Implement security overhaul: remove seal/legacy system, add Security modal and random passwords
Agent-Logs-Url: https://github.com/naturallaw777/staging_alpha/sessions/6e7593c4-f741-4ddc-9bce-8c558a4af014 Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
committed by
GitHub
GitHub
parent
477d265de8
commit
2fae4ccc79
@@ -1,3 +1,270 @@
|
||||
/* ── Security Modal sections ──────────────────────────────────────── */
|
||||
|
||||
.security-section {
|
||||
padding: 0 0 8px 0;
|
||||
}
|
||||
|
||||
.security-section-title {
|
||||
font-size: 1rem;
|
||||
font-weight: 700;
|
||||
color: var(--text-primary);
|
||||
margin: 0 0 10px 0;
|
||||
}
|
||||
|
||||
.security-section-desc {
|
||||
font-size: 0.85rem;
|
||||
color: var(--text-secondary);
|
||||
line-height: 1.6;
|
||||
margin-bottom: 10px;
|
||||
}
|
||||
|
||||
.security-divider {
|
||||
border: none;
|
||||
border-top: 1px solid var(--border-color);
|
||||
margin: 18px 0;
|
||||
}
|
||||
|
||||
/* ── Security Reset warning box ──────────────────────────────────── */
|
||||
|
||||
.security-warning-box {
|
||||
background-color: rgba(180, 40, 40, 0.10);
|
||||
border-left: 3px solid #c94040;
|
||||
border-radius: 6px;
|
||||
padding: 12px 14px;
|
||||
margin-bottom: 14px;
|
||||
}
|
||||
|
||||
.security-warning-text {
|
||||
font-size: 0.85rem;
|
||||
color: var(--text-primary);
|
||||
margin: 0 0 8px 0;
|
||||
line-height: 1.5;
|
||||
}
|
||||
|
||||
.security-warning-list {
|
||||
margin: 6px 0 6px 20px;
|
||||
padding: 0;
|
||||
font-size: 0.82rem;
|
||||
color: var(--text-secondary);
|
||||
line-height: 1.7;
|
||||
}
|
||||
|
||||
.security-erase-group {
|
||||
margin-bottom: 14px;
|
||||
}
|
||||
|
||||
.security-erase-label {
|
||||
display: block;
|
||||
font-size: 0.85rem;
|
||||
color: var(--text-primary);
|
||||
margin-bottom: 6px;
|
||||
}
|
||||
|
||||
.security-erase-input {
|
||||
width: 100%;
|
||||
padding: 8px 10px;
|
||||
border: 1px solid var(--border-color);
|
||||
border-radius: 6px;
|
||||
background: var(--input-bg, var(--card-color));
|
||||
color: var(--text-primary);
|
||||
font-size: 0.9rem;
|
||||
box-sizing: border-box;
|
||||
}
|
||||
|
||||
.security-reset-actions {
|
||||
display: flex;
|
||||
gap: 10px;
|
||||
flex-wrap: wrap;
|
||||
}
|
||||
|
||||
.btn-danger {
|
||||
background-color: #c94040;
|
||||
color: #fff;
|
||||
border: none;
|
||||
border-radius: 6px;
|
||||
padding: 8px 18px;
|
||||
font-size: 0.88rem;
|
||||
font-weight: 600;
|
||||
cursor: pointer;
|
||||
transition: background-color 0.15s;
|
||||
}
|
||||
|
||||
.btn-danger:hover:not(:disabled) {
|
||||
background-color: #a83030;
|
||||
}
|
||||
|
||||
.btn-danger:disabled {
|
||||
opacity: 0.5;
|
||||
cursor: not-allowed;
|
||||
}
|
||||
|
||||
.security-status-msg {
|
||||
font-size: 0.83rem;
|
||||
margin-top: 10px;
|
||||
min-height: 1.2em;
|
||||
}
|
||||
|
||||
.security-status-info { color: var(--text-secondary); }
|
||||
.security-status-ok { color: #2ec27e; }
|
||||
.security-status-error { color: #e05252; }
|
||||
|
||||
/* ── Verify System Integrity ─────────────────────────────────────── */
|
||||
|
||||
.security-verify-list {
|
||||
margin: 8px 0 10px 20px;
|
||||
padding: 0;
|
||||
font-size: 0.84rem;
|
||||
color: var(--text-secondary);
|
||||
line-height: 1.7;
|
||||
}
|
||||
|
||||
.security-verify-loading {
|
||||
font-size: 0.85rem;
|
||||
color: var(--text-secondary);
|
||||
}
|
||||
|
||||
.security-verify-result-card {
|
||||
background: var(--card-color);
|
||||
border: 1px solid var(--border-color);
|
||||
border-radius: 8px;
|
||||
padding: 14px 16px;
|
||||
display: flex;
|
||||
flex-direction: column;
|
||||
gap: 12px;
|
||||
}
|
||||
|
||||
.security-verify-row {
|
||||
display: flex;
|
||||
align-items: center;
|
||||
gap: 10px;
|
||||
flex-wrap: wrap;
|
||||
}
|
||||
|
||||
.security-verify-label {
|
||||
font-size: 0.82rem;
|
||||
color: var(--text-secondary);
|
||||
min-width: 130px;
|
||||
font-weight: 600;
|
||||
}
|
||||
|
||||
.security-verify-value {
|
||||
font-size: 0.82rem;
|
||||
color: var(--text-primary);
|
||||
}
|
||||
|
||||
.security-verify-mono {
|
||||
font-family: monospace;
|
||||
font-size: 0.78rem;
|
||||
word-break: break-all;
|
||||
}
|
||||
|
||||
.security-verify-link {
|
||||
font-size: 0.78rem;
|
||||
color: var(--accent-color, #2ec27e);
|
||||
text-decoration: none;
|
||||
}
|
||||
|
||||
.security-verify-link:hover { text-decoration: underline; }
|
||||
|
||||
.security-verify-badge {
|
||||
font-size: 0.82rem;
|
||||
font-weight: 700;
