Implement security overhaul: remove seal/legacy system, add Security modal and random passwords
Agent-Logs-Url: https://github.com/naturallaw777/staging_alpha/sessions/6e7593c4-f741-4ddc-9bce-8c558a4af014 Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
committed by
GitHub
GitHub
parent
477d265de8
commit
2fae4ccc79
@@ -70,6 +70,47 @@ async function doUpgradeToServer() {
|
||||
|
||||
if ($upgradeConfirmBtn) $upgradeConfirmBtn.addEventListener("click", doUpgradeToServer);
|
||||
|
||||
// ── First-login security banner ───────────────────────────────────
|
||||
|
||||
function showSecurityBanner() {
|
||||
var existing = document.getElementById("security-first-login-banner");
|
||||
if (existing) return;
|
||||
|
||||
var banner = document.createElement("div");
|
||||
banner.id = "security-first-login-banner";
|
||||
banner.className = "security-first-login-banner";
|
||||
banner.innerHTML =
|
||||
'<div class="security-banner-content">' +
|
||||
'<span class="security-banner-icon">\uD83D\uDEE1</span>' +
|
||||
'<span class="security-banner-text">' +
|
||||
'<strong>Did someone else set up this machine?</strong> ' +
|
||||
'If this computer was pre-configured by another person, go to ' +
|
||||
'<strong>Menu \u2192 Security</strong> to reset all passwords and keys. ' +
|
||||
'This ensures only you have access.' +
|
||||
'</span>' +
|
||||
'</div>' +
|
||||
'<button class="security-banner-dismiss" id="security-banner-dismiss-btn" title="Dismiss">\u2715</button>';
|
||||
|
||||
var mainContent = document.querySelector(".main-content");
|
||||
if (mainContent) {
|
||||
mainContent.insertAdjacentElement("beforebegin", banner);
|
||||
} else {
|
||||
document.body.insertAdjacentElement("afterbegin", banner);
|
||||
}
|
||||
|
||||
var dismissBtn = document.getElementById("security-banner-dismiss-btn");
|
||||
if (dismissBtn) {
|
||||
dismissBtn.addEventListener("click", async function() {
|
||||
banner.remove();
|
||||
try {
|
||||
await apiFetch("/api/security/banner-dismiss", { method: "POST" });
|
||||
} catch (_) {
|
||||
// Non-fatal
|
||||
}
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
// ── Init ──────────────────────────────────────────────────────────
|
||||
|
||||
async function init() {
|
||||
@@ -84,8 +125,16 @@ async function init() {
|
||||
// If we can't reach the endpoint, continue to normal dashboard
|
||||
}
|
||||
|
||||
// Check for legacy machine security warning
|
||||
await checkLegacySecurity();
|
||||
// Show first-login security banner only for machines that went through onboarding
|
||||
// (legacy machines without the onboarding flag will never see this)
|
||||
try {
|
||||
var bannerData = await apiFetch("/api/security/banner-status");
|
||||
if (bannerData && bannerData.show) {
|
||||
showSecurityBanner();
|
||||
}
|
||||
} catch (_) {
|
||||
// Non-fatal — silently ignore
|
||||
}
|
||||
|
||||
try {
|
||||
var cfg = await apiFetch("/api/config");
|
||||
|
||||
@@ -599,29 +599,9 @@ function renderAutolaunchToggle(enabled) {
|
||||
var section = document.createElement("div");
|
||||
section.className = "category-section autolaunch-section";
|
||||
|
||||
var securityBanner = "";
|
||||
if (_securityIsLegacy) {
|
||||
var msg = _securityWarningMessage || "Your system may have factory default passwords. Please change your passwords to secure your system.";
|
||||
var linkText, linkAction;
|
||||
if (_securityStatus === "unsealed") {
|
||||
linkText = "Contact Support";
|
||||
linkAction = "openSupportModal(); return false;";
|
||||
} else {
|
||||
linkText = "Change Passwords";
|
||||
