Commit Graph

16 Commits

Author SHA1 Message Date
cproudlock
be78e45320 Rework the first-run setup wizard around what a site cannot run without
The wizard configured five of the product's 129 settings. A site that finished
it still had no timezone, no authentication, no mail server, no backup
destination and no endpoint agent policy, and nothing told the operator so.

Six steps now: Administrator, Site, Authentication, Features, Mail and Backups,
Review. Everything else moves to a standing setup checklist at
/settings/setupchecklist, because a wizard that asked for all 129 settings would
be worse than one that asked for none.

Two new endpoints back it. /setup/checklist reports twelve areas as
ok/partial/todo/na with a link to the page that fixes each, and /setup/health
reports account counts plus whether a plugin toggle has reached every worker.
Both take care not to lie:

- Several settings are SEEDED non-empty (the shipped logo, a placeholder floor
  plan, every identifier field), so "is it set" compares against the shipped
  default rather than emptiness.
- plugin.endpoints.sharedkeyallowed DEFAULTS TO ALLOWED when its row is absent,
  so an absent row is reported as the fleet-wide key being accepted. Reporting
  it as refused told an admin the opposite of the truth about the credential
  they are migrating away from.
- A plugin is held at "starting" until several DISTINCT workers report it live.
  Counting replies instead let one recycled worker answer four times and declare
  a change complete while other workers still served the old routes.

Recommended plugins are declared in each plugin's manifest rather than listed in
the wizard, so adding a plugin cannot leave a stale list in another file.

Also fixed: the logo preview was invisible, because the image borrowed a class
that hardcodes a white background while the shipped logo is white; and signing
in did not re-read setup state, so an admin already browsing was never steered
to the wizard and a hard refresh was the only cure.

(cherry picked from commit 32d3f4b29d)
2026-09-20 12:41:57 -04:00
Proudlock
397c02611a security: fix admin bootstrap race and KB article disclosure
Address two security findings from darkwing scan:

Finding 1 [High]: Unauthenticated admin bootstrap race
- Require SETUP_TOKEN header or loopback origin for POST /api/setup/create-admin
- Enforce 12-character minimum password for bootstrap admin
- Cross-check setup_complete setting to prevent re-arming
- Log token to container logs on first startup for operator retrieval
- Add flask seed show-setup-token CLI helper
- Add audit log entry when first admin is created
- Preserve existing flask seed admin workflow (uses loopback)

Finding 2 [Medium]: Unauthenticated KB article disclosure
- Gate POST /api/knowledgebase/<id>/click on kb.view permission
- Remove linkurl from response (caller already has it from GET)
- Apply _visible_articles() filter to respect retired applications
- Prevent anonymous link enumeration and counter manipulation

Recovery paths if token is lost:
1. docker logs shopdb-api | grep "Setup token"
2. docker exec shopdb-api flask seed show-setup-token
3. docker exec shopdb-api flask seed admin (unchanged, always works)

Zero breaking changes. CLI and existing workflows unaffected.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-09-07 03:37:22 -04:00
ff9ae693a6 Remediate the 2026-09-03 feature-test findings 2026-09-03 17:14:53 -04:00
e8f1de811f nav items declare their permission 2026-08-27 14:51:04 -04:00
0c1fbfcc1e read permissions on every GET 2026-08-27 14:26:17 -04:00
4da6c6aa36 guest role; guide section ticking 2026-08-27 13:02:35 -04:00
4e38303326 Tab titles name the record; Guides reach a site and the contract surface 2026-08-26 13:31:13 -04:00
04107ff8ab Search spelling suggestions across every list 2026-08-21 11:15:06 -04:00
980b2e8be3 Find a knowledge base article by words from different fields 2026-08-21 09:40:14 -04:00
ece0e15f03 Page past the 100-row cap in pickers and batch label sheets 2026-08-17 14:17:28 -04:00
fbd99041b0 Buildings and levels for the floor map, and make every identifier searchable 2026-08-17 13:03:54 -04:00
d32513727b Tech Tools section with a code generator, toner report that names the part, toner forecasting, warranty proof of cover, application uploads 2026-08-12 11:51:38 -04:00
9c530a70db Filter pagination reset; catalog model retype tool 2026-08-05 11:26:40 -04:00
9cf026e31a kb topic search + client-ip port strip + application notes html 2026-07-29 10:09:02 -04:00
d1592b84c7 ADR-013 Phase 4: all 13 plugin frontends relocated + staging machinery 2026-07-18 23:56:32 -04:00
a9d0dfff4a Initial import: shopdb-flask multi-site asset platform
Flask + Vue rewrite of the classic-ASP shopdb, built as a plugin
framework so sister GE Aerospace sites can adopt it. Product version
0.7.0-pre-0.8.0, plugin contract 0.11.0, 966 backend tests.

Key entry points:
- docs/INSTALL-WINDOWS-IIS.md - tested Windows + IIS install runbook
  (own-site and subpath deployment methods)
- docs/PILOT-DEPLOY.md - production pilot: stand up + import + verify
- docs/IMPORT-API.md - schema-agnostic legacy data import contract
- scripts/site_imports/wjf/ - West Jefferson reference import loader
- docs/adr/ - twelve accepted architecture decision records
2026-07-14 07:58:51 -04:00