.round(x.wind_speed_10m),windDir:h(x.wind_direction_10m),unit:N}}catch(j){return console.warn("Weather fetch failed:",j),null}}async function f(){const L=M();if(!L.icon||!L.temp||!L.condition||!L.location||!L.wind){console.warn("Weather widget elements not found");return}const j=safeGet(B);if(!j){L.location.textContent="Set Location",L.temp.textContent="--\xB0",L.condition.textContent="Click \u2699\uFE0F to configure",L.wind.textContent="--",L.icon.innerHTML='<span class="weather-emoji">\u{1F324}\uFE0F</span>';return}try{const N=await $(j);if(N){const R=N.unit==="metric"?"\xB0C":"\xB0F",u=N.unit==="metric"?"km/h":"mph";L.location.textContent=N.locationStr,L.temp.textContent=`${N.temp}${R}`,L.condition.textContent=N.condition,L.wind.textContent=`Wind: ${N.windSpeed} ${u} ${N.windDir}`,L.icon.innerHTML=`<span class="weather-emoji">${escapeHtml(N.icon)}</span>`}}catch(N){k.logError("[Weather] Update Error",N,{function:"updateWeather"}),L.location.textContent="Weather Error",L.temp.textContent="Error",L.condition.textContent="Failed to load",L.wind.textContent="--"}}const E=document.getElementById("weather-modal"),O=document.getElementById("weather-location-input");document.getElementById("weather-settings")?.addEventListener("click",()=>{O.value=safeGet(B)||"";const L=P(),j=E.querySelector(`input[name="weather-unit-radio"][value="${L}"]`);j&&(j.checked=!0),E.classList.add("show"),O.focus()}),document.getElementById("weather-cancel")?.addEventListener("click",()=>{E.classList.remove("show")}),document.getElementById("weather-save")?.addEventListener("click",()=>{const L=O.value.trim();if(L){safeGet(B)!==L&&safeSet(I,""),safeSet(B,L);const N=E.querySelector('input[name="weather-unit-radio"]:checked'),R=N?N.value:"imperial",u=P();safeSet(z,R),u!==R&&safeSet(I,""),E.classList.remove("show"),f()}else showNotification("Please enter a location (e.g., Hamburg, London, 90210)","warning")}),wireModal(E),document.addEventListener("keydown",L=>{L.keyLine truncated
|
||||
<div class="weather-modal-buttons"><button id="weather-cancel">Cancel</button><button id="weather-save">Save</button></div></div></div>`);const B="weather-location",A="weather-zip",I="weather-geo",z="weather-unit";!safeGet(B)&&safeGet(A)&&safeSet(B,safeGet(A));function P(){return safeGet(z)||"imperial"}function M(){return{icon:document.querySelector(".weather-icon"),temp:document.querySelector(".weather-temp"),condition:document.querySelector(".weather-condition"),location:document.querySelector(".weather-location"),wind:document.querySelector(".weather-wind")}}const D={0:"Clear sky",1:"Mainly clear",2:"Partly cloudy",3:"Overcast",45:"Fog",48:"Rime fog",51:"Light drizzle",53:"Drizzle",55:"Dense drizzle",56:"Freezing drizzle",57:"Dense freezing drizzle",61:"Light rain",63:"Moderate rain",65:"Heavy rain",66:"Light freezing rain",67:"Heavy freezing rain",71:"Light snow",73:"Moderate snow",75:"Heavy snow",77:"Snow grains",80:"Light showers",81:"Moderate showers",82:"Violent showers",85:"Light snow showers",86:"Heavy snow showers",95:"Thunderstorm",96:"Thunderstorm with hail",99:"Severe thunderstorm"},h={0:"\u2600\uFE0F",1:"\u{1F324}\uFE0F",2:"\u26C5",3:"\u2601\uFE0F",45:"\u{1F32B}\uFE0F",48:"\u{1F32B}\uFE0F",51:"\u{1F326}\uFE0F",53:"\u{1F326}\uFE0F",55:"\u{1F326}\uFE0F",56:"\u{1F328}\uFE0F",57:"\u{1F328}\uFE0F",61:"\u{1F326}\uFE0F",63:"\u{1F327}\uFE0F",65:"\u{1F327}\uFE0F",66:"\u{1F328}\uFE0F",67:"\u{1F328}\uFE0F",71:"\u{1F328}\uFE0F",73:"\u2744\uFE0F",75:"\u2744\uFE0F",77:"\u2744\uFE0F",80:"\u{1F326}\uFE0F",81:"\u{1F327}\uFE0F",82:"\u{1F327}\uFE0F",85:"\u{1F328}\uFE0F",86:"\u2744\uFE0F",95:"\u26C8\uFE0F",96:"\u26C8\uFE0F",99:"\u26C8\uFE0F"},T=["N","NNE","NE","ENE","E","ESE","SE","SSE","S","SSW","SW","WSW","W","WNW","NW","NNW"];function f(C){return T[Math.round(C/22.5)%16]}async function H(C){const j=safeGet(I);if(j)try{const x=JSON.parse(j);if(x.query===C)return x}catch{}const N=await fetch(`https://geocoding-api.open-meteo.com/v1/search?name=${encodeURIComponent(C)}&count=1&language=en&format=json`);if(!N.ok)throw new Error("Geocoding failed");const R=await N.json();if(!R.results||!R.results.length)throw new Error("Location not found");const u=R.results[0],v={query:C,lat:u.latitude,lon:u.longitude,city:u.name,state:u.admin1||"",country:u.country||"",countryCode:u.country_code||""};return safeSet(I,JSON.stringify(v)),v}function S(C){return C.countryCode==="US"&&C.state?`${C.city}, ${C.state}`:C.country?`${C.city}, ${C.country}`:C.city}async function $(C){try{const j=await H(C),N=P(),R=N==="metric"?"celsius":"fahrenheit",u=N==="metric"?"kmh":"mph",v=`https://api.open-meteo.com/v1/forecast?latitude=${j.lat}&longitude=${j.lon}¤t=temperature_2m,weather_code,wind_speed_10m,wind_direction_10m&temperature_unit=${R}&wind_speed_unit=${u}`,x=await fetch(v);if(!x.ok)throw new Error("Weather fetch failed");const b=(await x.json()).current,s=b.weather_code;return{temp:Math.round(b.temperature_2m),condition:D[s]||"Unknown",icon:h[s]||"\u{1F324}\uFE0F",locationStr:S(j),windSpeed:Math.round(b.wind_speed_10m),windDir:f(b.wind_direction_10m),unit:N}}catch(j){return console.warn("Weather fetch failed:",j),null}}async function w(){const C=M();if(!C.icon||!C.temp||!C.condition||!C.location||!C.wind){console.warn("Weather widget elements not found");return}const j=safeGet(B);if(!j){C.location.textContent="Set Location",C.temp.textContent="--\xB0",C.condition.textContent="Click \u2699\uFE0F to configure",C.wind.textContent="--",C.icon.innerHTML='<span class="weather-emoji">\u{1F324}\uFE0F</span>';return}try{const N=await $(j);if(N){const R=N.unit==="metric"?"\xB0C":"\xB0F",u=N.unit==="metric"?"km/h":"mph";C.location.textContent=N.locationStr,C.temp.textContent=`${N.temp}${R}`,C.condition.textContent=N.condition,C.wind.textContent=`Wind: ${N.windSpeed} ${u} ${N.windDir}`,C.icon.innerHTML=`<span class="weather-emoji">${escapeHtml(N.icon)}</span>`}}catch(N){k.logError("[Weather] Update Error",N,{function:"updateWeather"}),C.location.textContent="Weather Error",C.temp.textContent="Error",C.condition.textContent="Failed to load",C.wind.textContent="--"}}const E=document.getElementById("weather-modal"),O=document.getElementById("weather-location-input");document.getElementById("weather-settings")?.addEventListener("click",()=>{O.value=safeGet(B)||"";const C=P(),j=E.querySelector(`input[name="weather-unit-radio"][value="${C}"]`);j&&(j.checked=!0),E.classList.add("show"),O.focus()}),document.getElementById("weather-cancel")?.addEventListener("click",()=>{E.classList.remove("show")}),document.getElementById("weather-save")?.addEventListener("click",()=>{const C=O.value.trim();if(C){safeGet(B)!==C&&safeSet(I,""),safeSet(B,C);const N=E.querySelector('input[name="weather-unit-radio"]:checked'),R=N?N.value:"imperial",u=P();safeSet(z,R),u!==R&&safeSet(I,""),E.classList.remove("show"),w()}else showNotification("Please enter a location (e.g., Hamburg, London, 90210)","warning")}),wireModal(E),document.addEventListener("keydown",C=>{C.keyLine truncated
|
||||
<circle cx="${r}" cy="${d}" r="58" fill="none" stroke="var(--border)" stroke-width="2"/>
|
||||
${F}
|
||||
${q}
|
||||
<line x1="${r}" y1="${d}" x2="${r+28*Math.cos(U*Math.PI/180)}" y2="${d+28*Math.sin(U*Math.PI/180)}" stroke="var(--fg)" stroke-width="3" stroke-linecap="round"/>
|
||||
<line x1="${r}" y1="${d}" x2="${r+38*Math.cos(C*Math.PI/180)}" y2="${d+38*Math.sin(C*Math.PI/180)}" stroke="var(--fg)" stroke-width="2" stroke-linecap="round"/>
|
||||
<line x1="${r}" y1="${d}" x2="${r+38*Math.cos(L*Math.PI/180)}" y2="${d+38*Math.sin(L*Math.PI/180)}" stroke="var(--fg)" stroke-width="2" stroke-linecap="round"/>
|
||||
<line x1="${r}" y1="${d}" x2="${r+42*Math.cos(y*Math.PI/180)}" y2="${d+42*Math.sin(y*Math.PI/180)}" stroke="#e74c3c" stroke-width="1" stroke-linecap="round"/>
|
||||
<circle cx="${r}" cy="${d}" r="3" fill="var(--fg)"/>
|
||||
</svg>`,J=t.getHours()>=12?"PM":"AM";B.innerHTML=`<div class="analog-clock-wrap">${_}<div class="analog-info"><span class="analog-digital">${t.getHours()%12||12}:${String(o).padStart(2,"0")} ${J}</span><span class="analog-date-sm">${$(t)}</span></div></div>`,T="analog"}function v(){const t=new Date,e=t.getHours()%12||12,a=t.getMinutes(),o=t.getSeconds(),i="clock-widget"+(P!=="default"?" "+P:"");switch(k.className!==i&&(k.className=i),P){case"lcd":L(t);break;case"lcd-blue":L(t);break;case"lcd-amber":L(t);break;case"lcd-retro":L(t);break;case"lcd-taxi":L(t);break;case"flip":j(t);break;case"binary":R(t);break;case"analog":u(t,!1);break;case"roman":u(t,!0);break;default:O(t)}a===0&&o===0&&e!==M&&(M=e,S(e)),a!==0&&(M=-1)}function w(){clearTimeout(H);const t=document.hidden?6e4:1e3,e=t-Date.now()%t+25;H=setTimeout(()=>{v(),w()},e)}document.addEventListener("visibilitychange",()=>{b="",f(),v(),w()}),v(),w();const g=[{id:"default",label:"Default",icon:"\u{1F550}"},{id:"lcd",label:"LCD Green",icon:"\u{1F49A}"},{id:"lcd-blue",label:"LCD Blue",icon:"\u{1F499}"},{id:"lcd-amber",label:"LCD Amber",icon:"\u{1F7E0}"},{id:"lcd-retro",label:"LCD Retro",icon:"\u{1F7E9}"},{id:"lcd-taxi",label:"LCD Taxi",icon:"\u{1F7E1}"},{id:"flip",label:"Flip Clock",icon:"\u{1F4DF}"},{id:"binary",label:"Binary",icon:"\u{1F4BB}"},{id:"analog",label:"Analog",icon:"\u23F0"},{id:"roman",label:"Roman",icon:"\u{1F3DB}\uFE0F"}];let x='<div class="clock-style-grid">';g.forEach(t=>{x+=`<label class="clock-style-option">
|
||||
</svg>`,J=t.getHours()>=12?"PM":"AM";B.innerHTML=`<div class="analog-clock-wrap">${_}<div class="analog-info"><span class="analog-digital">${t.getHours()%12||12}:${String(o).padStart(2,"0")} ${J}</span><span class="analog-date-sm">${$(t)}</span></div></div>`,T="analog"}function v(){const t=new Date,e=t.getHours()%12||12,a=t.getMinutes(),o=t.getSeconds(),i="clock-widget"+(P!=="default"?" "+P:"");switch(k.className!==i&&(k.className=i),P){case"lcd":C(t);break;case"lcd-blue":C(t);break;case"lcd-amber":C(t);break;case"lcd-retro":C(t);break;case"lcd-taxi":C(t);break;case"flip":j(t);break;case"binary":R(t);break;case"analog":u(t,!1);break;case"roman":u(t,!0);break;default:O(t)}a===0&&o===0&&e!==M&&(M=e,S(e)),a!==0&&(M=-1)}function x(){clearTimeout(H);const t=document.hidden?6e4:1e3,e=t-Date.now()%t+25;H=setTimeout(()=>{v(),x()},e)}document.addEventListener("visibilitychange",()=>{h="",w(),v(),x()}),v(),x();const g=[{id:"default",label:"Default",icon:"\u{1F550}"},{id:"lcd",label:"LCD Green",icon:"\u{1F49A}"},{id:"lcd-blue",label:"LCD Blue",icon:"\u{1F499}"},{id:"lcd-amber",label:"LCD Amber",icon:"\u{1F7E0}"},{id:"lcd-retro",label:"LCD Retro",icon:"\u{1F7E9}"},{id:"lcd-taxi",label:"LCD Taxi",icon:"\u{1F7E1}"},{id:"flip",label:"Flip Clock",icon:"\u{1F4DF}"},{id:"binary",label:"Binary",icon:"\u{1F4BB}"},{id:"analog",label:"Analog",icon:"\u23F0"},{id:"roman",label:"Roman",icon:"\u{1F3DB}\uFE0F"}];let b='<div class="clock-style-grid">';g.forEach(t=>{b+=`<label class="clock-style-option">
|
||||
<input type="radio" name="clock-style-radio" value="${t.id}">
|
||||
<span class="clock-style-card"><span class="clock-style-icon">${t.icon}</span><span class="clock-style-label">${t.label}</span></span>
|
||||
</label>`}),x+="</div>",injectModal("clock-settings-modal",`<div id="clock-settings-modal" class="weather-modal">
|
||||
</label>`}),b+="</div>",injectModal("clock-settings-modal",`<div id="clock-settings-modal" class="weather-modal">
|
||||
<div class="weather-modal-content" style="max-width: 420px;">
|
||||
<h3>Clock Settings</h3>
|
||||
<div style="margin-bottom: 16px;">
|
||||
<label style="display: block; margin-bottom: 8px; font-weight: 600; color: var(--fg);">Style</label>
|
||||
${x}
|
||||
${b}
|
||||
</div>
|
||||
<div style="margin-bottom: 16px; padding-top: 12px; border-top: 1px solid var(--border);">
|
||||
<label style="display: flex; align-items: center; gap: 8px; cursor: pointer; font-weight: 600; color: var(--fg);">
|
||||
@@ -1973,7 +1946,7 @@ To endpoint: POST /api/v1/security/events/ingest or /events/batch`),v()}catch(m)
|
||||
