27 Commits

Author	SHA1	Message	Date
Gan, Jimmy	1a37f34401	auth: Sprint 02 — auth hardening (Pydantic models, challenge binding, admin gates) ... - Add max_length validation to LoginRequest (username 128, password 1024) - Replace raw request.json() with Pydantic models in RBAC override/update endpoints - Replace raw request.json() with Pydantic models in passkey register/login/delete - Bind passkey challenges to session-bound challenge_id (prevents cross-session replay) - Gate audit log and security log endpoints behind admin role - Fix fragile opc_db.json.dumps() → import json directly - Add COOKIE_SECURE=False startup warning (suppress with ALLOW_INSECURE_COOKIES) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-03 13:45:42 +08:00
Gan, Jimmy	dac163d88c	security: fix critical vulnerabilities (issues #2 and #3) ... Issue #2: Unprotected Chat Summary Trigger (CRITICAL) - Add authentication and admin authorization to /trigger endpoint - Add path validation to prevent directory traversal - Block access to system directories (/etc, /root, /sys, /proc, /boot) - Add tests for unauthorized access and invalid paths Issue #3: Exception Information Disclosure (HIGH) - Replace raw exception messages with generic errors - Log full exception details server-side with logger.exception() - Affected files: auth.py, files.py, passkey.py, opc_agents.py - Prevents information leakage about system architecture Security Impact: - Prevents unauthenticated file system writes - Reduces reconnaissance opportunities for attackers - Maintains security while preserving debugging capability Tests: 214 passing, all security tests verified	2026-04-08 00:57:14 +08:00
Gan, Jimmy	b981c06d59	feat: comprehensive test infrastructure improvements ... - Fix unit test imports: add env setup in conftest.py before module imports - Add 24 new auth router tests (RBAC, preferences, password validation) - Add 16 new tests for litellm and chat_summary routers - Apply black formatting and ruff linting across codebase - Add pre-commit hooks configuration (black, ruff, file checks) - Increase CI coverage threshold from 40% to 50% Test Results: - 206 tests passing (91 unit + 115 integration) - Coverage: 58.79% on core modules - auth.py: 57% → 85%, litellm.py: 23% → 87%, chat_summary.py: 41% → 100% - auth_service: 96.51%, config: 100%, rbac: 93.48%	2026-04-08 00:21:32 +08:00
Gan, Jimmy	1b769bca1d	fix: rename auth module to auth_service to resolve circular import	2026-04-02 01:02:45 +08:00
Gan, Jimmy	e46003711b	fix: make RBAC dependencies properly chain _inject_user for OPC authorization	2026-04-02 00:25:32 +08:00
Gan, Jimmy	4201917e17	fix: harden dashboard RBAC and cookie auth flows ... Restrict Docker/Files writes to admins, move terminal websocket auth to cookie-first with temporary query fallback, and migrate refresh-token handling to httpOnly cookies for safer session persistence. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-09 23:44:23 +08:00
Gan, Jimmy	44f0ed5d04	fix: harden dashboard auth and terminal flows ... Tighten terminal websocket auth and proxy trust handling while making file-backed auth/RBAC writes atomic to reduce high-impact security and persistence risks. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-06 23:53:58 +08:00
Gan, Jimmy	ae437db92e	refactor: split auth router into focused modules ... Split the 429-line auth.py into three modules for better maintainability: - auth.py (264 lines): core auth, login, token refresh, RBAC, preferences - passkey.py (187 lines): WebAuthn passkey registration and authentication - totp.py (41 lines): TOTP 2FA setup and verification All 21 endpoints maintain backward compatibility under /api/auth prefix. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-01 22:19:33 +08:00
Gan, Jimmy	7ab2ad41c4	feat: add role-based sidebar link visibility control	2026-03-01 18:17:45 +08:00
