From 90cd85b268ed63f2394b54dfba22d6b3bb025efb Mon Sep 17 00:00:00 2001
From: Cam Proudlock <cam.proudlock@gmail.com>
Date: Mon, 27 Jul 2026 14:44:26 -0400
Subject: [PATCH] geenforce: settings in the Settings rail

---
 plugins/geenforce/frontend/routes.js               | 14 ++++++++------
 .../geenforce/frontend/views/GeEnforceLayout.vue   |  1 -
 plugins/geenforce/plugin.py                        | 13 +++++++++++++
 3 files changed, 21 insertions(+), 7 deletions(-)

diff --git a/plugins/geenforce/frontend/routes.js b/plugins/geenforce/frontend/routes.js
index 52c575ec..2c18f0d6 100644
--- a/plugins/geenforce/frontend/routes.js
+++ b/plugins/geenforce/frontend/routes.js
@@ -24,13 +24,15 @@ export default [
         name: 'geenforce-reports',
         component: () => import('./views/EnforcementReports.vue'),
         meta: { requiresAuth: true, requiresAdmin: true, plugin: 'geenforce' }
-      },
-      {
-        path: 'settings',
-        name: 'geenforce-settings',
-        component: () => import('./views/GeEnforceSettings.vue'),
-        meta: { requiresAuth: true, requiresAdmin: true, plugin: 'geenforce' }
       }
     ]
+  },
+  {
+    // Config lives in the Settings rail (contributed via get_settings_cards),
+    // not inside the GE-Enforce section tabs.
+    path: 'settings/geenforce',
+    name: 'settings-geenforce',
+    component: () => import('./views/GeEnforceSettings.vue'),
+    meta: { requiresAuth: true, requiresAdmin: true, plugin: 'geenforce' }
   }
 ]
diff --git a/plugins/geenforce/frontend/views/GeEnforceLayout.vue b/plugins/geenforce/frontend/views/GeEnforceLayout.vue
index c06db073..b5c74af8 100644
--- a/plugins/geenforce/frontend/views/GeEnforceLayout.vue
+++ b/plugins/geenforce/frontend/views/GeEnforceLayout.vue
@@ -7,7 +7,6 @@
     <nav class="section-tabs">
       <router-link to="/geenforce/manifests" class="tab">Manifests</router-link>
       <router-link to="/geenforce/reports" class="tab">Enforcement Reports</router-link>
-      <router-link to="/geenforce/settings" class="tab">Settings</router-link>
     </nav>
     <router-view />
   </div>
diff --git a/plugins/geenforce/plugin.py b/plugins/geenforce/plugin.py
index 105afaf3..8d7372fb 100644
--- a/plugins/geenforce/plugin.py
+++ b/plugins/geenforce/plugin.py
@@ -91,6 +91,19 @@ class GeEnforcePlugin(BasePlugin):
             },
         ]
 
+    def get_settings_cards(self) -> List[Dict]:
+        """Admin config for GE-Enforce lives in the Settings rail."""
+        return [
+            {
+                'group': 'GE-Enforce',
+                'to': '/settings/geenforce',
+                'icon': 'shield',
+                'title': 'GE-Enforce Settings',
+                'description': 'Client IP allowlist for token-less fleet access',
+                'position': 46,
+            },
+        ]
+
     def init_app(self, app: Flask, db_instance) -> None:
         logger.info(f"GE-Enforce plugin initialized (v{self.meta.version})")