<button id="clock-settings-save">Save</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>`);const s=document.getElementById("clock-settings-modal"),p=document.getElementById("clock-chimes-toggle"),l=document.getElementById("clock-chime-volume"),m=document.getElementById("clock-volume-section");function c(){const t=safeGet("clock-style")||"default",e=s.querySelector(`input[value="${t}"]`);e&&(e.checked=!0),p.checked=safeGet("clock-chimes")==="true",l.value=safeGet("clock-chime-volume")||"50",m.style.opacity=p.checked?"1":"0.4"}p?.addEventListener("change",()=>{m.style.opacity=p.checked?"1":"0.4"}),document.getElementById("clock-settings")?.addEventListener("click",()=>{c(),s.classList.add("show")}),document.getElementById("clock-chime-test")?.addEventListener("click",()=>{const t=parseInt(l.value,10)/100,e=new Audio("/assets/sounds/church-bell.mp3");e.volume=t,e.play().catch(()=>{})}),document.getElementById("clock-settings-save")?.addEventListener("click",()=>{const t=s.querySelector('input[name="clock-style-radio"]:checked'),e=t?t.value:"default";safeSet("clock-style",e),safeSet("clock-chimes",String(p.checked)),safeSet("clock-chime-volume",l.value),P=e,b="",f(),v(),w(),s.classList.remove("show"),showNotification("Clock settings saved","success",2e3)}),document.getElementById("clock-settings-cancel")?.addEventListener("click",()=>{s.classList.remove("show")}),wireModal(s),s?.querySelectorAll('input[name="clock-style-radio"]').forEach(t=>{t.addEventListener("change",()=>{P=t.value,b="",f(),v()})})})(),(function(){async function k(){try{const D=await(await fetch("/api/v1/health-checks/status")).json();if(!D.success||!D.status)return;for(const[b,T]of Object.entries(D.status)){const h=document.getElementById("uptime-"+b),H=document.getElementById("uptime-bar-"+b);if(!h)continue;const S=T.uptime?.["24h"];if(S!=null){const $=S.toFixed(1);h.textContent=`${$}% uptime`,h.className="uptime-chip",S>=99.9?h.classList.add("excellent"):S>=99?h.classList.add("good"):S>=95?h.classList.add("degraded"):h.classList.add("poor"),H&&(H.style.width=$+"%")}}}catch{console.warn("[Card Badges] Health check API unavailable")}}let B;try{B=new Set(JSON.parse(safeSessionGet("dismissed-updates")||"[]"))}catch{B=new Set}let A=[];async function I(M){try{const b=await(await fetch("/api/v1/updates/available")).json();if(!b.success)return;document.querySelectorAll(".update-available-badge").forEach(h=>h.classList.remove("visible"));const T=b.updates||[];if(A=T,M&&T.length>0){const h=window._lastKnownUpdateCount||0;h>0&&T.length>h&&showNotification(`${T.length} container update(s) available \u2014 click Update Management to review.`,"info"),window._lastKnownUpdateCount=T.length}if(!T.length)return;for(const h of T){const H=window.APPS||[];for(const S of H)if(S.containerId===h.containerId||S.id===h.containerName||S.name===h.containerName){if(B.has(S.id))break;const $=document.getElementById("update-badge-"+S.id),f=document.getElementById("update-btn-"+S.id);$&&($.classList.add("visible"),$.title="Update available \u2014 click to open Update Management.",$.style.cursor="pointer",$.onclick=E=>{E.stopPropagation(),window.openUpdateModal&&window.openUpdateModal(S.id)}),f&&(f.style.background="#f97316",f.style.borderColor="#f97316",f.style.boxShadow="0 0 6px #f9731688",f.title="Update available \u2014 click to open Update Management.");break}}}catch{console.warn("[Card Badges] Updates API unavailable")}}function z(){setTimeout(()=>{k(),I()},5e3),setInterval(()=>{k(),I(!0)},6e4)}const P=window.refreshAll;P&&(window.refreshAll=async function(){try{await P(),setTimeout(k,1e3)}catch(M){console.warn("[Card Badges] Error in refreshAll hook:",M.message)}}),z()})(),(function(){var k=null,B=null,A={},I={dark:"Dark",light:"Light",blue:"Blue",black:"Black",nord:"Nord",dracula:"Dracula","solarized-dark":"Solarized Dark","solarized-light":"Solarized Light",taxi:"Taxi",ocean:"Ocean"},z=[["bg","Background","base"],["card-base","Card","base"],["fg","Text","base"],["muted","Muted Text","base"],["border","Border","base"],["accent","Accent","accent"],["accent-strong","Accent Strong","accent"],["ok-bg","OK Background","status"],["ok-fg","OK Text","status"],["bad-bg","Error Bg","status"],["bad-fg","Error Text","status"],["dot-ok","Dot OK","status"],["dot-bad","Dot Error","status"],["uptime","Uptime Bar","status"],["hover","Hover","advanced"],["card-hover","Card Hover","advanced"],["base","Tags/Badges","advanced"],["fg-muted","Dim Text","advanced"],["success","Success","advanced"],["error","Error","advanced"],["warning","Warning","advanced"]],P=document.getElementById("theme");if(!P)return;var M=document.getElementById("theme-label");function D(o){if(I[o])return I[o];var i=safeGetJSON(window.USER_THEMES_KEY,{});return i[o]&&i[o].name||o}function b(){M&&(M.textContent=D(window.getActiveTheme()))}P.addEventListener("click",function(){var o=window.THEMES.slice(),i=window.getActiveTheme(),n=o.indexOf(i),r=o[(n+1)%o.length];window.applyTheme(r),b()}),b();function T(){var o={base:"Base Colors",accent:"Accent",status:"Status",advanced:"Advanced (auto-deriLine truncated
|
||||
</div>`);const s=document.getElementById("clock-settings-modal"),p=document.getElementById("clock-chimes-toggle"),l=document.getElementById("clock-chime-volume"),m=document.getElementById("clock-volume-section");function c(){const t=safeGet("clock-style")||"default",e=s.querySelector(`input[value="${t}"]`);e&&(e.checked=!0),p.checked=safeGet("clock-chimes")==="true",l.value=safeGet("clock-chime-volume")||"50",m.style.opacity=p.checked?"1":"0.4"}p?.addEventListener("change",()=>{m.style.opacity=p.checked?"1":"0.4"}),document.getElementById("clock-settings")?.addEventListener("click",()=>{c(),s.classList.add("show")}),document.getElementById("clock-chime-test")?.addEventListener("click",()=>{const t=parseInt(l.value,10)/100,e=new Audio("/assets/sounds/church-bell.mp3");e.volume=t,e.play().catch(()=>{})}),document.getElementById("clock-settings-save")?.addEventListener("click",()=>{const t=s.querySelector('input[name="clock-style-radio"]:checked'),e=t?t.value:"default";safeSet("clock-style",e),safeSet("clock-chimes",String(p.checked)),safeSet("clock-chime-volume",l.value),P=e,h="",w(),v(),x(),s.classList.remove("show"),showNotification("Clock settings saved","success",2e3)}),document.getElementById("clock-settings-cancel")?.addEventListener("click",()=>{s.classList.remove("show")}),wireModal(s),s?.querySelectorAll('input[name="clock-style-radio"]').forEach(t=>{t.addEventListener("change",()=>{P=t.value,h="",w(),v()})})})(),(function(){async function k(){try{const D=await(await fetch("/api/v1/health-checks/status")).json();if(!D.success||!D.status)return;for(const[h,T]of Object.entries(D.status)){const f=document.getElementById("uptime-"+h),H=document.getElementById("uptime-bar-"+h);if(!f)continue;const S=T.uptime?.["24h"];if(S!=null){const $=S.toFixed(1);f.textContent=`${$}% uptime`,f.className="uptime-chip",S>=99.9?f.classList.add("excellent"):S>=99?f.classList.add("good"):S>=95?f.classList.add("degraded"):f.classList.add("poor"),H&&(H.style.width=$+"%")}}}catch{console.warn("[Card Badges] Health check API unavailable")}}let B;try{B=new Set(JSON.parse(safeSessionGet("dismissed-updates")||"[]"))}catch{B=new Set}let A=[];async function I(M){try{const h=await(await fetch("/api/v1/updates/available")).json();if(!h.success)return;document.querySelectorAll(".update-available-badge").forEach(f=>f.classList.remove("visible"));const T=h.updates||[];if(A=T,M&&T.length>0){const f=window._lastKnownUpdateCount||0;f>0&&T.length>f&&showNotification(`${T.length} container update(s) available \u2014 click Update Management to review.`,"info"),window._lastKnownUpdateCount=T.length}if(!T.length)return;for(const f of T){const H=window.APPS||[];for(const S of H)if(S.containerId===f.containerId||S.id===f.containerName||S.name===f.containerName){if(B.has(S.id))break;const $=document.getElementById("update-badge-"+S.id),w=document.getElementById("update-btn-"+S.id);$&&($.classList.add("visible"),$.title="Update available \u2014 click to open Update Management.",$.style.cursor="pointer",$.onclick=E=>{E.stopPropagation(),window.openUpdateModal&&window.openUpdateModal(S.id)}),w&&(w.style.background="#f97316",w.style.borderColor="#f97316",w.style.boxShadow="0 0 6px #f9731688",w.title="Update available \u2014 click to open Update Management.");break}}}catch{console.warn("[Card Badges] Updates API unavailable")}}function z(){setTimeout(()=>{k(),I()},5e3),setInterval(()=>{k(),I(!0)},6e4)}const P=window.refreshAll;P&&(window.refreshAll=async function(){try{await P(),setTimeout(k,1e3)}catch(M){console.warn("[Card Badges] Error in refreshAll hook:",M.message)}}),z()})(),(function(){var k=null,B=null,A={},I={dark:"Dark",light:"Light",blue:"Blue",black:"Black",nord:"Nord",dracula:"Dracula","solarized-dark":"Solarized Dark","solarized-light":"Solarized Light",taxi:"Taxi",ocean:"Ocean"},z=[["bg","Background","base"],["card-base","Card","base"],["fg","Text","base"],["muted","Muted Text","base"],["border","Border","base"],["accent","Accent","accent"],["accent-strong","Accent Strong","accent"],["ok-bg","OK Background","status"],["ok-fg","OK Text","status"],["bad-bg","Error Bg","status"],["bad-fg","Error Text","status"],["dot-ok","Dot OK","status"],["dot-bad","Dot Error","status"],["uptime","Uptime Bar","status"],["hover","Hover","advanced"],["card-hover","Card Hover","advanced"],["base","Tags/Badges","advanced"],["fg-muted","Dim Text","advanced"],["success","Success","advanced"],["error","Error","advanced"],["warning","Warning","advanced"]],P=document.getElementById("theme");if(!P)return;var M=document.getElementById("theme-label");function D(o){if(I[o])return I[o];var i=safeGetJSON(window.USER_THEMES_KEY,{});return i[o]&&i[o].name||o}function h(){M&&(M.textContent=D(window.getActiveTheme()))}P.addEventListener("click",function(){var o=window.THEMES.slice(),i=window.getActiveTheme(),n=o.indexOf(i),r=o[(n+1)%o.length];window.applyTheme(r),h()}),h();function T(){var o={base:"Base Colors",accent:"Accent",status:"Status",advanced:"Advanced (auto-deriLine truncated
|
||||
<div class="weather-modal-content" style="min-width: 420px; max-width: 520px;">
|
||||
<h3>DashCaddy License</h3>
|
||||
<p style="font-size: 0.85rem; color: var(--muted); margin: 0 0 16px;">
|
||||
@@ -2010,16 +1983,16 @@ To endpoint: POST /api/v1/security/events/ingest or /events/batch`),v()}catch(m)
|
||||
<button id="license-activate" class="btn-accent">Activate</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>`);const k=document.getElementById("license-modal"),B=document.getElementById("license-code-input"),A=document.getElementById("license-activate"),I=document.getElementById("license-deactivate"),z=document.getElementById("license-error"),P=document.getElementById("license-success"),M=document.getElementById("license-badge-icon"),D=document.getElementById("license-badge-text"),b=document.getElementById("license-badge"),T=document.getElementById("license-details"),h=document.getElementById("license-feature-list"),H=document.getElementById("license-activate-section");let S=null;function $(){z.style.display="none",P.style.display="none"}function f(w){$(),z.textContent=w,z.style.display="block"}function E(w){$(),P.textContent=w,P.style.display="block"}function O(w){if(S=w,w.active){b.style.background="rgba(46,204,113,0.15)",b.style.color="var(--ok-fg)",M.textContent="\u2605",D.textContent="Premium Active";const s=w.lifetime?"<div>License: <strong>LIFETIME</strong></div>":`<div>Expires: <strong>${new Date(w.expiresAt).toLocaleDateString()}</strong> (${w.daysRemaining} days remaining)</div>`;T.innerHTML=`
|
||||
<div>Code: <code style="font-family: monospace;">${w.code||"***"}</code></div>
|
||||
</div>`);const k=document.getElementById("license-modal"),B=document.getElementById("license-code-input"),A=document.getElementById("license-activate"),I=document.getElementById("license-deactivate"),z=document.getElementById("license-error"),P=document.getElementById("license-success"),M=document.getElementById("license-badge-icon"),D=document.getElementById("license-badge-text"),h=document.getElementById("license-badge"),T=document.getElementById("license-details"),f=document.getElementById("license-feature-list"),H=document.getElementById("license-activate-section");let S=null;function $(){z.style.display="none",P.style.display="none"}function w(x){$(),z.textContent=x,z.style.display="block"}function E(x){$(),P.textContent=x,P.style.display="block"}function O(x){if(S=x,x.active){h.style.background="rgba(46,204,113,0.15)",h.style.color="var(--ok-fg)",M.textContent="\u2605",D.textContent="Premium Active";const s=x.lifetime?"<div>License: <strong>LIFETIME</strong></div>":`<div>Expires: <strong>${new Date(x.expiresAt).toLocaleDateString()}</strong> (${x.daysRemaining} days remaining)</div>`;T.innerHTML=`
|
||||
<div>Code: <code style="font-family: monospace;">${x.code||"***"}</code></div>
|
||||
${s}
|
||||
`,H.style.display="none",A.style.display="none",I.style.display=""}else b.style.background="rgba(149,165,166,0.15)",b.style.color="var(--muted)",M.textContent="\u2606",D.textContent=w.expired?"License Expired":"Free Tier",T.innerHTML=w.expired?"<div>Your license has expired. Enter a new code to renew.</div>":"<div>Enter a license code to unlock premium features.</div>",H.style.display="",A.style.display="",I.style.display="none";const g=w.premiumFeatures||{},x=new Set(w.features||[]);h.innerHTML=Object.entries(g).map(([s,p])=>`<div style="display: flex; align-items: center; gap: 8px; padding: 8px 12px; border-radius: 6px; background: var(--card-bg); border: 1px solid var(--border);">
|
||||
<span style="font-size: 1.1rem;">${x.has(s)?"\u2705":"\u{1F512}"}</span>
|
||||
`,H.style.display="none",A.style.display="none",I.style.display=""}else h.style.background="rgba(149,165,166,0.15)",h.style.color="var(--muted)",M.textContent="\u2606",D.textContent=x.expired?"License Expired":"Free Tier",T.innerHTML=x.expired?"<div>Your license has expired. Enter a new code to renew.</div>":"<div>Enter a license code to unlock premium features.</div>",H.style.display="",A.style.display="",I.style.display="none";const g=x.premiumFeatures||{},b=new Set(x.features||[]);f.innerHTML=Object.entries(g).map(([s,p])=>`<div style="display: flex; align-items: center; gap: 8px; padding: 8px 12px; border-radius: 6px; background: var(--card-bg); border: 1px solid var(--border);">
|
||||
<span style="font-size: 1.1rem;">${b.has(s)?"\u2705":"\u{1F512}"}</span>
|
||||
<div>
|
||||
<div style="font-weight: 600; font-size: 0.9rem;">${p.name}</div>
|
||||
<div style="font-size: 0.78rem; color: var(--muted);">${p.description}</div>
|
||||
</div>
|
||||
