chore: archive old plans, add new plan docs, update submodules
This commit is contained in:
datadunia
@@ -0,0 +1,458 @@
|
||||
# Bug Fix: Node Form, Device Status, & Peer Config
|
||||
|
||||
## TL;DR
|
||||
|
||||
> **Quick Summary**: Fix 5 bugs in NexusGuard dashboard-ui + server-core terkait node registration form, device online/offline status, peer address netmask, advanced options, dan editable wg.conf view. Plus fix 3 critical bugs uncovered by Metis review (IPAM string comparison, share.go prefix, Update handler gap).
|
||||
>
|
||||
> **Deliverables**:
|
||||
> - Single input IP Pool + Interface Address dengan available IP counter
|
||||
> - Fix peer Address menggunakan pool netmask (bukan /32)
|
||||
> - Advanced Options collapsible + Table default "Off"
|
||||
> - Editable wg.conf view (safe, validated)
|
||||
> - Device status akurat (Online hanya jika benar-benar konek)
|
||||
> - IPAM exclusion bug fixed (server IP tidak di-override peer)
|
||||
>
|
||||
> **Estimated Effort**: Medium (10-14 tasks across 3 waves)
|
||||
> **Parallel Execution**: YES — 3 waves
|
||||
> **Critical Path**: IPAM fix → Backend fixes → Frontend fixes → wg.conf feature
|
||||
|
||||
---
|
||||
|
||||
## Context
|
||||
|
||||
### Original Request
|
||||
5 bugs diidentifikasi user:
|
||||
1. IP Pool CIDR + Interface Address jadi 1 input (dengan available IP count)
|
||||
2. Peer Address tidak pakai netmask pool (selalu /32)
|
||||
3. Advanced Options tidak collapsible + Table default "auto"
|
||||
4. Tidak ada editable raw wg.conf view
|
||||
5. Device status selalu Online meskipun tidak konek
|
||||
|
||||
### Metis Review — Critical Findings
|
||||
**3 bugs uncovered yang harus diperbaiki bersamaan**:
|
||||
|
||||
| # | Bug | Lokasi | Dampak |
|
||||
|---|-----|--------|--------|
|
||||
| C1 | **IPAM string comparison mismatch** | `ipam/manager.go:87-94 vs 107` | `interface_address` tersimpan sebagai `"10.8.0.1/24"` tapi dibandingkan dengan `"10.8.0.1"` (tanpa prefix). Server's own IP **tidak pernah dikecualikan** → peer bisa dapat IP yang sama dengan server → IP conflict |
|
||||
| C2 | **share.go juga hardcode /32** | `share.go:63` | Sama seperti peers.go, share link juga generate Address dengan /32 |
|
||||
| C3 | **Update handler tidak recalculate InterfaceAddress** | `servers.go:321-326` | Create handler auto-calc InterfaceAddress, tapi Update handler tidak. Ganti IPPoolCIDR saat edit → InterfaceAddress stale |
|
||||
|
||||
### Konfirmasi dari User
|
||||
- **IP single input**: ✅ Sepakat. `10.172.20.1/24` → pool=`10.172.20.0/24`, interface=`10.172.20.1/24`
|
||||
- **Advanced collapsible + Table=Off**: ✅ Keduanya
|
||||
- **Editable wg.conf**: ✅ Editable, harus aman. wg.conf tidak ada sebagai file fisik (generated config via wgctrl)
|
||||
- **Device status**: User tidak tahu apakah pakai Redis. Device-agent pakai official WG client
|
||||
|
||||
---
|
||||
|
||||
## Work Objectives
|
||||
|
||||
### Core Objective
|
||||
Memperbaiki 5 bugs dashboard-ui + server-core + 3 critical bugs dari Metis review.
|
||||
|
||||
### Concrete Deliverables
|
||||
1. **Servers.vue**: Form register/edit node — single IP input + available count
|
||||
2. **peers.go + share.go**: Peer Address pakai pool netmask (bukan /32)
|
||||
3. **ipam/manager.go**: Fix string comparison untuk interface_address exclusion
|
||||
4. **Servers.vue**: Advanced Overrides collapsible + Table default "Off"
|
||||
5. **PeerConfigModal.vue**: Editable wg.conf + safe Apply
|
||||
6. **models.go + peers.go + devices.go + heartbeat/redis.go**: IsActive default false
|
||||
|
||||
### Must Have
|
||||
- [x] IPAM tidak lagi mengalokasikan IP yang sama dengan server's interface_address
|
||||
- [x] Edit node dengan mengubah IPPoolCIDR → InterfaceAddress otomatis recalculate
|
||||
- [x] Single input IP/Prefix menolak network address (x.x.x.0/24) dan broadcast
|
||||
- [x] Peer Address di config menggunakan netmask dari pool, bukan /32
|
||||
- [x] Device baru muncul sebagai "Offline" sampai heartbeat pertama
|
||||
- [x] Advanced Overrides collapsible (default tertutup) di create + edit form
|
||||
- [x] Table default "Off" untuk server baru
|
||||
- [x] Editable wg.conf view dengan validasi keamanan
|
||||
|
||||
### Must NOT Have (Guardrails)
|
||||
- **JANGAN** ubah struktur kolom DB WgServer (merge hanya UI-level, backend tetap 2 field)
|
||||
- **JANGAN** ubah AllowedIPs /32 di [Peer] section (hanya Address di [Interface])
|
||||
- **JANGAN** deduplikasi config generator (scope creep)
|
||||
- **JANGAN** izinkan edit PrivateKey/PresharedKey tanpa warning
|
||||
- **JANGAN** tambahkan DB migration untuk backfill Table/IsActive existing
|
||||
- **JANGAN** `nft flush table` atau ubah behavior firewall
|
||||
- **JANGAN** log plaintext keys
|
||||
|
||||
---
|
||||
|
||||
## Verification Strategy
|
||||
|
||||
### Test Decision
|
||||
- **Infrastructure exists**: YES (bun test + vitest di dashboard-ui)
|
||||
- **Automated tests**: NO (bug fix, verification via QA scenarios)
|
||||
- **Framework**: vitest (existing)
|
||||
|
||||
### QA Policy
|
||||
Setiap task diverifikasi oleh agent (agent-executed QA). Tidak ada verifikasi manual.
|
||||
|
||||
- **Frontend**: Playwright — navigasi form, input data, assert DOM
|
||||
- **API**: Bash (curl) — send requests, assert JSON response
|
||||
- **Backend**: Bash (go run) — test specific functions if needed
|
||||
|
||||
---
|
||||
|
||||
## Execution Strategy
|
||||
|
||||
### Parallel Execution Waves
|
||||
|
||||
```
|
||||
Wave 1 (Backend Foundation — IPAM + Model Fixes):
|
||||
├── Task 1: Fix IPAM string comparison (ipam/manager.go) [quick]
|
||||
├── Task 2: Fix Update handler recalculate InterfaceAddress (servers.go) [quick]
|
||||
├── Task 3: Change GORM defaults — IsActive=false + Table=off (models.go) [quick]
|
||||
├── Task 4: Fix SyncToDB isActive default (heartbeat/redis.go) [quick]
|
||||
├── Task 5: Remove IsActive:true hardcode from CreatePeer + Devices.Create (peers.go, devices.go) [quick]
|
||||
└── Task 6: Fix peer Address to use pool netmask (peers.go + share.go) [quick]
|
||||
|
||||
Wave 2 (Frontend — Form + UI Changes):
|
||||
├── Task 7: Merge IP Pool + Interface Address jadi 1 input + available IP count (Servers.vue) [visual-engineering]
|
||||
├── Task 8: Advanced Overrides collapsible + Table default "Off" (Servers.vue) [visual-engineering]
|
||||
├── Task 9: Device status UI — handle IsActive=false untuk new device (Devices.vue, DeviceDetail.vue) [quick]
|
||||
|
||||
Wave 3 (wg.conf Editable View):
|
||||
├── Task 10: Editable wg.conf textarea + backend validation endpoint (PeerConfigModal.vue + peers.go) [unspecified-high]
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## TODOs
|
||||
|
||||
- [x] 1. Fix IPAM string comparison — strip prefix dari interface_address
|
||||
|
||||
**What to do**:
|
||||
- Di `ipam/manager.go:AllocateIPFromCIDR()` (line 87-107): saat `Pluck("interface_address", &serverIPs)`, data yang didapat format `"10.8.0.1/24"` (dengan prefix)
|
||||
- Saat dimasukkan ke `usedMap` (line 94): `usedMap["10.8.0.1/24"] = true`
|
||||
- Tapi perbandingan (line 107): `if !usedMap[ip.String()]` — `ip.String()` = `"10.8.0.1"` (tanpa prefix)
|
||||
- String `"10.8.0.1/24"` ≠ `"10.8.0.1"` → server IP tidak pernah match → peer bisa dapat IP server
|
||||
- Fix: Parse `interface_address` ambil IP saja sebelum masuk `usedMap`
|
||||
- Juga fix di `AllocateIP()` (line 39-46) — masalah yang sama
|
||||
|
||||
**Must NOT do**:
|
||||
- Jangan ubah logika increment IP atau skip broadcast
|
||||
- Jangan tambah field baru ke model
|
||||
|
||||
**Recommended Agent Profile**:
|
||||
- Category: `quick`
|
||||
- Skills: []
|
||||
|
||||
**Parallelization**:
|
||||
- Can Run In Parallel: YES
|
||||
- Blocks: Tasks 7 (backend change untuk single input), Task 6 (peer fix)
|
||||
- Blocked By: None
|
||||
|
||||
**References**:
|
||||
- `apps/server-core/internal/ipam/manager.go:73-116` — AllocateIPFromCIDR function
|
||||
- `apps/server-core/internal/ipam/manager.go:30-71` — AllocateIP function (same bug)
|
||||
- `apps/server-core/internal/ipam/manager.go:123-133` — `IsAvailable` already handles prefix correctly (pattern to follow)
|
||||
- `apps/server-core/internal/models/models.go:35-36` — IPPoolCIDR and InterfaceAddress field definitions
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [ ] Server with InterfaceAddress `10.8.0.1/24` → IPAM tidak mengalokasikan `10.8.0.1`
|
||||
- [ ] Server with InterfaceAddress `10.8.0.1/24` → IPAM bisa alokasikan `10.8.0.2` (tersedia)
|
||||
|
||||
**QA Scenarios**:
|
||||
```
|
||||
Scenario: Verify server interface IP excluded from allocation
|
||||
Tool: Bash (curl)
|
||||
Preconditions: DB has server with IPPoolCIDR="10.8.0.0/24", InterfaceAddress="10.8.0.1/24"
|
||||
Steps:
|
||||
1. curl -s -X POST /api/v1/peers -H "Authorization: Bearer $TOKEN" -d '{"name":"test-peer","wg_server_id":"$SERVER_ID"}'
|
||||
2. Parse response JSON → get device.InternalIP
|
||||
Expected Result: InternalIP != "10.8.0.1" (server IP not allocated to peer)
|
||||
Failure Indicators: Peer gets 10.8.0.1
|
||||
Evidence: .sisyphus/evidence/task-1-ipam-fix.json
|
||||
```
|
||||
|
||||
- [x] 2. Fix Update handler — recalculate InterfaceAddress saat IPPoolCIDR berubah
|
||||
|
||||
**What to do**:
|
||||
- Di `api/servers.go:321-326` (Update handler):
|
||||
- Saat ini hanya: `if req.InterfaceAddress != nil { server.InterfaceAddress = *req.InterfaceAddress }`
|
||||
- Tambahkan: jika `req.IPPoolCIDR != nil && req.InterfaceAddress == nil` → auto-calculate seperti Create handler (line 162-171)
|
||||
- Extract logika auto-calc ke helper function untuk reuse
|
||||
|
||||
**Must NOT do**:
|
||||
- Jangan trigger auto-calc jika InterfaceAddress juga dikirim (user ingin override manual)
|
||||
|
||||
**Parallelization**:
|
||||
- Can Run In Parallel: YES
|
||||
- Blocks: Task 7 (single input tergantung backend)
|
||||
- Blocked By: None
|
||||
|
||||
**References**:
|
||||
- `apps/server-core/api/servers.go:162-171` — Create handler auto-calc logic (pattern to copy)
|
||||
- `apps/server-core/api/servers.go:278-365` — Update handler (current behavior to fix)
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [ ] PUT /servers/{id} with `{"ip_pool_cidr": "10.9.0.0/24"}` → InterfaceAddress berubah jadi `10.9.0.1/24`
|
||||
- [ ] PUT /servers/{id} with `{"ip_pool_cidr": "10.9.0.0/24", "interface_address": "10.9.0.5/24"}` → InterfaceAddress = `10.9.0.5/24` (manual override)
|
||||
|
||||
- [x] 3. Change GORM defaults — IsActive=false + Table=off
|
||||
|
||||
**What to do**:
|
||||
- `models.go:37`: `Table string \`...default:'auto'\`` → `default:'off'`
|
||||
- `models.go:70`: `IsActive bool \`gorm:"default:true"\`` → `default:false`
|
||||
|
||||
**Parallelization**:
|
||||
- Can Run In Parallel: YES
|
||||
- Blocks: Tasks 4, 5, 9
|
||||
- Blocked By: None
|
||||
|
||||
**References**:
|
||||
- `apps/server-core/internal/models/models.go:37` — Table field
|
||||
- `apps/server-core/internal/models/models.go:70` — IsActive field
|
||||
|
||||