linkAction = "openServiceDetailModal('root-password-setup.service', 'System Passwords', 'passwords'); return false;";
|
||||
}
|
||||
securityBanner =
|
||||
'<div class="security-inline-banner">' +
|
||||
'<span class="security-inline-icon">⚠</span>' +
|
||||
'<span class="security-inline-text">' + msg + '</span>' +
|
||||
'<a class="security-inline-link" href="#" onclick="' + linkAction + '">' + linkText + '</a>' +
|
||||
'</div>';
|
||||
}
|
||||
|
||||
section.innerHTML =
|
||||
'<div class="section-header">Preferences</div>' +
|
||||
'<hr class="section-divider" />' +
|
||||
securityBanner +
|
||||
'<div class="feature-card">' +
|
||||
'<div class="feature-card-top">' +
|
||||
'<div class="feature-card-info">' +
|
||||
|
||||
@@ -1,16 +1,201 @@
|
||||
"use strict";
|
||||
|
||||
// ── Legacy security warning ───────────────────────────────────────
|
||||
// ── Security Modal ────────────────────────────────────────────────
|
||||
|
||||
async function checkLegacySecurity() {
|
||||
try {
|
||||
var data = await apiFetch("/api/security/status");
|
||||
if (data && (data.status === "legacy" || data.status === "unsealed")) {
|
||||
_securityIsLegacy = true;
|
||||
_securityStatus = data.status;
|
||||
_securityWarningMessage = data.warning || "This machine may have a security issue. Please review your system security.";
|
||||
function openSecurityModal() {
|
||||
if ($supportModal) $supportModal.classList.add("open");
|
||||
var title = document.getElementById("support-modal-title");
|
||||
if (title) title.textContent = "\uD83D\uDEE1 Security";
|
||||
|
||||
if ($supportBody) {
|
||||
$supportBody.innerHTML =
|
||||
// ── Section A: Security Reset ──────────────────────────────
|
||||
'<div class="security-section">' +
|
||||
'<h3 class="security-section-title">Security Reset</h3>' +
|
||||
'<p class="security-section-desc">' +
|
||||
'Run this if you are using this physical computer for the first time <strong>AND</strong> ' +
|
||||
'it was not set up by you. This will complete the security setup by resetting all passwords ' +
|
||||
'and your Bitcoin Lightning Node\u2019s private keys.' +
|
||||
'</p>' +
|
||||
'<p class="security-section-desc">' +
|
||||
'You can also run this if you wish to reset all your passwords and your Bitcoin Lightning ' +
|
||||
'Node\u2019s private keys. If you have not transferred the Bitcoin out of this node and did ' +
|
||||
'not back up the private keys, <strong>you will lose your Bitcoin.</strong>' +
|
||||
'</p>' +
|
||||
'<button class="btn btn-primary" id="security-reset-open-btn">Proceed with Security Reset</button>' +
|
||||
'<div id="security-reset-confirm" style="display:none;margin-top:16px;">' +
|
||||
'<div class="security-warning-box">' +
|
||||
'<p class="security-warning-text">' +
|
||||
'<strong>\u26A0\uFE0F This will permanently delete:</strong>' +
|
||||
'</p>' +
|
||||
'<ul class="security-warning-list">' +
|
||||
'<li>All generated passwords and SSH keys</li>' +
|
||||
'<li>LND wallet data (seed words, channels, macaroons)</li>' +
|
||||
'<li>Application databases</li>' +
|
||||
'<li>Vaultwarden data</li>' +
|
||||
'</ul>' +
|
||||
'<p class="security-warning-text">You will go through onboarding again. <strong>This cannot be undone.</strong></p>' +
|
||||
'</div>' +
|
||||
'<div class="security-erase-group">' +
|
||||
'<label class="security-erase-label" for="security-erase-input">Type <strong>ERASE</strong> to confirm:</label>' +
|
||||
'<input class="security-erase-input" type="text" id="security-erase-input" autocomplete="off" placeholder="ERASE" />' +
|
||||
'</div>' +
|
||||
'<div class="security-reset-actions">' +