|
||||
padding: 2px 10px;
|
||||
border-radius: 12px;
|
||||
}
|
||||
|
||||
.security-verify-pass {
|
||||
background-color: rgba(46, 194, 126, 0.15);
|
||||
color: #2ec27e;
|
||||
}
|
||||
|
||||
.security-verify-fail {
|
||||
background-color: rgba(224, 82, 82, 0.15);
|
||||
color: #e05252;
|
||||
}
|
||||
|
||||
.security-verify-errors {
|
||||
font-size: 0.8rem;
|
||||
color: var(--text-secondary);
|
||||
}
|
||||
|
||||
.security-verify-pre {
|
||||
white-space: pre-wrap;
|
||||
word-break: break-all;
|
||||
font-size: 0.75rem;
|
||||
background: var(--card-color);
|
||||
border: 1px solid var(--border-color);
|
||||
border-radius: 4px;
|
||||
padding: 8px;
|
||||
margin-top: 6px;
|
||||
max-height: 150px;
|
||||
overflow-y: auto;
|
||||
}
|
||||
|
||||
.security-verify-path-row {
|
||||
display: flex;
|
||||
gap: 8px;
|
||||
font-size: 0.78rem;
|
||||
align-items: flex-start;
|
||||
flex-wrap: wrap;
|
||||
}
|
||||
|
||||
.security-verify-path-label {
|
||||
font-weight: 600;
|
||||
color: var(--text-secondary);
|
||||
min-width: 70px;
|
||||
}
|
||||
|
||||
/* ── First-login security banner ─────────────────────────────────── */
|
||||
|
||||
.security-first-login-banner {
|
||||
display: flex;
|
||||
align-items: center;
|
||||
justify-content: space-between;
|
||||
gap: 12px;
|
||||
padding: 12px 18px;
|
||||
background-color: rgba(46, 100, 194, 0.12);
|
||||
border-bottom: 2px solid rgba(46, 100, 194, 0.35);
|
||||
color: var(--text-primary);
|
||||
}
|
||||
|
||||
.security-banner-content {
|
||||
display: flex;
|
||||
align-items: flex-start;
|
||||
gap: 10px;
|
||||
flex: 1;
|
||||
min-width: 0;
|
||||
}
|
||||
|
||||
.security-banner-icon {
|
||||
font-size: 1.2rem;
|
||||
flex-shrink: 0;
|
||||
margin-top: 1px;
|
||||
}
|
||||
|
||||
.security-banner-text {
|
||||
font-size: 0.85rem;
|
||||
line-height: 1.5;
|
||||
color: var(--text-primary);
|
||||
}
|
||||
|
||||
.security-banner-dismiss {
|
||||
background: none;
|
||||
border: 1px solid var(--border-color);
|
||||
border-radius: 4px;
|
||||
cursor: pointer;
|
||||
font-size: 0.9rem;
|
||||
color: var(--text-secondary);
|
||||
padding: 2px 7px;
|
||||
flex-shrink: 0;
|
||||
line-height: 1.4;
|
||||
transition: background-color 0.15s;
|
||||
}
|
||||
|
||||
.security-banner-dismiss:hover {
|
||||
background-color: rgba(0,0,0,0.08);
|
||||
}
|
||||
|
||||
/* ── Legacy security inline warning banner ───────────────────────── */
|
||||
|
||||
.security-inline-banner {
|
||||
|
||||
@@ -70,6 +70,47 @@ async function doUpgradeToServer() {
|
||||
|
||||
if ($upgradeConfirmBtn) $upgradeConfirmBtn.addEventListener("click", doUpgradeToServer);
|
||||
|
||||
// ── First-login security banner ───────────────────────────────────
|
||||
|
||||
function showSecurityBanner() {
|
||||
var existing = document.getElementById("security-first-login-banner");
|
||||
if (existing) return;
|
||||
|
||||
var banner = document.createElement("div");
|
||||
banner.id = "security-first-login-banner";
|
||||
banner.className = "security-first-login-banner";
|
||||
banner.innerHTML =
|
||||
'<div class="security-banner-content">' +
|
||||
'<span class="security-banner-icon">\uD83D\uDEE1</span>' +
|
||||
'<span class="security-banner-text">' +
|
||||
'<strong>Did someone else set up this machine?</strong> ' +
|
||||
'If this computer was pre-configured by another person, go to ' +
|
||||
'<strong>Menu \u2192 Security</strong> to reset all passwords and keys. ' +
|
||||
'This ensures only you have access.' +
|
||||
'</span>' +
|
||||
'</div>' +
|
||||
'<button class="security-banner-dismiss" id="security-banner-dismiss-btn" title="Dismiss">\u2715</button>';
|
||||
|
||||
var mainContent = document.querySelector(".main-content");
|
||||
if (mainContent) {
|
||||
mainContent.insertAdjacentElement("beforebegin", banner);
|
||||
} else {
|
||||
document.body.insertAdjacentElement("afterbegin", banner);
|
||||
}
|
||||
|
||||
var dismissBtn = document.getElementById("security-banner-dismiss-btn");
|
||||
if (dismissBtn) {
|
||||
dismissBtn.addEventListener("click", async function() {
|
||||
banner.remove();
|
||||
try {
|
||||
await apiFetch("/api/security/banner-dismiss", { method: "POST" });
|
||||
} catch (_) {
|
||||
// Non-fatal
|
||||
}
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
// ── Init ──────────────────────────────────────────────────────────
|
||||
|
||||
async function init() {
|
||||
@@ -84,8 +125,16 @@ async function init() {
|
||||
// If we can't reach the endpoint, continue to normal dashboard