</div>`).join("")}async function L(){try{const g=await(await fetch("/api/v1/license/status")).json();g.success&&(O(g.license),R(g.license))}catch(w){console.warn("Failed to load license status:",w.message)}}async function j(){const w=B.value.trim();if(!w){f("Please enter a license code.");return}$(),A.disabled=!0,A.textContent="Activating...";try{const x=await(await secureFetch("/api/v1/license/activate",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({code:w})})).json();x.success?(E(x.message),B.value="",O(x.license),showNotification("License activated! Premium features unlocked.","success",5e3),R(x.license)):f(x.error||"Activation failed")}catch(g){f("Network error: "+g.message)}finally{A.disabled=!1,A.textContent="Activate"}}async function N(){if(confirm("Deactivate your license? You can reuse the code on another machine.")){I.disabled=!0,I.textContent="Deactivating...";try{const g=await(await secureFetch("/api/v1/license/deactivate",{method:"POST"})).json();g.success?(E(g.message),await L(),showNotification("License deactivated.","info",3e3),R({active:!1})):f(g.error||"Deactivation failed")}catch(w){f("Network error: "+w.message)}finally{I.disabled=!1,I.textContent="Deactivate"}}}function R(w){const g=document.getElementById("license-status-topbar"),x=document.getElementById("license-topbar-icon"),s=document.getElementById("license-topbar-text"),p=document.getElementById("license-topbar-time");if(g)if(g.className="license-status-topbar "+(w.active?"premium":"free"),w.active)if(x.textContent="\u2605",s.textContent="PREMIUM",w.lifetime)p.textContent="\xB7 LIFETIME";else{const l=w.daysRemaining;p.textContent=l!=null?"\xB7 "+l+"d remaining":""}else x.textContent="\u2606",s.textContent=w.expired?"EXPIRED":"FREE TIER",p.textContent=""}function u(){$(),L(),k.classList.add("show")}B.addEventListener("input",function(){let w=this.value.toUpperCase().replace(/[^A-Z0-9-]/g,"");if(w.length>this._prevLength&&(w=w.replace(/-/g,""),w.length>2&&!w.startsWith("DC")&&(w="DC"+w),w.startsWith("DC")&&w.length>2)){const g=["DC"],x=w.substring(2);for(let s=0;s<x.length;s+=5)g.push(x.substring(s,s+5));w=g.join("-")}this._prevLength=w.length,this.value=w}),A.addEventListener("click",j),I.addEventListener("click",N),B.addEventListener("keydown",w=>{w.key==="Enter"&&j()}),wireModal(k,document.getElementById("license-cancel"));const v=document.getElementById("license-status-topbar");v&&v.addEventListener("click",()=>window.openLicenseModal&&window.openLicenseModal()),window.openLicenseModal=u,window.checkPremiumFeature=async function(w){try{return(await(await fetch(`/api/v1/license/feature/${w}`)).json()).available}catch{return!1}},L().then(w=>{S&&R(S)})})(),(function(){"use strict";if(window.__dc_058_share_modal_loaded)return;window.__dc_058_share_modal_loaded=!0;const k=[{ms:3600*1e3,label:"1 hour"},{ms:1440*60*1e3,label:"24 hours"},{ms:10080*60*1e3,label:"7 days"}];injectModal("share-modal",`
|
||||
</div>`).join("")}async function C(){try{const g=await(await fetch("/api/v1/license/status")).json();g.success&&(O(g.license),R(g.license))}catch(x){console.warn("Failed to load license status:",x.message)}}async function j(){const x=B.value.trim();if(!x){w("Please enter a license code.");return}$(),A.disabled=!0,A.textContent="Activating...";try{const b=await(await secureFetch("/api/v1/license/activate",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({code:x})})).json();b.success?(E(b.message),B.value="",O(b.license),showNotification("License activated! Premium features unlocked.","success",5e3),R(b.license)):w(b.error||"Activation failed")}catch(g){w("Network error: "+g.message)}finally{A.disabled=!1,A.textContent="Activate"}}async function N(){if(confirm("Deactivate your license? You can reuse the code on another machine.")){I.disabled=!0,I.textContent="Deactivating...";try{const g=await(await secureFetch("/api/v1/license/deactivate",{method:"POST"})).json();g.success?(E(g.message),await C(),showNotification("License deactivated.","info",3e3),R({active:!1})):w(g.error||"Deactivation failed")}catch(x){w("Network error: "+x.message)}finally{I.disabled=!1,I.textContent="Deactivate"}}}function R(x){const g=document.getElementById("license-status-topbar"),b=document.getElementById("license-topbar-icon"),s=document.getElementById("license-topbar-text"),p=document.getElementById("license-topbar-time");if(g)if(g.className="license-status-topbar "+(x.active?"premium":"free"),x.active)if(b.textContent="\u2605",s.textContent="PREMIUM",x.lifetime)p.textContent="\xB7 LIFETIME";else{const l=x.daysRemaining;p.textContent=l!=null?"\xB7 "+l+"d remaining":""}else b.textContent="\u2606",s.textContent=x.expired?"EXPIRED":"FREE TIER",p.textContent=""}function u(){$(),C(),k.classList.add("show")}B.addEventListener("input",function(){let x=this.value.toUpperCase().replace(/[^A-Z0-9-]/g,"");if(x.length>this._prevLength&&(x=x.replace(/-/g,""),x.length>2&&!x.startsWith("DC")&&(x="DC"+x),x.startsWith("DC")&&x.length>2)){const g=["DC"],b=x.substring(2);for(let s=0;s<b.length;s+=5)g.push(b.substring(s,s+5));x=g.join("-")}this._prevLength=x.length,this.value=x}),A.addEventListener("click",j),I.addEventListener("click",N),B.addEventListener("keydown",x=>{x.key==="Enter"&&j()}),wireModal(k,document.getElementById("license-cancel"));const v=document.getElementById("license-status-topbar");v&&v.addEventListener("click",()=>window.openLicenseModal&&window.openLicenseModal()),window.openLicenseModal=u,window.checkPremiumFeature=async function(x){try{return(await(await fetch(`/api/v1/license/feature/${x}`)).json()).available}catch{return!1}},C().then(x=>{S&&R(S)})})(),(function(){"use strict";if(window.__dc_058_share_modal_loaded)return;window.__dc_058_share_modal_loaded=!0;const k=[{ms:3600*1e3,label:"1 hour"},{ms:1440*60*1e3,label:"24 hours"},{ms:10080*60*1e3,label:"7 days"}];injectModal("share-modal",`
|
||||
<div id="share-modal" class="weather-modal" role="dialog" aria-labelledby="share-modal-title">
|
||||
<div class="weather-modal-content" style="min-width: 460px; max-width: 580px;">
|
||||
<h3 id="share-modal-title">Share <span id="share-modal-service-name">\u2026</span></h3>
|
||||
@@ -2088,7 +2061,7 @@ To endpoint: POST /api/v1/security/events/ingest or /events/batch`),v()}catch(m)
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
`);const B=document.getElementById("share-modal"),A=document.getElementById("share-modal-service-name"),I=document.getElementById("share-issued"),z=document.getElementById("share-issued-url"),P=document.getElementById("share-issued-copy"),M=document.getElementById("share-issued-meta"),D=document.getElementById("share-error"),b=document.getElementById("share-success"),T=document.getElementById("share-outstanding-list"),h=document.getElementById("share-cancel"),H=document.getElementById("share-public-create"),S=document.getElementById("share-ts-create"),$=document.getElementById("share-ts-email"),f=document.getElementById("share-public-ttl");let E=null,O="public";function L(){D.style.display="none",b.style.display="none",I.style.display="none"}function j(t){b.style.display="none",I.style.display="none",D.textContent=t,D.style.display="block"}function N(t){D.style.display="none",b.textContent=t,b.style.display="block"}function R(){return window.location.origin}function u(t){return t.startsWith("http")?t:R()+t}function v(t){if(!t)return"";const e=new Date(t);return Number.isNaN(e.getTime())?"":e.toLocaleString()}function w(t){if(t<=0)return"expired";const e=Math.floor(t/36e5);if(e>=24)return`${Math.floor(e/24)}d ${e%24}h left`;const a=Math.floor(t%36e5/6e4);return`${e}h ${a}m left`}function g(t){O=t,L(),B.querySelectorAll(".share-tab").forEach(e=>{const a=e.dataset.tab===t;e.classList.toggle("active",a),e.style.borderBottomColor=a?"var(--accent)":"transparent",e.style.color=a?"var(--fg)":"var(--muted)",e.style.fontWeight=a?"600":"400"}),B.querySelectorAll(".share-tab-panel").forEach(e=>{e.style.display=e.dataset.panel===t?"":"none"})}async function x(){T.innerHTML='<span style="color: var(--muted);">Loading\u2026</span>';try{const t=await fetch("/api/v1/share",{credentials:"same-origin"});if(!t.ok){T.innerHTML='<span style="color: var(--muted);">No shares listed.</span>';return}const e=await t.json(),o=(e&&e.data||[]).filter(i=>i.serviceId===E.id);if(o.length===0){T.innerHTML='<span style="color: var(--muted);">No outstanding shares for this service.</span>';return}T.innerHTML=o.map(i=>{const n=i.expiresAt?w(new Date(i.expiresAt).getTime()-Date.now()):"";return`
|
||||
`);const B=document.getElementById("share-modal"),A=document.getElementById("share-modal-service-name"),I=document.getElementById("share-issued"),z=document.getElementById("share-issued-url"),P=document.getElementById("share-issued-copy"),M=document.getElementById("share-issued-meta"),D=document.getElementById("share-error"),h=document.getElementById("share-success"),T=document.getElementById("share-outstanding-list"),f=document.getElementById("share-cancel"),H=document.getElementById("share-public-create"),S=document.getElementById("share-ts-create"),$=document.getElementById("share-ts-email"),w=document.getElementById("share-public-ttl");let E=null,O="public";function C(){D.style.display="none",h.style.display="none",I.style.display="none"}function j(t){h.style.display="none",I.style.display="none",D.textContent=t,D.style.display="block"}function N(t){D.style.display="none",h.textContent=t,h.style.display="block"}function R(){return window.location.origin}function u(t){return t.startsWith("http")?t:R()+t}function v(t){if(!t)return"";const e=new Date(t);return Number.isNaN(e.getTime())?"":e.toLocaleString()}function x(t){if(t<=0)return"expired";const e=Math.floor(t/36e5);if(e>=24)return`${Math.floor(e/24)}d ${e%24}h left`;const a=Math.floor(t%36e5/6e4);return`${e}h ${a}m left`}function g(t){O=t,C(),B.querySelectorAll(".share-tab").forEach(e=>{const a=e.dataset.tab===t;e.classList.toggle("active",a),e.style.borderBottomColor=a?"var(--accent)":"transparent",e.style.color=a?"var(--fg)":"var(--muted)",e.style.fontWeight=a?"600":"400"}),B.querySelectorAll(".share-tab-panel").forEach(e=>{e.style.display=e.dataset.panel===t?"":"none"})}async function b(){T.innerHTML='<span style="color: var(--muted);">Loading\u2026</span>';try{const t=await fetch("/api/v1/share",{credentials:"same-origin"});if(!t.ok){T.innerHTML='<span style="color: var(--muted);">No shares listed.</span>';return}const e=await t.json(),o=(e&&e.data||[]).filter(i=>i.serviceId===E.id);if(o.length===0){T.innerHTML='<span style="color: var(--muted);">No outstanding shares for this service.</span>';return}T.innerHTML=o.map(i=>{const n=i.expiresAt?x(new Date(i.expiresAt).getTime()-Date.now()):"";return`
|
||||
<div class="share-row" data-share-id="${escapeHtml(i.id)}"
|
||||
style="display: flex; align-items: center; gap: 8px; padding: 6px 0; border-bottom: 1px dashed var(--border);">
|
||||
<span style="flex: 1;">
|
||||
@@ -2100,5 +2073,5 @@ To endpoint: POST /api/v1/security/events/ingest or /events/batch`),v()}catch(m)
|
||||
Revoke
|
||||
</button>
|
||||
</div>
|
||||
`}).join(""),T.querySelectorAll(".share-revoke").forEach(i=>{i.addEventListener("click",()=>s(i.dataset.shareId))})}catch{T.innerHTML='<span style="color: var(--muted);">Could not load outstanding shares.</span>'}}async function s(t){try{const e=await fetch(`/api/v1/share/${encodeURIComponent(t)}`,{method:"DELETE",credentials:"same-origin"});if(!e.ok){const a=await e.json().catch(()=>({}));j(a&&a.error||`Revoke failed (HTTP ${e.status}).`);return}N("Share revoked."),x()}catch{j("Network error while revoking.")}}async function p(){if(!E)return;L(),H.disabled=!0;const t=H.textContent;H.textContent="Creating\u2026";try{const e=parseInt(f.value,10),a=await fetch("/api/v1/share",{method:"POST",credentials:"same-origin",headers:{"Content-Type":"application/json"},body:JSON.stringify({serviceId:E.id,ttlMs:e})}),o=await a.json().catch(()=>({}));if(!a.ok||!o.success){m(a.status,o);return}const i=o.data.urlPath;z.value=u(i),M.textContent=`Public link \xB7 expires ${v(o.data.expiresAt)}`,I.style.display="block",N("Share link created."),x()}catch{j("Network error while creating share.")}finally{H.disabled=!1,H.textContent=t}}async function l(){if(!E)return;const t=($.value||"").trim();if(!t||!t.includes("@")){j("A valid recipient email is required.");return}L(),S.disabled=!0;const e=S.textContent;S.textContent="Creating\u2026";try{const a=await fetch("/api/v1/share/tailscale",{method:"POST",credentials:"same-origin",headers:{"Content-Type":"application/json"},body:JSON.stringify({serviceId:E.id,email:t})}),o=await a.json().catch(()=>({}));if(!a.ok||!o.success){m(a.status,o);return}const i=o.data&&o.data.urlPath;i?(z.value=u(i),M.textContent=`Tailscale invite \xB7 emailed to ${t} (or use this URL manually if delivery failed).`):(z.value="",M.textContent=`Tailscale invite sent to ${t}.`),I.style.display="block",N("Tailscale invite created."),$.value="",x()}catch{j("Network error while creating Tailscale invite.")}finally{S.disabled=!1,S.textContent=e}}function m(t,e){const a=e&&e.error||"";if(t===402){j("Share is a Pro feature. Activate a license to unlock.");return}if(t===400&&/tailscale/i.test(a)){j("Tailscale is not configured on this host. Set up Tailscale in the dashboard first.");return}if(t===403){j("You do not have permission to share services.");return}if(t===404){j("Service not found. It may have been deleted.");return}j(a||`Request failed (HTTP ${t}).`)}function c(t){!t||!t.id||(E={id:t.id,name:t.name||t.id},A.textContent=E.name,L(),g("public"),$.value="",f.value=String(k[1].ms),B.classList.add("show"),x())}B.querySelectorAll(".share-tab").forEach(t=>{t.addEventListener("click",()=>g(t.dataset.tab))}),H.addEventListener("click",p),S.addEventListener("click",l),h.addEventListener("click",()=>B.classList.remove("show")),wireModal(B,h),P.addEventListener("click",async()=>{const t=z.value;if(t)try{navigator.clipboard&&navigator.clipboard.writeText?await navigator.clipboard.writeText(t):(z.select(),document.execCommand("copy"));const e=P.textContent;P.textContent="Copied!",setTimeout(()=>{P.textContent=e},1200)}catch{j("Could not copy to clipboard. Select the URL manually.")}}),window.openShareModal=c})();
|
||||