|
||||
'<button class="btn btn-close-modal" id="security-reset-cancel-btn">Cancel</button>' +
|
||||
'<button class="btn btn-danger" id="security-reset-confirm-btn" disabled>Erase & Reset</button>' +
|
||||
'</div>' +
|
||||
'<div id="security-reset-status" class="security-status-msg"></div>' +
|
||||
'</div>' +
|
||||
'</div>' +
|
||||
|
||||
'<hr class="security-divider" />' +
|
||||
|
||||
// ── Section B: Verify System Integrity ────────────────────
|
||||
'<div class="security-section">' +
|
||||
'<h3 class="security-section-title">Verify System Integrity</h3>' +
|
||||
'<p class="security-section-desc">' +
|
||||
'Your Sovran_SystemsOS is built with NixOS \u2014 a system designed for complete transparency ' +
|
||||
'and reproducibility. Every piece of software on this machine is built from publicly auditable ' +
|
||||
'source code and verified using cryptographic hashes.' +
|
||||
'</p>' +
|
||||
'<p class="security-section-desc">This verification confirms three things:</p>' +
|
||||
'<ol class="security-verify-list">' +
|
||||
'<li>' +
|
||||
'<strong>Source Code Match</strong> \u2014 The system configuration on this machine matches ' +
|
||||
'the exact commit published in the public repository. No hidden changes were added.' +
|
||||
'</li>' +
|
||||
'<li>' +
|
||||
'<strong>Binary Integrity</strong> \u2014 Every installed package in the system store is ' +
|
||||
'verified against its expected cryptographic hash. If any binary, library, or config file ' +
|
||||
'was tampered with, it will be detected.' +
|
||||
'</li>' +
|
||||
'<li>' +
|
||||
'<strong>Running System Match</strong> \u2014 The currently running system matches what the ' +
|
||||
'configuration says it should be. No unauthorized modifications are active.' +
|
||||
'</li>' +
|
||||
'</ol>' +
|
||||
'<p class="security-section-desc">' +
|
||||
'In short: if this verification passes, you can be confident that the software running on ' +
|
||||
'your machine is exactly what is published \u2014 nothing more, nothing less.' +
|
||||
'</p>' +
|
||||
'<button class="btn btn-primary" id="security-verify-btn">Verify Now</button>' +
|
||||
'<div id="security-verify-results" style="display:none;margin-top:16px;"></div>' +
|
||||
'</div>';
|
||||
|
||||
// ── Wire Security Reset flow
|
||||
var resetOpenBtn = document.getElementById("security-reset-open-btn");
|
||||
var resetConfirmDiv = document.getElementById("security-reset-confirm");
|
||||
var eraseInput = document.getElementById("security-erase-input");
|
||||
var resetConfirmBtn = document.getElementById("security-reset-confirm-btn");
|
||||
var resetCancelBtn = document.getElementById("security-reset-cancel-btn");
|
||||
var resetStatus = document.getElementById("security-reset-status");
|
||||
|
||||
if (resetOpenBtn) {
|
||||
resetOpenBtn.addEventListener("click", function() {
|
||||
resetOpenBtn.style.display = "none";
|
||||
if (resetConfirmDiv) resetConfirmDiv.style.display = "";
|
||||
if (eraseInput) eraseInput.focus();
|
||||
});
|
||||
}
|
||||
|
||||
if (eraseInput && resetConfirmBtn) {
|
||||
eraseInput.addEventListener("input", function() {
|
||||
resetConfirmBtn.disabled = eraseInput.value.trim() !== "ERASE";
|
||||
});
|
||||
}
|
||||
|
||||
if (resetCancelBtn) {
|
||||
resetCancelBtn.addEventListener("click", function() {
|
||||
if (resetConfirmDiv) resetConfirmDiv.style.display = "none";
|
||||
if (resetOpenBtn) resetOpenBtn.style.display = "";
|
||||
if (eraseInput) eraseInput.value = "";
|
||||
if (resetConfirmBtn) resetConfirmBtn.disabled = true;
|
||||