|
||||
}
|
||||
|
||||
// Check for legacy machine security warning
|
||||
await checkLegacySecurity();
|
||||
// Show first-login security banner only for machines that went through onboarding
|
||||
// (legacy machines without the onboarding flag will never see this)
|
||||
try {
|
||||
var bannerData = await apiFetch("/api/security/banner-status");
|
||||
if (bannerData && bannerData.show) {
|
||||
showSecurityBanner();
|
||||
}
|
||||
} catch (_) {
|
||||
// Non-fatal — silently ignore
|
||||
}
|
||||
|
||||
try {
|
||||
var cfg = await apiFetch("/api/config");
|
||||
|
||||
@@ -599,29 +599,9 @@ function renderAutolaunchToggle(enabled) {
|
||||
var section = document.createElement("div");
|
||||
section.className = "category-section autolaunch-section";
|
||||
|
||||
var securityBanner = "";
|
||||
if (_securityIsLegacy) {
|
||||
var msg = _securityWarningMessage || "Your system may have factory default passwords. Please change your passwords to secure your system.";
|
||||
var linkText, linkAction;
|
||||
if (_securityStatus === "unsealed") {
|
||||
linkText = "Contact Support";
|
||||
linkAction = "openSupportModal(); return false;";
|
||||
} else {
|
||||
linkText = "Change Passwords";
|
||||
linkAction = "openServiceDetailModal('root-password-setup.service', 'System Passwords', 'passwords'); return false;";
|
||||
}
|
||||
securityBanner =
|
||||
'<div class="security-inline-banner">' +
|
||||
'<span class="security-inline-icon">⚠</span>' +
|
||||
'<span class="security-inline-text">' + msg + '</span>' +
|
||||
'<a class="security-inline-link" href="#" onclick="' + linkAction + '">' + linkText + '</a>' +
|
||||
'</div>';
|
||||
}
|
||||
|
||||
section.innerHTML =
|
||||
'<div class="section-header">Preferences</div>' +
|
||||
'<hr class="section-divider" />' +
|
||||
securityBanner +
|
||||
'<div class="feature-card">' +
|
||||
'<div class="feature-card-top">' +
|
||||
'<div class="feature-card-info">' +
|
||||
|
||||
@@ -1,16 +1,201 @@
|
||||
"use strict";
|
||||
|
||||
// ── Legacy security warning ───────────────────────────────────────
|
||||
// ── Security Modal ────────────────────────────────────────────────
|
||||
|
||||
async function checkLegacySecurity() {
|
||||
try {
|
||||
var data = await apiFetch("/api/security/status");
|
||||
if (data && (data.status === "legacy" || data.status === "unsealed")) {
|
||||
_securityIsLegacy = true;
|
||||
_securityStatus = data.status;
|
||||
_securityWarningMessage = data.warning || "This machine may have a security issue. Please review your system security.";
|
||||
function openSecurityModal() {
|
||||
if ($supportModal) $supportModal.classList.add("open");
|
||||
var title = document.getElementById("support-modal-title");
|
||||
if (title) title.textContent = "\uD83D\uDEE1 Security";
|
||||
|
||||
if ($supportBody) {
|
||||
$supportBody.innerHTML =
|
||||
// ── Section A: Security Reset ──────────────────────────────
|
||||
'<div class="security-section">' +
|
||||
'<h3 class="security-section-title">Security Reset</h3>' +
|
||||
'<p class="security-section-desc">' +
|
||||
'Run this if you are using this physical computer for the first time <strong>AND</strong> ' +
|
||||
'it was not set up by you. This will complete the security setup by resetting all passwords ' +
|
||||
'and your Bitcoin Lightning Node\u2019s private keys.' +
|
||||
'</p>' +
|
||||
'<p class="security-section-desc">' +
|
||||
'You can also run this if you wish to reset all your passwords and your Bitcoin Lightning ' +
|
||||
'Node\u2019s private keys. If you have not transferred the Bitcoin out of this node and did ' +
|
||||
'not back up the private keys, <strong>you will lose your Bitcoin.</strong>' +
|
||||
'</p>' +
|
||||
'<button class="btn btn-primary" id="security-reset-open-btn">Proceed with Security Reset</button>' +
|
||||
'<div id="security-reset-confirm" style="display:none;margin-top:16px;">' +
|
||||
'<div class="security-warning-box">' +
|
||||
'<p class="security-warning-text">' +
|
||||
'<strong>\u26A0\uFE0F This will permanently delete:</strong>' +
|
||||
'</p>' +
|
||||
'<ul class="security-warning-list">' +
|
||||
'<li>All generated passwords and SSH keys</li>' +
|
||||
'<li>LND wallet data (seed words, channels, macaroons)</li>' +
|
||||
'<li>Application databases</li>' +
|
||||
'<li>Vaultwarden data</li>' +
|
||||
'</ul>' +
|
||||
'<p class="security-warning-text">You will go through onboarding again. <strong>This cannot be undone.</strong></p>' +
|
||||
'</div>' +
|
||||
'<div class="security-erase-group">' +