//# sourceMappingURL=data:application/json;base64,ewogICJ2ZXJzaW9uIjogMywKICAic291cmNlcyI6IFsiPHN0ZGluPiJdLAogICJzb3VyY2VzQ29udGVudCI6IFsiLy8gTG9nbyBDdXN0b21pemF0aW9uIFN5c3RlbVxuKGZ1bmN0aW9uKCkge1xuICAvLyBJbmplY3QgbW9kYWwgSFRNTFxuICBpbmplY3RNb2RhbCgnbG9nby1tb2RhbCcsIGA8ZGl2IGlkPVwibG9nby1tb2RhbFwiIGNsYXNzPVwid2VhdGhlci1tb2RhbFwiPlxuICAgIDxkaXYgY2xhc3M9XCJ3ZWF0aGVyLW1vZGFsLWNvbnRlbnRcIiBzdHlsZT1cIm1pbi13aWR0aDogNDAwcHg7IG1heC13aWR0aDogNTIwcHg7XCI+XG4gICAgICA8aDM+RGFzaGJvYXJkIFNldHRpbmdzPC9oMz5cbiAgICAgIDxwIHN0eWxlPVwiZm9udC1zaXplOiAwLjg1cmVtOyBjb2xvcjogdmFyKC0tbXV0ZWQpOyBtYXJnaW46IDAgMCAxNnB4O1wiPlxuICAgICAgICBDdXN0b21pemUgeW91ciBkYXNoYm9hcmQncyBhcHBlYXJhbmNlIGFuZCBzeXN0ZW0gcHJlZmVyZW5jZXMuXG4gICAgICA8L3A+XG5cbiAgICAgIDxkaXYgY2xhc3M9XCJtYi0xNlwiPlxuICAgICAgICA8bGFiZWwgZm9yPVwiZGFzaGJvYXJkLXRpdGxlXCIgY2xhc3M9XCJmb3JtLWxhYmVsLWJvbGRcIj5EYXNoYm9hcmQgVGl0bGU6PC9sYWJlbD5cbiAgICAgICAgPGlucHV0IHR5cGU9XCJ0ZXh0XCIgaWQ9XCJkYXNoYm9hcmQtdGl0bGVcIiBwbGFjZWhvbGRlcj1cIkRhc2hDYWRkeVwiIG1heGxlbmd0aD1cIjUwXCIgc3R5bGU9XCJ3aWR0aDogMTAwJTsgcGFkZGluZzogMTBweCAxMnB4OyBib3JkZXI6IDFweCBzb2xpZCB2YXIoLS1ib3JkZXIpOyBib3JkZXItcmFkaXVzOiA0cHg7IGJhY2tncm91bmQ6IHZhcigtLWNhcmQtYmcpOyBjb2xvcjogdmFyKC0tZmcpOyBmb250LXNpemU6IDFyZW07XCIgLz5cbiAgICAgICAgPHAgY2xhc3M9XCJ0aW55LWhpbnRcIj5TaG93biBpbiBicm93c2VyIHRhYiBhbmQgaGVhZGVyIChtYXggNTAgY2hhcmFjdGVycyk8L3A+XG4gICAgICA8L2Rpdj5cblxuICAgICAgPGhyIGNsYXNzPVwiaHItZGl2aWRlclwiIC8+XG5cbiAgICAgIDxkaXYgY2xhc3M9XCJtYi0xNlwiPlxuICAgICAgICA8bGFiZWwgY2xhc3M9XCJmb3JtLWxhYmVsLWJvbGRcIj5Mb2dvOjwvbGFiZWw+XG4gICAgICAgIDxwIGNsYXNzPVwidGlueS1oaW50XCIgc3R5bGU9XCJtYXJnaW4tdG9wOiAycHg7XCI+U2VwYXJhdGUgbG9nb3MgZm9yIGRhcmsgYW5kIGxpZ2h0IHRoZW1lcywgb3IgdXNlIHRoZSBzYW1lIGZvciBib3RoLjwvcD5cbiAgICAgIDwvZGl2PlxuXG4gICAgICA8ZGl2IHN0eWxlPVwiZGlzcGxheTogZmxleDsgZ2FwOiAxMnB4OyBtYXJnaW4tYm90dG9tOiAxMnB4O1wiPlxuICAgICAgICA8ZGl2IHN0eWxlPVwiZmxleDogMTsgdGV4dC1hbGlnbjogY2VudGVyOyBwYWRkaW5nOiAxNnB4IDEwcHg7IGJvcmRlci1yYWRpdXM6IDhweDsgYmFja2dyb3VuZDogIzFhMWEyZTsgYm9yZGVyOiAxcHggc29saWQgcmdiYSgyNTUsMjU1LDI1NSwuMSk7XCI+XG4gICAgICAgICAgPGltZyBpZD1cImxvZ28tcHJldmlldy1kYXJrXCIgc3JjPVwiL2Fzc2V0cy9kYXNoY2FkZHktbG9nby1kYXJrLnBuZ1wiIGFsdD1cIkRhcmsgdGhlbWUgbG9nb1wiIHN0eWxlPVwibWF4LWhlaWdodDogNjBweDsgbWF4LXdpZHRoOiAxMDAlO1wiIC8+XG4gICAgICAgICAgPHAgc3R5bGU9XCJmb250LXNpemU6IDAuNjVyZW07IGNvbG9yOiAjOWFhNmJmOyBtYXJnaW4tdG9wOiA2cHg7XCI+RGFyayB0aGVtZXM8L3A+XG4gICAgICAgIDwvZGl2PlxuICAgICAgICA8ZGl2IHN0eWxlPVwiZmxleDogMTsgdGV4dC1hbGlnbjogY2VudGVyOyBwYWRkaW5nOiAxNnB4IDEwcHg7IGJvcmRlci1yYWRpdXM6IDhweDsgYmFja2dyb3VuZDogI2YwZjBmMDsgYm9yZGVyOiAxcHggc29saWQgcmdiYSgwLDAsMCwuMSk7XCI+XG4gICAgICAgICAgPGltZyBpZD1cImxvZ28tcHJldmlldy1saWdodFwiIHNyYz1cIi9hc3NldHMvZGFzaGNhZGR5LWxvZ28tbGlnaHQucG5nXCIgYWx0PVwiTGlnaHQgdGhlbWUgbG9nb1wiIHN0eWxlPVwibWF4LWhlaWdodDogNjBweDsgbWF4LXdpZHRoOiAxMDAlO1wiIC8+XG4gICAgICAgICAgPHAgc3R5bGU9XCJmb250LXNpemU6IDAuNjVyZW07IGNvbG9yOiAjNWY2YjdhOyBtYXJnaW4tdG9wOiA2cHg7XCI+TGlnaHQgdGhlbWVzPC9wPlxuICAgICAgICA8L2Rpdj5cbiAgICAgIDwvZGl2PlxuICAgICAgPHAgaWQ9XCJsb2dvLXN0YXR1c1wiIHN0eWxlPVwiZm9udC1zaXplOiAwLjc1cmVtOyBjb2xvcjogdmFyKC0tbXV0ZWQpOyBtYXJnaW4tYm90dG9tOiAxMnB4OyB0ZXh0LWFsaWduOiBjZW50ZXI7XCI+VXNpbmcgZGVmYXVsdCBsb2dvczwvcD5cblxuICAgICAgPGRpdiBjbGFzcz1cIm1iLTE2XCI+XG4gICAgICAgIDxsYWJlbCBzdHlsZT1cImRpc3BsYXk6IGZsZXg7IGFsaWduLWl0ZW1zOiBjZW50ZXI7IGdhcDogOHB4OyBmb250LXNpemU6IDAuODJyZW07IGN1cnNvcjogcG9pbnRlcjsgdXNlci1zZWxlY3Q6IG5vbmU7XCI+XG4gICAgICAgICAgPGlucHV0IHR5cGU9XCJjaGVja2JveFwiIGlkPVwibG9nby1zYW1lLWJvdGhcIiAvPiBVc2Ugc2FtZSBsb2dvIGZvciBib3RoXG4gICAgICAgIDwvbGFiZWw+XG4gICAgICA8L2Rpdj5cblxuICAgICAgPGRpdiBpZD1cImxvZ28tZHVhbC11cGxvYWRzXCIgY2xhc3M9XCJtYi0xNlwiIHN0eWxlPVwiZGlzcGxheTogZmxleDsgZ2FwOiAxMnB4O1wiPlxuICAgICAgICA8ZGl2IHN0eWxlPVwiZmxleDogMTtcIj5cbiAgICAgICAgICA8bGFiZWwgZm9yPVwibG9nby11cGxvYWQtZGFya1wiIHN0eWxlPVwiZGlzcGxheTogYmxvY2s7IG1hcmdpbi1ib3R0b206IDZweDsgZm9udC1zaXplOiAwLjhyZW07XCI+RGFyayB0aGVtZSBsb2dvOjwvbGFiZWw+XG4gICAgICAgICAgPGlucHV0IHR5cGU9XCJmaWxlXCIgaWQ9XCJsb2dvLXVwbG9hZC1kYXJrXCIgYWNjZXB0PVwiaW1hZ2UvKlwiIGNsYXNzPVwiaW5wdXQtY2FyZC1hbHRcIiBzdHlsZT1cImZvbnQtc2l6ZTogMC43NXJlbTtcIiAvPlxuICAgICAgICA8L2Rpdj5cbiAgICAgICAgPGRpdiBzdHlsZT1cImZsZXg6IDE7XCI+XG4gICAgICAgICAgPGxhYmVsIGZvcj1cImxvZ28tdXBsb2FkLWxpZ2h0XCIgc3R5bGU9XCJkaXNwbGF5OiBibG9jazsgbWFyZ2luLWJvdHRvbTogNnB4OyBmb250LXNpemU6IDAuOHJlbTtcIj5MaWdodCB0aGVtZSBsb2dvOjwvbGFiZWw+XG4gICAgICAgICAgPGlucHV0IHR5cGU9XCJmaWxlXCIgaWQ9XCJsb2dvLXVwbG9hZC1saWdodFwiIGFjY2VwdD1cImltYWdlLypcIiBjbGFzcz1cImlucHV0LWNhcmQtYWx0XCIgc3R5bGU9XCJmb250LXNpemU6IDAuNzVyZW07XCIgLz5cbiAgICAgICAgPC9kaXY+XG4gICAgICA8L2Rpdj5cblxuICAgICAgPGRpdiBpZD1cImxvZ28tc2luZ2xlLXVwbG9hZFwiIGNsYXNzPVwibWItMTZcIiBzdHlsZT1cImRpc3BsYXk6IG5vbmU7XCI+XG4gICAgICAgIDxsYWJlbCBmb3I9XCJsb2dvLXVwbG9hZC1zaW5nbGVcIiBzdHlsZT1cImRpc3BsYXk6IGJsb2NrOyBtYXJnaW4tYm90dG9tOiA2cHg7IGZvbnQtc2l6ZTogMC44cmVtO1wiPlVwbG9hZCBsb2dvOjwvbGFiZWw+XG4gICAgICAgIDxpbnB1dCB0eXBlPVwiZmlsZVwiIGlkPVwibG9nby11cGxvYWQtc2luZ2xlXCIgYWNjZXB0PVwiaW1hZ2UvKlwiIGNsYXNzPVwiaW5wdXQtY2FyZC1hbHRcIiAvPlxuICAgICAgICA8cCBjbGFzcz1cInRpbnktaGludFwiPlRoaXMgbG9nbyB3aWxsIGJlIHVzZWQgb24gYWxsIHRoZW1lc
Line truncated
|
||||
`}).join(""),T.querySelectorAll(".share-revoke").forEach(i=>{i.addEventListener("click",()=>s(i.dataset.shareId))})}catch{T.innerHTML='<span style="color: var(--muted);">Could not load outstanding shares.</span>'}}async function s(t){try{const e=await fetch(`/api/v1/share/${encodeURIComponent(t)}`,{method:"DELETE",credentials:"same-origin"});if(!e.ok){const a=await e.json().catch(()=>({}));j(a&&a.error||`Revoke failed (HTTP ${e.status}).`);return}N("Share revoked."),b()}catch{j("Network error while revoking.")}}async function p(){if(!E)return;C(),H.disabled=!0;const t=H.textContent;H.textContent="Creating\u2026";try{const e=parseInt(w.value,10),a=await fetch("/api/v1/share",{method:"POST",credentials:"same-origin",headers:{"Content-Type":"application/json"},body:JSON.stringify({serviceId:E.id,ttlMs:e})}),o=await a.json().catch(()=>({}));if(!a.ok||!o.success){m(a.status,o);return}const i=o.data.urlPath;z.value=u(i),M.textContent=`Public link \xB7 expires ${v(o.data.expiresAt)}`,I.style.display="block",N("Share link created."),b()}catch{j("Network error while creating share.")}finally{H.disabled=!1,H.textContent=t}}async function l(){if(!E)return;const t=($.value||"").trim();if(!t||!t.includes("@")){j("A valid recipient email is required.");return}C(),S.disabled=!0;const e=S.textContent;S.textContent="Creating\u2026";try{const a=await fetch("/api/v1/share/tailscale",{method:"POST",credentials:"same-origin",headers:{"Content-Type":"application/json"},body:JSON.stringify({serviceId:E.id,email:t})}),o=await a.json().catch(()=>({}));if(!a.ok||!o.success){m(a.status,o);return}const i=o.data&&o.data.urlPath;i?(z.value=u(i),M.textContent=`Tailscale invite \xB7 emailed to ${t} (or use this URL manually if delivery failed).`):(z.value="",M.textContent=`Tailscale invite sent to ${t}.`),I.style.display="block",N("Tailscale invite created."),$.value="",b()}catch{j("Network error while creating Tailscale invite.")}finally{S.disabled=!1,S.textContent=e}}function m(t,e){const a=e&&e.error||"";if(t===402){j("Share is a Pro feature. Activate a license to unlock.");return}if(t===400&&/tailscale/i.test(a)){j("Tailscale is not configured on this host. Set up Tailscale in the dashboard first.");return}if(t===403){j("You do not have permission to share services.");return}if(t===404){j("Service not found. It may have been deleted.");return}j(a||`Request failed (HTTP ${t}).`)}function c(t){!t||!t.id||(E={id:t.id,name:t.name||t.id},A.textContent=E.name,C(),g("public"),$.value="",w.value=String(k[1].ms),B.classList.add("show"),b())}B.querySelectorAll(".share-tab").forEach(t=>{t.addEventListener("click",()=>g(t.dataset.tab))}),H.addEventListener("click",p),S.addEventListener("click",l),f.addEventListener("click",()=>B.classList.remove("show")),wireModal(B,f),P.addEventListener("click",async()=>{const t=z.value;if(t)try{navigator.clipboard&&navigator.clipboard.writeText?await navigator.clipboard.writeText(t):(z.select(),document.execCommand("copy"));const e=P.textContent;P.textContent="Copied!",setTimeout(()=>{P.textContent=e},1200)}catch{j("Could not copy to clipboard. Select the URL manually.")}}),window.openShareModal=c})();
|
||||
//# sourceMappingURL=data:application/json;base64,ewogICJ2ZXJzaW9uIjogMywKICAic291cmNlcyI6IFsiPHN0ZGluPiJdLAogICJzb3VyY2VzQ29udGVudCI6IFsiLy8gTG9nbyBDdXN0b21pemF0aW9uIFN5c3RlbVxuKGZ1bmN0aW9uKCkge1xuICAvLyBJbmplY3QgbW9kYWwgSFRNTFxuICBpbmplY3RNb2RhbCgnbG9nby1tb2RhbCcsIGA8ZGl2IGlkPVwibG9nby1tb2RhbFwiIGNsYXNzPVwid2VhdGhlci1tb2RhbFwiPlxuICAgIDxkaXYgY2xhc3M9XCJ3ZWF0aGVyLW1vZGFsLWNvbnRlbnRcIiBzdHlsZT1cIm1pbi13aWR0aDogNDAwcHg7IG1heC13aWR0aDogNTIwcHg7XCI+XG4gICAgICA8aDM+RGFzaGJvYXJkIFNldHRpbmdzPC9oMz5cbiAgICAgIDxwIHN0eWxlPVwiZm9udC1zaXplOiAwLjg1cmVtOyBjb2xvcjogdmFyKC0tbXV0ZWQpOyBtYXJnaW46IDAgMCAxNnB4O1wiPlxuICAgICAgICBDdXN0b21pemUgeW91ciBkYXNoYm9hcmQncyBhcHBlYXJhbmNlIGFuZCBzeXN0ZW0gcHJlZmVyZW5jZXMuXG4gICAgICA8L3A+XG5cbiAgICAgIDxkaXYgY2xhc3M9XCJtYi0xNlwiPlxuICAgICAgICA8bGFiZWwgZm9yPVwiZGFzaGJvYXJkLXRpdGxlXCIgY2xhc3M9XCJmb3JtLWxhYmVsLWJvbGRcIj5EYXNoYm9hcmQgVGl0bGU6PC9sYWJlbD5cbiAgICAgICAgPGlucHV0IHR5cGU9XCJ0ZXh0XCIgaWQ9XCJkYXNoYm9hcmQtdGl0bGVcIiBwbGFjZWhvbGRlcj1cIkRhc2hDYWRkeVwiIG1heGxlbmd0aD1cIjUwXCIgc3R5bGU9XCJ3aWR0aDogMTAwJTsgcGFkZGluZzogMTBweCAxMnB4OyBib3JkZXI6IDFweCBzb2xpZCB2YXIoLS1ib3JkZXIpOyBib3JkZXItcmFkaXVzOiA0cHg7IGJhY2tncm91bmQ6IHZhcigtLWNhcmQtYmcpOyBjb2xvcjogdmFyKC0tZmcpOyBmb250LXNpemU6IDFyZW07XCIgLz5cbiAgICAgICAgPHAgY2xhc3M9XCJ0aW55LWhpbnRcIj5TaG93biBpbiBicm93c2VyIHRhYiBhbmQgaGVhZGVyIChtYXggNTAgY2hhcmFjdGVycyk8L3A+XG4gICAgICA8L2Rpdj5cblxuICAgICAgPGhyIGNsYXNzPVwiaHItZGl2aWRlclwiIC8+XG5cbiAgICAgIDxkaXYgY2xhc3M9XCJtYi0xNlwiPlxuICAgICAgICA8bGFiZWwgY2xhc3M9XCJmb3JtLWxhYmVsLWJvbGRcIj5Mb2dvOjwvbGFiZWw+XG4gICAgICAgIDxwIGNsYXNzPVwidGlueS1oaW50XCIgc3R5bGU9XCJtYXJnaW4tdG9wOiAycHg7XCI+U2VwYXJhdGUgbG9nb3MgZm9yIGRhcmsgYW5kIGxpZ2h0IHRoZW1lcywgb3IgdXNlIHRoZSBzYW1lIGZvciBib3RoLjwvcD5cbiAgICAgIDwvZGl2PlxuXG4gICAgICA8ZGl2IHN0eWxlPVwiZGlzcGxheTogZmxleDsgZ2FwOiAxMnB4OyBtYXJnaW4tYm90dG9tOiAxMnB4O1wiPlxuICAgICAgICA8ZGl2IHN0eWxlPVwiZmxleDogMTsgdGV4dC1hbGlnbjogY2VudGVyOyBwYWRkaW5nOiAxNnB4IDEwcHg7IGJvcmRlci1yYWRpdXM6IDhweDsgYmFja2dyb3VuZDogIzFhMWEyZTsgYm9yZGVyOiAxcHggc29saWQgcmdiYSgyNTUsMjU1LDI1NSwuMSk7XCI+XG4gICAgICAgICAgPGltZyBpZD1cImxvZ28tcHJldmlldy1kYXJrXCIgc3JjPVwiL2Fzc2V0cy9kYXNoY2FkZHktbG9nby1kYXJrLnBuZ1wiIGFsdD1cIkRhcmsgdGhlbWUgbG9nb1wiIHN0eWxlPVwibWF4LWhlaWdodDogNjBweDsgbWF4LXdpZHRoOiAxMDAlO1wiIC8+XG4gICAgICAgICAgPHAgc3R5bGU9XCJmb250LXNpemU6IDAuNjVyZW07IGNvbG9yOiAjOWFhNmJmOyBtYXJnaW4tdG9wOiA2cHg7XCI+RGFyayB0aGVtZXM8L3A+XG4gICAgICAgIDwvZGl2PlxuICAgICAgICA8ZGl2IHN0eWxlPVwiZmxleDogMTsgdGV4dC1hbGlnbjogY2VudGVyOyBwYWRkaW5nOiAxNnB4IDEwcHg7IGJvcmRlci1yYWRpdXM6IDhweDsgYmFja2dyb3VuZDogI2YwZjBmMDsgYm9yZGVyOiAxcHggc29saWQgcmdiYSgwLDAsMCwuMSk7XCI+XG4gICAgICAgICAgPGltZyBpZD1cImxvZ28tcHJldmlldy1saWdodFwiIHNyYz1cIi9hc3NldHMvZGFzaGNhZGR5LWxvZ28tbGlnaHQucG5nXCIgYWx0PVwiTGlnaHQgdGhlbWUgbG9nb1wiIHN0eWxlPVwibWF4LWhlaWdodDogNjBweDsgbWF4LXdpZHRoOiAxMDAlO1wiIC8+XG4gICAgICAgICAgPHAgc3R5bGU9XCJmb250LXNpemU6IDAuNjVyZW07IGNvbG9yOiAjNWY2YjdhOyBtYXJnaW4tdG9wOiA2cHg7XCI+TGlnaHQgdGhlbWVzPC9wPlxuICAgICAgICA8L2Rpdj5cbiAgICAgIDwvZGl2PlxuICAgICAgPHAgaWQ9XCJsb2dvLXN0YXR1c1wiIHN0eWxlPVwiZm9udC1zaXplOiAwLjc1cmVtOyBjb2xvcjogdmFyKC0tbXV0ZWQpOyBtYXJnaW4tYm90dG9tOiAxMnB4OyB0ZXh0LWFsaWduOiBjZW50ZXI7XCI+VXNpbmcgZGVmYXVsdCBsb2dvczwvcD5cblxuICAgICAgPGRpdiBjbGFzcz1cIm1iLTE2XCI+XG4gICAgICAgIDxsYWJlbCBzdHlsZT1cImRpc3BsYXk6IGZsZXg7IGFsaWduLWl0ZW1zOiBjZW50ZXI7IGdhcDogOHB4OyBmb250LXNpemU6IDAuODJyZW07IGN1cnNvcjogcG9pbnRlcjsgdXNlci1zZWxlY3Q6IG5vbmU7XCI+XG4gICAgICAgICAgPGlucHV0IHR5cGU9XCJjaGVja2JveFwiIGlkPVwibG9nby1zYW1lLWJvdGhcIiAvPiBVc2Ugc2FtZSBsb2dvIGZvciBib3RoXG4gICAgICAgIDwvbGFiZWw+XG4gICAgICA8L2Rpdj5cblxuICAgICAgPGRpdiBpZD1cImxvZ28tZHVhbC11cGxvYWRzXCIgY2xhc3M9XCJtYi0xNlwiIHN0eWxlPVwiZGlzcGxheTogZmxleDsgZ2FwOiAxMnB4O1wiPlxuICAgICAgICA8ZGl2IHN0eWxlPVwiZmxleDogMTtcIj5cbiAgICAgICAgICA8bGFiZWwgZm9yPVwibG9nby11cGxvYWQtZGFya1wiIHN0eWxlPVwiZGlzcGxheTogYmxvY2s7IG1hcmdpbi1ib3R0b206IDZweDsgZm9udC1zaXplOiAwLjhyZW07XCI+RGFyayB0aGVtZSBsb2dvOjwvbGFiZWw+XG4gICAgICAgICAgPGlucHV0IHR5cGU9XCJmaWxlXCIgaWQ9XCJsb2dvLXVwbG9hZC1kYXJrXCIgYWNjZXB0PVwiaW1hZ2UvKlwiIGNsYXNzPVwiaW5wdXQtY2FyZC1hbHRcIiBzdHlsZT1cImZvbnQtc2l6ZTogMC43NXJlbTtcIiAvPlxuICAgICAgICA8L2Rpdj5cbiAgICAgICAgPGRpdiBzdHlsZT1cImZsZXg6IDE7XCI+XG4gICAgICAgICAgPGxhYmVsIGZvcj1cImxvZ28tdXBsb2FkLWxpZ2h0XCIgc3R5bGU9XCJkaXNwbGF5OiBibG9jazsgbWFyZ2luLWJvdHRvbTogNnB4OyBmb250LXNpemU6IDAuOHJlbTtcIj5MaWdodCB0aGVtZSBsb2dvOjwvbGFiZWw+XG4gICAgICAgICAgPGlucHV0IHR5cGU9XCJmaWxlXCIgaWQ9XCJsb2dvLXVwbG9hZC1saWdodFwiIGFjY2VwdD1cImltYWdlLypcIiBjbGFzcz1cImlucHV0LWNhcmQtYWx0XCIgc3R5bGU9XCJmb250LXNpemU6IDAuNzVyZW07XCIgLz5cbiAgICAgICAgPC9kaXY+XG4gICAgICA8L2Rpdj5cblxuICAgICAgPGRpdiBpZD1cImxvZ28tc2luZ2xlLXVwbG9hZFwiIGNsYXNzPVwibWItMTZcIiBzdHlsZT1cImRpc3BsYXk6IG5vbmU7XCI+XG4gICAgICAgIDxsYWJlbCBmb3I9XCJsb2dvLXVwbG9hZC1zaW5nbGVcIiBzdHlsZT1cImRpc3BsYXk6IGJsb2NrOyBtYXJnaW4tYm90dG9tOiA2cHg7IGZvbnQtc2l6ZTogMC44cmVtO1wiPlVwbG9hZCBsb2dvOjwvbGFiZWw+XG4gICAgICAgIDxpbnB1dCB0eXBlPVwiZmlsZVwiIGlkPVwibG9nby11cGxvYWQtc2luZ2xlXCIgYWNjZXB0PVwiaW1hZ2UvKlwiIGNsYXNzPVwiaW5wdXQtY2FyZC1hbHRcIiAvPlxuICAgICAgICA8cCBjbGFzcz1cInRpbnktaGludFwiPlRoaXMgbG9nbyB3aWxsIGJlIHVzZWQgb24gYWxsIHRoZW1lc
Line truncated
|
||||
@@ -30,12 +30,6 @@
|
||||
<div id="li-ips-table" class="scroll-container" style="max-height: 300px;"></div>
|
||||
</div>
|
||||
|
||||
<!-- DC-120: Perimeter (caddy-source) — public traffic reaching the reverse proxy -->
|
||||
<div id="li-perimeter-section">
|
||||
<h4 style="margin: 12px 0 8px; font-size: 0.95rem;">🌐 Perimeter <span style="font-size: 0.75rem; color: var(--muted); font-weight: 400;">(public traffic at the reverse proxy)</span></h4>
|
||||
<div id="li-perimeter" class="scroll-container" style="max-height: 320px;"></div>
|
||||
</div>
|
||||
|
||||
<!-- Storage Info -->
|
||||
<div id="li-storage" style="margin-top: 16px; padding: 12px; background: var(--card-base); border-radius: 8px; border: 1px solid var(--border);"></div>
|
||||
|
||||
@@ -54,7 +48,6 @@
|
||||
const insightsDiv = document.getElementById('li-insights');
|
||||
const summaryDiv = document.getElementById('li-summary');
|
||||
const ipsDiv = document.getElementById('li-ips-table');
|
||||
const perimeterDiv = document.getElementById('li-perimeter');
|
||||
const storageDiv = document.getElementById('li-storage');
|
||||
|
||||
if (openBtn) {
|
||||
@@ -65,31 +58,13 @@
|
||||
periodSel.addEventListener('change', loadInsights);
|
||||
disposeBtn.addEventListener('click', showDisposePreview);
|
||||
|
||||
// DC-120: perimeter fetch runs in parallel with the main insights
|
||||
// request so a slow perimeter response never blanks the panel the
|
||||
// user opened the modal for. A monotonically increasing request ID
|
||||
// guards against stale responses: if the user changes period/refreshes,
|
||||
// the new request's ID will be greater, and the old callback will
|
||||
// no-op instead of overwriting fresh data. The ID is incremented
|
||||
// at the START of loadInsights so ALL in-flight callbacks check the
|
||||
// same monotonically increasing value.
