diff --git a/AGENTS.md b/AGENTS.md index e7ed193..570a778 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -35,10 +35,28 @@ Rules: - Status pills and tinted panels: `var(--color-{info,success,warning,danger,primary}-50)` background with the matching `-700` text. These flip per theme; the pale `#eff6ff`/`#fef3c7`/`#fee2e2` hexes do not. - Solid saturated fills (a colored button background, a status dot, an icon) may stay as a saturated color; those read on both themes. Do not convert those to the `-50` tints. - Inputs/selects must set both `background` and `color` (a missing `color` shows black text on a dark surface). Prefer `BaseInput`/`BaseSelect`, which handle this. +- Native form controls are not accepted when a base primitive supports the same control. Theme correctness belongs to the primitive, not each page. +- Every changed form must be exercised with `data-theme="light"` and `data-theme="dark"`. Check entered text, placeholders, disabled controls, browser autofill, dropdown options, focus rings, and modal surfaces. + +## Authorization: permission and resource scope are separate + +A module permission answers what kind of operation an actor may perform. A resource grant answers where they may perform it. Features that operate on deployments, buckets, peers, or another owned resource must enforce both. + +Rules: + +- Define dedicated read and write permissions for each module. Do not reuse an unrelated permission because the feature shares a page or transport. +- Enforce permissions and resource scope in the agent API. Router guards and hidden buttons improve the experience but are not security boundaries. +- Filter collection responses to resources the actor may read. Validate every resource referenced by create, update, delete, bulk, and action requests. +- A bulk update must preserve records outside the actor's scope. Never let a scoped request replace a global collection. +- Host-wide, fleet-wide, and all-resource operations require an explicit global permission. An empty resource identifier must not silently mean global access. +- API keys may narrow their user's grants. Use the intersection of user and key access. +- The UI must hide mutation controls without write permission and exclude read-only resources from target selectors. +- Tests must call the HTTP endpoint with two actors whose resource grants differ. Prove that each actor sees only allowed records and cannot change the other actor's records. ## Review checklist (UI changes) - [ ] New inputs/selects/buttons/cards reuse `src/components/base/` rather than bespoke markup. Flag any hand-rolled control that duplicates a primitive. - [ ] No hardcoded hex/`white`/`black` in ` diff --git a/src/components/StorageBackupsSettings.vue b/src/components/StorageBackupsSettings.vue index 8751598..74c8e19 100644 --- a/src/components/StorageBackupsSettings.vue +++ b/src/components/StorageBackupsSettings.vue @@ -177,8 +177,8 @@ import { useNotificationsStore } from "@/stores/notifications"; const auth = useAuthStore(); const notifications = useNotificationsStore(); -const canWriteCreds = auth.hasPermission("backups:write"); -const canDeleteCreds = auth.hasPermission("backups:delete"); +const canWriteCreds = auth.hasPermission("storage:write"); +const canDeleteCreds = auth.hasPermission("storage:delete"); const canWriteDests = auth.hasPermission("config:write"); const creds = ref([]); diff --git a/src/layouts/DashboardLayout.vue b/src/layouts/DashboardLayout.vue index 54311e5..a3ded1c 100644 --- a/src/layouts/DashboardLayout.vue +++ b/src/layouts/DashboardLayout.vue @@ -205,7 +205,7 @@
@@ -233,7 +233,7 @@ {{ stats.databases }} { }; const fetchClusterInfo = async () => { + if (!authStore.hasPermission("cluster:read")) return; try { const res = await clusterApi.getStatus(); if (res.data.enabled && res.data.server_name) { diff --git a/src/router/index.ts b/src/router/index.ts index 41fd184..485b2dc 100644 --- a/src/router/index.ts +++ b/src/router/index.ts @@ -98,19 +98,19 @@ const routes: RouteRecordRaw[] = [ path: "storage/object-stores", name: "object-stores", component: () => import("@/views/ObjectStoresView.vue"), - meta: { permission: "backups:read" }, + meta: { permission: "storage:read" }, }, { path: "storage/object-stores/:name", name: "object-store-detail", component: () => import("@/views/ObjectStoreDetailView.vue"), - meta: { permission: "backups:read" }, + meta: { permission: "storage:read" }, }, { path: "storage/object-stores/:name/buckets/:bucket", name: "object-store-bucket", component: () => import("@/views/ObjectBucketView.vue"), - meta: { permission: "backups:read" }, + meta: { permission: "storage:read" }, }, { path: "certificates", @@ -143,6 +143,7 @@ const routes: RouteRecordRaw[] = [ path: "alerts", name: "alerts", component: () => import("@/views/AlertsView.vue"), + meta: { permission: "alerts:read" }, }, { path: "dashboards", @@ -196,7 +197,7 @@ const routes: RouteRecordRaw[] = [ path: "updates", name: "updates", component: () => import("@/views/UpdatesView.vue"), - meta: { permission: "settings:read" }, + meta: { permission: "updates:read" }, }, { path: "system-terminal", @@ -220,7 +221,7 @@ const routes: RouteRecordRaw[] = [ path: "notifications", name: "notifications", component: () => import("@/views/NotificationsView.vue"), - meta: { permission: "settings:read" }, + meta: { permission: "notifications:read" }, }, { path: "security", diff --git a/src/services/api.ts b/src/services/api.ts index c1b2cc4..3cd084b 100755 --- a/src/services/api.ts +++ b/src/services/api.ts @@ -180,10 +180,14 @@ export interface ServiceMetadata { auto_cert: boolean; }; healthcheck: { + type?: "http" | "tcp" | "exec"; + service?: string; + port?: number; path: string; interval: string; success_statuses?: number[]; response_contains?: string; + command?: string; }; protected_mode?: ProtectedModeConfig; require_plan?: boolean; @@ -568,6 +572,8 @@ export interface NotificationIncident { export const notificationsApi = { getTargets: () => apiClient.get<{ targets: NotificationTarget[] }>("/notifications/targets"), + getAlertTargetOptions: () => + apiClient.get<{ targets: Pick[] }>("/alerts/target-options"), updateTargets: (targets: NotificationTarget[]) => apiClient.put("/notifications/targets", { targets }), getRules: () => apiClient.get<{ rules: NotificationRule[] }>("/notifications/rules"), updateRules: (rules: NotificationRule[]) => @@ -1403,6 +1409,7 @@ export interface StoreBucket { } export const objectStoresApi = { + list: () => apiClient.get<{ destinations: BackupDestination[] }>("/object-stores"), listBuckets: (name: string) => apiClient.get<{ buckets: StoreBucket[]; backup_bucket: string }>( `/object-stores/${encodeURIComponent(name)}/buckets`, @@ -2144,6 +2151,13 @@ export const clusterApi = { apiClient.post("/cluster/accept", { invite_token: inviteToken, peer_url: peerUrl }), removePeer: (name: string) => apiClient.delete<{ status: string; peer: string }>(`/cluster/peers/${name}`), getAggregatedDeployments: () => apiClient.get("/cluster/deployments"), + getDeployment: (server: string, name: string) => + apiClient.get<{ + deployment: Deployment; + compose_content?: string; + compose_filename?: string; + proxy_status?: unknown; + }>(`/cluster/peers/${encodeURIComponent(server)}/proxy/deployments/${encodeURIComponent(name)}`), deploymentAction: (server: string, name: string, action: "start" | "stop" | "restart") => apiClient.post( `/cluster/peers/${encodeURIComponent(server)}/proxy/deployments/${encodeURIComponent(name)}/${action}`, diff --git a/src/types/index.ts b/src/types/index.ts index 98578ed..e9b552c 100644 --- a/src/types/index.ts +++ b/src/types/index.ts @@ -105,10 +105,14 @@ export interface SSLConfig { } export interface HealthCheckConfig { + type?: "http" | "tcp" | "exec"; + service?: string; + port?: number; path: string; interval: string; success_statuses?: number[]; response_contains?: string; + command?: string; } export interface Network { @@ -394,6 +398,13 @@ export type Permission = | "backups:read" | "backups:write" | "backups:delete" + | "storage:read" + | "storage:write" + | "storage:delete" + | "notifications:read" + | "notifications:write" + | "alerts:read" + | "alerts:write" | "users:read" | "users:write" | "users:delete" @@ -402,6 +413,8 @@ export type Permission = | "apikeys:delete" | "settings:read" | "settings:write" + | "updates:read" + | "updates:write" | "config:read" | "config:write" | "audit:read" diff --git a/src/utils/permissions.ts b/src/utils/permissions.ts index 4f5cc4f..cc468aa 100644 --- a/src/utils/permissions.ts +++ b/src/utils/permissions.ts @@ -53,6 +53,8 @@ const adminPermissions: string[] = [ "templates:write", "traffic:read", "traffic:write", + "alerts:read", + "alerts:write", ]; const operatorPermissions: string[] = [ @@ -88,6 +90,8 @@ const operatorPermissions: string[] = [ "registries:write", "templates:read", "traffic:read", + "alerts:read", + "alerts:write", ]; const viewerPermissions: string[] = [ @@ -109,6 +113,7 @@ const viewerPermissions: string[] = [ "registries:read", "templates:read", "traffic:read", + "alerts:read", ]; export function getRolePermissions(role: UserRole): string[] { diff --git a/src/views/AlertsView.vue b/src/views/AlertsView.vue index c6bbdc8..d196470 100644 --- a/src/views/AlertsView.vue +++ b/src/views/AlertsView.vue @@ -8,7 +8,7 @@ crosses a line you care about.

