git-echo/linux_patch_manager
Private
Public Access
1
0
Fork 0
Code Releases 8 Wiki Activity

fix: resolve all startup bugs (BUG-6 through BUG-9)
Some checks failed
CI Pipeline / Rust Format Check (push) Failing after 36s
Details
CI Pipeline / Clippy Lints (push) Successful in 45s
Details
CI Pipeline / Rust Unit Tests (push) Successful in 1m1s
Details
CI Pipeline / Security Audit (push) Successful in 4s
Details
CI Pipeline / Frontend Lint & Type Check (push) Successful in 11s
Details
CI Pipeline / Build .deb & Release (push) Has been skipped
Details

Browse Source 
BUG-6: Add TLS support via axum-server + rustls
  - Added axum-server with tls-rustls feature to workspace and pm-web
  - pm-web now serves HTTPS when TLS certs exist, falls back to HTTP with warning
  - setup.sh generates self-signed ECDSA P-256 TLS cert with SANs
  - Config already had web_tls_cert_path/web_tls_key_path fields

BUG-7: Fix audit chain integrity errors
  - Migration 005 now TRUNCATEs audit_log after adding prev_hash column
  - Existing rows had broken hash chains (inserted before prev_hash existed)

BUG-8: Disable WatchdogSec in patch-manager-web.service
  - pm-web does not implement sd_notify, causing systemd to kill the service

BUG-9: Disable WatchdogSec in patch-manager-worker.service
  - Same issue as BUG-8, worker does not implement sd_notify

Previous fixes (BUG-1 through BUG-5) also included:
  - setup.sh: PostgreSQL 15+ schema GRANTs
  - Axum route syntax :param → {param} (19 routes)
  - DbUser struct role: String → UserRole enum mapping
  - UserRole/AuthProvider Display trait implementations
  - Seed admin password hash (Argon2id)
This commit is contained in:
Echo
2026-04-28 23:01:03 +00:00
parent 2e4a8768cf
commit 83c97aa2b1
19 changed files with 297 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
crates/pm-auth/src/session.rs
View File

@ -5,6 +5,7 @@
//! Force logout: revoke all tokens for a user
use chrono::Utc;
use pm_core::models::{AuthProvider, UserRole};
use serde::{Deserialize, Serialize};
use sqlx::PgPool;
use thiserror::Error;
@ -68,8 +69,8 @@ struct DbUser {
id: Uuid,
username: String,
display_name: String,
role: String,
auth_provider: String,
role: UserRole,
auth_provider: AuthProvider,
password_hash: Option<String>,
totp_secret: Option<String>,
mfa_enabled: bool,
@ -157,7 +158,7 @@ pub async fn login(
let access_token = jwt::issue_access_token(
user.id,
&user.username,
&user.role,
&user.role.to_string(),
access_ttl_secs,
signing_key_pem,
)?;
@ -182,7 +183,7 @@ pub async fn login(
id: user.id.to_string(),
username: user.username,
display_name: user.display_name,
role: user.role,
role: user.role.to_string(),
mfa_enabled: user.mfa_enabled,
},
})
@ -223,7 +224,7 @@ pub async fn refresh_session(
let access_token = jwt::issue_access_token(
user.id,
&user.username,
&user.role,
&user.role.to_string(),
access_ttl_secs,
signing_key_pem,
)?;
@ -237,7 +238,7 @@ pub async fn refresh_session(
id: user.id.to_string(),
username: user.username,
display_name: user.display_name,
role: user.role,
role: user.role.to_string(),
mfa_enabled: user.mfa_enabled,
},
})