|
||||
var perimeterReqId = 0;
|
||||
|
||||
async function loadInsights() {
|
||||
// Increment first — ANY perimeter callback with the old ID must
|
||||
// self-discard, even the ones already in flight from a prior click.
|
||||
var thisReq = ++perimeterReqId;
|
||||
const hours = periodSel.value;
|
||||
insightsDiv.innerHTML = '<div class="panel-empty"><span class="brand-spinner"></span> Analyzing logs...</div>';
|
||||
summaryDiv.innerHTML = '';
|
||||
ipsDiv.innerHTML = '';
|
||||
if (perimeterDiv) perimeterDiv.innerHTML = '<div class="panel-empty"><span class="brand-spinner"></span> Loading perimeter...</div>';
|
||||
storageDiv.innerHTML = '';
|
||||
|
||||
// DC-120: fire perimeter IN PARALLEL — don't await main insights.
|
||||
// If main fails, perimeter still runs and renders its own terminal state.
|
||||
loadPerimeter(hours, thisReq);
|
||||
|
||||
try {
|
||||
const res = await fetch('/api/v1/log-insights?hours=' + hours);
|
||||
const data = await res.json();
|
||||
@@ -150,73 +125,6 @@
|
||||
}
|
||||
}
|
||||
|
||||
// DC-120: render the caddy-source perimeter (public traffic at the
|
||||
// reverse proxy). Separate fetch so a failure here leaves the rest of
|
||||
// the modal intact. A request ID guards against stale responses.
|
||||
async function loadPerimeter(hours, reqId) {
|
||||
if (!perimeterDiv) return;
|
||||
try {
|
||||
const res = await fetch('/api/v1/security/events/perimeter?hours=' + hours + '&limit=15');
|
||||
// Stale-response guard: if a newer request has superseded this one,
|
||||
// discard this response silently (the new callback will render fresh data).
|
||||
if (reqId !== perimeterReqId) return;
|
||||
const data = await res.json();
|
||||
// Stale-parse guard: a newer request can begin while JSON parsing
|
||||
// is pending; check again before touching the DOM.
|
||||
if (reqId !== perimeterReqId) return;
|
||||
if (!data.success) {
|
||||
perimeterDiv.innerHTML = '<div class="panel-empty">Perimeter unavailable: ' + escapeHtml(data.error || 'unknown error') + '</div>';
|
||||
return;
|
||||
}
|
||||
|
||||
const sum = data.summary || {};
|
||||
let html = '<div style="font-size: 0.8rem; color: var(--muted); margin-bottom: 8px;">' +
|
||||
sum.events + ' requests from ' + sum.uniqueIPs + ' IPs' +
|
||||
(sum.denied ? ' · <span style="color: var(--warn-fg, #f0c674);">' + sum.denied + ' denied</span>' : '') +
|
||||
(sum.error ? ' · <span style="color: var(--bad-fg, #ff6b6b);">' + sum.error + ' errors</span>' : '') +
|
||||
'</div>';
|
||||
|
||||
const ips = data.topIPs || [];
|
||||
if (ips.length === 0) {
|
||||
html += '<div class="panel-empty">No perimeter traffic in this period.</div>';
|
||||
} else {
|
||||
html += '<table style="width: 100%; font-size: 0.85rem; border-collapse: collapse;">' +
|
||||
'<tr style="border-bottom: 1px solid var(--border);"><th style="text-align:left; padding: 6px;">Source IP</th>' +
|
||||
'<th style="text-align:right; padding: 6px;">Requests</th>' +
|
||||
'<th style="text-align:right; padding: 6px;">Denied</th>' +
|
||||
'<th style="text-align:right; padding: 6px;">Errors</th>' +
|
||||
'<th style="text-align:left; padding: 6px;">Hosts Hit</th></tr>';
|
||||
ips.forEach(function(p) {
|
||||
var deniedStyle = p.denied > 0 ? 'color: var(--warn-fg, #f0c674); font-weight: 600;' : '';
|
||||
var errStyle = p.error > 0 ? 'color: var(--bad-fg, #ff6b6b); font-weight: 600;' : '';
|
||||
html += '<tr style="border-bottom: 1px solid var(--border);">' +
|
||||
'<td style="padding: 6px; font-family: monospace;">' + escapeHtml(p.ip) + '</td>' +
|
||||
'<td style="padding: 6px; text-align: right;">' + p.count + '</td>' +
|
||||
'<td style="padding: 6px; text-align: right; ' + deniedStyle + '">' + p.denied + '</td>' +
|
||||
'<td style="padding: 6px; text-align: right; ' + errStyle + '">' + p.error + '</td>' +
|
||||
'<td style="padding: 6px; color: var(--muted);">' + (p.hosts && p.hosts.length ? escapeHtml(p.hosts.join(', ')) : '—') + '</td>' +
|
||||
'</tr>';
|
||||
});
|
||||
html += '</table>';
|
||||
}
|
||||
|
||||
const hosts = data.byHost || [];
|
||||
if (hosts.length > 0) {
|
||||
html += '<div style="font-size: 0.75rem; color: var(--muted); margin-top: 10px;">By host: ' +
|
||||
hosts.map(function(h) {
|
||||
return escapeHtml(h.host) + ' (' + h.count + (h.denied ? ', ' + h.denied + ' denied' : '') + (h.error ? ', ' + h.error + ' err' : '') + ')';
|
||||
}).join(' · ') + '</div>';
|
||||
}
|
||||
|
||||
perimeterDiv.innerHTML = html;
|
||||
} catch (e) {
|
||||
// Stale-rejection guard: if a newer request has superseded this
|
||||
// one, discard this error instead of overwriting fresh data.
|
||||
if (reqId !== perimeterReqId) return;
|
||||
perimeterDiv.innerHTML = '<div class="panel-empty">Perimeter failed to load: ' + escapeHtml(e.message) + '</div>';
|
||||
}
|
||||
}
|
||||
|
||||
function statCard(label, value) {
|
||||
return '<div style="text-align: center; padding: 12px; background: var(--card-base); border-radius: 8px; border: 1px solid var(--border);">' +
|
||||
'<div style="font-size: 1.5rem; font-weight: 700;">' + value + '</div>' +
|
||||
@@ -273,12 +181,4 @@
|
||||
div.innerHTML = html;
|
||||
document.body.appendChild(div.firstElementChild);
|
||||
}
|
||||
|
||||
// DC-120: local escapeHtml — this file loads standalone (line-order in
|
||||
// index.html) BEFORE dist/core.js, and the bundled globals.js copy never
|
||||
// leaks to window (esbuild IIFE-wraps it), so a bare global reference
|
||||
// would throw at render time. Same escaping contract as globals.js.
|
||||
function escapeHtml(text) {
|
||||
return String(text ?? '').replace(/&/g, '&').replace(/</g, '<').replace(/>/g, '>').replace(/"/g, '"').replace(/'/g, ''');
|
||||
}
|
||||
})();
|
||||
@@ -168,33 +168,6 @@
|
||||
<label class="checkbox-label-sm">
|
||||
<input type="checkbox" id="event-deploy-failed" checked /> Deployment Failed
|
||||
</label>
|
||||
<label class="checkbox-label-sm">
|
||||
<input type="checkbox" id="event-ssl-cert-expiry" checked /> SSL Expiry
|
||||
</label>
|
||||
<label class="checkbox-label-sm">
|
||||
<input type="checkbox" id="event-dns-propagation" checked /> DNS Propagation
|
||||
</label>
|
||||
<label class="checkbox-label-sm">
|
||||
<input type="checkbox" id="event-drift-detected" checked /> Config Drift
|
||||
</label>
|
||||
<label class="checkbox-label-sm">
|
||||
<input type="checkbox" id="event-dependency-restart" checked /> Dependency Restarts
|
||||
</label>
|
||||
<label class="checkbox-label-sm">
|
||||
<input type="checkbox" id="event-recipe-removed" checked /> Recipe Removed
|
||||
</label>
|
||||
<label class="checkbox-label-sm">
|
||||
<input type="checkbox" id="event-workflow" checked /> Workflow Actions
|
||||
</label>
|
||||
<label class="checkbox-label-sm">
|
||||
<input type="checkbox" id="event-backup-complete" checked /> Backup Complete
|
||||
</label>
|
||||
<label class="checkbox-label-sm">
|
||||
<input type="checkbox" id="event-backup-failed" checked /> Backup Failed
|
||||
</label>
|
||||
<label class="checkbox-label-sm">
|
||||
<input type="checkbox" id="event-update-available" checked /> Updates
|
||||
</label>
|
||||
<label class="checkbox-label-sm" style="grid-column: 1 / -1;">
|
||||
<input type="checkbox" id="event-resource-alert" checked /> Resource Alerts
|
||||
</label>
|
||||
@@ -302,15 +275,6 @@
|
||||
document.getElementById('event-container-up').checked = config.events?.['container-up'] === true;
|
||||
document.getElementById('event-deploy-success').checked = config.events?.['deploy-success'] !== false;
|
||||
document.getElementById('event-deploy-failed').checked = config.events?.['deploy-failed'] !== false;
|
||||
document.getElementById('event-ssl-cert-expiry').checked = config.events?.['ssl-cert-expiry'] !== false;
|
||||
document.getElementById('event-dns-propagation').checked = config.events?.['dns-propagation'] !== false;
|
||||
document.getElementById('event-drift-detected').checked = config.events?.['drift-detected'] !== false;
|
||||
document.getElementById('event-dependency-restart').checked = config.events?.['dependency-restart'] !== false;
|
||||
document.getElementById('event-recipe-removed').checked = config.events?.['recipe-removed'] !== false;
|
||||
document.getElementById('event-workflow').checked = config.events?.['workflow'] !== false;
|
||||
document.getElementById('event-backup-complete').checked = config.events?.['backup-complete'] !== false;
|
||||
document.getElementById('event-backup-failed').checked = config.events?.['backup-failed'] !== false;
|
||||
document.getElementById('event-update-available').checked = config.events?.['update-available'] !== false;
|
||||
document.getElementById('event-resource-alert').checked = config.events?.['alert'] !== false;
|
||||
}
|
||||
} catch (error) {
|
||||
@@ -388,15 +352,6 @@
|
||||
'container-up': document.getElementById('event-container-up').checked,
|
||||
'deploy-success': document.getElementById('event-deploy-success').checked,
|
||||
'deploy-failed': document.getElementById('event-deploy-failed').checked,
|
||||
'ssl-cert-expiry': document.getElementById('event-ssl-cert-expiry').checked,
|
||||
'dns-propagation': document.getElementById('event-dns-propagation').checked,
|
||||
'drift-detected': document.getElementById('event-drift-detected').checked,
|
||||
'dependency-restart': document.getElementById('event-dependency-restart').checked,
|
||||
'recipe-removed': document.getElementById('event-recipe-removed').checked,
|
||||
'workflow': document.getElementById('event-workflow').checked,
|
||||
'backup-complete': document.getElementById('event-backup-complete').checked,
|
||||
'backup-failed': document.getElementById('event-backup-failed').checked,
|
||||
'update-available': document.getElementById('event-update-available').checked,
|
||||
'alert': document.getElementById('event-resource-alert').checked
|
||||
},
|
||||
healthCheck: {
|
||||
|
||||
Generated
+1
-541
@@ -8,194 +8,7 @@
|
||||
"name": "dashcaddy-frontend",
|
||||
"version": "1.0.0",
|
||||
"devDependencies": {
|
||||
"esbuild": "^0.25.0",
|
||||
"jsdom": "^30.0.1"
|
||||
}
|
||||
},
|
||||
"node_modules/@asamuzakjp/css-color": {
|
||||
"version": "6.0.7",
|
||||
"resolved": "https://registry.npmjs.org/@asamuzakjp/css-color/-/css-color-6.0.7.tgz",
|
||||
"integrity": "sha512-vC/bk1Lz7Tn/EfU9/apOTBk80/8dyGyWMowPoV1tJ52muDGsDqt2HPT2klrFUiY60MQmQv9q8yIht15JnBgDGw==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"@csstools/css-calc": "^3.3.0",
|
||||
"@csstools/css-color-parser": "^4.1.10",
|
||||
"@csstools/css-parser-algorithms": "^4.0.0",
|
||||
"@csstools/css-tokenizer": "^4.0.0",
|
||||
"lru-cache": "^11.5.2"
|
||||
},
|
||||
"engines": {
|
||||
"node": "^22.13.0 || >=24.0.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@asamuzakjp/dom-selector": {
|
||||
"version": "8.3.2",
|
||||
"resolved": "https://registry.npmjs.org/@asamuzakjp/dom-selector/-/dom-selector-8.3.2.tgz",
|
||||
"integrity": "sha512-93Z1N+BQNXysodoicpOIyNh2drHfz/CTf9nnT0FEx72GJcIiwgydD7tGAr78j41LsYn3hlRn+LdGPuBLn1Bl8Q==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"bidi-js": "^1.0.3",
|
||||
"css-tree": "^3.2.1",
|
||||
"is-potential-custom-element-name": "^1.0.1",
|
||||
"lru-cache": "^11.5.2"
|
||||
},
|
||||
"engines": {
|
||||
"node": "^22.13.0 || >=24.0.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@bramus/specificity": {
|
||||
"version": "2.4.2",
|
||||
"resolved": "https://registry.npmjs.org/@bramus/specificity/-/specificity-2.4.2.tgz",
|
||||
"integrity": "sha512-ctxtJ/eA+t+6q2++vj5j7FYX3nRu311q1wfYH3xjlLOsczhlhxAg2FWNUXhpGvAw3BWo1xBcvOV6/YLc2r5FJw==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"css-tree": "^3.0.0"
|
||||
},
|
||||
"bin": {
|
||||
"specificity": "bin/cli.js"
|
||||
}
|
||||
},
|
||||
"node_modules/@csstools/color-helpers": {
|
||||
"version": "6.1.1",
|
||||
"resolved": "https://registry.npmjs.org/@csstools/color-helpers/-/color-helpers-6.1.1.tgz",
|
||||
"integrity": "sha512-gLNsunvwf3mCi5u5o46/Z/JcJMnhbHSaZ69rkgPzNM3J4s8hWwpPUQB6/tt0EDFyCiWzxANlx+2LJwpYj4zS1w==",
|
||||
"dev": true,
|
||||
"funding": [
|
||||
{
|
||||
"type": "github",
|
||||
"url": "https://github.com/sponsors/csstools"
|
||||
},
|
||||
{
|
||||
"type": "opencollective",
|
||||
"url": "https://opencollective.com/csstools"
|
||||
}
|
||||
],
|
||||
"license": "MIT-0",
|
||||
"engines": {
|
||||
"node": ">=20.19.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@csstools/css-calc": {
|
||||
"version": "3.3.0",
|
||||
"resolved": "https://registry.npmjs.org/@csstools/css-calc/-/css-calc-3.3.0.tgz",
|
||||
"integrity": "sha512-c5ihYsPkdG6JCkU2zTMm4+k6r7RXuGxtWYhu5DHMIiF1FHzrfmHL5so11AoFpUv/tu61xfcmT4AmKoFfMPoqdQ==",
|
||||
"dev": true,
|
||||
"funding": [
|
||||
{
|
||||
"type": "github",
|
||||
"url": "https://github.com/sponsors/csstools"
|
||||
},
|
||||
{
|
||||
"type": "opencollective",
|
||||
"url": "https://opencollective.com/csstools"