Gan, Jimmy	862097813d	feat: add UI to edit role default page permissions	2026-03-01 17:57:45 +08:00
Gan, Jimmy	79a9fc980e	debug: add exception logging to preferences save endpoint	2026-03-01 17:45:00 +08:00
Gan, Jimmy	a8debcfb4b	feat: access control UI in Settings + sidebar drag-and-drop reordering ... - Add Access Control card in Settings (admin-only): role defaults display, user overrides CRUD - Add sidebar drag-and-drop reordering with per-user persistence in rbac.json - Backend: GET/PUT /api/auth/preferences endpoints, sidebar order helpers in rbac.py - Frontend: HTML5 drag API with grip handles, smart order merge, debounced save - Preserve sidebar_order when updating page overrides	2026-03-01 14:48:35 +08:00
Gan, Jimmy	9992105b49	feat: RBAC multi-user role-based access control ... - Add rbac.py with User model, LDAP group-to-role mapping, page/write dependencies - Proxy auth reads Remote-Groups header to resolve role from LDAP groups - JWT tokens carry role claim, /me returns role + allowed pages - Per-router page access control and viewer write protection - Terminal WebSocket RBAC check - Frontend filters sidebar links and routes by allowed pages - Admin-only Settings page and RBAC override endpoints - Mount rbac.json in docker-compose for page config persistence	2026-03-01 14:13:43 +08:00
Gan, Jimmy	a0354c335b	fix: trust docker gateway IP for reverse proxy auth	2026-02-27 23:48:34 +08:00
Gan, Jimmy	3888a57642	chore: secure dashboard proxy endpoint and decouple lan checks	2026-02-27 23:41:36 +08:00
Gan, Jimmy	29a9e9d881	feat: integrate Authelia SSO and update LLDAP routing	2026-02-27 23:04:57 +08:00
Gan, Jimmy	394a1aa367	security: harden dashboard (SSH keys, auth, uploads, CORS, non-root) ... Remove SSH private keys from git, add SECRET_KEY validation, move WS auth from query string to first message, add session limits/idle timeout, PBKDF2 Fernet key, refresh token rotation, TOTP replay protection, file upload size limit + filename sanitization, symlink safety check, restrict CORS methods, IP-gate OpenClaw token, run container as non-root, rate-limit refresh/passkey endpoints, sanitize Gitea path params. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-02-26 17:22:25 +08:00
Gan, Jimmy	332696689a	fix: support port 8443 origin for WebAuthn passkeys and CORS	2026-02-26 02:00:29 +08:00
Gan, Jimmy	6c3bb26c3d	Clean up: remove stale scripts/docs, fix debug prints, update PLAN.md	2026-02-24 10:14:48 +08:00
Gan, Jimmy	19b3de3c91	Show passkey names and dates, add individual delete	2026-02-22 12:20:05 +08:00
Gan, Jimmy	be1f3b3ad6	Add security improvements: refresh tokens, passkeys, CSP, audit logging, TOTP encryption ... - Shorten access token to 30min with 7-day refresh token flow - Add WebAuthn passkey registration and login with TOTP fallback - Add Content-Security-Policy header - Add audit logging middleware to /volume1/docker/nas-dashboard/audit.log - Block /volume1/docker/ in files endpoint - Encrypt TOTP secret at rest with Fernet (derived from SECRET_KEY) - New deps: py_webauthn, cryptography	2026-02-22 11:04:40 +08:00
Gan, Jimmy	b1dee47126	Add CORS, rate limiting, security headers, and files endpoint protection	2026-02-21 11:18:29 +08:00
Gan, Jimmy	17e7073fab	Fix proxy env bug in Telegram alert	2026-02-20 22:21:16 +08:00
Gan, Jimmy	dd3e8e0d2c	security: remove hardcoded secrets, add health endpoint, add security headers	2026-02-20 22:04:01 +08:00
Gan, Jimmy	197b7c1cbb	Fix session expiry: use config value, increase to 7 days ... - LOGIN was ignoring ACCESS_TOKEN_EXPIRE_MINUTES (hardcoded 15min default) - Pass expires_delta from config in login route - Increase token lifetime from 30min to 7 days	2026-02-19 19:44:30 +08:00
Gan, Jimmy	bf49e13e56	Add settings page with change password, fix terminal ws bug	2026-02-19 17:29:03 +08:00
Gan, Jimmy	651bc0580e	Phase 7: Auth & Security upgrade (JWT, 2FA, Login UI)	2026-02-19 03:47:48 +08:00