|
||||
'<label class="security-erase-label" for="security-erase-input">Type <strong>ERASE</strong> to confirm:</label>' +
|
||||
'<input class="security-erase-input" type="text" id="security-erase-input" autocomplete="off" placeholder="ERASE" />' +
|
||||
'</div>' +
|
||||
'<div class="security-reset-actions">' +
|
||||
'<button class="btn btn-close-modal" id="security-reset-cancel-btn">Cancel</button>' +
|
||||
'<button class="btn btn-danger" id="security-reset-confirm-btn" disabled>Erase & Reset</button>' +
|
||||
'</div>' +
|
||||
'<div id="security-reset-status" class="security-status-msg"></div>' +
|
||||
'</div>' +
|
||||
'</div>' +
|
||||
|
||||
'<hr class="security-divider" />' +
|
||||
|
||||
// ── Section B: Verify System Integrity ────────────────────
|
||||
'<div class="security-section">' +
|
||||
'<h3 class="security-section-title">Verify System Integrity</h3>' +
|
||||
'<p class="security-section-desc">' +
|
||||
'Your Sovran_SystemsOS is built with NixOS \u2014 a system designed for complete transparency ' +
|
||||
'and reproducibility. Every piece of software on this machine is built from publicly auditable ' +
|
||||
'source code and verified using cryptographic hashes.' +
|
||||
'</p>' +
|
||||
'<p class="security-section-desc">This verification confirms three things:</p>' +
|
||||
'<ol class="security-verify-list">' +
|
||||
'<li>' +
|
||||
'<strong>Source Code Match</strong> \u2014 The system configuration on this machine matches ' +
|
||||
'the exact commit published in the public repository. No hidden changes were added.' +
|
||||
'</li>' +
|
||||
'<li>' +
|
||||
'<strong>Binary Integrity</strong> \u2014 Every installed package in the system store is ' +
|
||||
'verified against its expected cryptographic hash. If any binary, library, or config file ' +
|
||||
'was tampered with, it will be detected.' +
|
||||
'</li>' +
|
||||
'<li>' +
|
||||
'<strong>Running System Match</strong> \u2014 The currently running system matches what the ' +
|
||||
'configuration says it should be. No unauthorized modifications are active.' +
|
||||
'</li>' +
|
||||
'</ol>' +
|
||||
'<p class="security-section-desc">' +
|
||||
'In short: if this verification passes, you can be confident that the software running on ' +
|
||||
'your machine is exactly what is published \u2014 nothing more, nothing less.' +
|
||||
'</p>' +
|
||||
'<button class="btn btn-primary" id="security-verify-btn">Verify Now</button>' +
|
||||
'<div id="security-verify-results" style="display:none;margin-top:16px;"></div>' +
|
||||
'</div>';
|
||||
|
||||
// ── Wire Security Reset flow
|
||||
var resetOpenBtn = document.getElementById("security-reset-open-btn");
|
||||
var resetConfirmDiv = document.getElementById("security-reset-confirm");
|
||||
var eraseInput = document.getElementById("security-erase-input");
|
||||
var resetConfirmBtn = document.getElementById("security-reset-confirm-btn");
|
||||
var resetCancelBtn = document.getElementById("security-reset-cancel-btn");
|
||||
var resetStatus = document.getElementById("security-reset-status");
|
||||
|
||||
if (resetOpenBtn) {
|
||||
resetOpenBtn.addEventListener("click", function() {
|
||||
resetOpenBtn.style.display = "none";
|
||||
if (resetConfirmDiv) resetConfirmDiv.style.display = "";
|
||||
if (eraseInput) eraseInput.focus();
|
||||
});
|
||||
}
|
||||
|
||||
if (eraseInput && resetConfirmBtn) {
|
||||
eraseInput.addEventListener("input", function() {
|
||||
resetConfirmBtn.disabled = eraseInput.value.trim() !== "ERASE";
|
||||
});
|
||||
}
|
||||
|
||||
if (resetCancelBtn) {
|
||||
resetCancelBtn.addEventListener("click", function() {
|
||||
if (resetConfirmDiv) resetConfirmDiv.style.display = "none";
|
||||
if (resetOpenBtn) resetOpenBtn.style.display = "";
|
||||
if (eraseInput) eraseInput.value = "";
|
||||
if (resetConfirmBtn) resetConfirmBtn.disabled = true;
|
||||
if (resetStatus) { resetStatus.textContent = ""; resetStatus.className = "security-status-msg"; }
|
||||
});
|
||||
}
|
||||
|
||||
if (resetConfirmBtn) {
|
||||
resetConfirmBtn.addEventListener("click", async function() {
|
||||
if (!eraseInput || eraseInput.value.trim() !== "ERASE") return;
|
||||
resetConfirmBtn.disabled = true;
|
||||
resetConfirmBtn.textContent = "Erasing\u2026";
|
||||
if (resetStatus) { resetStatus.textContent = "Running security reset\u2026"; resetStatus.className = "security-status-msg security-status-info"; }
|
||||
try {
|
||||
await apiFetch("/api/security/reset", { method: "POST" });
|
||||