|
||||
}
|
||||
],
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">=20.19.0"
|
||||
},
|
||||
"peerDependencies": {
|
||||
"@csstools/css-parser-algorithms": "^4.0.0",
|
||||
"@csstools/css-tokenizer": "^4.0.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@csstools/css-color-parser": {
|
||||
"version": "4.2.0",
|
||||
"resolved": "https://registry.npmjs.org/@csstools/css-color-parser/-/css-color-parser-4.2.0.tgz",
|
||||
"integrity": "sha512-5+5LEmFuY1AjXdYhmgjTJogtQnP1evJ1zrBZGUNZ0thkpwnnmKxcHdAMn/OtFjAb25zA+jKDVYVRl+5G7rjv1A==",
|
||||
"dev": true,
|
||||
"funding": [
|
||||
{
|
||||
"type": "github",
|
||||
"url": "https://github.com/sponsors/csstools"
|
||||
},
|
||||
{
|
||||
"type": "opencollective",
|
||||
"url": "https://opencollective.com/csstools"
|
||||
}
|
||||
],
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"@csstools/color-helpers": "^6.1.1",
|
||||
"@csstools/css-calc": "^3.3.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=20.19.0"
|
||||
},
|
||||
"peerDependencies": {
|
||||
"@csstools/css-parser-algorithms": "^4.0.0",
|
||||
"@csstools/css-tokenizer": "^4.0.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@csstools/css-parser-algorithms": {
|
||||
"version": "4.0.0",
|
||||
"resolved": "https://registry.npmjs.org/@csstools/css-parser-algorithms/-/css-parser-algorithms-4.0.0.tgz",
|
||||
"integrity": "sha512-+B87qS7fIG3L5h3qwJ/IFbjoVoOe/bpOdh9hAjXbvx0o8ImEmUsGXN0inFOnk2ChCFgqkkGFQ+TpM5rbhkKe4w==",
|
||||
"dev": true,
|
||||
"funding": [
|
||||
{
|
||||
"type": "github",
|
||||
"url": "https://github.com/sponsors/csstools"
|
||||
},
|
||||
{
|
||||
"type": "opencollective",
|
||||
"url": "https://opencollective.com/csstools"
|
||||
}
|
||||
],
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">=20.19.0"
|
||||
},
|
||||
"peerDependencies": {
|
||||
"@csstools/css-tokenizer": "^4.0.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@csstools/css-syntax-patches-for-csstree": {
|
||||
"version": "1.1.8",
|
||||
"resolved": "https://registry.npmjs.org/@csstools/css-syntax-patches-for-csstree/-/css-syntax-patches-for-csstree-1.1.8.tgz",
|
||||
"integrity": "sha512-CpMLjAvwQg3BL5S0IeqsZNMH7EQrEWi0kLKOC13ZBF0ZwERiLWlibNPJr8G1kdU3Ms/r2KiNrF81pUh2HwAHdg==",
|
||||
"dev": true,
|
||||
"funding": [
|
||||
{
|
||||
"type": "github",
|
||||
"url": "https://github.com/sponsors/csstools"
|
||||
},
|
||||
{
|
||||
"type": "opencollective",
|
||||
"url": "https://opencollective.com/csstools"
|
||||
}
|
||||
],
|
||||
"license": "MIT-0",
|
||||
"peerDependencies": {
|
||||
"css-tree": "^3.2.1"
|
||||
},
|
||||
"peerDependenciesMeta": {
|
||||
"css-tree": {
|
||||
"optional": true
|
||||
}
|
||||
}
|
||||
},
|
||||
"node_modules/@csstools/css-tokenizer": {
|
||||
"version": "4.0.0",
|
||||
"resolved": "https://registry.npmjs.org/@csstools/css-tokenizer/-/css-tokenizer-4.0.0.tgz",
|
||||
"integrity": "sha512-QxULHAm7cNu72w97JUNCBFODFaXpbDg+dP8b/oWFAZ2MTRppA3U00Y2L1HqaS4J6yBqxwa/Y3nMBaxVKbB/NsA==",
|
||||
"dev": true,
|
||||
"funding": [
|
||||
{
|
||||
"type": "github",
|
||||
"url": "https://github.com/sponsors/csstools"
|
||||
},
|
||||
{
|
||||
"type": "opencollective",
|
||||
"url": "https://opencollective.com/csstools"
|
||||
}
|
||||
],
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">=20.19.0"
|
||||
"esbuild": "^0.25.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@esbuild/aix-ppc64": {
|
||||
@@ -640,97 +453,6 @@
|
||||
"node": ">=18"
|
||||
}
|
||||
},
|
||||
"node_modules/@exodus/bytes": {
|
||||
"version": "1.15.1",
|
||||
"resolved": "https://registry.npmjs.org/@exodus/bytes/-/bytes-1.15.1.tgz",
|
||||
"integrity": "sha512-S6mL0yNB/Abt9Ei4tq8gDhcczc4S3+vQ4ra7vxnAf+YHC02srtqxKKZghx2Dq6p0e66THKwR6r8N6P95wEty7Q==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": "^20.19.0 || ^22.12.0 || >=24.0.0"
|
||||
},
|
||||
"peerDependencies": {
|
||||
"@noble/hashes": "^1.8.0 || ^2.0.0"
|
||||
},
|
||||
"peerDependenciesMeta": {
|
||||
"@noble/hashes": {
|
||||
"optional": true
|
||||
}
|
||||
}
|
||||
},
|
||||
"node_modules/bidi-js": {
|
||||
"version": "1.0.3",
|
||||
"resolved": "https://registry.npmjs.org/bidi-js/-/bidi-js-1.0.3.tgz",
|
||||
"integrity": "sha512-RKshQI1R3YQ+n9YJz2QQ147P66ELpa1FQEg20Dk8oW9t2KgLbpDLLp9aGZ7y8WHSshDknG0bknqGw5/tyCs5tw==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"require-from-string": "^2.0.2"
|
||||
}
|
||||
},
|
||||
"node_modules/css-tree": {
|
||||
"version": "3.2.1",
|
||||
"resolved": "https://registry.npmjs.org/css-tree/-/css-tree-3.2.1.tgz",
|
||||
"integrity": "sha512-X7sjQzceUhu1u7Y/ylrRZFU2FS6LRiFVp6rKLPg23y3x3c3DOKAwuXGDp+PAGjh6CSnCjYeAul8pcT8bAl+lSA==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"mdn-data": "2.27.1",
|
||||
"source-map-js": "^1.2.1"
|
||||
},
|
||||
"engines": {
|
||||
"node": "^10 || ^12.20.0 || ^14.13.0 || >=15.0.0"
|
||||
}
|
||||
},
|
||||
"node_modules/data-urls": {
|
||||
"version": "7.0.0",
|
||||
"resolved": "https://registry.npmjs.org/data-urls/-/data-urls-7.0.0.tgz",
|
||||
"integrity": "sha512-23XHcCF+coGYevirZceTVD7NdJOqVn+49IHyxgszm+JIiHLoB2TkmPtsYkNWT1pvRSGkc35L6NHs0yHkN2SumA==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"whatwg-mimetype": "^5.0.0",
|
||||
"whatwg-url": "^16.0.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": "^20.19.0 || ^22.12.0 || >=24.0.0"
|
||||
}
|
||||
},
|
||||
"node_modules/data-urls/node_modules/whatwg-url": {
|
||||
"version": "16.0.1",
|
||||
"resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-16.0.1.tgz",
|
||||
"integrity": "sha512-1to4zXBxmXHV3IiSSEInrreIlu02vUOvrhxJJH5vcxYTBDAx51cqZiKdyTxlecdKNSjj8EcxGBxNf6Vg+945gw==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"@exodus/bytes": "^1.11.0",
|
||||
"tr46": "^6.0.0",
|
||||
"webidl-conversions": "^8.0.1"
|
||||
},
|
||||
"engines": {
|
||||
"node": "^20.19.0 || ^22.12.0 || >=24.0.0"
|
||||
}
|
||||
},
|
||||
"node_modules/decimal.js": {
|
||||
"version": "10.6.0",
|
||||
"resolved": "https://registry.npmjs.org/decimal.js/-/decimal.js-10.6.0.tgz",
|
||||
"integrity": "sha512-YpgQiITW3JXGntzdUmyUR1V812Hn8T1YVXhCu+wO3OpS4eU9l4YdD3qjyiKdV6mvV29zapkMeD390UVEf2lkUg==",
|
||||
"dev": true,
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/entities": {
|
||||
"version": "8.0.0",
|
||||
"resolved": "https://registry.npmjs.org/entities/-/entities-8.0.0.tgz",
|
||||
"integrity": "sha512-zwfzJecQ/Uej6tusMqwAqU/6KL2XaB2VZ2Jg54Je6ahNBGNH6Ek6g3jjNCF0fG9EWQKGZNddNjU5F1ZQn/sBnA==",
|
||||
"dev": true,
|
||||
"license": "BSD-2-Clause",
|
||||
"engines": {
|
||||
"node": ">=20.19.0"
|
||||
},
|
||||
"funding": {
|
||||
"url": "https://github.com/fb55/entities?sponsor=1"
|
||||
}
|
||||
},
|
||||
"node_modules/esbuild": {
|
||||
"version": "0.25.12",
|
||||
"resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.12.tgz",
|
||||
@@ -772,268 +494,6 @@
|
||||
"@esbuild/win32-ia32": "0.25.12",
|
||||
"@esbuild/win32-x64": "0.25.12"
|
||||
}
|
||||
},
|
||||
"node_modules/html-encoding-sniffer": {
|
||||
"version": "6.0.0",
|
||||
"resolved": "https://registry.npmjs.org/html-encoding-sniffer/-/html-encoding-sniffer-6.0.0.tgz",
|
||||
"integrity": "sha512-CV9TW3Y3f8/wT0BRFc1/KAVQ3TUHiXmaAb6VW9vtiMFf7SLoMd1PdAc4W3KFOFETBJUb90KatHqlsZMWV+R9Gg==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"@exodus/bytes": "^1.6.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": "^20.19.0 || ^22.12.0 || >=24.0.0"
|
||||
}
|
||||
},
|
||||
"node_modules/is-potential-custom-element-name": {
|
||||
"version": "1.0.1",
|
||||
"resolved": "https://registry.npmjs.org/is-potential-custom-element-name/-/is-potential-custom-element-name-1.0.1.tgz",
|
||||
"integrity": "sha512-bCYeRA2rVibKZd+s2625gGnGF/t7DSqDs4dP7CrLA1m7jKWz6pps0LpYLJN8Q64HtmPKJ1hrN3nzPNKFEKOUiQ==",
|
||||
"dev": true,
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/jsdom": {
|
||||
"version": "30.0.1",
|
||||
"resolved": "https://registry.npmjs.org/jsdom/-/jsdom-30.0.1.tgz",
|
||||
"integrity": "sha512-52v7mUVUfNQVYYqE1lcdaymWL0njO7lTLUog6ZvW2U5KsbiLk/GnZlVJ+qx0xfNJZ6Gn+KSpPNE52vurbxZwrA==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"@asamuzakjp/css-color": "^6.0.5",
|
||||
"@asamuzakjp/dom-selector": "^8.3.0",
|
||||
"@bramus/specificity": "^2.4.2",
|
||||
"@csstools/css-syntax-patches-for-csstree": "^1.1.7",
|
||||
"@exodus/bytes": "^1.15.1",
|
||||
"css-tree": "^3.2.1",
|
||||
"data-urls": "^7.0.0",
|
||||
"decimal.js": "^10.6.0",
|
||||
"html-encoding-sniffer": "^6.0.0",
|
||||
"is-potential-custom-element-name": "^1.0.1",
|
||||
"lru-cache": "^11.5.2",
|
||||
"parse5": "^8.0.1",
|
||||
"saxes": "^6.0.0",
|
||||
"symbol-tree": "^3.2.4",
|
||||
"tough-cookie": "^6.0.2",
|
||||
"undici": "^8.9.0",
|
||||
"w3c-xmlserializer": "^5.0.0",
|
||||
"webidl-conversions": "^8.0.1",
|
||||
"whatwg-mimetype": "^5.0.0",
|
||||
"whatwg-url": "^17.1.0",
|
||||
"xml-name-validator": "^5.0.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": "^22.22.2 || ^24.15.0 || >=26.0.0"
|
||||
},
|
||||
"peerDependencies": {
|
||||
"canvas": "^3.2.3"
|
||||
},
|
||||
"peerDependenciesMeta": {
|
||||
"canvas": {
|
||||
"optional": true
|
||||
}
|
||||
}
|
||||
},
|
||||
"node_modules/lru-cache": {
|
||||
"version": "11.5.2",
|
||||
"resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.2.tgz",
|
||||
"integrity": "sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g==",
|
||||
"dev": true,
|
||||
"license": "BlueOak-1.0.0",
|
||||
"engines": {
|
||||
"node": "20 || >=22"
|
||||
}
|
||||
},
|
||||
"node_modules/mdn-data": {
|
||||
"version": "2.27.1",
|
||||
"resolved": "https://registry.npmjs.org/mdn-data/-/mdn-data-2.27.1.tgz",
|
||||
"integrity": "sha512-9Yubnt3e8A0OKwxYSXyhLymGW4sCufcLG6VdiDdUGVkPhpqLxlvP5vl1983gQjJl3tqbrM731mjaZaP68AgosQ==",
|
||||
"dev": true,
|
||||
"license": "CC0-1.0"
|
||||
},
|
||||
"node_modules/parse5": {
|
||||
"version": "8.0.1",
|
||||
"resolved": "https://registry.npmjs.org/parse5/-/parse5-8.0.1.tgz",
|
||||
"integrity": "sha512-z1e/HMG90obSGeidlli3hj7cbocou0/wa5HacvI3ASx34PecNjNQeaHNo5WIZpWofN9kgkqV1q5YvXe3F0FoPw==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"entities": "^8.0.0"
|
||||
},
|
||||
"funding": {
|
||||
"url": "https://github.com/inikulin/parse5?sponsor=1"
|
||||
}
|
||||
},
|
||||
"node_modules/punycode": {
|
||||
"version": "2.3.1",
|
||||
"resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
|
||||
"integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">=6"
|
||||
}
|
||||
},
|
||||
"node_modules/require-from-string": {
|
||||
"version": "2.0.2",
|
||||
"resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
|
||||
"integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">=0.10.0"
|
||||
}
|
||||
},
|
||||
"node_modules/saxes": {
|
||||
"version": "6.0.0",
|
||||
"resolved": "https://registry.npmjs.org/saxes/-/saxes-6.0.0.tgz",
|
||||
"integrity": "sha512-xAg7SOnEhrm5zI3puOOKyy1OMcMlIJZYNJY7xLBwSze0UjhPLnWfj2GF2EpT0jmzaJKIWKHLsaSSajf35bcYnA==",
|
||||
"dev": true,
|
||||
"license": "ISC",
|
||||
"dependencies": {
|
||||
"xmlchars": "^2.2.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=v12.22.7"
|
||||
}
|
||||
},
|
||||
"node_modules/source-map-js": {
|
||||
"version": "1.2.1",
|
||||
"resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
|
||||
"integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
|
||||
"dev": true,
|
||||
"license": "BSD-3-Clause",
|
||||
"engines": {
|
||||
"node": ">=0.10.0"
|
||||
}
|
||||
},
|
||||
"node_modules/symbol-tree": {
|
||||
"version": "3.2.4",
|
||||
"resolved": "https://registry.npmjs.org/symbol-tree/-/symbol-tree-3.2.4.tgz",
|
||||
"integrity": "sha512-9QNk5KwDF+Bvz+PyObkmSYjI5ksVUYtjW7AU22r2NKcfLJcXp96hkDWU3+XndOsUb+AQ9QhfzfCT2O+CNWT5Tw==",
|
||||
"dev": true,
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/tldts": {
|
||||
"version": "7.4.10",
|
||||
"resolved": "https://registry.npmjs.org/tldts/-/tldts-7.4.10.tgz",
|
||||
"integrity": "sha512-GgouD1B+sWwvkaEq8vXC15DjQitxbvs12oIXELpconwm+Tg3zfcEv4jgzq3vtKverDXsg3VI8aRgNL2Nra0Iog==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"tldts-core": "^7.4.10"
|
||||
},
|
||||
"bin": {
|
||||
"tldts": "bin/cli.js"
|
||||
}
|
||||
},
|
||||
"node_modules/tldts-core": {
|
||||
"version": "7.4.10",
|
||||
"resolved": "https://registry.npmjs.org/tldts-core/-/tldts-core-7.4.10.tgz",
|
||||
"integrity": "sha512-KnQjp53ZekKgm/r3l+u8kJGGzYgrWdP8+Mql7a4vijh2WE0IrZWspQj/TpTxDho/YxO+AnOZnIjQcCD+q6iJsw==",
|
||||
"dev": true,
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/tough-cookie": {
|
||||
"version": "6.0.2",
|
||||
"resolved": "https://registry.npmjs.org/tough-cookie/-/tough-cookie-6.0.2.tgz",
|
||||
"integrity": "sha512-exgYmnmL/sJpR3upZfXG5PoatXQii55xAiXGXzY+sROLZ/Y+SLcp9PgJNI9Vz37HpQ74WvDcLT8eqm+kV3FzrA==",
|
||||
"dev": true,
|
||||
"license": "BSD-3-Clause",
|
||||
"dependencies": {
|
||||
"tldts": "^7.0.5"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=16"
|
||||
}
|
||||
},
|
||||
"node_modules/tr46": {
|
||||
"version": "6.0.0",
|
||||