if (resetStatus) { resetStatus.textContent = ""; resetStatus.className = "security-status-msg"; }
|
||||
});
|
||||
}
|
||||
|
||||
if (resetConfirmBtn) {
|
||||
resetConfirmBtn.addEventListener("click", async function() {
|
||||
if (!eraseInput || eraseInput.value.trim() !== "ERASE") return;
|
||||
resetConfirmBtn.disabled = true;
|
||||
resetConfirmBtn.textContent = "Erasing\u2026";
|
||||
if (resetStatus) { resetStatus.textContent = "Running security reset\u2026"; resetStatus.className = "security-status-msg security-status-info"; }
|
||||
try {
|
||||
await apiFetch("/api/security/reset", { method: "POST" });
|
||||
if (resetStatus) { resetStatus.textContent = "\u2713 Reset complete. Rebooting\u2026"; resetStatus.className = "security-status-msg security-status-ok"; }
|
||||
if ($rebootOverlay) $rebootOverlay.classList.add("open");
|
||||
} catch (err) {
|
||||
if (resetStatus) { resetStatus.textContent = "\u2717 Error: " + (err.message || "Reset failed."); resetStatus.className = "security-status-msg security-status-error"; }
|
||||
resetConfirmBtn.disabled = false;
|
||||
resetConfirmBtn.textContent = "Erase & Reset";
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
// ── Wire Verify System Integrity
|
||||
var verifyBtn = document.getElementById("security-verify-btn");
|
||||
var verifyResults = document.getElementById("security-verify-results");
|
||||
|
||||
if (verifyBtn && verifyResults) {
|
||||
verifyBtn.addEventListener("click", async function() {
|
||||
verifyBtn.disabled = true;
|
||||
verifyBtn.textContent = "Verifying\u2026";
|
||||
verifyResults.style.display = "";
|
||||
verifyResults.innerHTML = '<p class="security-verify-loading">\u231B Running verification checks\u2026 This may take a few minutes.</p>';
|
||||
|
||||
try {
|
||||
var data = await apiFetch("/api/security/verify-integrity", { method: "POST" });
|
||||
var html = '<div class="security-verify-result-card">';
|
||||
|
||||
// Flake commit
|
||||
html += '<div class="security-verify-row">';
|
||||
html += '<span class="security-verify-label">Source Commit:</span>';
|
||||
html += '<span class="security-verify-value security-verify-mono">' + escHtml(data.flake_commit || "unknown") + '</span>';
|
||||
if (data.repo_url) {
|
||||
html += '<a class="security-verify-link" href="' + escHtml(data.repo_url) + '" target="_blank" rel="noopener noreferrer">View on Gitea \u2197</a>';
|
||||
}
|
||||
html += '</div>';
|
||||
|
||||
// Store verification
|
||||
var storeOk = data.store_verified === true;
|
||||
html += '<div class="security-verify-row">';
|
||||
html += '<span class="security-verify-label">Binary Integrity:</span>';
|
||||
html += '<span class="security-verify-badge ' + (storeOk ? "security-verify-pass" : "security-verify-fail") + '">';
|
||||
html += storeOk ? "\u2705 PASS" : "\u274C FAIL";
|
||||
html += '</span>';
|
||||
html += '</div>';
|
||||
if (!storeOk && data.store_errors && data.store_errors.length > 0) {
|
||||
html += '<details class="security-verify-errors"><summary>Show errors (' + data.store_errors.length + ')</summary>';
|
||||
html += '<pre class="security-verify-pre">' + escHtml(data.store_errors.join("\n")) + '</pre>';
|
||||
html += '</details>';
|
||||
}
|
||||
|
||||
// System match
|
||||
var sysOk = data.system_matches === true;
|
||||
html += '<div class="security-verify-row">';
|
||||
html += '<span class="security-verify-label">Running System Match:</span>';
|
||||
html += '<span class="security-verify-badge ' + (sysOk ? "security-verify-pass" : "security-verify-fail") + '">';
|
||||
html += sysOk ? "\u2705 PASS" : "\u274C FAIL";
|
||||
html += '</span>';
|
||||