if (resetStatus) { resetStatus.textContent = "\u2713 Reset complete. Rebooting\u2026"; resetStatus.className = "security-status-msg security-status-ok"; }
|
||||
if ($rebootOverlay) $rebootOverlay.classList.add("open");
|
||||
} catch (err) {
|
||||
if (resetStatus) { resetStatus.textContent = "\u2717 Error: " + (err.message || "Reset failed."); resetStatus.className = "security-status-msg security-status-error"; }
|
||||
resetConfirmBtn.disabled = false;
|
||||
resetConfirmBtn.textContent = "Erase & Reset";
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
// ── Wire Verify System Integrity
|
||||
var verifyBtn = document.getElementById("security-verify-btn");
|
||||
var verifyResults = document.getElementById("security-verify-results");
|
||||
|
||||
if (verifyBtn && verifyResults) {
|
||||
verifyBtn.addEventListener("click", async function() {
|
||||
verifyBtn.disabled = true;
|
||||
verifyBtn.textContent = "Verifying\u2026";
|
||||
verifyResults.style.display = "";
|
||||
verifyResults.innerHTML = '<p class="security-verify-loading">\u231B Running verification checks\u2026 This may take a few minutes.</p>';
|
||||
|
||||
try {
|
||||
var data = await apiFetch("/api/security/verify-integrity", { method: "POST" });
|
||||
var html = '<div class="security-verify-result-card">';
|
||||
|
||||
// Flake commit
|
||||
html += '<div class="security-verify-row">';
|
||||
html += '<span class="security-verify-label">Source Commit:</span>';
|
||||
html += '<span class="security-verify-value security-verify-mono">' + escHtml(data.flake_commit || "unknown") + '</span>';
|
||||
if (data.repo_url) {
|
||||
html += '<a class="security-verify-link" href="' + escHtml(data.repo_url) + '" target="_blank" rel="noopener noreferrer">View on Gitea \u2197</a>';
|
||||
}
|
||||
html += '</div>';
|
||||
|
||||
// Store verification
|
||||
var storeOk = data.store_verified === true;
|
||||
html += '<div class="security-verify-row">';
|
||||
html += '<span class="security-verify-label">Binary Integrity:</span>';
|
||||
html += '<span class="security-verify-badge ' + (storeOk ? "security-verify-pass" : "security-verify-fail") + '">';
|
||||
html += storeOk ? "\u2705 PASS" : "\u274C FAIL";
|
||||
html += '</span>';
|
||||
html += '</div>';
|
||||
if (!storeOk && data.store_errors && data.store_errors.length > 0) {
|
||||
html += '<details class="security-verify-errors"><summary>Show errors (' + data.store_errors.length + ')</summary>';
|
||||
html += '<pre class="security-verify-pre">' + escHtml(data.store_errors.join("\n")) + '</pre>';
|
||||
html += '</details>';
|
||||
}
|
||||
|
||||
// System match
|
||||
var sysOk = data.system_matches === true;
|
||||
html += '<div class="security-verify-row">';
|
||||
html += '<span class="security-verify-label">Running System Match:</span>';
|
||||
html += '<span class="security-verify-badge ' + (sysOk ? "security-verify-pass" : "security-verify-fail") + '">';
|
||||
html += sysOk ? "\u2705 PASS" : "\u274C FAIL";
|
||||
html += '</span>';
|
||||
html += '</div>';
|
||||
if (!sysOk) {
|
||||
html += '<div class="security-verify-path-row">';
|
||||
html += '<span class="security-verify-path-label">Current:</span><code class="security-verify-mono">' + escHtml(data.current_system_path || "") + '</code>';
|
||||
html += '</div>';
|
||||
html += '<div class="security-verify-path-row">';
|
||||
html += '<span class="security-verify-path-label">Expected:</span><code class="security-verify-mono">' + escHtml(data.expected_system_path || "") + '</code>';
|
||||
html += '</div>';
|
||||
}
|
||||
|
||||
html += '</div>';
|
||||
verifyResults.innerHTML = html;
|
||||
} catch (err) {
|
||||
verifyResults.innerHTML = '<p class="security-status-msg security-status-error">\u274C Verification failed: ' + escHtml(err.message || "Unknown error") + '</p>';
|
||||
}
|
||||
|
||||
verifyBtn.disabled = false;
|
||||
verifyBtn.textContent = "Verify Now";
|
||||
});
|
||||
}
|
||||
} catch (_) {
|
||||
// Non-fatal — silently ignore if the endpoint is unreachable
|
||||
}
|
||||
}
|
||||
|
||||
@@ -612,15 +612,6 @@ function openSystemChangePasswordModal(unit, name, icon) {
|
||||
resultEl.textContent = "✅ System password changed successfully.";
|
||||
submitBtn.textContent = "Change Password";
|
||||
submitBtn.disabled = false;
|
||||
// Hide the legacy security banner if it's visible — but only for
|
||||
// "legacy" status machines. For "unsealed" machines, changing passwords
|
||||
// is not enough; the factory residue remains until a proper re-seal or re-install.