"resolved": "https://registry.npmjs.org/tr46/-/tr46-6.0.0.tgz",
|
||||
"integrity": "sha512-bLVMLPtstlZ4iMQHpFHTR7GAGj2jxi8Dg0s2h2MafAE4uSWF98FC/3MomU51iQAMf8/qDUbKWf5GxuvvVcXEhw==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"punycode": "^2.3.1"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=20"
|
||||
}
|
||||
},
|
||||
"node_modules/undici": {
|
||||
"version": "8.10.0",
|
||||
"resolved": "https://registry.npmjs.org/undici/-/undici-8.10.0.tgz",
|
||||
"integrity": "sha512-HvltHd7avK13QIw/oLe4qoOLyoVSoafqJ2jYOrtMRBkbYT31eiBQ8O0ehRKZiEZCMEyLFQNIADpgCWC5fALvYQ==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">=22.19.0"
|
||||
}
|
||||
},
|
||||
"node_modules/w3c-xmlserializer": {
|
||||
"version": "5.0.0",
|
||||
"resolved": "https://registry.npmjs.org/w3c-xmlserializer/-/w3c-xmlserializer-5.0.0.tgz",
|
||||
"integrity": "sha512-o8qghlI8NZHU1lLPrpi2+Uq7abh4GGPpYANlalzWxyWteJOCsr/P+oPBA49TOLu5FTZO4d3F9MnWJfiMo4BkmA==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"xml-name-validator": "^5.0.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=18"
|
||||
}
|
||||
},
|
||||
"node_modules/webidl-conversions": {
|
||||
"version": "8.0.1",
|
||||
"resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-8.0.1.tgz",
|
||||
"integrity": "sha512-BMhLD/Sw+GbJC21C/UgyaZX41nPt8bUTg+jWyDeg7e7YN4xOM05YPSIXceACnXVtqyEw/LMClUQMtMZ+PGGpqQ==",
|
||||
"dev": true,
|
||||
"license": "BSD-2-Clause",
|
||||
"engines": {
|
||||
"node": ">=20"
|
||||
}
|
||||
},
|
||||
"node_modules/whatwg-mimetype": {
|
||||
"version": "5.0.0",
|
||||
"resolved": "https://registry.npmjs.org/whatwg-mimetype/-/whatwg-mimetype-5.0.0.tgz",
|
||||
"integrity": "sha512-sXcNcHOC51uPGF0P/D4NVtrkjSU2fNsm9iog4ZvZJsL3rjoDAzXZhkm2MWt1y+PUdggKAYVoMAIYcs78wJ51Cw==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">=20"
|
||||
}
|
||||
},
|
||||
"node_modules/whatwg-url": {
|
||||
"version": "17.1.0",
|
||||
"resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-17.1.0.tgz",
|
||||
"integrity": "sha512-3GeworPmc2ZfEEHP7lEbUfBX/L75wdEsi0rLNhXcXxnoN5jyq0SL5gCy06SGW2cyTIZdTvWIDQNQoza++vKeaw==",
|
||||
"dev": true,
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"@exodus/bytes": "^1.15.1",
|
||||
"tr46": "^6.0.0",
|
||||
"webidl-conversions": "^8.0.1"
|
||||
},
|
||||
"engines": {
|
||||
"node": "^22.14.0 || >=24.0.0"
|
||||
}
|
||||
},
|
||||
"node_modules/xml-name-validator": {
|
||||
"version": "5.0.0",
|
||||
"resolved": "https://registry.npmjs.org/xml-name-validator/-/xml-name-validator-5.0.0.tgz",
|
||||
"integrity": "sha512-EvGK8EJ3DhaHfbRlETOWAS5pO9MZITeauHKJyb8wyajUfQUenkIg2MvLDTZ4T/TgIcm3HU0TFBgWWboAZ30UHg==",
|
||||
"dev": true,
|
||||
"license": "Apache-2.0",
|
||||
"engines": {
|
||||
"node": ">=18"
|
||||
}
|
||||
},
|
||||
"node_modules/xmlchars": {
|
||||
"version": "2.2.0",
|
||||
"resolved": "https://registry.npmjs.org/xmlchars/-/xmlchars-2.2.0.tgz",
|
||||
"integrity": "sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw==",
|
||||
"dev": true,
|
||||
"license": "MIT"
|
||||
}
|
||||
}
|
||||
}
|
||||
+1
-2
@@ -8,7 +8,6 @@
|
||||
"watch": "node build.js --watch"
|
||||
},
|
||||
"devDependencies": {
|
||||
"esbuild": "^0.25.0",
|
||||
"jsdom": "^30.0.1"
|
||||
"esbuild": "^0.25.0"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,165 @@
|
||||
<!doctype html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width,initial-scale=1">
|
||||
<title>DashCaddy Pricing — Free & Pro</title>
|
||||
<link rel="canonical" href="/pricing">
|
||||
<link rel="stylesheet" href="/assets/dashboard.css">
|
||||
<style>
|
||||
:root { color-scheme: dark; --bg:#09111f; --card:#111c2e; --text:#e8edf5; --muted:#aab7ca; --accent:#68a4ff; --border:#263750; --pro:#7cf2c0; --danger:#ff9090; }
|
||||
* { box-sizing: border-box; }
|
||||
body { margin: 0; background: linear-gradient(145deg,#07101d,#101b31); color: var(--text); font: 16px/1.7 system-ui,-apple-system,Segoe UI,Roboto,sans-serif; }
|
||||
main { width: min(1100px, calc(100% - 32px)); margin: 48px auto; padding: clamp(24px,5vw,56px); }
|
||||
.eyebrow { color: var(--accent); font-weight: 700; text-transform: uppercase; letter-spacing: .12em; font-size: .85rem; }
|
||||
h1 { margin: 8px 0 0; font-size: clamp(2rem,5vw,3rem); }
|
||||
.lede { color: var(--muted); max-width: 720px; margin-top: 12px; }
|
||||
.tiers { display: grid; grid-template-columns: repeat(auto-fit,minmax(220px,1fr)); gap: 18px; margin-top: 36px; }
|
||||
.tier { background: var(--card); border: 1px solid var(--border); border-radius: 18px; padding: 28px; display: flex; flex-direction: column; }
|
||||
.tier.pro { border-color: var(--pro); box-shadow: 0 0 0 1px rgba(124,242,192,.25); }
|
||||
.tier h2 { margin: 0 0 4px; font-size: 1.25rem; }
|
||||
.tier .price { font-size: 2rem; font-weight: 700; margin: 14px 0 0; }
|
||||
.tier .price small { font-size: 1rem; color: var(--muted); font-weight: 400; }
|
||||
.tier .duration { color: var(--muted); margin-top: 4px; font-size: .9rem; }
|
||||
.tier ul { margin: 14px 0; padding-left: 18px; color: var(--muted); font-size: .9rem; }
|
||||
.tier li { margin: 4px 0; }
|
||||
.tier button { cursor: pointer; border: 0; padding: 12px 16px; border-radius: 10px; font: inherit; font-weight: 600; margin-top: auto; }
|
||||
.tier.free { grid-column: 1 / -1; }
|
||||
.tier.free button { background: #1a2742; color: var(--text); border: 1px solid var(--border); }
|
||||
.tier.pro button { background: var(--pro); color: #052016; }
|
||||
.tier button:disabled { opacity: .6; cursor: not-allowed; }
|
||||
.footnote { color: var(--muted); margin-top: 32px; font-size: .9rem; }
|
||||
.footnote a { color: var(--accent); }
|
||||
.error { color: var(--danger); margin-top: 12px; min-height: 1.4em; }
|
||||
@media (max-width: 600px) { .tier { padding: 20px; } }
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<main>
|
||||
<div class="eyebrow">DashCaddy</div>
|
||||
<h1>Simple pricing. Self-hosted either way.</h1>
|
||||
<p class="lede">DashCaddy runs on your hardware. Free is enough for most homelabs. Pro unlocks multi-host fleets, public sharing, and email support.</p>
|
||||
|
||||
<div class="tiers">
|
||||
<div class="tier free">
|
||||
<h2>Free</h2>
|
||||
<div class="price">$0<small>/forever</small></div>
|
||||
<div class="duration">Unlimited duration</div>
|
||||
<ul>
|
||||
<li>Single host</li>
|
||||
<li>Up to <strong>3 users</strong></li>
|
||||
<li>TOTP login (single-user)</li>
|
||||
<li>Docker / Caddy / DNS management</li>
|
||||
<li>Community support (GitHub issues)</li>
|
||||
</ul>
|
||||
<button type="button" onclick="window.location.href='/download'">Download Free</button>
|
||||
</div>
|
||||
|
||||
<div class="tier pro" data-product-id="pro-30d">
|
||||
<h2>1 month</h2>
|
||||
<div class="price">$20</div>
|
||||
<div class="duration">30-day Pro license</div>
|
||||
<ul>
|
||||
<li>Unlimited users</li>
|
||||
<li>Public share links</li>
|
||||
<li>Tailscale-mediated share</li>
|
||||
<li>Email support</li>
|
||||
</ul>
|
||||
<button class="buy-btn" type="button" data-product-id="pro-30d">Buy 1 month</button>
|
||||
</div>
|
||||
|
||||
<div class="tier pro" data-product-id="pro-90d">
|
||||
<h2>3 months</h2>
|
||||
<div class="price">$50</div>
|
||||
<div class="duration">90-day Pro license (17% off)</div>
|
||||
<ul>
|
||||
<li>Unlimited users</li>
|
||||
<li>Public share links</li>
|
||||
<li>Tailscale-mediated share</li>
|
||||
<li>Email support</li>
|
||||
</ul>
|
||||
<button class="buy-btn" type="button" data-product-id="pro-90d">Buy 3 months</button>
|
||||
</div>
|
||||
|
||||
<div class="tier pro" data-product-id="pro-180d">
|
||||
<h2>6 months</h2>
|
||||
<div class="price">$70</div>
|
||||
<div class="duration">180-day Pro license (42% off)</div>
|
||||
<ul>
|
||||
<li>Unlimited users</li>
|
||||
<li>Public share links</li>
|
||||
<li>Tailscale-mediated share</li>
|
||||
<li>Email support</li>
|
||||
</ul>
|
||||
<button class="buy-btn" type="button" data-product-id="pro-180d">Buy 6 months</button>
|
||||
</div>
|
||||
|
||||
<div class="tier pro" data-product-id="pro-365d">
|
||||
<h2>12 months</h2>
|
||||
<div class="price">$99</div>
|
||||
<div class="duration">365-day Pro license (59% off)</div>
|
||||
<ul>
|
||||
<li>Unlimited users</li>
|
||||
<li>Public share links</li>
|
||||
<li>Tailscale-mediated share</li>
|
||||
<li>Email support</li>
|
||||
</ul>
|
||||
<button class="buy-btn" type="button" data-product-id="pro-365d">Buy 12 months</button>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div id="error" class="error" role="alert"></div>
|
||||
<p class="footnote">Payments are processed by <a href="https://stripe.com" rel="noopener">Stripe</a>. Your card details never touch DashCaddy servers. After payment you receive a Pro license code on the success page AND by email — keep it safe; you'll paste it into <code>/admin/license</code> on your host. 14-day pro-rated refunds. By purchasing you agree to the <a href="/legal/terms">Terms of Service</a> and <a href="/legal/privacy">Privacy Policy</a>.</p>
|
||||
</main>
|
||||
|
||||
<script>
|
||||
(function () {
|
||||
'use strict';
|
||||
var errEl = document.getElementById('error');
|
||||
|
||||
function setError(msg) {
|
||||
errEl.textContent = msg || '';
|
||||
}
|
||||
|
||||
function buy(productId, btn) {
|
||||
setError('');
|
||||
btn.disabled = true;
|
||||
var originalText = btn.textContent;
|
||||
btn.textContent = 'Opening Stripe…';
|
||||
|
||||
var email = null; // could prefill from a logged-in user; left null for the public pricing page
|
||||
|
||||
fetch('/api/v1/billing/checkout', {
|
||||
method: 'POST',
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
body: JSON.stringify({ productId: productId, customerEmail: email })
|
||||
}).then(function (r) {
|
||||
return r.json().then(function (body) { return { status: r.status, body: body }; });
|
||||
}).then(function (resp) {
|
||||
if (resp.status === 200 && resp.body.success && resp.body.data && resp.body.data.url) {
|
||||
window.location.href = resp.body.data.url;
|
||||
return;
|
||||
}
|
||||
btn.disabled = false;
|
||||
btn.textContent = originalText;
|
||||
setError((resp.body && resp.body.error) || ('Checkout failed (HTTP ' + resp.status + ').'));
|
||||
}).catch(function () {
|
||||
btn.disabled = false;
|
||||
btn.textContent = originalText;
|
||||
setError('Network error. Please try again.');
|
||||
});
|
||||
}
|
||||
|
||||
var buttons = document.querySelectorAll('.buy-btn');
|
||||
for (var i = 0; i < buttons.length; i++) {
|
||||
(function (btn) {
|
||||
btn.addEventListener('click', function () {
|
||||
var productId = btn.getAttribute('data-product-id');
|
||||
buy(productId, btn);
|
||||
});
|
||||
})(buttons[i]);
|
||||
}
|
||||
})();
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
+1
-1
@@ -1,4 +1,4 @@
|
||||
const CACHE = 'dashcaddy-shell-d39ab69dd4';
|
||||
const CACHE = 'dashcaddy-shell-3354f5fd96';
|
||||
const PRECACHE = [
|
||||
'/',
|
||||
'/index.html',
|
||||
|
||||
@@ -1,127 +0,0 @@
|
||||
'use strict';
|
||||
/**
|
||||
* DC-119: frontend build determinism across line endings.
|
||||
*
|
||||
* The frontend build (status/build.js) concatenates raw source files and
|
||||
* minifies them with esbuild using sourcemap:'both' — the inline map
|
||||
* base64-embeds the raw source bytes (sourcesContent), CRs included. A CRLF
|
||||
* working copy (Windows dev tree, core.autocrlf=true) vs an LF working copy
|
||||
* (DNS2 Linux checkout) of the SAME commit therefore produces different
|
||||
* dist bytes and a different sw.js cache tag — so the committed dist could
|
||||
* never be reproduced on the deploy host, showing up as permanent phantom
|
||||
* drift on `git pull` in /opt/dashcaddy (the recurring "pre-pull drift"
|
||||
* stashes).
|
||||
*
|
||||
* build.js now normalizes every source read to LF (\r\n -> \n) before
|
||||
* concatenation. This test pins that behavior at the transform level: the
|
||||
* SAME input, CRLF vs LF, must produce byte-identical minified output, and
|
||||
* the normalization regex used by build.js must strip all CR bytes.
|
||||
*
|
||||
* It deliberately does NOT shell out to `node build.js` (slow, writes
|
||||
* dist/) — it exercises the exact transform + normalization logic inline.
|
||||
*/
|
||||
|
||||
const test = require('node:test');
|
||||
const assert = require('node:assert');
|
||||
|
||||
// Same devDependency esbuild the build itself uses.
|
||||
const esbuild = require('esbuild');
|
||||
|
||||
// DC-119: import THE ACTUAL normalization from build.js — not a local
|
||||
// re-implementation — so this test fails if the build's regex ever changes.
|
||||
const { normalizeSource: normalize } = require('../build.js');
|
||||
|
||||
// Representative source: top-level names, nested scopes, strings with
|
||||
// escapes, template literals, regex literals, comments — the constructs
|
||||
// whose minified renames shifted pre-fix.
