170 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Echo	2cc3d0db40	chore: bump version to 0.1.9 for rate limiting fix release	2026-05-21 02:38:29 +00:00
Echo	59794bc8f2	fix: replace broken DashMap rate limiting with tower-governor middleware ... - Replace custom DashMap<IpAddr, Instant> rate limiting in enrollment.rs that fell back to 0.0.0.0 when X-Forwarded-For was missing, causing ALL enrollment traffic to share a single global rate limit bucket - Use tower_governor with SmartIpKeyExtractor for proper per-IP rate limiting that respects X-Forwarded-For headers (critical behind HAProxy) - Add three configurable rate limit tiers via config.toml: * Enrollment: 5 req/min per IP, burst 3 (strict) * Auth: 20 req/min per IP, burst 10 (moderate) * API: 120 req/min per IP, burst 30 (normal) - Remove enrollment_rate_limits from AppState and cleanup task - Remove manual rate limit code from enrollment.rs (headers param, IP extraction) - Add into_make_service_with_connect_info for ConnectInfo fallback - Add RateLimitConfig to AppConfig with sensible defaults Fixes: #1	2026-05-21 02:27:10 +00:00
Echo	6c72dc3ac6	feat: populate os_family, os_name, arch, agent_version from health poller and enrollment ... - health_poller: persist agent_version from HealthData.version - health_poller: call /system/info to update os_family, os_name, arch - enrollment: set os_family and arch from os_details during approval - enrollment: build os_name from os+os_version when name field absent - COALESCE in UPDATE preserves existing values when new data unavailable - version bump 0.1.7 -> 0.1.8	2026-05-21 00:09:57 +00:00
Echo	f70c5e53f9	feat: add host editing endpoint and frontend UI	2026-05-18 21:52:00 +00:00
Echo	b3ae42215b	fix(ca): strip CIDR netmask from IP before adding to server cert SANs	2026-05-18 16:19:39 +00:00
Echo	d326b25203	fix(ca): make CA path configurable and prevent encrypted keys ... - main.rs: use config.security.ca_cert_path parent directory instead of hardcoded /etc/patch-manager/ca for CA initialization. - config.example.toml: add warning that CA key must be unencrypted PEM. - This prevents silent generation of a second CA on fresh installs and ensures the manager always uses the configured CA.	2026-05-18 15:58:38 +00:00
Echo	aabaa3a0d4	fix: reorder host insert before cert issuance, add migration for missing columns	2026-05-18 13:18:44 +00:00
Echo	005718c38a	fix: cast ip_address to inet in enrollment approval collision check and host insert	2026-05-18 01:42:23 +00:00
Echo	2c7432f2ec	fix: cast ip_address to inet on insert and to text on read for enrollment_requests	2026-05-18 01:31:20 +00:00
Echo	545277add2	fix: cast ip_address to inet type in enrollment INSERT query	2026-05-18 01:29:24 +00:00
Echo	6046dd199c	fix: rustfmt formatting for tracing::warn! macro in enrollment.rs v0.1.7	2026-05-18 00:35:45 +00:00
Echo	024e800708	fix: remove ConnectInfo extractor to fix public endpoint 500 error	2026-05-17 23:01:01 +00:00
Echo	3aff64afb7	docs: add REST API reference and update README version to v0.1.7	2026-05-16 19:14:08 +00:00
Echo	fe56959d88	fix: separate revoked certs from active pairs in CertificatesPage	2026-05-16 18:21:35 +00:00
Echo	6e2c270c75	feat: group certificate pairs in CertificatesPage	2026-05-16 18:07:09 +00:00
Echo	f9bdc0a5af	fix: update axum route syntax to v0.8 standard	2026-05-16 17:39:21 +00:00
Echo	da3dffd81f	feat: add host self-enrollment workflow v0.1.7	2026-05-16 17:03:28 +00:00
Echo	f183c8edf8	fix: bump lettre to 0.11.22 in Cargo.lock (RUSTSEC-2026-0141)	2026-05-16 00:57:44 +00:00