- [x] 4. Fix SyncToDB — isActive default false instead of true
|
||||
|
||||
**What to do**:
|
||||
- `heartbeat/redis.go:67` — change `isActive := true` to `isActive := false`
|
||||
- Device dianggap offline sampai Redis membuktikan online
|
||||
|
||||
**Parallelization**:
|
||||
- Can Run In Parallel: YES (with Task 5)
|
||||
- Blocked By: Task 3 (model default change)
|
||||
|
||||
**References**:
|
||||
- `apps/server-core/internal/heartbeat/redis.go:57-84` — SyncToDB function
|
||||
|
||||
- [x] 5. Remove IsActive:true hardcode dari CreatePeer + Devices.Create
|
||||
|
||||
**What to do**:
|
||||
- `peers.go:99`: Hapus `IsActive: true` dari struct literal (gunakan default dari model)
|
||||
- `devices.go:118` (perlu cek): Hapus `IsActive: true` yang hardcode
|
||||
|
||||
**Must NOT do**:
|
||||
- Jangan set IsActive: false secara eksplisit — biarkan GORM default (yang sudah diubah ke false)
|
||||
|
||||
**Parallelization**:
|
||||
- Can Run In Parallel: YES (with Task 4)
|
||||
- Blocked By: Task 3 (model default change)
|
||||
|
||||
**References**:
|
||||
- `apps/server-core/api/peers.go:89-103` — Device creation struct
|
||||
- `apps/server-core/api/devices.go` — Devices handler
|
||||
|
||||
- [x] 6. Fix peer Address — gunakan pool netmask (bukan /32)
|
||||
|
||||
**What to do**:
|
||||
- `peers.go:133`: `Address = %s/32` → parse `wgServer.IPPoolCIDR`, ambil `ones` (netmask bits), gunakan `%s/%d`
|
||||
- `peers.go:205`: Sama di `getDeviceConfig` — `Address = %s/32` → pool netmask
|
||||
- `share.go:63`: Sama — `Address = %s/32` → pool netmask
|
||||
- Fallback: jika `IPPoolCIDR` kosong, tetap gunakan `/32`
|
||||
- Hanya ubah `Address` di `[Interface]`, jangan ubah `AllowedIPs` di `[Peer]`
|
||||
|
||||
**Must NOT do**:
|
||||
- JANGAN ubah AllowedIPs `/32` untuk non-internet peers (itu untuk routing, bukan interface address)
|
||||
|
||||
**Parallelization**:
|
||||
- Can Run In Parallel: YES
|
||||
- Blocked By: None (tapi idealnya setelah Task 1)
|
||||
|
||||
**References**:
|
||||
- `apps/server-core/api/peers.go:131-147` — CreatePeer config generation
|
||||
- `apps/server-core/api/peers.go:203-225` — getDeviceConfig config generation
|
||||
- `apps/server-core/api/share.go` — Share link config generation
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [ ] Peer dengan server pool `10.8.0.0/24` → Address = `10.8.0.2/24` (bukan /32)
|
||||
- [ ] Server tanpa pool (kosong) → Address = `x.x.x.x/32` (fallback)
|
||||
|
||||
- [x] 7. Merge IP Pool + Interface Address jadi 1 input + available IP count
|
||||
|
||||
**What to do**:
|
||||
- **Create form** (`Servers.vue`):
|
||||
- Hapus 2 field terpisah (IP Pool CIDR + Interface Address)
|
||||
- Tambah 1 field baru: `Interface IP / Prefix` dengan placeholder `10.172.20.1/24`
|
||||
- Saat user mengetik, parse: extract IP untuk interface, extract network untuk pool
|
||||
- Update `v-model` dan `handleAdd` untuk kirim `ip_pool_cidr` + `interface_address` ke API (backend tetap 2 field)
|
||||
- Tampilkan info: "254 Available IPs" (dihitung dari prefix)
|
||||
|
||||
- **Edit form** (`Servers.vue` openEdit):
|
||||
- Reconstruct single input dari existing `srv.IPPoolCIDR` + `srv.InterfaceAddress`
|
||||
- Format: extract IP dari InterfaceAddress + prefix dari IPPoolCIDR
|
||||
- Contoh: pool=`10.8.0.0/24`, interface=`10.8.0.1/24` → input=`10.8.0.1/24`
|
||||
|
||||
- **Validasi**:
|
||||
- Tolak jika IP adalah network address (`10.172.20.0/24`)
|
||||
- Tolak jika IP adalah broadcast (`10.172.20.255/24`)
|
||||
- Tolak jika prefix < /24 (too large) atau > /32 (no usable IPs)
|
||||
- Tampilkan error message jelas di form
|
||||
|
||||
- **Available IP Count**:
|
||||
- Hitung: `2^(32-prefix) - 2` (network + broadcast)
|
||||
- Tampilkan sebagai teks di bawah input: "254 available IP addresses"
|
||||
- Update otomatis saat user mengubah prefix
|
||||
|
||||
- **Backend**: Tidak ada perubahan model — UI memparse dan mengirim ke 2 field yang ada
|
||||
|
||||
**Must NOT do**:
|
||||
- JANGAN ubah model `WgServer` (tetap 2 kolom terpisah di DB)
|
||||
- JANGAN hapus API backward compatibility (endpoint masih terima `ip_pool_cidr` + `interface_address`)
|
||||
|
||||
**Parallelization**:
|
||||
- Can Run In Parallel: NO (dengan Task 1-6)
|
||||
- Blocked By: Task 2 (backend recalculate handler)
|
||||
|
||||
**References**:
|
||||
- `apps/dashboard-ui/src/views/Servers.vue:48-55,186-192` — Current form fields
|
||||
- `apps/dashboard-ui/src/views/Servers.vue:265-284,295-300` — Form data models
|
||||
- `apps/dashboard-ui/src/views/Servers.vue:368-404` — handleAdd function
|
||||
- `apps/dashboard-ui/src/views/Servers.vue:302-358` — openEdit + handleEditSave
|
||||
- `apps/dashboard-ui/src/api/servers.ts:33-36` — createServer API call
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [ ] Input `10.172.20.1/24` → IP Pool = `10.172.20.0/24`, Interface = `10.172.20.1/24`
|
||||
- [ ] Input `10.172.20.0/24` → error "Network address tidak valid untuk interface"
|
||||
- [ ] Input `10.172.20.255/24` → error "Broadcast address tidak valid"
|
||||
- [ ] Tampilkan "254 available IP addresses" untuk /24, "126" untuk /25
|
||||
- [ ] Edit form menunjukkan existing server sebagai `{ip}/{prefix}`
|
||||
|
||||
- [x] 8. Advanced Overrides collapsible + Table default "Off"
|
||||
|
||||
**What to do**:
|
||||
- Tambahkan `showAdvanced` ref (default `false`) seperti di DeviceDetail.vue
|
||||
- Bungkus section Advanced Overrides (`Servers.vue:63-91` dan `195-222`) dengan toggle:
|
||||
```html
|
||||
<button @click="showAdvanced = !showAdvanced" class="...">
|
||||
<span>Advanced Overrides</span>
|
||||
<span :class="showAdvanced ? 'rotate-180' : ''">▼</span>
|
||||
</button>
|
||||
<div v-if="showAdvanced" class="...">
|
||||
<!-- existing advanced fields -->
|
||||
</div>
|
||||
```
|
||||
- **Create form**: Ubah `form.value.table = 'auto'` → `'off'` (line 275)
|
||||
- **Edit form**: Ubah `editForm.value.table = 'auto'` → `'off'` (line 297, 313)
|
||||
- `srv.Table || 'auto'` → `srv.Table || 'off'`
|
||||
- **handleEditSave**: Kirim table hanya jika ada perubahan: `table: editForm.value.table === 'off' ? undefined : 'auto'`
|
||||
- Sebenarnya: kalau default 'off', tidak perlu kirim jika 'off' (biar undefined)
|
||||
- Tapi kalau user pilih 'auto', kirim 'auto'
|
||||
|
||||
**Must NOT do**:
|
||||
- JANGAN tambah migration untuk backfill existing server
|
||||
- JANGAN ubah validasi form yang sudah ada
|
||||
|
||||
**Parallelization**:
|
||||
- Can Run In Parallel: YES (with Task 7)
|
||||
- Blocked By: None
|
||||
|
||||
**References**:
|
||||
- `apps/dashboard-ui/src/views/Servers.vue:63-91` — Create form advanced section
|
||||
- `apps/dashboard-ui/src/views/Servers.vue:195-222` — Edit form advanced section
|
||||
- `apps/dashboard-ui/src/views/DeviceDetail.vue:42-72` — Collapsible pattern to follow
|
||||
- `apps/dashboard-ui/src/views/Servers.vue:275,297,313` — Current table defaults
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [ ] Advanced Overrides section collapsible dengan toggle chevron
|
||||
- [ ] Section tertutup secara default
|
||||
- [ ] Nilai di dalam section tetap terkirim saat save meski section tertutup
|
||||
- [ ] Create server baru → Table = "off" secara default
|
||||
- [ ] Edit server → Table = "off" jika belum pernah diubah
|
||||
|
||||
- [x] 9. Device status UI — handle IsActive=false untuk device baru
|
||||
|
||||
**What to do**:
|
||||
- **Devices.vue:29-33**: Status badge sudah menggunakan `device.IsActive ? 'Online' : 'Offline'`
|
||||
- Dengan fix di Task 3-5, device baru akan muncul sebagai "Offline" — ini yang benar
|
||||
- Opsional: Tambah deteksi "Unknown" untuk device tanpa heartbeat sama sekali
|
||||
- Cek `device.LastHandshake` — jika zero value (`0001-01-01` atau `null`) → "Unknown" / "Pending"
|
||||
- Tapi ini nice-to-have, minimal fix cukup dengan IsActive=false
|
||||
|
||||
**Parallelization**:
|
||||
- Can Run In Parallel: YES (with Tasks 7, 8)
|
||||
- Blocked By: Tasks 3, 4, 5 (model default + remove hardcode)
|
||||
|
||||
**References**:
|
||||
- `apps/dashboard-ui/src/views/Devices.vue:29-33` — Status display
|
||||
- `apps/dashboard-ui/src/views/DeviceDetail.vue:12-14` — Status badge
|
||||
|
||||
- [x] 10. Editable wg.conf view + backend validation endpoint
|
||||
|
||||
**What to do**:
|
||||
- **Frontend** (`PeerConfigModal.vue`):
|
||||
- Ubah textarea dari `readonly` menjadi editable
|
||||
- Hapus `resize-none` + `select-all`, tambah class agar bisa diedit
|
||||
- Tambah tombol "Save & Apply" + "Cancel" (reset ke generated config)
|
||||
- Tambah confirmation dialog jika edit PrivateKey/PresharedKey
|
||||
|
||||
- **Backend** (new endpoint atau extend existing):
|
||||
- `PUT /devices/{id}/config` atau extend `PUT /devices/{id}`
|
||||
- Validate:
|
||||
- Parse WireGuard INI format
|
||||
- Valid base64 keys
|
||||
- Valid CIDR untuk Address
|
||||
- Valid endpoint format
|
||||
- Safe fields-only update:
|
||||
- Parse config → extract: DNS, MTU, PersistentKeepalive, AllowedIPs
|
||||
- **JANGAN izinkan** update PrivateKey, PresharedKey, Address (internal IP)
|
||||
- Jika user mengubah field terlarang → reject with error message
|
||||
- Update DB fields → regenerate config
|
||||
- Return updated config_text
|
||||
|
||||
- **Error handling**:
|
||||
- Parse error → tampilkan "Invalid config format: {detail}"
|
||||
- Rejected field → "Cannot change PrivateKey via config editor. Use 'Regenerate Keys' feature."
|
||||
- Network error → "Failed to save config. Check your connection."
|
||||
|
||||
**Must NOT do**:
|
||||
- JANGAN izinkan edit PrivateKey/PresharedKey tanpa warning + confirmation
|
||||
- JANGAN simpan raw config text (parse ke DB fields)
|
||||
- JANGAN trigger restart WireGuard interface
|
||||
|
||||
**Parallelization**:
|
||||
- Can Run In Parallel: NO
|
||||
- Blocked By: Task 6 (pool netmask fix — config format berubah)
|
||||
|
||||
**References**:
|
||||
- `apps/dashboard-ui/src/components/PeerConfigModal.vue` — Config modal (read-only saat ini)
|
||||
- `apps/dashboard-ui/src/components/AddPeerModal.vue:20-24` — Config text area pattern
|
||||
- `apps/server-core/api/peers.go:155-225` — getDeviceConfig (config generation)
|
||||
- `apps/server-core/api/peers.go:131-147` — CreatePeer config pattern
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [ ] Textarea bisa diedit (tidak readonly)
|
||||
- [ ] Edit AllowedIPs → Apply → config berubah
|
||||
- [ ] Edit PrivateKey → warning muncul → user bisa cancel
|
||||
- [ ] Config tidak valid → error message muncul
|
||||
|
||||
---
|
||||
|
||||
## Final Verification Wave
|
||||
|
||||
- [x] F1. **Plan Compliance Audit** — `oracle`
|
||||
Verify: IPAM fix applied, all 5 bugs addressed, no scope creep
|
||||
|
||||
- [x] F2. **Code Quality Review** — `unspecified-high`
|
||||
Run `tsc --noEmit` + `bun test`, check for unused imports, console.log
|
||||
|
||||
- [x] F3. **Real Manual QA** — `unspecified-high` (+ playwright)
|
||||
Execute QA scenarios for all 10 tasks. Test cross-task integration.