- + Notification targets @@ -113,12 +113,15 @@ import { ref, computed, onMounted, onUnmounted } from "vue"; import { observabilityApi } from "@/services/observability"; import type { AlertEvent } from "@/services/observability"; import { useDeploymentsStore } from "@/stores/deployments"; +import { useAuthStore } from "@/stores/auth"; import Icon from "@/components/base/Icon.vue"; import AlertRulesPanel from "@/components/AlertRulesPanel.vue"; import LogRulesPanel from "@/components/LogRulesPanel.vue"; import type { Incident } from "@/services/observability"; const deploymentsStore = useDeploymentsStore(); +const auth = useAuthStore(); +const canManageTargets = computed(() => auth.hasPermission("notifications:read")); const deploymentNames = computed(() => deploymentsStore.deployments.map((d) => d.name).sort()); const scope = ref<"metrics" | "logs">("metrics"); diff --git a/src/views/ClusterView.vue b/src/views/ClusterView.vue index 0e6a842..17a8f55 100644 --- a/src/views/ClusterView.vue +++ b/src/views/ClusterView.vue @@ -149,11 +149,11 @@

Enter the invite token and the URL of the server that generated it.

- +
- , }; vi.mock("vue-router", () => ({ @@ -18,6 +18,21 @@ vi.mock("vue-router", () => ({ })); vi.mock("@/services/api", () => ({ + clusterApi: { + getDeployment: vi.fn().mockResolvedValue({ + data: { + deployment: { + name: "test-app", + status: "running", + path: "/deployments/test-app", + services: [{ name: "web", status: "running", container_id: "abc123", image: "nginx:1.27" }], + created_at: "2024-01-01T00:00:00Z", + updated_at: "2024-01-01T00:00:00Z", + }, + proxy_status: { exposed: true, domain: "test-app.example.com", ssl_enabled: true }, + }, + }), + }, deploymentsApi: { get: vi.fn().mockResolvedValue({ data: { @@ -135,6 +150,7 @@ describe("DeploymentDetailView", () => { beforeEach(() => { vi.clearAllMocks(); vi.useFakeTimers(); + mockRoute.query = {}; }); afterEach(() => { @@ -178,6 +194,20 @@ describe("DeploymentDetailView", () => { expect(wrapper.find(".detail-header").exists()).toBe(true); }); + it("loads peer deployment details and shows the peer context", async () => { + const { clusterApi, deploymentsApi } = await import("@/services/api"); + mockRoute.query = { server: "prod-2" }; + const wrapper = mountView(); + await flushPromises(); + + expect(clusterApi.getDeployment).toHaveBeenCalledWith("prod-2", "test-app"); + expect(deploymentsApi.get).not.toHaveBeenCalled(); + expect(wrapper.text()).toContain("Managed on"); + expect(wrapper.text()).toContain("prod-2"); + expect(wrapper.text()).toContain("nginx:1.27"); + expect(wrapper.find(".detail-tabs").exists()).toBe(false); + }); + it("contains detail tabs section", async () => { const wrapper = mountView(); await flushPromises(); diff --git a/src/views/DeploymentDetailView.vue b/src/views/DeploymentDetailView.vue index eaabb88..7d639a3 100755 --- a/src/views/DeploymentDetailView.vue +++ b/src/views/DeploymentDetailView.vue @@ -13,7 +13,7 @@
-
+
Diagnose Try Again
+ + @@ -307,7 +302,7 @@