|
||||
const SAMPLE = `// feature module
|
||||
const logoCustomization = {
|
||||
position: 'left',
|
||||
cacheTag: 'dashcaddy-shell-abc123',
|
||||
};
|
||||
|
||||
function applyPosition(position, elem) {
|
||||
const normalized = position || logoCustomization.position;
|
||||
elem.setAttribute('data-logo-pos', normalized);
|
||||
return normalized.replace(/_/g, ' ');
|
||||
}
|
||||
|
||||
const summarize = (items) => {
|
||||
let total = 0;
|
||||
for (const item of items) {
|
||||
total += item.count ?? 0;
|
||||
}
|
||||
return \`total: \${total} (\${items.length} items)\`;
|
||||
};
|
||||
|
||||
async function loadConfig(url) {
|
||||
try {
|
||||
const res = await fetch(url);
|
||||
if (!res.ok) throw new Error('HTTP ' + res.status);
|
||||
return await res.json();
|
||||
} catch (err) {
|
||||
console.warn('load failed:', err.message);
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
module.exports = { applyPosition, summarize, loadConfig };
|
||||
`;
|
||||
|
||||
// Production transform options — MUST mirror build.js. The CRLF divergence
|
||||
// lives in the INLINE SOURCEMAP: sourcemap:'both' embeds the raw source as
|
||||
// base64 sourcesContent, so CRLF bytes survive into dist and shift both the
|
||||
// bundle bytes and the sw.js content-hash cache tag.
|
||||
async function minify(source) {
|
||||
const { code } = await esbuild.transform(source, {
|
||||
minify: true,
|
||||
target: 'es2020',
|
||||
sourcemap: 'both',
|
||||
});
|
||||
return code;
|
||||
}
|
||||
|
||||
test('DC-119: CRLF and LF inputs produce byte-identical minified output', async () => {
|
||||
const lf = SAMPLE;
|
||||
const crlf = SAMPLE.replace(/\n/g, '\r\n');
|
||||
|
||||
// Sanity: the two raw inputs really do differ.
|
||||
assert.notEqual(lf, crlf, 'fixture setup: CRLF variant must differ from LF');
|
||||
|
||||
const outLf = await minify(normalize(lf));
|
||||
const outCrlf = await minify(normalize(crlf));
|
||||
assert.strictEqual(
|
||||
outCrlf,
|
||||
outLf,
|
||||
'minified output must be byte-identical after CRLF->LF normalization'
|
||||
);
|
||||
});
|
||||
|
||||
test('DC-119: without normalization, CRLF vs LF differ (documents the bug)', async () => {
|
||||
const lf = SAMPLE;
|
||||
const crlf = SAMPLE.replace(/\n/g, '\r\n');
|
||||
|
||||
const outLf = await minify(lf);
|
||||
const outCrlf = await minify(crlf);
|
||||
|
||||
// Documents WHY the normalization exists: the inline sourcemap's
|
||||
// sourcesContent base64-encodes the raw bytes, CRs included. If esbuild
|
||||
// ever normalizes sourcesContent itself, this may flip to equal — then
|
||||
// the normalization is redundant but harmless; update the DC-119 comment
|
||||
// in build.js when that happens.
|
||||
assert.notEqual(
|
||||
outCrlf,
|
||||
outLf,
|
||||
'expected CRLF/LF divergence pre-normalization (inline sourcemap sourcesContent); if equal, esbuild changed behavior — update the DC-119 comment in build.js'
|
||||
);
|
||||
});
|
||||
|
||||
test('DC-119: normalization strips every CR from CRLF input and leaves LF untouched', () => {
|
||||
const crlf = 'line1\r\nline2\r\n';
|
||||
const lf = 'line1\nline2\n';
|
||||
// Lone \r (old-Mac style) is NOT produced by git autocrlf and is NOT
|
||||
// claimed to be handled — assert only the CRLF contract.
|
||||
assert.strictEqual(normalize(crlf), 'line1\nline2\n');
|
||||
assert.strictEqual(normalize(lf), 'line1\nline2\n');
|
||||
assert.ok(!normalize(crlf).includes('\r'), 'no CR may survive normalization');
|
||||
});
|
||||
@@ -1,278 +0,0 @@
|
||||
'use strict';
|
||||
|
||||
/**
|
||||
* DC-120: log-insights perimeter section smoke test.
|
||||
*
|
||||
* Validates that the Log Insights module:
|
||||
* 1. still declares the sections it always had (insights, summary, IPs,
|
||||
* storage) — refactor guard
|
||||
* 2. wires the new Perimeter section (li-perimeter div + loadPerimeter)
|
||||
* 3. escapes hostile IP/host strings before innerHTML insertion
|
||||
* (perimeter data comes from the public internet via caddy logs —
|
||||
* a malicious Host header is attacker-controlled input)
|
||||
* 4. keeps the perimeter fetch failure-isolated: a rejected perimeter
|
||||
* fetch must NOT blank the insights panel
|
||||
*
|
||||
* We load the script in a sandboxed VM with a mocked DOM (same pattern as
|
||||
* share-modal.test.js) and drive loadPerimeter directly via the exposed
|
||||
* test handle.
|
||||
*
|
||||
* Source path resolution: the judge worktree may flatten files with a
|
||||
* numeric prefix (e.g. `0_log-insights.js`) — same fallback scan as the
|
||||
* share-modal test.
|
||||
*/
|
||||
|
||||
const fs = require('fs');
|
||||
const path = require('path');
|
||||
const vm = require('vm');
|
||||
const test = require('node:test');
|
||||
const assert = require('node:assert/strict');
|
||||
|
||||
function findTarget() {
|
||||
const candidates = [
|
||||
path.join(__dirname, '..', 'js', 'log-insights.js'),
|
||||
path.join(__dirname, 'log-insights.js'),
|
||||
];
|
||||
for (const c of candidates) {
|
||||
if (fs.existsSync(c)) return c;
|
||||
}
|
||||
// Flat-worktree fallback: scan cwd + tests dir for the module name.
|
||||
for (const dir of [__dirname, process.cwd()]) {
|
||||
try {
|
||||
const hit = fs.readdirSync(dir).find((f) => /log-insights\.js$/.test(f));
|
||||
if (hit) return path.join(dir, hit);
|
||||
} catch (_) { /* keep scanning */ }
|
||||
}
|
||||
throw new Error('log-insights.js not found');
|
||||
}
|
||||
|
||||
function makeDom() {
|
||||
const elements = {};
|
||||
function el(id) {
|
||||
if (!elements[id]) {
|
||||
elements[id] = {
|
||||
id,
|
||||
innerHTML: '',
|
||||
style: {},
|
||||
listeners: {},
|
||||
addEventListener(ev, fn) { this.listeners[ev] = fn; },
|
||||
click() { this.listeners.click && this.listeners.click(); },
|
||||
};
|
||||
}
|
||||
return elements[id];
|
||||
}
|
||||
return {
|
||||
getElementById: (id) => (id === 'nonexistent' ? null : el(id)),
|
||||
createElement: () => ({ innerHTML: '', firstElementChild: { id: 'spawned' } }),
|
||||
body: { appendChild() {} },
|
||||
};
|
||||
}
|
||||
|
||||
test('module still declares the core sections (refactor guard)', () => {
|
||||
const src = fs.readFileSync(findTarget(), 'utf8');
|
||||
for (const id of ['li-insights', 'li-summary', 'li-ips-table', 'li-storage', 'li-perimeter']) {
|
||||
assert.ok(src.includes(`id="${id}"`), `missing section #${id}`);
|
||||
}
|
||||
});
|
||||
|
||||
test('module wires loadPerimeter and fetches the perimeter endpoint', async () => {
|
||||
const document = makeDom();
|
||||
const calls = [];
|
||||
const sandbox = {
|
||||
document,
|
||||
fetch: async (url) => {
|
||||
calls.push(url);
|
||||
return {
|
||||
json: async () => ({
|
||||
success: true,
|
||||
summary: { events: 42, uniqueIPs: 7, denied: 3, error: 1 },
|
||||
topIPs: [{ ip: '1.2.3.4', count: 10, denied: 2, error: 0, hosts: ['a.example'] }],
|
||||
byHost: [{ host: 'a.example', count: 10, denied: 2, error: 0 }],
|
||||
}),
|
||||
};
|
||||
},
|
||||
prompt: () => null,
|
||||
alert: () => {},
|
||||
confirm: () => false,
|
||||
console,
|
||||
setTimeout,
|
||||
};
|
||||
vm.createContext(sandbox);
|
||||
vm.runInContext(fs.readFileSync(findTarget(), 'utf8'), sandbox, { filename: 'log-insights.js' });
|
||||
|
||||
// Open the modal → loadInsights runs → perimeter fetch fires.
|
||||
const openBtn = document.getElementById('log-insights-btn');
|
||||
openBtn.click();
|
||||
await new Promise((r) => setTimeout(r, 20));
|
||||
|
||||
assert.ok(calls.some((u) => String(u).includes('/api/v1/security/events/perimeter')),
|
||||
'perimeter endpoint never fetched');
|
||||
const html = document.getElementById('li-perimeter').innerHTML;
|
||||
assert.ok(html.includes('1.2.3.4'), 'top IP not rendered');
|
||||
assert.ok(html.includes('42 requests from 7 IPs'), 'summary line not rendered');
|
||||
assert.ok(html.includes('3 denied'), 'denied count not rendered');
|
||||
});
|
||||
|
||||
test('hostile IP/host strings are HTML-escaped before innerHTML', async () => {
|
||||
const document = makeDom();
|
||||
const sandbox = {
|
||||
document,
|
||||
fetch: async () => ({
|
||||
json: async () => ({
|
||||
success: true,
|
||||
summary: { events: 1, uniqueIPs: 1, denied: 0, error: 0 },
|
||||
topIPs: [{ ip: '<script>alert(1)</script>', count: 1, denied: 0, error: 0, hosts: ['<img src=x onerror=alert(2)>'] }],
|
||||
byHost: [{ host: '<b>evil</b>', count: 1, denied: 0, error: 0 }],
|
||||
}),
|
||||
}),
|
||||
prompt: () => null,
|
||||
alert: () => {},
|
||||
confirm: () => false,
|
||||
console,
|
||||
setTimeout,
|
||||
};
|
||||
vm.createContext(sandbox);
|
||||
vm.runInContext(fs.readFileSync(findTarget(), 'utf8'), sandbox, { filename: 'log-insights.js' });
|
||||
|
||||
document.getElementById('log-insights-btn').click();
|
||||
await new Promise((r) => setTimeout(r, 20));
|
||||
|
||||
const html = document.getElementById('li-perimeter').innerHTML;
|
||||
assert.ok(!html.includes('<script>'), 'raw <script> leaked into perimeter HTML');
|
||||
assert.ok(!html.includes('<img src=x'), 'raw onerror img leaked into perimeter HTML');
|
||||
assert.ok(html.includes('<script>'), 'IP not escaped');
|
||||
});
|
||||
|
||||
test('perimeter fetch failure leaves insights intact (isolation)', async () => {
|
||||
const document = makeDom();
|
||||
const sandbox = {
|
||||
document,
|
||||
fetch: async (url) => {
|
||||
if (String(url).includes('perimeter')) {
|
||||
return { json: async () => ({ success: false, error: 'boom' }) };
|
||||
}
|
||||
// Main insights endpoint succeeds.
|
||||
return {
|
||||
json: async () => ({
|
||||
success: true,
|
||||
insights: [{ severity: 'ok', title: 'All quiet', plain: 'nothing' }],
|
||||
summary: { totalRequests: 5, uniqueIPs: 1, securityEvents: 0, failedActions: 0 },
|
||||
topIPs: [{ ip: '127.0.0.1', count: 5, failures: 0, topActions: [['auth.login', 5]], lastSeen: '2026-01-01T00:00:00Z' }],
|
||||
storage: { auditLog: { sizeMB: 1, entries: 10 } },
|
||||
}),
|
||||
};
|
||||
},
|
||||
prompt: () => null,
|
||||
alert: () => {},
|
||||
confirm: () => false,
|
||||
console,
|
||||
setTimeout,
|
||||
};
|
||||
vm.createContext(sandbox);
|
||||
vm.runInContext(fs.readFileSync(findTarget(), 'utf8'), sandbox, { filename: 'log-insights.js' });
|
||||
|
||||
document.getElementById('log-insights-btn').click();
|
||||
await new Promise((r) => setTimeout(r, 20));
|
||||
|
||||
const insights = document.getElementById('li-insights').innerHTML;
|
||||
assert.ok(insights.includes('All quiet'), 'insights panel was blanked by perimeter failure');
|
||||
const perimeter = document.getElementById('li-perimeter').innerHTML;
|
||||
assert.ok(perimeter.includes('Perimeter unavailable'), 'perimeter error state not shown');
|
||||
});
|
||||
|
||||
test('true rejected perimeter fetch (network error) exercises catch path with stale guard', async () => {
|
||||
const document = makeDom();
|
||||
const sandbox = {
|
||||
document,
|
||||
fetch: async (url) => {
|
||||
if (String(url).includes('perimeter')) {
|
||||
throw new Error('Network error');
|
||||
}
|
||||
return {
|
||||
json: async () => ({
|
||||
success: true,
|
||||
insights: [{ severity: 'ok', title: 'All quiet', plain: 'nothing' }],
|
||||
summary: { totalRequests: 5, uniqueIPs: 1, securityEvents: 0, failedActions: 0 },
|
||||
topIPs: [{ ip: '127.0.0.1', count: 5, failures: 0, topActions: [['auth.login', 5]], lastSeen: '2026-01-01T00:00:00Z' }],
|
||||
storage: { auditLog: { sizeMB: 1, entries: 10 } },
|
||||
}),
|
||||
};
|
||||
},
|
||||
prompt: () => null,
|
||||
alert: () => {},
|
||||
confirm: () => false,
|
||||
console,
|
||||
setTimeout,
|
||||
};
|
||||
vm.createContext(sandbox);
|
||||
vm.runInContext(fs.readFileSync(findTarget(), 'utf8'), sandbox, { filename: 'log-insights.js' });
|
||||
|
||||
document.getElementById('log-insights-btn').click();
|
||||
await new Promise((r) => setTimeout(r, 20));
|
||||
|
||||
const perimeter = document.getElementById('li-perimeter').innerHTML;
|
||||
assert.ok(perimeter.includes('Perimeter failed to load'), 'catch path not executed');
|
||||
assert.ok(perimeter.includes('Network error'), 'network error not shown');
|
||||
});
|
||||
|
||||
test('stale rejected perimeter fetch does not overwrite fresh data', async () => {
|
||||
const document = makeDom();
|
||||
let perimeterCallCount = 0;
|
||||
let resolveOld;
|
||||
const oldPromise = new Promise((res) => { resolveOld = res; });
|
||||
const sandbox = {
|
||||
document,
|
||||
fetch: async (url) => {
|
||||
if (String(url).includes('perimeter')) {
|
||||
perimeterCallCount++;
|
||||
if (perimeterCallCount === 1) {
|
||||
// First (stale) call: returns a promise that rejects when resolved
|
||||
return oldPromise.then(() => { throw new Error('Old rejected'); });
|
||||
}
|
||||
// Second (fresh) call: immediate success
|
||||
return {
|
||||
json: async () => ({
|
||||
success: true,
|
||||
summary: { events: 10, uniqueIPs: 2, denied: 0, error: 0 },
|
||||
topIPs: [{ ip: '1.2.3.4', count: 5, denied: 0, error: 0, hosts: ['a.example'] }],
|
||||
byHost: [{ host: 'a.example', count: 5, denied: 0, error: 0 }],
|
||||
}),
|
||||
};
|
||||
}
|
||||
return {
|
||||
json: async () => ({
|
||||
success: true,
|
||||
insights: [{ severity: 'ok', title: 'All quiet', plain: 'nothing' }],
|
||||
summary: { totalRequests: 5, uniqueIPs: 1, securityEvents: 0, failedActions: 0 },
|
||||
topIPs: [{ ip: '127.0.0.1', count: 5, failures: 0, topActions: [['auth.login', 5]], lastSeen: '2026-01-01T00:00:00Z' }],
|
||||
storage: { auditLog: { sizeMB: 1, entries: 10 } },
|
||||
}),
|
||||
};
|
||||
},
|
||||
prompt: () => null,
|
||||
alert: () => {},
|
||||
confirm: () => false,
|
||||
console,
|
||||
setTimeout,
|
||||
};
|
||||
vm.createContext(sandbox);
|
||||
vm.runInContext(fs.readFileSync(findTarget(), 'utf8'), sandbox, { filename: 'log-insights.js' });
|
||||
|
||||
document.getElementById('log-insights-btn').click();
|
||||
await new Promise((r) => setTimeout(r, 20));
|
||||
|
||||
// Simulate a rapid period change — fires a NEW request before old resolves.
|
||||
const periodSel = document.getElementById('li-period');
|
||||
periodSel.value = '6';
|
||||
const listeners = periodSel.listeners || {};
|
||||
if (listeners.change) await listeners.change();
|
||||
await new Promise((r) => setTimeout(r, 20));
|
||||
|
||||
// Now resolve the OLD request's rejection.
|
||||
resolveOld(undefined);
|
||||
await new Promise((r) => setTimeout(r, 20));
|
||||
|
||||
const perimeter = document.getElementById('li-perimeter').innerHTML;
|
||||
assert.ok(perimeter.includes('1.2.3.4') || perimeter.includes('10 requests') || perimeter.includes('requests from'),
|
||||
'stale rejection overwrote fresh perimeter: ' + perimeter);
|
||||
});
|
||||
Reference in new issue
Block a user