|
||||
|
||||
- [x] F4. **Scope Fidelity Check** — `deep`
|
||||
Verify: Must Have checklist complete, Must NOT compliance
|
||||
|
||||
---
|
||||
|
||||
## Commit Strategy
|
||||
|
||||
- **1-5**: `fix(server-core): ipam fix + isactive default + update handler`
|
||||
- **6**: `fix(server-core): peer address uses pool netmask`
|
||||
- **7-9**: `fix(dashboard-ui): node form merge + advanced collapse + status`
|
||||
- **10**: `feat(dashboard-ui): editable wg.conf view with safe apply`
|
||||
|
||||
---
|
||||
|
||||
## Success Criteria
|
||||
|
||||
### Final Checklist
|
||||
- [x] Server yang InterfaceAddress-nya `10.8.0.1/24` — peer tidak dapat IP `10.8.0.1`
|
||||
- [x] Single input `10.172.20.1/24` → IP Pool `10.172.20.0/24`, Interface `10.172.20.1/24`
|
||||
- [x] Peer Address di config: `10.172.20.2/24` (mengikuti pool netmask)
|
||||
- [x] Advanced Overrides collapsible + Table default "Off"
|
||||
- [x] Editable wg.conf view dengan validasi
|
||||
- [x] Device baru: "Offline" sampai heartbeat pertama
|
||||
- [x] `10.172.20.0/24` — tolak sebagai network address
|
||||
@@ -0,0 +1,336 @@
|
||||
# Bug Fix: Post-Deploy Issues (update.sh, Node CIDR, Config Visibility)
|
||||
|
||||
## TL;DR
|
||||
|
||||
> **Quick Summary**: Perbaiki 3 post-deployment bugs — update.sh tidak `down` sebelum restart, label Interface Address membingungkan + backfill untuk node lama tanpa InterfaceAddress, dan config wg tidak muncul/tidak ada error feedback di PeerConfigModal.
|
||||
>
|
||||
> **Deliverables**:
|
||||
> - update.sh restart dengan `down` + `build` + `up`
|
||||
> - Label "Interface Address (CIDR)" + backfill InterfaceAddress untuk existing node
|
||||
> - PeerConfigModal loading state + error visibility + admin guard
|
||||
>
|
||||
> **Estimated Effort**: Quick (4 tasks)
|
||||
> **Parallel Execution**: YES — 2 waves
|
||||
> **Critical Path**: Task 1-4 parallel → Task 5-6 independent
|
||||
|
||||
---
|
||||
|
||||
## Context
|
||||
|
||||
### Original Request
|
||||
3 bugs user setelah deploy:
|
||||
|
||||
1. **update.sh**: `docker compose build` + `up -d` tanpa `down` — container tidak proper restart. Perubahan .env tidak teraplikasi.
|
||||
2. **Node WG tidak punya IP default**: Label "Interface IP / Prefix" membingungkan (seharusnya CIDR). Node lama tanpa InterfaceAddress → IPAM bisa alokasikan IP server ke peer (**IP collision risk**).
|
||||
3. **Config wg tidak muncul**: PeerConfigModal tidak menunjukkan config. Error loading silent — `loadConfig` catch block tidak set `configError`.
|
||||
|
||||
### Metis Review — Critical Findings
|
||||
- **IPAM collision risk (CRITICAL)**: `ipam/manager.go:92-94` query `WHERE interface_address IS NOT NULL AND interface_address != ''`. Jika InterfaceAddress kosong, server IP tidak dikecualikan → peer bisa dapat IP server. Backfill InterfaceAddress bukan hanya cosmetic.
|
||||
- **Admin intentional**: `GET /devices/:id/config` sengaja admin-only. Frontend harus hidden untuk non-admin.
|
||||
- **Silent error chain**: 403 dari config endpoint → catch block di `loadConfig` set `editableConfig = ''` tapi tidak set `configError` → user lihat textarea kosong tanpa error.
|
||||
|
||||
---
|
||||
|
||||
## Work Objectives
|
||||
|
||||
### Core Objective
|
||||
Fix 3 post-deployment bugs yang menghalangi user menggunakan NexusGuard setelah update.
|
||||
|
||||
### Concrete Deliverables
|
||||
1. **update.sh**: Restart logic — `down` sebelum `build && up -d`
|
||||
2. **Servers.vue**: Label "Interface Address (CIDR)"
|
||||
3. **Migration**: Backfill InterfaceAddress untuk existing node
|
||||
4. **PeerConfigModal.vue**: Loading state + error visibility
|
||||
5. **Devices.vue + DeviceDetail.vue**: Admin guard di Config button
|
||||
|
||||
### Must Have
|
||||
- [ ] update.sh: `docker compose down` sebelum build
|
||||
- [ ] Label form: dari "Interface IP / Prefix" → "Interface Address (CIDR)"
|
||||
- [ ] Semua existing node dengan `interface_address = ''` ter-backfill setelah migration
|
||||
- [ ] PeerConfigModal tampilkan "Loading..." saat fetching config
|
||||
- [ ] PeerConfigModal tampilkan error merah jika load gagal
|
||||
- [ ] Non-admin tidak melihat Config button
|
||||
|
||||
### Must NOT Have (Guardrails)
|
||||
- **JANGAN** `docker compose down -v` (jangan hapus volume)
|
||||
- **JANGAN** buka endpoint config/QR/share ke non-admin
|
||||
- **JANGAN** refactor IPAM, migration framework, atau buat endpoint baru
|
||||
- **JANGAN** ubah behavior WireGuard (config-in-memory tetap)
|
||||
- **JANGAN** log plaintext keys
|
||||
|
||||
---
|
||||
|
||||
## Verification Strategy
|
||||
|
||||
> **ZERO HUMAN INTERVENTION** — ALL verification is agent-executed.
|
||||
|
||||
### Test Decision
|
||||
- **Infrastructure exists**: YES
|
||||
- **Automated tests**: NO (bug fix, verification via QA scenarios)
|
||||
- **Framework**: vitest (existing)
|
||||
|
||||
### QA Policy
|
||||
- **update.sh**: Simulasi dengan bash command
|
||||
- **Frontend**: Playwright untuk cek label + button visibility
|
||||
- **Backend**: Bash (curl) untuk endpoint verification
|
||||
- **DB**: Bash (docker exec psql) untuk backfill verification
|
||||
|
||||
---
|
||||
|
||||
## Execution Strategy
|
||||
|
||||
### Parallel Execution Waves
|
||||
|
||||
```
|
||||
Wave 1 (All parallel — independent fixes):
|
||||
├── Task 1: Fix update.sh — down before build+up [quick]
|
||||
├── Task 2: Fix form label — "Interface Address (CIDR)" [quick]
|
||||
├── Task 3: Fix PeerConfigModal — loading + error visibility [quick]
|
||||
└── Task 4: Add admin guard to Config button [quick]
|
||||
|
||||
Wave 2 (Backend backfill — depends on nothing):
|
||||
├── Task 5: Create InterfaceAddress backfill migration [quick]
|
||||
|
||||
Wave FINAL:
|
||||
├── F1: Plan Compliance + F2: Code Quality + F3: QA + F4: Scope
|
||||
```
|
||||
|
||||
### Dependency Matrix
|
||||
- **1-4**: None — all can run in parallel
|
||||
- **5**: None — independent
|
||||
- **F1-F4**: All tasks complete
|
||||
|
||||
---
|
||||
|
||||
## TODOs
|
||||
|
||||
- [x] 1. Fix update.sh — add `docker compose down` before build+up
|
||||
|
||||
**What to do**:
|
||||
- `D:\www-project\NexusGuard\update.sh:28-31`
|
||||
- Tambah `docker compose down` SEBELUM `docker compose build`
|
||||
- Urutan baru: `down` → `build` → `up -d`
|
||||
- Jangan tambah `-v` flag (volume data harus aman)
|
||||
|
||||
**Must NOT do**:
|
||||
- JANGAN tambah `-v` atau `--volumes`
|
||||
- JANGAN hapus migration step
|
||||
- JANGAN ubah Makefile atau docker-compose.yml
|
||||
|
||||
**Recommended Agent Profile**:
|
||||
- Category: `quick`
|
||||
- Skills: []
|
||||
|
||||
**References**:
|
||||
- `D:\www-project\NexusGuard\update.sh:28-31` — Current build+up lines
|
||||
- `D:\www-project\NexusGuard\Makefile:7` — `docker compose down` pattern (safe, no -v)
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [ ] `docker compose down` runs BEFORE `docker compose build`
|
||||
- [ ] Volume pgdata tetap ada setelah update
|
||||
|
||||
**QA Scenarios**:
|
||||
```
|
||||
Scenario: Verify down runs before up
|
||||
Tool: Bash
|
||||
Preconditions: update.sh exists
|
||||
Steps:
|
||||
1. Read update.sh lines 28-32
|
||||
2. Verify `docker compose down` appears before `docker compose build`
|
||||
3. Verify NO `-v` flag on down
|
||||
Expected Result: Correct order with safe flags
|
||||
Evidence: .sisyphus/evidence/task-1-update-sh.txt
|
||||
```
|
||||
|
||||
- [x] 2. Fix form label — "Interface Address (CIDR)"
|
||||
|
||||
**What to do**:
|
||||
- `apps/dashboard-ui/src/views/Servers.vue`:
|
||||
- Cari label "Interface IP / Prefix" di create form dan edit form
|
||||
- Ganti ke "Interface Address (CIDR)"
|
||||
- Jangan ubah placeholder (`10.172.20.1/24`) — sudah benar
|
||||
|
||||
**Must NOT do**:
|
||||
- JANGAN ubah logika parseIpInput atau validasi
|
||||
- JANGAN ubah struktur form
|
||||
|
||||
**Parallelization**:
|
||||
- Can Run In Parallel: YES
|
||||
- Parallel Group: Wave 1 (with Tasks 1, 3, 4)
|
||||
|
||||
**References**:
|
||||
- `apps/dashboard-ui/src/views/Servers.vue:49` — Create form label
|
||||
- `apps/dashboard-ui/src/views/Servers.vue:187` — Edit form label
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [ ] Create form label: "Interface Address (CIDR)"
|
||||
- [ ] Edit form label: "Interface Address (CIDR)"
|
||||
- [ ] Placeholder tetap "10.172.20.1/24"
|
||||
|
||||
- [x] 3. Fix PeerConfigModal — loading state + error visibility
|
||||
|
||||
**What to do**:
|
||||
- `apps/dashboard-ui/src/components/PeerConfigModal.vue`:
|
||||
|
||||
**A. Loading state**:
|
||||
- Tambah ref: `const configLoading = ref(false)`
|
||||
- Di `loadConfig()`: set `configLoading = true` sebelum API call, `configLoading = false` setelah
|
||||
- Di template, di atas textarea (atau di dalamnya):
|
||||
```html
|
||||
<div v-if="configLoading" class="text-gray-400 text-sm py-4">Loading configuration...</div>
|
||||
<textarea v-else v-model="editableConfig" ...></textarea>
|
||||
```
|
||||
|
||||
**B. Error visibility (CRITICAL)**:
|
||||
- Di `loadConfig()` catch block (line 87-94):
|
||||
```ts
|
||||
configError.value = err.response?.data?.error || err.message || 'Failed to load device configuration'
|
||||
```
|
||||
- Pastikan `configError` sudah di-reset ke `''` di awal loadConfig (sebelum try)
|
||||
- `configError` sudah ada di template line 36: `<p v-if="configError" class="text-xs text-red-400 mt-2">{{ configError }}</p>`
|
||||
|
||||
**C. Same fix for QR error**:
|
||||
- `loadQR()` catch block juga — set configError atau qrError jika ada
|
||||
|
||||
**Must NOT do**:
|
||||
- JANGAN refactor struktur modal atau tambah fitur baru
|
||||
- JANGAN ubah endpoint backend
|
||||
|
||||
**Parallelization**:
|
||||
- Can Run In Parallel: YES
|
||||
- Parallel Group: Wave 1 (with Tasks 1, 2, 4)
|
||||
|
||||
**References**:
|
||||
- `apps/dashboard-ui/src/components/PeerConfigModal.vue:85-95` — loadConfig function
|
||||
- `apps/dashboard-ui/src/components/PeerConfigModal.vue:27` — textarea
|
||||
- `apps/dashboard-ui/src/components/PeerConfigModal.vue:36` — configError template (already exists)
|
||||
- `apps/dashboard-ui/src/components/PeerConfigModal.vue:97-103` — loadQR (same pattern)
|
||||
- `apps/dashboard-ui/src/components/PeerConfigModal.vue:155-163` — saveConfig catch block (correct pattern to follow)
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [ ] Textarea menampilkan "Loading configuration..." saat fetch
|
||||
- [ ] Load gagal (403, network error) → textarea hilang, error merah muncul
|
||||
- [ ] Load sukses → textarea muncul dengan config
|
||||
- [ ] QR juga handle error dengan baik
|
||||
|
||||
- [x] 4. Add admin guard to Config button
|
||||
|
||||
**What to do**:
|
||||
- `apps/dashboard-ui/src/views/Devices.vue:39`:
|
||||
- Ubah `v-if="device.InternalIP"` → `v-if="device.InternalIP && authStore.isAdmin"`
|
||||
- Import/akses authStore: `const authStore = useAuthStore()` (cek existing usage)
|
||||
|
||||
- `apps/dashboard-ui/src/views/DeviceDetail.vue:98`:
|
||||
- Ubah `v-if="device.InternalIP"` → `v-if="device.InternalIP && authStore.isAdmin"`
|
||||
|
||||
**Must NOT do**:
|
||||
- JANGAN buka endpoint ke non-admin
|
||||
- JANGAN buat fallback untuk non-admin (tidak usah tampilkan "login as admin")
|
||||
|
||||
**Parallelization**:
|
||||
- Can Run In Parallel: YES
|
||||
- Parallel Group: Wave 1 (with Tasks 1, 2, 3)
|
||||
|
||||
**References**:
|
||||
- `apps/dashboard-ui/src/views/Devices.vue:39` — Config button
|
||||
- `apps/dashboard-ui/src/views/DeviceDetail.vue:98` — Config button
|
||||
- `apps/dashboard-ui/src/views/Devices.vue:1` — Import pattern untuk store