|
||||
if (typeof _securityIsLegacy !== "undefined" && _securityIsLegacy &&
|
||||
(typeof _securityStatus === "undefined" || _securityStatus !== "unsealed")) {
|
||||
_securityIsLegacy = false;
|
||||
var banner = document.querySelector(".security-inline-banner");
|
||||
if (banner) banner.remove();
|
||||
}
|
||||
} catch (err) {
|
||||
resultEl.className = "matrix-form-result error";
|
||||
resultEl.textContent = "❌ " + (err.message || "Failed to change password.");
|
||||
|
||||
@@ -99,10 +99,5 @@ const $upgradeConfirmBtn = document.getElementById("upgrade-confirm-btn");
|
||||
const $upgradeCancelBtn = document.getElementById("upgrade-cancel-btn");
|
||||
const $upgradeCloseBtn = document.getElementById("upgrade-close-btn");
|
||||
|
||||
// Legacy security warning state (populated by checkLegacySecurity in security.js)
|
||||
var _securityIsLegacy = false;
|
||||
var _securityStatus = "ok"; // "ok", "legacy", or "unsealed"
|
||||
var _securityWarningMessage = "";
|
||||
|
||||
// System status banner
|
||||
// (removed — health is now shown per-tile via the composite health field)
|
||||
@@ -89,6 +89,18 @@ function renderSidebarSupport(supportServices) {
|
||||
backupBtn.addEventListener("click", function() { openBackupModal(); });
|
||||
$sidebarSupport.appendChild(backupBtn);
|
||||
|
||||
// ── Security button
|
||||
var securityBtn = document.createElement("button");
|
||||
securityBtn.className = "sidebar-support-btn";
|
||||
securityBtn.innerHTML =
|
||||
'<span class="sidebar-support-icon">\uD83D\uDEE1</span>' +
|
||||
'<span class="sidebar-support-text">' +
|
||||
'<span class="sidebar-support-title">Security</span>' +
|
||||
'<span class="sidebar-support-hint">Reset & verify system</span>' +
|
||||
'</span>';
|
||||
securityBtn.addEventListener("click", function() { openSecurityModal(); });
|
||||
$sidebarSupport.appendChild(securityBtn);
|
||||
|
||||
// ── Upgrade button (Node role only)
|
||||
if (_currentRole === "node") {
|
||||
var upgradeBtn = document.createElement("button");
|
||||
|
||||
@@ -1,25 +1,22 @@
|
||||
/* Sovran_SystemsOS Hub — First-Boot Onboarding Wizard
|
||||
Drives the 6-step post-install setup flow. */
|
||||
Drives the 5-step post-install setup flow. */
|
||||
"use strict";
|
||||
|
||||
// ── Constants ─────────────────────────────────────────────────────
|
||||
|
||||
const TOTAL_STEPS = 6;
|
||||
const TOTAL_STEPS = 5;
|
||||
|
||||
// Steps to skip per role (steps 4 and 5 involve domain/port setup)
|
||||
// Steps 2 (timezone/locale) and 3 (password) are NEVER skipped — all roles need them.
|
||||
// Steps to skip per role (steps 3 and 4 involve domain/port setup)
|
||||
// Step 2 (timezone/locale) is NEVER skipped — all roles need it.
|
||||
const ROLE_SKIP_STEPS = {
|
||||
"desktop": [4, 5],
|
||||
"node": [4, 5],
|
||||
"desktop": [3, 4],
|
||||
"node": [3, 4],
|
||||
};
|
||||
|
||||
// ── Role state (loaded at init) ───────────────────────────────────
|
||||
|
||||
var _onboardingRole = "server_plus_desktop";
|
||||
|
||||
// Password default state (loaded at step 2)
|
||||
var _passwordIsDefault = true;
|
||||
|
||||
// Domains that may need configuration, with service unit mapping for enabled check
|
||||
const DOMAIN_DEFS = [
|
||||
{ name: "matrix", label: "Matrix (Synapse)", unit: "matrix-synapse.service", needsDdns: true },
|
||||
@@ -96,8 +93,7 @@ function showStep(step) {
|
||||
if (step === 2) loadStep2();
|
||||
if (step === 3) loadStep3();
|
||||
if (step === 4) loadStep4();
|
||||
if (step === 5) loadStep5();
|
||||
// Step 6 (Complete) is static — no lazy-load needed
|
||||
// Step 5 (Complete) is static — no lazy-load needed
|
||||
}
|
||||
|
||||
// Return the next step number, skipping over role-excluded steps
|
||||
@@ -273,135 +269,12 @@ async function saveStep2() {
|
||||
return true;
|
||||
}
|
||||
|
||||
// ── Step 3: Create Your Password ─────────────────────────────────
|
||||
// ── Step 3: Domain Configuration ─────────────────────────────────
|
||||
|
||||
async function loadStep3() {
|
||||
var body = document.getElementById("step-3-body");
|
||||
if (!body) return;
|
||||
|
||||
var nextBtn = document.getElementById("step-3-next");
|
||||
|
||||
try {
|
||||
var result = await apiFetch("/api/security/password-is-default");
|
||||
_passwordIsDefault = result.is_default !== false;
|
||||
} catch (_) {
|
||||
_passwordIsDefault = true;
|
||||
}
|
||||
|
||||
if (_passwordIsDefault) {
|
||||
// Factory-sealed scenario: password must be set before continuing
|
||||