Echo	98a900b0ea	security: upgrade lettre to 0.11.22 (RUSTSEC-2026-0141)	2026-05-15 22:51:28 +00:00
Echo	4072ae1ba2	Bump version to 0.1.6 for Phase 4 release	2026-05-15 22:14:14 +00:00
Echo	7b067b2813	Phase 4: Exhaustive analysis fixes, security hardening, and code quality improvements	2026-05-15 22:10:05 +00:00
Echo	4593458c5a	fix: reporter role save - add case-insensitive role mapping in create_user and update_user	2026-05-14 20:06:34 +00:00
Echo	b36452f4d5	feat: add reporter role to user management dropdowns	2026-05-14 02:42:58 +00:00
Echo	3878bd4952	feat: add reporter role for SSO auto-provisioning	2026-05-14 02:23:18 +00:00
Echo	d58fa2befa	fix: add Keycloak and Oidc variants to AuthProvider enum	2026-05-13 20:34:56 +00:00
Echo	22e9c2819a	fix: cast user_role and auth_provider enum types in SSO callback SQL queries	2026-05-13 19:35:04 +00:00
Echo	31cdeda724	fix: cast auth_provider text to enum type in SSO callback SQL queries	2026-05-13 19:16:49 +00:00
Echo	83a0c29f3d	fix: handle SSO email collision by linking existing local users ... When a user already exists with auth_provider=local and the same email, the SSO callback now links the existing user to the new SSO provider instead of failing with a unique constraint violation on email. Flow: 1) Try exact match (email+auth_provider), 2) If not found, try email-only lookup, 3) If found with different provider, link by updating auth_provider, azure_oid, oidc_sub, 4) If not found, create new user as before.	2026-05-13 18:23:32 +00:00
Echo	d76450759a	fix: add public SSO config endpoint for login page ... The SSO button on the login page was not appearing because the settings API requires authentication, but the login page cannot authenticate before the user logs in. Changes: - Backend: Add GET /api/v1/auth/sso/config public endpoint that returns only enabled, display_name, and auth_url (no secrets exposed) - Backend: Mount sso::public_router() at /api/v1/auth/sso in main.rs (was previously missing - only azure_compat_router was mounted) - Frontend: Replace settingsApi.get() call in LoginPage.tsx with ssoConfigApi.get() which calls the public endpoint - Frontend: Add SsoConfigResponse interface and ssoConfigApi helper to client.ts - Frontend: Use auth_url from config response instead of hardcoded path	2026-05-13 14:53:12 +00:00
Echo	69d2e88bbd	feat: OIDC SSO provider support (Keycloak, Azure AD, custom) ... - Refactored azure_sso.rs to sso.rs with generic OIDC provider support - Added OIDC discovery URL lookup with 1hr TTL caching - Added PKCE for all providers, client_secret optional for public clients - Added /api/v1/auth/sso/login and /api/v1/auth/sso/callback routes - Added /api/v1/auth/azure/* backward-compatible routes - Added POST /settings/sso/discover and POST /settings/sso/test endpoints - Frontend: Provider dropdown (Keycloak/Azure AD/Custom OIDC) - Frontend: Auto-fill discovery URL for Keycloak - Frontend: Discover Endpoints and Test Connection buttons - Frontend: Dynamic SSO button based on provider display name - Made migration 014 idempotent with DO blocks and IF NOT EXISTS - Fixed debian/install to use /usr/local/bin/ for binaries - Fixed frontend file path in .deb package - Reset admin password on dev server - Fixed database permissions for oidc_config table	2026-05-13 13:32:24 +00:00
Echo	e3d8569b05	feat: include notification recipients in SMTP test email	2026-05-13 00:33:41 +00:00
Echo	3b3fd8b689	fix: remove duplicate audit integrity section and consolidate email settings into SMTP	2026-05-13 00:16:20 +00:00