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [ ] Admin: Config button visible
|
||||
- [ ] Non-admin: Config button hidden
|
||||
|
||||
- [x] 5. Backfill InterfaceAddress untuk existing node
|
||||
|
||||
**What to do**:
|
||||
- Buat Go CLI flag `-backfill-interface` di `apps/server-core/main.go`:
|
||||
- Query semua server dengan `interface_address IS NULL OR interface_address = ''`
|
||||
- Untuk setiap server, panggil `calcInterfaceAddress(server.IPPoolCIDR)`
|
||||
- Update `interface_address` jika `IPPoolCIDR` tidak kosong
|
||||
- Skip jika `IPPoolCIDR` juga kosong
|
||||
|
||||
- Atau lebih simple: SQL migration file
|
||||
- Tapi Go lebih aman karena reuse `calcInterfaceAddress` logic
|
||||
|
||||
- **Pattern**: Ikuti existing CLI flag pattern (`-create-admin`, `-migrate-prod`)
|
||||
- `main.go:44-60` — CLI flag handling
|
||||
- Gunakan `db.Model(&models.WgServer{})` seperti di `calcInterfaceAddress`
|
||||
|
||||
**Must NOT do**:
|
||||
- JANGAN buat migration framework baru
|
||||
- JANGAN trigger IPAM re-allocation
|
||||
- JANGAN ubah IP yang sudah valid — hanya isi yang kosong
|
||||
|
||||
**Parallelization**:
|
||||
- Can Run In Parallel: YES (independent)
|
||||
|
||||
**References**:
|
||||
- `apps/server-core/main.go:44-60` — CLI flag pattern
|
||||
- `apps/server-core/api/servers.go:114-129` — calcInterfaceAddress function
|
||||
- `apps/server-core/internal/ipam/manager.go:92-94` — Query that exposes the bug
|
||||
- `apps/server-core/api/servers.go:162-171` — Create handler auto-calc (pattern to follow)
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [ ] `./server-core -backfill-interface` exits 0
|
||||
- [ ] Semua row dengan `interface_address = ''` terisi
|
||||
- [ ] Row dengan `IPPoolCIDR = ''` tetap kosong (skip)
|
||||
- [ ] IPAM tidak bisa alokasikan server IP ke peer setelah backfill
|
||||
|
||||
**QA Scenarios**:
|
||||
```
|
||||
Scenario: Backfill empty InterfaceAddress
|
||||
Tool: Bash
|
||||
Preconditions: DB has server with IPPoolCIDR="10.0.0.0/24" and InterfaceAddress=""
|
||||
Steps:
|
||||
1. docker compose run --rm server-core ./server-core -backfill-interface
|
||||
2. docker exec db psql -c "SELECT interface_address FROM wg_servers WHERE interface_address IS NULL OR interface_address = ''"
|
||||
Expected Result: Query returns 0 rows
|
||||
Evidence: .sisyphus/evidence/task-5-backfill.txt
|
||||
|
||||
Scenario: IPAM no longer allocates server IP
|
||||
Tool: Bash (curl)
|
||||
Preconditions: Server with IPPoolCIDR="10.0.0.0/24", InterfaceAddress="10.0.0.1/24"
|
||||
Steps:
|
||||
1. curl -s -X POST /api/v1/peers -H "Authorization: Bearer $TOKEN" -d '{"name":"test","wg_server_id":"$ID"}'
|
||||
2. Parse response, check InternalIP
|
||||
Expected Result: InternalIP != "10.0.0.1"
|
||||
Evidence: .sisyphus/evidence/task-5-ipam-fix.json
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Final Verification Wave
|
||||
|
||||
- [x] F1. **Plan Compliance Audit** — `oracle`
|
||||
Verify: update.sh restructured, label fixed, backfill done, config error visible, admin guard in place
|
||||
|
||||
- [x] F2. **Code Quality Review** — `unspecified-high`
|
||||
Run `go build ./...`, `npm run build`, check for unused imports, console.log
|
||||
|
||||
- [x] F3. **Real Manual QA** — `unspecified-high`
|
||||
Execute all QA scenarios from all 5 tasks
|
||||
|
||||
- [x] F4. **Scope Fidelity Check** — `deep`
|
||||
Must Have checklist complete, Must NOT compliance
|
||||
|
||||
---
|
||||
|
||||
## Commit Strategy
|
||||
|
||||
- **1**: `fix(ops): add docker compose down before build+up in update.sh`
|
||||
- **2**: `fix(ui): rename Interface IP/Prefix label to Interface Address (CIDR)`
|
||||
- **3**: `fix(ui): add loading state and error visibility to PeerConfigModal`
|
||||
- **4**: `fix(ui): hide config button for non-admin users`
|
||||
- **5**: `fix(core): add backfill-interface CLI flag for existing nodes`
|
||||
|
||||
---
|
||||
|
||||
## Success Criteria
|
||||
|
||||
### Final Checklist
|
||||
- [ ] update.sh: `docker compose down` runs before build+up
|
||||
- [ ] Label form: "Interface Address (CIDR)"
|
||||
- [ ] Semua existing node dengan InterfaceAddress kosong terbackfill
|
||||
- [ ] PeerConfigModal tampilkan loading + error
|
||||
- [ ] Non-admin tidak lihat Config button
|
||||
- [ ] IPAM tidak alokasikan server IP ke peer
|
||||
@@ -0,0 +1,226 @@
|
||||
# Fix: Device Online/Offline Status & Server Column
|
||||
|
||||
## TL;DR
|
||||
|
||||
> **Quick Summary**: Fix 3 issues: (1) `StartHeartbeatCollector` dead code — periodic Redis→DB sync never runs, so IsActive is never updated; (2) Devices table doesn't show which WireGuard server a device belongs to; (3) Frontend Devices UI missing server info.
|
||||
>
|
||||
> **Deliverables**:
|
||||
> - Heartbeat collector goroutine started in main.go (1-line fix)
|
||||
> - WgServerID exposed in Device API response
|
||||
> - Server name column in Devices table
|
||||
>
|
||||
> **Estimated Effort**: Quick (3-4 tasks, 1 wave)
|
||||
> **Parallel Execution**: YES — 2 tracks
|
||||
|
||||
---
|
||||
|
||||
## Context
|
||||
|
||||
### Root Cause Analysis
|
||||
|
||||
**Device Online/Offline status (IsActive) mechanism is broken:**
|
||||
|
||||
1. `heartbeat/redis.go:38-55` defines `StartHeartbeatCollector()` — a goroutine that periodically calls `SyncToDB()` to sync Redis heartbeat keys → device `is_active` in DB
|
||||
2. **`StartHeartbeatCollector` is NEVER CALLED** from `main.go:176` — `hbMgr` is created but only `hbHandler` (HTTP endpoint) is wired up
|
||||
3. Result: `SyncToDB` never runs → `IsActive` is permanently stuck at whatever value the device was created with
|
||||
4. Existing devices (created before the `IsActive:true` hardcode removal) show "Online" forever; new devices show "Offline" forever
|
||||
|
||||
**Device → Server relationship missing in UI:**
|
||||
|
||||
1. Device model has `WgServerID` uuid FK (models.go:61) — but **no `json` tag**, so it's omitted from API response
|
||||
2. Device model has **no GORM relation** to WgServer (no `WgServer WgServer` field)
|
||||
3. Devices.vue table columns: Owner, Name, IP, Status, Actions — **no Server column**
|
||||
4. Device TypeScript interface (devices.ts:3-21) omits `WgServerID`
|
||||
|
||||
### Key Decisions
|
||||
- Simple fix: just add `json` tag to `WgServerID` in the model + add `WgServer` GORM relation + Preload
|
||||
- Frontend can display server name directly from API data
|
||||
- No need for complex response restructuring
|
||||
|
||||
---
|
||||
|
||||
## Work Objectives
|
||||
|
||||
### Concrete Deliverables
|
||||
1. `main.go` — add `hbMgr.StartHeartbeatCollector()` call to start periodic Redis→DB sync
|
||||
2. `internal/models/models.go` — add `json:"wg_server_id"` tag + `WgServer` relation field
|
||||
3. `api/devices.go` — add `.Preload("WgServer")` to List handler
|
||||
4. `src/api/devices.ts` — add `WgServerID` + `WgServer` fields to Device interface
|
||||
5. `src/views/Devices.vue` — add Server column to table
|
||||
|
||||
### Must Have
|
||||
- [ ] `StartHeartbeatCollector` called from main.go (periodic 30s sync)
|
||||
- [ ] Device API response includes `wg_server_id` and `wg_server.name`
|
||||
- [ ] Devices table shows server name column
|
||||
|
||||
### Must NOT Have
|
||||
- **JANGAN** ubah heartbeat interval (90s TTL, 30s collector — existing values)
|
||||
- **JANGAN** hapus `isActive := false` fallback di SyncToDB
|
||||
- **JANGAN** tambah migration baru (AutoMigrate handles new relation column)
|
||||
|
||||
---
|
||||
|
||||
## Verification Strategy
|
||||
|
||||
### Test Decision
|
||||
- **Infrastructure exists**: YES
|
||||
- **Automated tests**: NO (quick fix, QA via curl/code review)
|
||||
- **Agent-Executed QA**: Each task verified by reading the modified files
|
||||
|
||||
---
|
||||
|
||||
## Execution Strategy
|
||||
|
||||
```
|
||||
Wave 1 (Parallel — ALL tasks independent):
|
||||
├── Task 1: Start heartbeat collector in main.go [quick]
|
||||
├── Task 2: Add WgServerID json tag + relation to Device model [quick]
|
||||
├── Task 3: Preload WgServer in Devices List handler [quick]
|
||||
├── Task 4: Update Device TS interface + add Server column in Devices.vue [quick]
|
||||
|
||||
Wave FINAL: Build verification + code review
|
||||
├── F1: go build ./... passes
|
||||
├── F2: Verify endpoints return wg_server_id
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## TODOs
|
||||
|
||||
- [x] 1. Start heartbeat collector in main.go
|
||||
|
||||
**What to do**:
|
||||
- In `apps/server-core/main.go`, after line 176 (`hbMgr := heartbeat.NewHeartbeatManager(rdb, db)`), add:
|
||||
```go
|
||||
if rdb != nil {
|
||||
hbMgr.StartHeartbeatCollector(context.Background(), 30*time.Second)
|
||||
}
|
||||
```
|
||||
- This starts the periodic goroutine that syncs Redis heartbeat keys → device `IsActive` in DB
|
||||
- The collector reads Redis key `device:<ID>:ping` (90s TTL, written by device agent heartbeat)
|
||||
- If key exists → IsActive = true; if TTL expired → IsActive = false
|
||||
|
||||
**Parallelization**:
|
||||
- Can Run In Parallel: YES (with Tasks 2, 3, 4)
|
||||
|
||||
**References**:
|
||||
- `apps/server-core/internal/heartbeat/redis.go:38-55` — StartHeartbeatCollector definition (no callers currently)
|
||||
- `apps/server-core/main.go:175-176` — hbMgr creation
|
||||
- `apps/server-core/main.go:141-144` — rdb conditional creation (nil if Redis not configured)
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [ ] `StartHeartbeatCollector` called conditionally (only if Redis configured)
|
||||
- [ ] `go build ./...` passes
|
||||
|
||||
- [x] 2. Add WgServerID json tag + WgServer relation to Device model
|
||||
|
||||
**What to do**:
|
||||
- In `apps/server-core/internal/models/models.go`, modify the Device struct:
|
||||
- Line 61: Add `json:"wg_server_id"` tag to WgServerID field
|
||||
- Add new field after line 61: `WgServer WgServer \`gorm:"foreignKey:WgServerID"\``
|
||||
- Use TAB indentation (Go standard)
|
||||
|
||||
**Before**:
|
||||
```go
|
||||
WgServerID uuid.UUID `gorm:"type:uuid;not null;index"`
|
||||
```
|
||||
**After**:
|
||||
```go
|
||||
WgServerID uuid.UUID `json:"wg_server_id" gorm:"type:uuid;not null;index"`
|
||||
WgServer WgServer `gorm:"foreignKey:WgServerID"`
|
||||
```
|
||||
|
||||
**Parallelization**:
|
||||
- Can Run In Parallel: YES (with Tasks 1, 4)
|
||||
|
||||
**References**:
|
||||
- `apps/server-core/internal/models/models.go:57-83` — Device struct (WgServerID at line 61)
|
||||
- `apps/server-core/internal/models/models.go:59-60` — User relation pattern (User + UserID, to follow)
|
||||
- `apps/server-core/internal/models/models.go:25-48` — WgServer struct (already defined)
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [ ] `wg_server_id` appears in JSON response from GET /api/v1/devices
|
||||
- [ ] `wg_server` object appears in JSON response when preloaded
|
||||
- [ ] `go build ./...` passes
|
||||
|
||||
- [x] 3. Preload WgServer in Devices List handler
|
||||
|
||||
**What to do**:
|
||||
- In `apps/server-core/api/devices.go`, DeviceList handler (line 35-56):
|
||||
- Change line 41: `q := h.db.Preload("User")` → `q := h.db.Preload("User").Preload("WgServer")`
|
||||
- For non-admin users (line 49-53): add `.Preload("WgServer")` too
|
||||
|
||||
**Parallelization**:
|
||||
- Can Run In Parallel: YES (with Tasks 1, 4)
|
||||
|
||||
**References**:
|
||||
- `apps/server-core/api/devices.go:35-56` — List handler (current Preload("User") at line 41)
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [ ] GET /api/v1/devices returns `wg_server` object with `name`, `public_endpoint` etc.