if (nextBtn) nextBtn.textContent = "Set Password & Continue \u2192";
|
||||
|
||||
body.innerHTML =
|
||||
'<div class="onboarding-password-group">' +
|
||||
'<label class="onboarding-domain-label" for="pw-new">New Password</label>' +
|
||||
'<div class="onboarding-password-input-wrap">' +
|
||||
'<input class="onboarding-password-input" type="password" id="pw-new" autocomplete="new-password" placeholder="At least 8 characters" />' +
|
||||
'<button type="button" class="onboarding-password-toggle" data-target="pw-new" aria-label="Show password">👁</button>' +
|
||||
'</div>' +
|
||||
'<p class="onboarding-password-hint">Minimum 8 characters</p>' +
|
||||
'</div>' +
|
||||
'<div class="onboarding-password-group">' +
|
||||
'<label class="onboarding-domain-label" for="pw-confirm">Confirm Password</label>' +
|
||||
'<div class="onboarding-password-input-wrap">' +
|
||||
'<input class="onboarding-password-input" type="password" id="pw-confirm" autocomplete="new-password" placeholder="Re-enter your password" />' +
|
||||
'<button type="button" class="onboarding-password-toggle" data-target="pw-confirm" aria-label="Show password">👁</button>' +
|
||||
'</div>' +
|
||||
'</div>' +
|
||||
'<div class="onboarding-password-warning">⚠️ Write this password down — it cannot be recovered.</div>';
|
||||
|
||||
// Wire show/hide toggles
|
||||
body.querySelectorAll(".onboarding-password-toggle").forEach(function(btn) {
|
||||
btn.addEventListener("click", function() {
|
||||
var inp = document.getElementById(btn.dataset.target);
|
||||
if (inp) inp.type = (inp.type === "password") ? "text" : "password";
|
||||
});
|
||||
});
|
||||
|
||||
} else {
|
||||
// DIY install scenario: password already set by installer
|
||||
if (nextBtn) nextBtn.textContent = "Continue \u2192";
|
||||
|
||||
body.innerHTML =
|
||||
'<div class="onboarding-password-success">✅ Your password was already set during installation.</div>' +
|
||||
'<details class="onboarding-password-optional">' +
|
||||
'<summary>Change it anyway</summary>' +
|
||||
'<div style="margin-top:14px;">' +
|
||||
'<div class="onboarding-password-group">' +
|
||||
'<label class="onboarding-domain-label" for="pw-new">New Password</label>' +
|
||||
'<div class="onboarding-password-input-wrap">' +
|
||||
'<input class="onboarding-password-input" type="password" id="pw-new" autocomplete="new-password" placeholder="At least 8 characters" />' +
|
||||
'<button type="button" class="onboarding-password-toggle" data-target="pw-new" aria-label="Show password">👁</button>' +
|
||||
'</div>' +
|
||||
'<p class="onboarding-password-hint">Minimum 8 characters</p>' +
|
||||
'</div>' +
|
||||
'<div class="onboarding-password-group">' +
|
||||
'<label class="onboarding-domain-label" for="pw-confirm">Confirm Password</label>' +
|
||||
'<div class="onboarding-password-input-wrap">' +
|
||||
'<input class="onboarding-password-input" type="password" id="pw-confirm" autocomplete="new-password" placeholder="Re-enter your password" />' +
|
||||
'<button type="button" class="onboarding-password-toggle" data-target="pw-confirm" aria-label="Show password">👁</button>' +
|
||||
'</div>' +
|
||||
'</div>' +
|
||||
'<div class="onboarding-password-warning">⚠️ Write this password down — it cannot be recovered.</div>' +
|
||||
'</div>' +
|
||||
'</details>';
|
||||
|
||||
// Wire show/hide toggles
|
||||
body.querySelectorAll(".onboarding-password-toggle").forEach(function(btn) {
|
||||
btn.addEventListener("click", function() {
|
||||
var inp = document.getElementById(btn.dataset.target);
|
||||
if (inp) inp.type = (inp.type === "password") ? "text" : "password";
|
||||
});
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
async function saveStep3() {
|
||||
var newPw = document.getElementById("pw-new");
|
||||
var confirmPw = document.getElementById("pw-confirm");
|
||||
|
||||
// If no fields visible or both empty and password already set → skip
|
||||
if (!newPw || !newPw.value.trim()) {
|
||||
if (!_passwordIsDefault) return true; // already set, no change requested
|
||||
setStatus("step-3-status", "⚠ Please enter a password.", "error");
|
||||
return false;
|
||||
}
|
||||
|
||||
var pw = newPw.value;
|
||||
var cpw = confirmPw ? confirmPw.value : "";
|
||||
|
||||
if (pw.length < 8) {
|
||||
setStatus("step-3-status", "⚠ Password must be at least 8 characters.", "error");
|
||||
return false;
|
||||
}
|
||||
if (pw !== cpw) {
|
||||
setStatus("step-3-status", "⚠ Passwords do not match.", "error");
|
||||
return false;
|
||||
}
|
||||
|
||||
