066a19052b
Findings F2, F4, F5, F6, F7, F8, F9, F10, F11 and F13 from wj-architectural-review.md. F1/F1a (the non-sargable LOWER pattern) and F3 (the warranty sync holding a pooled connection) are being handled separately and are untouched here. - A collector check-in that raced another for the same PC lost everything: the unique index on the application fingerprint raised, nothing caught it, and the whole check-in rolled back, discarding state, events and hardware, answering the agent with form copy meant for a person. The insert now runs in a savepoint, reconciles what the other transaction already wrote, one row per savepoint so a second collision skips a row rather than the batch, and the check-in commits with a warning. This is the shape the delete side of the same function already had. - Enrollment is deliberately unauthenticated, so it now carries a per-address rate limit and a cap on pending requests, and the cap is a setting an admin can see and change. A flood can no longer bury the approval queue or grow the table without bound. - The fleet alert poll no longer formats debug strings on every request. - BusinessUnit is on the contract surface (0.34.0), so the endpoints plugin stops reaching into a core table with raw SQL. - A test walks every asset type descriptor and proves the endpoint it names really refuses a caller without the declared permission. - The plugin settings routes now need a permission; they were telling anyone which modules a site runs and where its components live. - The connection pool is sized explicitly with a short timeout, and the arithmetic against the server's connection ceiling is written next to the worker count instead of being left to defaults nobody chose. - Fleet alerts carry both the correct lowercase keys and the old camelCase pair. Trays older than 1.7.0 match keys case-sensitively and would have gone quiet on every PC not yet upgraded; the old pair goes when they are. - The dev server proxy points at localhost again, with environment variables for the remote-box workflow, and one developer's address is out of the server certificate page.
41 lines
1.3 KiB
JavaScript
41 lines
1.3 KiB
JavaScript
import { defineConfig } from 'vite'
|
|
import vue from '@vitejs/plugin-vue'
|
|
import path from 'path'
|
|
|
|
// Dev proxy target for /api and /static. Default is the local Flask dev server.
|
|
// To develop against a backend on another box, set it per shell, never here:
|
|
// VITE_DEV_API_TARGET=https://10.0.0.5:5001 npm run dev
|
|
// Certificates on such a box are usually self-signed, so verification is off by
|
|
// default; VITE_DEV_SECURE=true turns it back on for an https target.
|
|
const devApiTarget = process.env.VITE_DEV_API_TARGET || 'http://localhost:5001'
|
|
const devApiSecure = devApiTarget.startsWith('https:')
|
|
&& process.env.VITE_DEV_SECURE === 'true'
|
|
|
|
const devProxy = {
|
|
target: devApiTarget,
|
|
changeOrigin: true,
|
|
secure: devApiSecure
|
|
}
|
|
|
|
export default defineConfig({
|
|
// Mount path of the built app. Default '/' (own IIS site / dev). Set
|
|
// VITE_BASE_PATH='/ops/' (trailing slash) to build for a subpath mount under
|
|
// Default Web Site, e.g. `VITE_BASE_PATH=/ops/ npm run build`.
|
|
base: process.env.VITE_BASE_PATH || '/',
|
|
plugins: [vue()],
|
|
resolve: {
|
|
alias: {
|
|
'@': path.resolve(__dirname, './src')
|
|
}
|
|
},
|
|
server: {
|
|
// all interfaces, so a VM or phone on the LAN can load the dev server
|
|
host: true,
|
|
port: 5173,
|
|
proxy: {
|
|
'/api': { ...devProxy },
|
|
'/static': { ...devProxy }
|
|
}
|
|
}
|
|
})
|