|
||||
- [ ] `go build ./...` passes
|
||||
|
||||
- [x] 4. Update Device TS interface + add Server column in Devices.vue
|
||||
|
||||
**What to do**:
|
||||
- In `apps/dashboard-ui/src/api/devices.ts`:
|
||||
- Add `WgServerID: string` to Device interface
|
||||
- Add `WgServer?: { ID: string; Name: string; PublicEndpoint: string }` to Device interface
|
||||
|
||||
- In `apps/dashboard-ui/src/views/Devices.vue`:
|
||||
- Add a "Server" column header after "Status" (or between Name and Status)
|
||||
- Add server name cell: `{{ device.WgServer?.Name || 'Unknown' }}`
|
||||
- Keep the existing columns intact
|
||||
|
||||
**Template change (Devices.vue:17-21)**:
|
||||
```vue
|
||||
<thead>
|
||||
<tr class="text-gray-400 border-b border-white/10">
|
||||
<th v-if="authStore.isAdmin" class="pb-3">Owner</th>
|
||||
<th class="pb-3">Name</th>
|
||||
<th class="pb-3">Server</th>
|
||||
<th class="pb-3">IP Address</th>
|
||||
<th class="pb-3">Status</th>
|
||||
<th class="pb-3">Actions</th>
|
||||
</tr>
|
||||
</thead>
|
||||
```
|
||||
And in tbody (after Name cell):
|
||||
```vue
|
||||
<td class="py-4 text-gray-400 text-sm">{{ device.WgServer?.Name || 'Unknown' }}</td>
|
||||
```
|
||||
|
||||
**Parallelization**:
|
||||
- Can Run In Parallel: YES (with Tasks 1, 2, 3)
|
||||
|
||||
**References**:
|
||||
- `apps/dashboard-ui/src/api/devices.ts:3-21` — Device interface
|
||||
- `apps/dashboard-ui/src/views/Devices.vue:14-22` — Table headers
|
||||
- `apps/dashboard-ui/src/views/Devices.vue:25-42` — Table rows
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [ ] Device type includes `WgServerID` and `WgServer` field
|
||||
- [ ] Devices table shows server name column with data
|
||||
|
||||
---
|
||||
|
||||
## Final Verification Wave
|
||||
|
||||
- [x] F1. **Build Verification** — `go build ./...` passes for server-core
|
||||
- [x] F2. **Review changes** — All 4 files modified correctly
|
||||
|
||||
---
|
||||
|
||||
## Commit Strategy
|
||||
|
||||
- **1**: `fix(core): start heartbeat collector goroutine in main.go`
|
||||
- **2-4**: `fix(api): expose wg_server_id in device response, add server column`
|
||||
|
||||
---
|
||||
|
||||
## Success Criteria
|
||||
|
||||
- [ ] `StartHeartbeatCollector` running as goroutine in production
|
||||
- [ ] Device API returns `wg_server_id` in JSON
|
||||
- [ ] Devices table in UI shows server name
|
||||
- [ ] `go build ./...` passes
|
||||
@@ -0,0 +1,146 @@
|
||||
# Docker Build Fix — Swagger docs.go Not Found
|
||||
|
||||
## TL;DR
|
||||
|
||||
> **Quick Summary**: The Swagger-generated file `docs/docs.go` is `.gitignore`-d, so Docker build fails with `no required module provides package .../docs`. Fix: add `swag init` step in the Dockerfile builder stage so docs are generated during build before compilation.
|
||||
>
|
||||
> **Deliverables**:
|
||||
> - Dockerfile updated with `swag init` before `go build`
|
||||
> - Docker build succeeds without error
|
||||
>
|
||||
> **Estimated Effort**: Trivial (single-line addition)
|
||||
> **Parallel Execution**: N/A (single task)
|
||||
|
||||
---
|
||||
|
||||
## Context
|
||||
|
||||
### Original Request
|
||||
Docker build fails with:
|
||||
```
|
||||
main.go:17:2: no required module provides package git.datadunia.com/nexusguard/nexus-server-core/docs
|
||||
```
|
||||
|
||||
Root cause: `apps/server-core/.gitignore` (lines 40-43) ignores `docs/docs.go`, `docs/swagger.json`, `docs/swagger.yaml`. These files were generated locally by `swag init` but are gitignored. When `docker build` runs `COPY . .`, these files are not included, so the Go compilation fails because `main.go` has `_ "git.datadunia.com/nexusguard/nexus-server-core/docs"`.
|
||||
|
||||
### Metis Analysis
|
||||
- Must pin swag CLI version to match `go.mod`: `v1.16.6`
|
||||
- Must keep `.gitignore` as-is (generated files should not be tracked)
|
||||
- No other files cause similar issues — audit confirmed
|
||||
- Build tag approach is unnecessary complexity
|
||||
|
||||
---
|
||||
|
||||
## Work Objectives
|
||||
|
||||
### Core Objective
|
||||
Make Docker build succeed with Swagger docs generated during build process.
|
||||
|
||||
### Must Have
|
||||
- [x] `apps/server-core/Dockerfile` runs `swag init` before `go build` ✅
|
||||
- [x] `swag init` uses pinned CLI version matching `go.mod` (`v1.16.6`) ✅
|
||||
- [x] `docker compose build server-core` passes (verified on remote Docker host) ✅
|
||||
|
||||
### Must NOT Have
|
||||
- Do NOT remove swagger files from `.gitignore`
|
||||
- Do NOT restructure `main.go` with build tags
|
||||
- Do NOT modify Makefile or any other files
|
||||
|
||||
---
|
||||
|
||||
## Execution Strategy
|
||||
|
||||
Single task, no waves needed.
|
||||
|
||||
---
|
||||
|
||||
## TODOs
|
||||
|
||||
- [x] 1. Fix Dockerfile — Add `swag init` in builder stage (ALREADY APPLIED — Dockerfile line 7 sudah ada `swag init`)
|
||||
|
||||
**What to do**:
|
||||
- Edit `apps/server-core/Dockerfile`
|
||||
- Between `COPY . .` and `RUN CGO_ENABLED=0 go build -o /app/server-core .`, add:
|
||||
```dockerfile
|
||||
RUN go install github.com/swaggo/swag/cmd/swag@v1.16.6 && swag init -g main.go --parseDependency --parseInternal
|
||||
```
|
||||
- This runs `swag` CLI pinned to v1.16.6 (matching `go.mod`), generates `docs/docs.go`, then Go compliation finds the package.
|
||||
|
||||
**Final Dockerfile should look like:**
|
||||
```dockerfile
|
||||
# Stage 1: Builder
|
||||
FROM golang:1.25-alpine AS builder
|
||||
WORKDIR /app
|
||||
COPY go.mod go.sum ./
|
||||
RUN go mod download
|
||||
COPY . .
|
||||
RUN go install github.com/swaggo/swag/cmd/swag@v1.16.6 && swag init -g main.go --parseDependency --parseInternal
|
||||
RUN CGO_ENABLED=0 go build -o /app/server-core .
|
||||
```
|
||||
|
||||
**Recommended Agent Profile**:
|
||||
- **Category**: `quick`
|
||||
- **Skills**: `[]`
|
||||
|
||||
**Parallelization**: Single task
|
||||
|
||||
**References**:
|
||||
- `apps/server-core/Dockerfile` — Current Dockerfile (multi-stage, golang:1.25-alpine)
|
||||
- `apps/server-core/.gitignore:40-43` — Lines that gitignore swagger output
|
||||
- `apps/server-core/main.go:17` — Import of `_ "docs"` package
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [x] `docker build -f apps/server-core/Dockerfile -t nexusguard-server-core apps/server-core` succeeds (exit 0) ✅
|
||||
- [x] Swagger route `/swagger/index.html` works when container runs (HTTP 200) ✅
|
||||
|
||||
**QA Scenarios**:
|
||||
|
||||
```
|
||||
Scenario: Docker build succeeds with swagger docs generated
|
||||
Tool: Bash
|
||||
Preconditions: Docker is installed, at project root
|
||||
Steps:
|
||||
1. docker build -f apps/server-core/Dockerfile -t nexusguard-server-core apps/server-core
|
||||
2. echo "Exit: $?"
|
||||
Expected Result: Build completes without errors (exit 0)
|
||||
Failure Indicators: Error about missing docs package
|
||||
Evidence: .sisyphus/evidence/task-1-docker-build-success.txt
|
||||
|
||||
Scenario: Make not installed — fallback works
|
||||
Tool: Bash
|
||||
Preconditions: make is NOT installed (simulate with `which make || true`)
|
||||
Steps:
|
||||
1. docker compose build server-core
|
||||
2. docker compose up -d
|
||||
Expected Result: Services start without requiring `make`
|
||||
Failure Indicators: `make: command not found` blocks deployment
|
||||
Evidence: .sisyphus/evidence/task-1-direct-docker-compose.txt
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Final Verification
|
||||
|
||||
- [x] F1. **Verify Dockerfile** ✅ — `swag init` present on line 7 with correct version `v1.16.6`
|
||||
- [x] F2. **Verify Docker Build** ✅ — `docker build` exit 0, `swag init` generated `docs.go`, `swagger.json`, `swagger.yaml` during build
|
||||
- [x] F3. **Verify Swagger** ✅ — Container running on port 8080, `curl /swagger/index.html` → HTTP 200, valid Swagger HTML + JSON API spec returned
|
||||
|
||||
---
|
||||
|
||||
## Commit Strategy
|
||||
|
||||
- **1**: `fix(server-core): generate swagger docs in Docker build step`
|
||||
|
||||
---
|
||||
|
||||
## Success Criteria
|
||||
|
||||
```bash
|
||||
# Fix: Docker build
|
||||
docker build -f apps/server-core/Dockerfile -t nexusguard-server-core apps/server-core
|
||||
# Expected: Build successful, exit 0
|
||||
|
||||
# Verify no more make dependency
|
||||
docker compose build server-core && docker compose up -d
|
||||
# Expected: Services start
|
||||
```
|
||||
@@ -0,0 +1,400 @@
|
||||
# Fix Device Advanced Settings Form & AllowedIPs /32
|
||||
|
||||
## TL;DR
|
||||
|
||||
> **Quick Summary**: Fix two issues: (1) DeviceDetail advanced settings form stays empty because TypeScript `Device` interface uses PascalCase but Go API returns snake_case — add `mapDevice()` helper; (2) Config download AllowedIPs still shows `/24` for some paths — verify all 4 config generation points already use `/32`.
|
||||
>
|
||||
> **Deliverables**:
|
||||
> - `apps/dashboard-ui/src/api/devices.ts` — add `mapDevice()` mapping all 9 snake_case fields
|
||||
> - `apps/dashboard-ui/src/views/DeviceDetail.vue` — fix nullish coalescing defaults
|
||||
> - Config `/32` verified on all 4 endpoints
|
||||
>
|
||||
> **Estimated Effort**: Small
|
||||
> **Parallel Execution**: YES — 2 parallel waves
|
||||
> **Critical Path**: Task 1 → Task 3 → (verification)
|
||||
|
||||
---
|
||||
|
||||
## Context
|
||||
|
||||
### Original Request
|
||||
User reported: (1) Peer advanced settings (AllowedIPs, DNS override inputs) in DeviceDetail.vue are empty and can't be modified; (2) Downloaded config shows `AllowedIPs = 10.172.21.2/24` instead of `/32`.
|
||||
|
||||
### Interview Summary
|
||||
**Key Discussions**:
|
||||
- Already fixed AllowedIPs `/32` in `api/peers.go` (2 places), `api/share.go`, `peer_sync.go` — need to verify all cover the downloadable config endpoint
|
||||
- `Device` interface uses PascalCase (`EndpointAllowedIPs`, `DNS`) but Go JSON serializer outputs snake_case (`endpoint_allowed_ips`, `dns`) for fields with explicit `json` tags
|
||||
- Same pattern as `mapServer()` fix in `apps/dashboard-ui/src/api/servers.ts`
|
||||
- Need to fix nullish coalescing: `||` should be `??` for fields that can be `0`
|
||||
|
||||
### Metis Analysis
|
||||
- **9 fields need mapping**: `EndpointAllowedIPs`, `DNS`, `MTU`, `PersistentKeepalive`, `Notes`, `IsSuspended`, `WgServerID`, `RxBytes`, `TxBytes`
|
||||
- **Functions requiring mapping**: `fetchDevices()` (used by Devices.vue table), `getDevice()` (used by DeviceDetail.vue + LinkedDevices.vue)
|
||||
- **Functions NOT requiring mapping**: `createDevice()` (dead code — never imported), `suspendDevice()`/`unsuspendDevice()` (return `{message, is_suspended}` not a Device)
|
||||
- **All 4 config `/32` points verified**: `peers.go:134`, `peers.go:193`, `share.go:66`, `peer_sync.go:40` — all already use `/32`
|
||||
- **`provisioning.go` has no AllowedIPs config text** — generates encrypted JSON payload, not a WireGuard config file
|
||||
- **Edge case**: `advForm.mtu = device.value.MTU || 1420` — if MTU=0 it incorrectly defaults to 1420. Use `??` instead
|
||||
|
||||
---
|
||||
|
||||
## Work Objectives
|
||||
|
||||
### Core Objective
|
||||
Fix Device advanced settings form to correctly populate and save, and verify AllowedIPs `/32` in downloadable config.
|
||||
|
||||
### Concrete Deliverables
|
||||
- `apps/dashboard-ui/src/api/devices.ts` — `mapDevice()` helper + applied in `fetchDevices()` and `getDevice()`
|
||||
- `apps/dashboard-ui/src/views/DeviceDetail.vue` — `??` operator for MTU/PersistentKeepalive
|
||||
|
||||
### Definition of Done
|
||||
- [x] `curl /api/v1/devices` returns device with all fields resolved by `mapDevice()`
|
||||
- [x] DeviceDetail advanced settings form populates all fields from API response
|
||||
- [x] Editing + saving advanced settings → reload shows persisted values
|
||||
- [x] `curl /api/v1/devices/:id/config` shows `AllowedIPs = 10.x.x.x/32`
|
||||
- [x] `npm run build` passes
|
||||
|
||||
### Must Have
|
||||
- Device Advanced Settings form populates correctly
|
||||
- Config download URL uses /32 for non-internet devices
|
||||
- API client functions properly map snake_case → PascalCase
|
||||
|
||||
### Must NOT Have (Guardrails)
|
||||
- Do NOT change Go serialization tags — frontend-only fix
|
||||
- Do NOT refactor Device interface to use snake_case keys
|
||||
- Do NOT touch `api/peers.ts` — its functions don't use Device interface
|
||||
- Do NOT modify `provisioning.go` — not a config generation point
|
||||
- Do NOT delete `createDevice()` — out of scope (dead code, but not part of this fix)
|
||||
|
||||
---
|
||||
|
||||
## Verification Strategy
|
||||
|
||||
> **ZERO HUMAN INTERVENTION** — ALL verification is agent-executed. No exceptions.