setStatus("step-3-status", "Saving password…", "info");
|
||||
try {
|
||||
await apiFetch("/api/change-password", {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({ new_password: pw, confirm_password: cpw }),
|
||||
});
|
||||
} catch (err) {
|
||||
setStatus("step-3-status", "⚠ " + err.message, "error");
|
||||
return false;
|
||||
}
|
||||
|
||||
setStatus("step-3-status", "✓ Password saved", "ok");
|
||||
_passwordIsDefault = false;
|
||||
return true;
|
||||
}
|
||||
|
||||
// ── Step 4: Domain Configuration ─────────────────────────────────
|
||||
|
||||
async function loadStep4() {
|
||||
var body = document.getElementById("step-4-body");
|
||||
if (!body) return;
|
||||
|
||||
try {
|
||||
// Fetch services, domains, and network info in parallel
|
||||
var results = await Promise.all([
|
||||
@@ -542,8 +415,8 @@ async function loadStep4() {
|
||||
});
|
||||
}
|
||||
|
||||
async function saveStep4() {
|
||||
setStatus("step-4-status", "Saving domains…", "info");
|
||||
async function saveStep3() {
|
||||
setStatus("step-3-status", "Saving domains…", "info");
|
||||
var errors = [];
|
||||
|
||||
// Save each domain input
|
||||
@@ -583,18 +456,18 @@ async function saveStep4() {
|
||||
}
|
||||
|
||||
if (errors.length > 0) {
|
||||
setStatus("step-4-status", "⚠ Some errors: " + errors.join("; "), "error");
|
||||
setStatus("step-3-status", "⚠ Some errors: " + errors.join("; "), "error");
|
||||
return false;
|
||||
}
|
||||
|
||||
setStatus("step-4-status", "✓ Saved", "ok");
|
||||
setStatus("step-3-status", "✓ Saved", "ok");
|
||||
return true;
|
||||
}
|
||||
|
||||
// ── Step 5: Port Forwarding ───────────────────────────────────────
|
||||
// ── Step 4: Port Forwarding ───────────────────────────────────────
|
||||
|
||||
async function loadStep5() {
|
||||
var body = document.getElementById("step-5-body");
|
||||
async function loadStep4() {
|
||||
var body = document.getElementById("step-4-body");
|
||||
if (!body) return;
|
||||
body.innerHTML = '<p class="onboarding-loading">Checking ports…</p>';
|
||||
|
||||
@@ -675,10 +548,10 @@ async function loadStep5() {
|
||||
body.innerHTML = html;
|
||||
}
|
||||
|
||||
// ── Step 6: Complete ──────────────────────────────────────────────
|
||||
// ── Step 5: Complete ──────────────────────────────────────────────
|
||||
|
||||
async function completeOnboarding() {
|
||||
var btn = document.getElementById("step-6-finish");
|
||||
var btn = document.getElementById("step-5-finish");
|
||||
if (btn) { btn.disabled = true; btn.textContent = "Finishing…"; }
|
||||
|
||||
try {
|
||||
@@ -709,36 +582,24 @@ function wireNavButtons() {
|
||||
if (ok) showStep(nextStep(2));
|
||||
});
|
||||
|
||||
// Step 3 → 4 (save password first)
|
||||
// Step 3 → 4 (save domains first)
|
||||
var s3next = document.getElementById("step-3-next");
|
||||
if (s3next) s3next.addEventListener("click", async function() {
|
||||
s3next.disabled = true;
|
||||
var origText = s3next.textContent;
|
||||
s3next.textContent = "Saving…";
|
||||
var ok = await saveStep3();
|
||||
await saveStep3();
|
||||
s3next.disabled = false;
|
||||
s3next.textContent = origText;
|
||||
if (ok) showStep(nextStep(3));
|
||||
s3next.textContent = "Save & Continue →";
|
||||
showStep(nextStep(3));
|
||||
});
|
||||
|
||||
// Step 4 → 5 (save domains first)
|
||||
// Step 4 → 5 (port forwarding — no save needed)
|
||||
var s4next = document.getElementById("step-4-next");
|
||||
if (s4next) s4next.addEventListener("click", async function() {
|
||||
s4next.disabled = true;
|
||||
s4next.textContent = "Saving…";
|
||||
await saveStep4();
|
||||
s4next.disabled = false;
|
||||
s4next.textContent = "Save & Continue →";
|
||||
showStep(nextStep(4));
|
||||
});
|
||||
if (s4next) s4next.addEventListener("click", function() { showStep(nextStep(4)); });
|
||||
|
||||
// Step 5 → 6 (port forwarding — no save needed)
|
||||
var s5next = document.getElementById("step-5-next");
|
||||
if (s5next) s5next.addEventListener("click", function() { showStep(nextStep(5)); });
|
||||
|
||||
// Step 6: finish
|
||||
var s6finish = document.getElementById("step-6-finish");
|
||||
if (s6finish) s6finish.addEventListener("click", completeOnboarding);
|
||||
// Step 5: finish
|
||||
var s5finish = document.getElementById("step-5-finish");
|
||||
if (s5finish) s5finish.addEventListener("click", completeOnboarding);
|
||||
|
||||
// Back buttons
|
||||
document.querySelectorAll(".onboarding-btn-back").forEach(function(btn) {
|
||||
|
||||
Reference in New Issue
Block a user