html += '</div>';
|
||||
if (!sysOk) {
|
||||
html += '<div class="security-verify-path-row">';
|
||||
html += '<span class="security-verify-path-label">Current:</span><code class="security-verify-mono">' + escHtml(data.current_system_path || "") + '</code>';
|
||||
html += '</div>';
|
||||
html += '<div class="security-verify-path-row">';
|
||||
html += '<span class="security-verify-path-label">Expected:</span><code class="security-verify-mono">' + escHtml(data.expected_system_path || "") + '</code>';
|
||||
html += '</div>';
|
||||
}
|
||||
|
||||
html += '</div>';
|
||||
verifyResults.innerHTML = html;
|
||||
} catch (err) {
|
||||
verifyResults.innerHTML = '<p class="security-status-msg security-status-error">\u274C Verification failed: ' + escHtml(err.message || "Unknown error") + '</p>';
|
||||
}
|
||||
|
||||
verifyBtn.disabled = false;
|
||||
verifyBtn.textContent = "Verify Now";
|
||||
});
|
||||
}
|
||||
} catch (_) {
|
||||
// Non-fatal — silently ignore if the endpoint is unreachable
|
||||
}
|
||||
}
|
||||
|
||||
@@ -612,15 +612,6 @@ function openSystemChangePasswordModal(unit, name, icon) {
|
||||
resultEl.textContent = "✅ System password changed successfully.";
|
||||
submitBtn.textContent = "Change Password";
|
||||
submitBtn.disabled = false;
|
||||
// Hide the legacy security banner if it's visible — but only for
|
||||
// "legacy" status machines. For "unsealed" machines, changing passwords
|
||||
// is not enough; the factory residue remains until a proper re-seal or re-install.
|
||||
if (typeof _securityIsLegacy !== "undefined" && _securityIsLegacy &&
|
||||
(typeof _securityStatus === "undefined" || _securityStatus !== "unsealed")) {
|
||||
_securityIsLegacy = false;
|
||||
var banner = document.querySelector(".security-inline-banner");
|
||||
if (banner) banner.remove();
|
||||
}
|
||||
} catch (err) {
|
||||
resultEl.className = "matrix-form-result error";
|
||||
resultEl.textContent = "❌ " + (err.message || "Failed to change password.");
|
||||
|
||||
@@ -99,10 +99,5 @@ const $upgradeConfirmBtn = document.getElementById("upgrade-confirm-btn");
|
||||
const $upgradeCancelBtn = document.getElementById("upgrade-cancel-btn");
|
||||
const $upgradeCloseBtn = document.getElementById("upgrade-close-btn");
|
||||
|
||||
// Legacy security warning state (populated by checkLegacySecurity in security.js)
|
||||
var _securityIsLegacy = false;
|
||||
var _securityStatus = "ok"; // "ok", "legacy", or "unsealed"
|
||||
var _securityWarningMessage = "";
|
||||
|
||||
// System status banner
|
||||
// (removed — health is now shown per-tile via the composite health field)
|
||||
@@ -89,6 +89,18 @@ function renderSidebarSupport(supportServices) {
|
||||
backupBtn.addEventListener("click", function() { openBackupModal(); });
|
||||
$sidebarSupport.appendChild(backupBtn);
|
||||
|
||||
// ── Security button
|
||||
var securityBtn = document.createElement("button");
|
||||
securityBtn.className = "sidebar-support-btn";
|
||||
securityBtn.innerHTML =
|
||||
'<span class="sidebar-support-icon">\uD83D\uDEE1</span>' +
|
||||
'<span class="sidebar-support-text">' +
|
||||
'<span class="sidebar-support-title">Security</span>' +
|
||||
'<span class="sidebar-support-hint">Reset & verify system</span>' +
|
||||
'</span>';
|
||||
securityBtn.addEventListener("click", function() { openSecurityModal(); });
|
||||
$sidebarSupport.appendChild(securityBtn);
|
||||
|
||||
// ── Upgrade button (Node role only)
|
||||
if (_currentRole === "node") {
|
||||
var upgradeBtn = document.createElement("button");
|
||||
|
||||
Reference in New Issue
Block a user