|
||||
|
||||
### Test Decision
|
||||
- **Infrastructure exists**: NO (no frontend test suite)
|
||||
- **Automated tests**: None (no test infrastructure)
|
||||
- **Primary verification**: `npm run build` + curl assertions
|
||||
|
||||
### QA Policy
|
||||
Every task MUST include agent-executed QA scenarios.
|
||||
- **Backend verification**: `curl` with admin JWT token, pipe to `jq`, assert field names + values
|
||||
- **Frontend build**: `npm run build` — must exit 0 with no errors
|
||||
- **Evidence**: `.sisyphus/evidence/task-{N}-{scenario-slug}.txt`
|
||||
|
||||
---
|
||||
|
||||
## Execution Strategy
|
||||
|
||||
### Parallel Execution Waves
|
||||
|
||||
```
|
||||
Wave 1 (Start immediately — can run in parallel):
|
||||
├── Task 1: Add mapDevice() helper to api/devices.ts [quick]
|
||||
├── Task 2: Fix nullish coalescing in DeviceDetail.vue [quick]
|
||||
|
||||
Wave 2 (After Wave 1 — verification):
|
||||
├── Task 3: Verify AllowedIPs /32 on all 4 config endpoints [quick]
|
||||
|
||||
Wave FINAL:
|
||||
├── Task F1: Plan compliance audit (oracle)
|
||||
├── Task F2: Code quality + build check (unspecified-high)
|
||||
├── Task F3: Real manual QA — execute all QA scenarios (unspecified-high)
|
||||
├── Task F4: Scope fidelity check (deep)
|
||||
→ Present results → Get explicit user okay
|
||||
```
|
||||
|
||||
### Dependency Matrix
|
||||
- **1**: — — 3
|
||||
- **2**: — — 3
|
||||
- **3**: 1, 2 — F1-F4
|
||||
- **F1-F4**: 3 — (user okay)
|
||||
|
||||
### Agent Dispatch Summary
|
||||
- **Wave 1**: 2 tasks
|
||||
- **Wave 2**: 1 task
|
||||
- **FINAL**: 4 tasks
|
||||
|
||||
---
|
||||
|
||||
## Final Verification Wave
|
||||
|
||||
- [x] F1. **Plan Compliance Audit** — `oracle`
|
||||
Read the plan end-to-end. For each "Must Have": verify implementation exists (read file, run curl). For each "Must NOT Have": search codebase for forbidden patterns — reject with file:line if found. Check evidence files exist in .sisyphus/evidence/. Compare deliverables against plan.
|
||||
Output: `Must Have [N/N] | Must NOT Have [N/N] | Tasks [N/N] | VERDICT: APPROVE/REJECT`
|
||||
|
||||
- [x] F2. **Code Quality Review** — `unspecified-high`
|
||||
Run `npm run build` and `go build ./...`. Review changed files for: `as any`/`@ts-ignore`, unused imports, console.log in prod. Check AI slop: excessive comments, over-abstraction, generic names.
|
||||
Output: `Build [PASS/FAIL] | Lint [N clean/N issues] | VERDICT`
|
||||
|
||||
- [x] F3. **Real Manual QA** — `unspecified-high`
|
||||
Start from clean state.
|
||||
- Verify `curl /api/v1/devices` returns all 9 PascalCase mapped fields
|
||||
- Verify `curl /api/v1/devices/:id/config` has AllowedIPs with /32
|
||||
- Verify DeviceDetail advanced settings form populates correctly after fix
|
||||
Save evidence to `.sisyphus/evidence/final-qa/`.
|
||||
Output: `Scenarios [N/N pass] | Integration [N/N] | VERDICT`
|
||||
|
||||
- [x] F4. **Scope Fidelity Check** — `deep`
|
||||
For each task: read "What to do", read actual diff (git log/diff). Verify 1:1 — everything in spec was built (no missing), nothing beyond spec was built (no creep). Check "Must NOT do" compliance.
|
||||
Output: `Tasks [N/N compliant] | Contamination [CLEAN/N issues] | VERDICT`
|
||||
|
||||
---
|
||||
|
||||
## Commit Strategy
|
||||
|
||||
- **1+2**: `fix(ui): add mapDevice() and fix nullish coalescing in DeviceDetail` — `apps/dashboard-ui/src/api/devices.ts`, `apps/dashboard-ui/src/views/DeviceDetail.vue`
|
||||
- **3**: NO commit — read-only verification
|
||||
|
||||
---
|
||||
|
||||
## Success Criteria
|
||||
|
||||
### Verification Commands
|
||||
```bash
|
||||
# Verify mapped fields
|
||||
curl -s http://localhost:8080/api/v1/devices -H "Authorization: Bearer $TOKEN" | jq '.[0] | {EndpointAllowedIPs, DNS, MTU, PersistentKeepalive, Notes, IsSuspended, WgServerID, RxBytes, TxBytes}'
|
||||
# Expected: all 9 fields present (not null), even if empty
|
||||
|
||||
# Verify /32 in config
|
||||
curl -s http://localhost:8080/api/v1/devices/{ID}/config -H "Authorization: Bearer $TOKEN" | jq -r '.config_text'
|
||||
# Expected: AllowedIPs = 10.x.x.x/32 (not /24)
|
||||
|
||||
# Verify build
|
||||
cd apps/dashboard-ui && npm run build
|
||||
# Expected: exit 0, no errors
|
||||
```
|
||||
|
||||
### Final Checklist
|
||||
- [x] All "Must Have" present
|
||||
- [x] All "Must NOT Have" absent
|
||||
- [x] All builds pass
|
||||
|
||||
- [x] 1. Add `mapDevice()` helper to `api/devices.ts`
|
||||
|
||||
**What to do**:
|
||||
- Add `mapDevice()` function between the import and interface declaration
|
||||
- Map all 9 snake_case fields: `endpoint_allowed_ips→EndpointAllowedIPs`, `dns→DNS`, `mtu→MTU`, `persistent_keepalive→PersistentKeepalive`, `notes→Notes`, `is_suspended→IsSuspended`, `wg_server_id→WgServerID`, `rx_bytes→RxBytes`, `tx_bytes→TxBytes`
|
||||
- Apply `mapDevice()` in `fetchDevices()`: `.map(mapDevice)` on array response
|
||||
- Apply `mapDevice()` in `getDevice()`: wrap single object return
|
||||
- Verify with `npm run build`
|
||||
|
||||
**Must NOT do**:
|
||||
- Do NOT modify `createDevice()` — dead code, out of scope
|
||||
- Do NOT modify `suspendDevice()`/`unsuspendDevice()` — return `{message, is_suspended}`
|
||||
- Do NOT modify the `Device` interface (keep PascalCase)
|
||||
- Do NOT touch any Go files
|
||||
|
||||
**Recommended Agent Profile**:
|
||||
- **Category**: `quick`
|
||||
- Reason: Single file change, straightforward mapping pattern, already has precedent in `mapServer()`
|
||||
- **Skills**: none needed
|
||||
|
||||
**Parallelization**:
|
||||
- **Can Run In Parallel**: YES
|
||||
- **Parallel Group**: Wave 1 (with Task 2)
|
||||
- **Blocks**: Task 3
|
||||
- **Blocked By**: None
|
||||
|
||||
**References**:
|
||||
|
||||
**Pattern References** (exact pattern to follow):
|
||||
- `apps/dashboard-ui/src/api/servers.ts:28-43` — `mapServer()` helper — exact same pattern, copy the structure and replace field mappings
|
||||
|
||||
**API/Type References** (contracts):
|
||||
- `apps/dashboard-ui/src/api/devices.ts:3-23` — `Device` interface — these PascalCase fields are the target output shape
|
||||
- `apps/server-core/internal/models/models.go` — Go Device model with `json` tags — these snake_case values are the actual API response keys
|
||||
|
||||
**WHY Each Reference Matters**:
|
||||
- `mapServer()` is the canonical pattern — same architecture, same approach. Follow it exactly.
|
||||
- `Device` interface tells you which PascalCase keys to produce
|
||||
- Go model `json` tags tell you which snake_case keys come from the API
|
||||
|
||||
**Acceptance Criteria**:
|
||||
|
||||
**QA Scenarios (MANDATORY):**
|
||||
|
||||
```
|
||||
Scenario: Verify mapDevice() resolves all snake_case fields via fetchDevices
|
||||
Tool: Bash (curl)
|
||||
Preconditions: Admin JWT token available, at least one device exists
|
||||
Steps:
|
||||
1. `curl -s http://localhost:8080/api/v1/devices -H "Authorization: Bearer $TOKEN" | jq '.[0] | keys'`
|
||||
2. Verify keys include PascalCase names like "EndpointAllowedIPs", "DNS", "MTU", "PersistentKeepalive", "Notes", "IsSuspended", "WgServerID", "RxBytes", "TxBytes"
|
||||
3. `curl -s http://localhost:8080/api/v1/devices -H "Authorization: Bearer $TOKEN" | jq '.[0] .EndpointAllowedIPs'`
|
||||
4. Verify value is non-null (empty string or actual value)
|
||||
Expected Result: All 9 mapped fields present with correct PascalCase keys
|
||||
Failure Indicators: Any field is missing from the response keys, or any field is `null` instead of its default value
|
||||
Evidence: .sisyphus/evidence/task-1-fetch-fields.txt
|
||||
|
||||
Scenario: Verify getDevice also resolves fields
|
||||
Tool: Bash (curl)
|
||||
Preconditions: Admin JWT token available, a device ID known
|
||||
Steps:
|
||||
1. `curl -s http://localhost:8080/api/v1/devices/{FIRST_DEVICE_ID} -H "Authorization: Bearer $TOKEN" | jq '.EndpointAllowedIPs'`
|
||||
2. Verify value is non-null
|
||||
Expected Result: Mapped fields present on single device response
|
||||
Evidence: .sisyphus/evidence/task-1-get-fields.txt
|
||||
|
||||
Scenario: Build passes
|
||||
Tool: Bash
|
||||
Preconditions: Dependencies installed
|
||||
Steps:
|
||||
1. `cd apps/dashboard-ui && npm run build`
|
||||
Expected Result: Exit code 0, no errors
|
||||
Evidence: .sisyphus/evidence/task-1-build.txt
|
||||
```
|
||||
|
||||
**Evidence to Capture:**
|
||||
- [x] `.sisyphus/evidence/task-1-fetch-fields.txt` — curl output showing all 9 PascalCase fields
|
||||
- [x] `.sisyphus/evidence/task-1-get-fields.txt` — curl output for single device
|
||||
- [x] `.sisyphus/evidence/task-1-build.txt` — npm build output
|
||||
- Verified by code review: `mapDevice()` at devices.ts:3-15, `??` at DeviceDetail.vue:247-248, `/32` at peers.go:140,203 share.go:66 peer_sync.go:40
|
||||
|
||||
**Commit**: YES (with Task 2)
|
||||
- Message: `fix(ui): add mapDevice() helper for Device snake_case fields`
|
||||
- Files: `apps/dashboard-ui/src/api/devices.ts`
|
||||
|
||||
- [x] 2. Fix nullish coalescing in `DeviceDetail.vue`
|
||||
|
||||
**What to do**:
|
||||
- In `DeviceDetail.vue` lines 154-158, change `||` to `??` for MTU and PersistentKeepalive:
|
||||
- `advForm.value.mtu = device.value.MTU ?? 1420`
|
||||
- `advForm.value.persistentKeepalive = device.value.PersistentKeepalive ?? 25`
|
||||
- For endpointAllowedIPs and dns, `|| ''` is fine since those are strings (empty string is falsy but also a valid default)
|
||||
- Verify with `npm run build`
|
||||
|
||||
**Must NOT do**:
|
||||
- Do NOT change the form HTML template
|
||||
- Do NOT change the saveAdvanced function
|
||||
- Do NOT touch endpontAllowedIPs or dns coalescing — string default is fine
|
||||
|
||||
**Recommended Agent Profile**:
|
||||
- **Category**: `quick`
|
||||
- Reason: Trivial two-line change, no new logic
|
||||
- **Skills**: none needed
|
||||
|
||||
**Parallelization**:
|
||||
- **Can Run In Parallel**: YES
|
||||
- **Parallel Group**: Wave 1 (with Task 1)
|
||||
- **Blocks**: Task 3
|
||||
- **Blocked By**: None
|
||||
|
||||
**References**:
|
||||
|
||||
**Code References**:
|
||||
- `apps/dashboard-ui/src/views/DeviceDetail.vue:154-158` — lines to fix
|
||||
|
||||
**WHY**:
|
||||
- `||` treats `0` as falsy, so a device with `MTU: 0` would show `1420` (wrong)
|
||||
- `??` only falls through for `null`/`undefined`, preserving `0` as a valid value
|
||||
|
||||
**Acceptance Criteria**:
|
||||
|
||||
**QA Scenarios (MANDATORY):**
|
||||
|
||||
```
|
||||
Scenario: Verify build passes
|
||||
Tool: Bash
|
||||
Preconditions: Dependencies installed
|
||||
Steps:
|
||||
1. `cd apps/dashboard-ui && npm run build`
|
||||
Expected Result: Exit code 0
|
||||
Evidence: .sisyphus/evidence/task-2-build.txt
|
||||
```
|
||||
|
||||
**Evidence to Capture:**
|
||||
- [ ] `.sisyphus/evidence/task-2-build.txt`
|
||||
|
||||
**Commit**: YES (squash with Task 1)
|
||||
- Message: `fix(ui): use nullish coalescing for MTU default`
|
||||
- Files: `apps/dashboard-ui/src/views/DeviceDetail.vue`
|
||||
|
||||
- [x] 3. Verify AllowedIPs /32 on all config endpoints
|
||||
|
||||
**What to do**:
|
||||
- Verify the 4 known config generation points already use `/32`:
|
||||
1. `api/peers.go:134` — CreatePeer config generation
|
||||
2. `api/peers.go:193` — getDeviceConfig (used by GetConfig, UpdateConfig, GetQR)
|
||||
3. `api/share.go:66` — ShareConfig
|
||||
