8 commits

Author	SHA1	Message	Date
oliver	c4526e36d8	Polish HeroUI chrome, topology toolbar, and session client IP. ... Checkpoint before workbench facade redesign: list defaults, API key quota, toast portal, topology canvas editor toolbar with More menu, and trusted-proxy client IP for sessions. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-12 15:10:57 +08:00
oliver	61531e524f	Audit only intentional auth actions, not automatic 401/403 gates. ... Stop recording unauthorized/forbidden/password-gate and silent refresh; keep login, logout, and failed-login style events. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-01 21:51:59 +08:00
oliver	d35d3992c2	Dedupe auth.unauthorized floods from unauthenticated page loads. ... Keep one 401 audit per IP+path window, and hide historical unauthorized noise from the default business view. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-09-01 21:48:18 +08:00
oliver	20c2fcd496	Harden auth with revocable sessions, cookies, and single-login default. ... Issue short-lived access JWTs backed by AuthSession rows, HttpOnly cookies with refresh rotation, idle timeout, session management UI, WebCRT ownership caps, and optional Redis login rate limits; new logins revoke other sessions by default. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-06 14:13:37 +08:00
oliver	254c50a2c0	Add dark workbench dashboard with host CPU/memory gauges. ... Sample Windows CPU via Processor Utility so values match Task Manager, and expose host metrics on /v1/metrics/json for the workbench poll. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-04 23:20:29 +08:00
oliver	d56020d84c	Harden runtime budgets: DB pool, CLI concurrency, timeouts, and metrics. ... Add shared CLI budget/timeout with force-close, parallel port-traffic dispatch, unified shutdown, bounded audit queue, output/log caps, and /metrics probes. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-02 18:02:43 +08:00
oliver	633a9d55bd	Harden auth scopes, SQL/WebCRT gates, and per-install JWT secrets. ... Add capability RBAC, Alembic bootstrap, optional worker schedulers, and close public docs by default so lab installs stay usable without shared signing keys. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-02 16:24:34 +08:00
hansjone	6d4cd741ef	feat(auth): add local login, audit, API keys, and system admin UI ... Gate netx Web/API/WebCRT with JWT and per-user API tokens, bootstrap an admin with forced password change, and expose users/audit/API-key management under a System section. MCP can reuse data/auth/mcp_token without extra env for local labs. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-07-30 02:34:25 +00:00