Echo	c8b6b01dbc	fix: resolve settings save failure - boolean type mismatch and improve error messages	2026-05-13 00:07:46 +00:00
Echo	c8b1feee19	fix: make version display dynamic from package.json instead of hardcoded	2026-05-12 23:49:14 +00:00
Echo	010d384c6a	fix: add libfontconfig1-dev to CI workflow for fontconfig build dependency	2026-05-12 23:29:28 +00:00
Echo	1426ecffc2	chore: bump version to 0.1.4	2026-05-12 23:23:43 +00:00
Echo	04abb59961	fix: clarify SMTP vs email notification UX and save-before-test	2026-05-12 23:17:47 +00:00
Echo	9352dc8a02	fix: add libfontconfig1 dependency for plotters TTF font support	2026-05-12 21:25:39 +00:00
Echo	4b5a252fc9	fix: enable plotters TTF font support to prevent PDF chart panics	2026-05-12 21:18:13 +00:00
Echo	65847c6c90	fix: use FontFamily enum for plotters chart captions to prevent font panic	2026-05-12 21:06:49 +00:00
Echo	4c91e02e58	fix: cast compliance_pct to float8 and fix PDF generation crashes	2026-05-12 20:59:21 +00:00
Echo	a1852fd55a	fix: cast compliance_pct to numeric for PostgreSQL ROUND()	2026-05-12 20:10:21 +00:00
Echo	2bbc03b937	fix: resolve 6 reporting issues - SQL schema mismatches, duplicate type, UI dropdown, chart scale, CSV error handling ... 1. Compliance CSV/PDF: Replace non-existent pd.total_packages with jsonb_array_length(pd.installed_packages) and pd.pending_patches with pd.patch_count. Fix GROUP BY to match new columns. 2. Vulnerability CSV/PDF: Replace non-existent pd.cve_data with jsonb_array_elements on pd.available_patches JSONB, extracting cve_ids via nested lateral join. Replace pd.updated_at with pd.polled_at (actual column name). 3. TypeScript: Remove duplicate PollingConfig interface declaration in frontend/src/types/index.ts. 4. ReportsPage: Replace Group ID text field with Select dropdown populated from GET /api/v1/groups, showing group names instead of requiring UUID input. 5. PDF charts: Increase embed_image scale from 0.18 to 0.28 for better visibility on A4 landscape pages. 6. Vulnerability CSV: Remove invalid (no data) comment row on query failure; return header-only CSV instead to maintain valid CSV format.	2026-05-12 19:59:03 +00:00
Echo	4c300087f2	fix: Update build-package.sh VERSION to 0.1.3	2026-05-12 17:40:09 +00:00
Echo	13cabcea77	fix: Replace console.log with console.warn in MfaSetupPage for ESLint	2026-05-12 17:26:49 +00:00
Echo	f04565ead7	style: cargo fmt --all for v0.1.3 SSO changes	2026-05-12 17:14:48 +00:00
Echo	0fb804eefb	fix: Merge duplicate @mui/icons-material import in LoginPage	2026-05-12 17:05:48 +00:00
Echo	86a6c714d4	feat: Complete Azure SSO implementation (v0.1.3) ... - Add SSO session cleanup task (10-min expiry, 60s purge interval) - Change callback to redirect to frontend with tokens as query params - Add sso_callback_url to SecurityConfig with serde default - Add SsoCallbackPage.tsx for handling SSO callback redirects - Add /auth/sso/callback public route to App.tsx - Add Sign in with Microsoft Azure button to LoginPage - Replace insecure decode_jwt_payload with verify_id_token - Implement JWKS caching (1-hour TTL) and RSA signature verification - Validate iss, aud, exp claims on id_token - Add jsonwebtoken dependency to pm-web crate - Update config.example.toml with sso_callback_url setting - Add sso_callback_url to settings response (read-only from TOML)	2026-05-12 17:01:20 +00:00
Echo	08add28b80	fix: eslint-disable for useEffect deps in UsersPage	2026-05-07 19:14:21 +00:00
Echo	cc1214a963	feat: Phase 4 - password validation, force password reset flow, account lockout, QR code for MFA	2026-05-07 17:53:16 +00:00