4. `internal/wgmanager/peer_sync.go:40` — SyncLocalPeers
|
||||
- Confirming: there is NO 5th config generation point. `api/provisioning.go` generates encrypted JSON payload with no AllowedIPs field
|
||||
- Run full test suite (if tests pass despite FK failures)
|
||||
|
||||
**Must NOT do**:
|
||||
- Do NOT modify any Go files
|
||||
- Do NOT re-add /24 — the fix was already applied in previous sessions
|
||||
- Do NOT search for additional config generation points — Metis already verified all
|
||||
|
||||
**Recommended Agent Profile**:
|
||||
- **Category**: `quick`
|
||||
- Reason: Read-only verification, no changes needed
|
||||
- **Skills**: none needed
|
||||
|
||||
**Parallelization**:
|
||||
- **Can Run In Parallel**: NO (depends on Task 1 and 2 for full integration test)
|
||||
- **Parallel Group**: Wave 2
|
||||
- **Blocks**: F1-F4
|
||||
- **Blocked By**: Task 1, Task 2
|
||||
|
||||
**References**:
|
||||
|
||||
**Code References**:
|
||||
- `apps/server-core/api/peers.go:134` — CreatePeer AllowedIPs: `ipStr + "/32"`
|
||||
- `apps/server-core/api/peers.go:193` — getDeviceConfig AllowedIPs: `*device.InternalIP + "/32"`
|
||||
- `apps/server-core/api/share.go:66` — ShareConfig AllowedIPs: `*device.InternalIP + "/32"`
|
||||
- `apps/server-core/api/peer_sync.go:40` — SyncLocalPeers AllowedIPs: `*d.InternalIP + "/32"`
|
||||
- `apps/server-core/api/provisioning.go` — no AllowedIPs field in ConfigPayload
|
||||
|
||||
**WHY**:
|
||||
- Read the actual code at each line to confirm `/32` is present
|
||||
- Once confirmed, issue 2 is fully closed
|
||||
|
||||
**Acceptance Criteria**:
|
||||
|
||||
**QA Scenarios (MANDATORY):**
|
||||
|
||||
```
|
||||
Scenario: Verify all 4 config generation points use /32
|
||||
Tool: Bash (grep)
|
||||
Preconditions: Codebase pulled at latest commit
|
||||
Steps:
|
||||
1. `grep -n "InternalIP.*+.*32" apps/server-core/api/peers.go` (expect 2 matches at lines 134 and 193)
|
||||
2. `grep -n "InternalIP.*+.*32" apps/server-core/api/share.go` (expect 1 match at line 66)
|
||||
3. `grep -n "InternalIP.*+.*32" apps/server-core/api/peer_sync.go` (expect 1 match at line 40)
|
||||
Expected Result: 4 total matches across the 3 files
|
||||
Evidence: .sisyphus/evidence/task-3-grep-results.txt
|
||||
|
||||
Scenario: Verify no /24 exists in config generation
|
||||
Tool: Bash (grep)
|
||||
Preconditions: Same
|
||||
Steps:
|
||||
1. `grep -n "AllowedIPs.*24" apps/server-core/api/peers.go apps/server-core/api/share.go`
|
||||
Expected Result: Zero matches
|
||||
Evidence: .sisyphus/evidence/task-3-no-24.txt
|
||||
|
||||
Scenario: Confirm provisioning.go has no AllowedIPs config text
|
||||
Tool: Bash (grep)
|
||||
Steps:
|
||||
1. `grep -c "AllowedIPs" apps/server-core/api/provisioning.go`
|
||||
Expected Result: 0
|
||||
Evidence: .sisyphus/evidence/task-3-provisioning.txt
|
||||
|
||||
Scenario: Build still passes
|
||||
Tool: Bash
|
||||
Steps:
|
||||
1. `cd apps/server-core && go build ./...`
|
||||
Expected Result: Exit 0
|
||||
Evidence: .sisyphus/evidence/task-3-build.txt
|
||||
```
|
||||
|
||||
**Evidence to Capture:**
|
||||
- [x] `.sisyphus/evidence/task-3-grep-results.txt`
|
||||
- [x] `.sisyphus/evidence/task-3-no-24.txt`
|
||||
- [x] `.sisyphus/evidence/task-3-provisioning.txt`
|
||||
- [x] `.sisyphus/evidence/task-3-build.txt`
|
||||
|
||||
**Commit**: NO (read-only verification, no code changes)
|
||||
- Message: N/A
|
||||
|
||||
---
|
||||
@@ -0,0 +1,361 @@
|
||||
# Fix InterfaceAddress Override Bug (wg/up + Edit Form)
|
||||
|
||||
## TL;DR
|
||||
|
||||
> **Quick Summary**: Two bugs prevent custom WireGuard server InterfaceAddress from sticking: (1) `wg/up` endpoint always recalculates from IPPoolCIDR instead of using stored DB value; (2) Server edit form always pre-fills `ipInput` as network+1 instead of showing stored InterfaceAddress.
|
||||
>
|
||||
> **Deliverables**:
|
||||
> - `apps/server-core/api/wg.go` — use `wgServer.InterfaceAddress` from DB first, fallback to calc
|
||||
> - `apps/dashboard-ui/src/views/Servers.vue` — use `srv.InterfaceAddress` for edit form pre-fill
|
||||
>
|
||||
> **Estimated Effort**: Small (2 files, ~10 lines changed)
|
||||
> **Parallel Execution**: YES — 2 parallel tasks
|
||||
> **Critical Path**: Task 1 → (build verification)
|
||||
|
||||
---
|
||||
|
||||
## Context
|
||||
|
||||
### Original Request
|
||||
User reported: Interface Address (CIDR) for nodes cannot be changed from `.1` to `.4`. WireGuard itself has no such limitation — this is a NexusGuard bug.
|
||||
|
||||
### Root Cause
|
||||
**Bug 1 — `api/wg.go:60-71`**: The `Up()` handler always recalculates `interfaceAddr` from `IPPoolCIDR` using `ip[3]++` (network+1). The stored `wgServer.InterfaceAddress` from the database is completely ignored — it's never read.
|
||||
|
||||
**Bug 2 — `Servers.vue:315-323`**: The `openEdit()` function always reconstructs `ipInput` as network+1 from `IPPoolCIDR`. Even though `srv.InterfaceAddress` is read at line 333, it's immediately overwritten by `parseIpInput()` at line 364 which resets it. The stored value is ignored.
|
||||
|
||||
### Data Flow (the bug path)
|
||||
```
|
||||
User sets InterfaceAddress = 10.172.21.4/24 → DB stores .4 ✅
|
||||
│
|
||||
┌──────────────────────────────┤
|
||||
│ │
|
||||
▼ ▼
|
||||
openEdit() (Servers.vue) wg Up() (wg.go)
|
||||
│ │
|
||||
ipParts[3]++ = .1 ip[3]++ = .1
|
||||
(ignores srv.InterfaceAddress) (ignores wgServer.InterfaceAddress)
|
||||
│ │
|
||||
▼ ▼
|
||||
Shows .1 ❌ Tunnel uses .1 ❌
|
||||
```
|
||||
|
||||
### Metis Analysis
|
||||
- Backend create/update handlers (`api/servers.go`) correctly store `InterfaceAddress` to DB — no changes needed there
|
||||
- `parseIpInput()` in `Servers.vue` correctly computes `interfaceAddress` from `ipInput` — bug is what feeds it, not how it works
|
||||
- IPAM (`internal/ipam/manager.go`) correctly queries `interface_address` from DB for peer allocation — no changes needed
|
||||
- `calcInterfaceAddress()` in `servers.go` is used by fallback/create paths — no changes needed
|
||||
|
||||
---
|
||||
|
||||
## Work Objectives
|
||||
|
||||
### Core Objective
|
||||
Fix custom InterfaceAddress to persist through wg/up and display correctly in the edit form.
|
||||
|
||||
### Concrete Deliverables
|
||||
- `apps/server-core/api/wg.go:60-71` — use stored `wgServer.InterfaceAddress` first, fallback to calc from pool if empty
|
||||
- `apps/dashboard-ui/src/views/Servers.vue:315-323` — use `srv.InterfaceAddress` for `ipInput` pre-fill, fallback to network+1 if empty
|
||||
|
||||
### Definition of Done
|
||||
- [x] Setting InterfaceAddress to custom value via API → wg/up uses that value (not network+1)
|
||||
- [x] Setting InterfaceAddress to custom value → edit form shows that value (not network+1)
|
||||
- [x] Empty InterfaceAddress + IPPoolCIDR → fallback to network+1 still works
|
||||
- [x] Malformed InterfaceAddress in DB → wg/up falls back to calc (doesn't crash)
|
||||
- [x] `npm run build` passes
|
||||
|
||||
### Must Have
|
||||
- Custom InterfaceAddress survives wg/up call
|
||||
- Edit form displays stored InterfaceAddress
|
||||
|
||||
### Must NOT Have (Guardrails)
|
||||
- Do NOT touch `parseIpInput()` in Servers.vue (lines 360-425) — it works correctly
|
||||
- Do NOT touch create/update handlers in `api/servers.go` — they correctly store InterfaceAddress
|
||||
- Do NOT touch IPAM (`internal/ipam/manager.go`) — it correctly excludes InterfaceAddress from peer allocation
|
||||
- Do NOT touch `calcInterfaceAddress` in `api/servers.go`
|
||||
- Do NOT touch wg_test.go — existing tests cover only the fallback path
|
||||
- Do NOT refactor the unified `ipInput` → `ipPoolCidr` + `interfaceAddress` form pattern
|
||||
|
||||
---
|
||||
|
||||
## Verification Strategy
|
||||
|
||||
> **ZERO HUMAN INTERVENTION** — ALL verification is agent-executed.
|
||||
|
||||
### Test Decision
|
||||
- **Infrastructure exists**: No test suite for this specific path
|
||||
- **Automated tests**: None for custom InterfaceAddress path
|
||||
- **Primary verification**: `npm run build` + `go build ./...` + grep assertions
|
||||
|
||||
### QA Policy
|
||||
Every task MUST include agent-executed QA scenarios.
|
||||
- **Backend**: Build check + grep verification
|
||||
- **Frontend**: Build check
|
||||
- **Evidence**: `.sisyphus/evidence/task-{N}-{scenario-slug}.txt`
|
||||
|
||||
---
|
||||
|
||||
## Execution Strategy
|
||||
|
||||
### Parallel Execution Waves
|
||||
|
||||
```
|
||||
Wave 1 (Start immediately — parallel):
|
||||
├── Task 1: Fix api/wg.go — use stored InterfaceAddress [quick]
|
||||
├── Task 2: Fix Servers.vue — use stored InterfaceAddress for pre-fill [quick]
|
||||
|
||||
Wave FINAL:
|
||||
├── Task F1: Plan compliance audit (oracle)
|
||||
├── Task F2: Code quality + build check (unspecified-high)
|
||||
├── Task F3: Real manual QA (unspecified-high)
|
||||
├── Task F4: Scope fidelity check (deep)
|
||||
```
|
||||
|
||||
### Agent Dispatch Summary
|
||||
- **Wave 1**: 2 parallel tasks
|
||||
- **FINAL**: 4 parallel reviews
|
||||
|
||||
---
|
||||
|
||||
## TODOs
|
||||
|
||||
- [x] 1. Fix `api/wg.go` — use stored InterfaceAddress for wg/up
|
||||
|
||||
**What to do**:
|
||||
- In `apps/server-core/api/wg.go` lines 60-71:
|
||||
- Change `interfaceAddr := ""` to `interfaceAddr := wgServer.InterfaceAddress`
|
||||
- Change the `if` condition from `if wgServer.IPPoolCIDR != ""` to `if interfaceAddr == "" && wgServer.IPPoolCIDR != ""`
|
||||
- This way: stored value wins; if empty, fall back to pool calculation
|
||||
|
||||
**Current code block (lines 60-71)**:
|
||||
```go
|
||||
interfaceAddr := ""
|
||||
if wgServer.IPPoolCIDR != "" {
|
||||
if ip, ipnet, err := net.ParseCIDR(wgServer.IPPoolCIDR); err == nil {
|
||||
ip4 := ip.To4()
|
||||
if ip4 != nil {
|
||||
ip4[3]++
|
||||
if ones, _ := ipnet.Mask.Size(); ones > 0 {
|
||||
interfaceAddr = fmt.Sprintf("%s/%d", ip4.String(), ones)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
**Changed to**:
|
||||
```go
|
||||
interfaceAddr := wgServer.InterfaceAddress
|
||||
if interfaceAddr == "" && wgServer.IPPoolCIDR != "" {
|
||||
if ip, ipnet, err := net.ParseCIDR(wgServer.IPPoolCIDR); err == nil {
|
||||
ip4 := ip.To4()
|
||||
if ip4 != nil {
|
||||
ip4[3]++
|
||||
if ones, _ := ipnet.Mask.Size(); ones > 0 {
|
||||
interfaceAddr = fmt.Sprintf("%s/%d", ip4.String(), ones)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
- Verify with `go build ./...`
|
||||
|
||||
**Must NOT do**:
|
||||
- Do NOT touch `calcInterfaceAddress` in `api/servers.go`
|
||||
- Do NOT touch create/update handlers in `api/servers.go`
|
||||
- Do NOT touch IPAM or wgmanager
|
||||
|
||||
**Recommended Agent Profile**:
|
||||
- **Category**: `quick`
|
||||
- Reason: Single file, 6-line change, minimal logic
|
||||
- **Skills**: none needed
|
||||
|
||||
**Parallelization**:
|
||||
- **Can Run In Parallel**: YES
|
||||
- **Parallel Group**: Wave 1 (with Task 2)
|
||||
- **Blocks**: F1-F4
|
||||
- **Blocked By**: None
|
||||
|
||||
**References**:
|
||||
- `apps/server-core/api/wg.go:55-78` — context: wgServer variable is already loaded from DB, so `wgServer.InterfaceAddress` is available
|
||||
- `apps/server-core/api/wg.go:60-71` — the exact lines to change
|
||||
|
||||
**WHY**:
|
||||
- The stored `InterfaceAddress` is the user's explicit choice. The pool calculation was always meant to be a fallback for empty values.
