11 Commits

Author	SHA1	Message	Date
Gan, Jimmy	e72665c466	fix: refresh terminal websocket auth on reconnect ... Reuse the existing refresh-token flow before opening terminal websocket connections so reconnects can recover from expired access tokens without requiring a full dashboard reload. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-07 17:49:46 +08:00
Gan, Jimmy	d8e6f5716a	feat: add cc-connect start/stop controls ... Add backend start/stop endpoints and wire cc-connect UI controls to toggle container state with post-action health refresh and clear error handling. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-03 00:11:53 +08:00
Gan, Jimmy	a91a1132c9	feat: add info engine MVP pipeline and dashboard page ... Introduce a standalone scheduled info-engine worker with SQLite persistence and expose read-only dashboard APIs/UI so curated intelligence items can be collected and viewed with minimal architecture changes. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-02 23:35:10 +08:00
Gan, Jimmy	14965c7e03	feat: add cc-connect dashboard health integration ... Add a protected backend health endpoint and a new dashboard page/sidebar entry so cc-connect operational status is visible in the UI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-02 23:24:03 +08:00
Gan, Jimmy	910ed3f7e6	feat: add LiteLLM health page to dashboard ... Expose LiteLLM operational status in the NAS Dashboard UI so auth-required and outage states are visible without calling backend APIs directly. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-02 03:50:56 +08:00
Gan, Jimmy	a8debcfb4b	feat: access control UI in Settings + sidebar drag-and-drop reordering ... - Add Access Control card in Settings (admin-only): role defaults display, user overrides CRUD - Add sidebar drag-and-drop reordering with per-user persistence in rbac.json - Backend: GET/PUT /api/auth/preferences endpoints, sidebar order helpers in rbac.py - Frontend: HTML5 drag API with grip handles, smart order merge, debounced save - Preserve sidebar_order when updating page overrides	2026-03-01 14:48:35 +08:00
Gan, Jimmy	9992105b49	feat: RBAC multi-user role-based access control ... - Add rbac.py with User model, LDAP group-to-role mapping, page/write dependencies - Proxy auth reads Remote-Groups header to resolve role from LDAP groups - JWT tokens carry role claim, /me returns role + allowed pages - Per-router page access control and viewer write protection - Terminal WebSocket RBAC check - Frontend filters sidebar links and routes by allowed pages - Admin-only Settings page and RBAC override endpoints - Mount rbac.json in docker-compose for page config persistence	2026-03-01 14:13:43 +08:00
Gan, Jimmy	be1f3b3ad6	Add security improvements: refresh tokens, passkeys, CSP, audit logging, TOTP encryption ... - Shorten access token to 30min with 7-day refresh token flow - Add WebAuthn passkey registration and login with TOTP fallback - Add Content-Security-Policy header - Add audit logging middleware to /volume1/docker/nas-dashboard/audit.log - Block /volume1/docker/ in files endpoint - Encrypt TOTP secret at rest with Fernet (derived from SECRET_KEY) - New deps: py_webauthn, cryptography	2026-02-22 11:04:40 +08:00
Gan, Jimmy	651bc0580e	Phase 7: Auth & Security upgrade (JWT, 2FA, Login UI)	2026-02-19 03:47:48 +08:00
Gan, Jimmy	f3db7d3654	Dashboard UI overhaul: modern design with system stats, SVG icons, Inter font, theme toggle, loading states, and log modal	2026-02-19 02:29:25 +08:00
Gan, Jimmy	70aa421d7f	Add NAS dashboard MVP: Docker mgmt, Gitea, Files, Terminal	2026-02-19 01:59:50 +08:00