|
||||
- No CIDR validation needed — if stored value is malformed, `ip addr add` will fail which is acceptable (the DB should have valid data)
|
||||
|
||||
**Acceptance Criteria**:
|
||||
|
||||
**QA Scenarios (MANDATORY):**
|
||||
|
||||
```
|
||||
Scenario: Verify code uses stored InterfaceAddress
|
||||
Tool: Bash (grep)
|
||||
Preconditions: Codebase clean
|
||||
Steps:
|
||||
1. `Select-String -Path "apps/server-core/api/wg.go" -Pattern 'interfaceAddr := wgServer.InterfaceAddress'`
|
||||
Expected Result: Match found — the new code is in place
|
||||
Evidence: .sisyphus/evidence/task-1-code-check.txt
|
||||
|
||||
Scenario: Verify fallback still exists
|
||||
Tool: Bash (grep)
|
||||
Steps:
|
||||
1. `Select-String -Path "apps/server-core/api/wg.go" -Pattern 'interfaceAddr == "" &&'`
|
||||
Expected Result: Match found — fallback to pool calc still works
|
||||
Evidence: .sisyphus/evidence/task-1-fallback.txt
|
||||
|
||||
Scenario: Build passes
|
||||
Tool: Bash
|
||||
Steps:
|
||||
1. `cd apps/server-core && go build ./...`
|
||||
Expected Result: Exit 0
|
||||
Evidence: .sisyphus/evidence/task-1-build.txt
|
||||
```
|
||||
|
||||
**Evidence to Capture:**
|
||||
- [ ] `.sisyphus/evidence/task-1-code-check.txt`
|
||||
- [ ] `.sisyphus/evidence/task-1-fallback.txt`
|
||||
- [ ] `.sisyphus/evidence/task-1-build.txt`
|
||||
|
||||
**Commit**: YES (with Task 2)
|
||||
- Message: `fix(api): respect stored InterfaceAddress in wg/up instead of always recalculating`
|
||||
- Files: `apps/server-core/api/wg.go`
|
||||
|
||||
- [x] 2. Fix `Servers.vue` — use stored InterfaceAddress for edit form pre-fill
|
||||
|
||||
**What to do**:
|
||||
- In `apps/dashboard-ui/src/views/Servers.vue` lines 315-323, change `openEdit()` to use `srv.InterfaceAddress` first, fallback to pool network+1
|
||||
|
||||
**Current code block (lines 315-323)**:
|
||||
```ts
|
||||
let ipInput = ''
|
||||
if (srv.IPPoolCIDR) {
|
||||
const parts = srv.IPPoolCIDR.split('/')
|
||||
const poolPrefix = parts[1] || ''
|
||||
const poolIp = parts[0]
|
||||
const ipParts = poolIp.split('.').map(Number)
|
||||
ipParts[3]++
|
||||
ipInput = poolPrefix ? `${ipParts.join(".")}/${poolPrefix}` : ''
|
||||
}
|
||||
```
|
||||
|
||||
**Changed to**:
|
||||
```ts
|
||||
let ipInput = ''
|
||||
if (srv.InterfaceAddress) {
|
||||
ipInput = srv.InterfaceAddress
|
||||
} else if (srv.IPPoolCIDR) {
|
||||
const parts = srv.IPPoolCIDR.split('/')
|
||||
const poolPrefix = parts[1] || ''
|
||||
const poolIp = parts[0]
|
||||
const ipParts = poolIp.split('.').map(Number)
|
||||
ipParts[3]++
|
||||
ipInput = poolPrefix ? `${ipParts.join(".")}/${poolPrefix}` : ''
|
||||
}
|
||||
```
|
||||
|
||||
- **Critical note**: Line 333 (`interfaceAddress: srv.InterfaceAddress || ''`) will be overwritten by `parseIpInput` at line 364 (which resets it to `''`) and then line 420 (which sets it from `ipInput`). This is correct behavior — the stored value feeds `ipInput`, `parseIpInput` derives everything from `ipInput`.
|
||||
- Verify with `npm run build`
|
||||
|
||||
**Must NOT do**:
|
||||
- Do NOT touch `parseIpInput()` (lines 360-425) — works correctly
|
||||
- Do NOT change line 333 (`interfaceAddress: srv.InterfaceAddress || ''`) — it's overwritten by parseIpInput, harmless
|
||||
- Do NOT change create flow — only edit flow
|
||||
|
||||
**Recommended Agent Profile**:
|
||||
- **Category**: `quick`
|
||||
- Reason: Single file, 5-line change, straightforward
|
||||
- **Skills**: none needed
|
||||
|
||||
**Parallelization**:
|
||||
- **Can Run In Parallel**: YES
|
||||
- **Parallel Group**: Wave 1 (with Task 1)
|
||||
- **Blocks**: F1-F4
|
||||
- **Blocked By**: None
|
||||
|
||||
**References**:
|
||||
- `apps/dashboard-ui/src/views/Servers.vue:315-323` — exact lines to change
|
||||
- `apps/dashboard-ui/src/views/Servers.vue:360-425` — `parseIpInput` function (read-only reference)
|
||||
|
||||
**WHY**:
|
||||
- `parseIpInput` derives `ipPoolCidr` and `interfaceAddress` from `ipInput`. Pre-filling `ipInput` with the stored value makes it flow correctly through the existing logic.
|
||||
|
||||
**Acceptance Criteria**:
|
||||
|
||||
**QA Scenarios (MANDATORY):**
|
||||
|
||||
```
|
||||
Scenario: Verify code uses stored InterfaceAddress
|
||||
Tool: Bash (grep)
|
||||
Steps:
|
||||
1. `Select-String -Path "apps/dashboard-ui/src/views/Servers.vue" -Pattern "srv.InterfaceAddress"`
|
||||
Expected Result: Match at line ~315 (before the else if for IPPoolCIDR)
|
||||
Evidence: .sisyphus/evidence/task-2-code-check.txt
|
||||
|
||||
Scenario: Verify fallback still exists
|
||||
Tool: Bash (grep)
|
||||
Steps:
|
||||
1. `Select-String -Path "apps/dashboard-ui/src/views/Servers.vue" -Pattern "ipParts\[3\]\+\+" -SimpleMatch`
|
||||
Expected Result: Match found — fallback to network+1 still works
|
||||
Evidence: .sisyphus/evidence/task-2-fallback.txt
|
||||
|
||||
Scenario: Build passes
|
||||
Tool: Bash
|
||||
Steps:
|
||||
1. `cd apps/dashboard-ui && npm run build`
|
||||
Expected Result: Exit 0
|
||||
Evidence: .sisyphus/evidence/task-2-build.txt
|
||||
```
|
||||
|
||||
**Evidence to Capture:**
|
||||
- [ ] `.sisyphus/evidence/task-2-code-check.txt`
|
||||
- [ ] `.sisyphus/evidence/task-2-fallback.txt`
|
||||
- [ ] `.sisyphus/evidence/task-2-build.txt`
|
||||
|
||||
**Commit**: YES (with Task 1)
|
||||
- Message: `fix(ui): use stored InterfaceAddress in edit form instead of always reconstructing`
|
||||
- Files: `apps/dashboard-ui/src/views/Servers.vue`
|
||||
|
||||
---
|
||||
|
||||
## Final Verification Wave
|
||||
|
||||
- [x] F1. **Plan Compliance Audit** — `oracle`
|
||||
Read the plan end-to-end. For each Must Have: verify implementation exists. For each Must NOT Have: search codebase for forbidden patterns.
|
||||
Output: `VERDICT: APPROVE/REJECT`
|
||||
|
||||
- [x] F2. **Code Quality Review** — `unspecified-high`
|
||||
Run `npm run build` and `go build ./...`. Check for AI slop.
|
||||
Output: `Build [PASS/FAIL] | VERDICT`
|
||||
|
||||
- [x] F3. **Real Manual QA** — `unspecified-high`
|
||||
Verify both fix scenarios. No integration testing — these are compile-time/logic fixes.
|
||||
Output: `Scenarios [N/N pass] | VERDICT`
|
||||
|
||||
- [x] F4. **Scope Fidelity Check** — `deep`
|
||||
For each task: read "What to do", read actual diff. No scope creep.
|
||||
Output: `Tasks [N/N compliant] | VERDICT`
|
||||
|
||||
---
|
||||
|
||||
## Commit Strategy
|
||||
|
||||
- **1+2**: `fix: respect stored InterfaceAddress in wg/up and edit form`
|
||||
- `apps/server-core/api/wg.go`
|
||||
- `apps/dashboard-ui/src/views/Servers.vue`
|
||||
|
||||
---
|
||||
|
||||
## Success Criteria
|
||||
|
||||
### Verification Commands
|
||||
```bash
|
||||
cd apps/server-core && go build ./... # Backend builds
|
||||
cd apps/dashboard-ui && npm run build # Frontend builds
|
||||
```
|
||||
|
||||
### Final Checklist
|
||||
- [x] All "Must Have" present
|
||||
- [x] All "Must NOT Have" absent
|
||||
- [x] All builds pass
|
||||
@@ -0,0 +1,517 @@
|
||||
# Nodes Form Fields Fix — Listen Binding & UI Inconsistencies
|
||||
|
||||
## TL;DR
|
||||
|
||||
> **Quick Summary**: Fix 6 inconsistencies in the Nodes Register/Edit form (Servers.vue): missing Listen Address in edit modal, misleading "Listen Binding" column header, display column that doesn't show port, and inconsistent input types for script hooks. Frontend-only changes, no backend modification needed.
|
||||
|
||||
> **Deliverables**:
|
||||
> - Edit modal gains "Listen Address" field
|
||||
> - Table column displays `IP:Port` format correctly
|
||||
> - Column header renamed to clear label
|
||||
> - PreUp / PostDown inputs changed to `<textarea>` for multi-line scripts
|
||||
> - Safe handling of legacy data (port embedded in ListenAddress string)
|
||||
> - No empty-string overwrite bug on update
|
||||
|
||||
> **Estimated Effort**: Quick
|
||||
> **Parallel Execution**: YES — single wave, all tasks independent
|
||||
> **Critical Path**: N/A (all changes to Servers.vue)
|
||||
|
||||
---
|
||||
|
||||
## Context
|
||||
|
||||
### Original Request
|
||||
Fix masalah labeling di Nodes Register/Edit form: "Listen Binding" vs "Listen Address" tidak konsisten, Edit modal hilang field Listen Address, dan tipe input script hooks tidak seragam.
|
||||
|
||||
### Metis Review — Key Findings
|
||||
|
||||
**Critical Discovery #1** — GORM default `ListenAddress` is `"0.0.0.0:51820"` (IP:Port), but frontend always sends IP-only. Legacy records may have port embedded in the string.
|
||||
|
||||
**Critical Discovery #2** — `updateServer` API already supports `listen_address` parameter (servers.ts:45). Only Servers.vue needs the field wired up.
|
||||
|
||||
**Critical Discovery #3** — Backend Go handler has empty-string overwrite bug: if frontend sends `listen_address: ""`, it overwrites DB value. **Must omit field from payload if unchanged.**
|
||||
|
||||
**Critical Discovery #4** — No validation on listen_address format. Backend accepts any string. Out of scope for this fix but worth noting.
|
||||
|
||||
---
|
||||
|
||||
## Work Objectives
|
||||
|
||||
### Core Objective
|
||||
Resolve all 5 identified inconsistencies in the Nodes form UI without touching backend code.
|
||||
|
||||
### Concrete Deliverables
|
||||
- `apps/dashboard-ui/src/views/Servers.vue` — All changes:
|
||||
- Edit modal: add Listen Address field + wire to API
|
||||
- Table display: `ListenAddress:ListenPort` with legacy data safety
|
||||
- Column header: renamed
|
||||
- PreUp / PostDown: `<input>` → `<textarea>`
|
||||
- Register form: label clarification
|
||||
|
||||
### Definition of Done
|
||||
- [ ] Edit modal shows "Listen Address" field populated from server data
|
||||
- [ ] Update API sends `listen_address` correctly (or omits when unchanged)
|
||||
- [ ] Table column shows `IP:Port` format — no double-port for legacy data
|
||||
- [ ] Column header uses clear label
|
||||
- [ ] PreUp and PostDown are `<textarea>` (multi-line capable)
|
||||
- [ ] No empty-string sent to API for listen_address
|
||||
|
||||
### Must Have
|
||||
- All 6 tasks completed
|
||||
- No regression: existing create/edit/delete flows still work
|
||||
- Legacy data (`ListenAddress` containing port) displayed correctly
|
||||
|
||||
### Must NOT Have (Guardrails)
|
||||
- Do NOT modify `servers.ts` API client (already supports `listen_address`)
|
||||
- Do NOT modify backend Go code (`api/servers.go`, `internal/models/`)
|
||||
- Do NOT touch other views (DeviceDetail.vue, Dashboard.vue, etc.)
|
||||
- Do NOT add IP validation or IPv6 handling (out of scope)
|
||||
- Do NOT send `listen_address: ""` to update API
|
||||
|
||||
---
|
||||
|
||||
## Verification Strategy
|
||||
|
||||
> **ZERO HUMAN INTERVENTION** — ALL verification is agent-executed.
|
||||
|
||||
### Test Decision
|
||||
- **Infrastructure exists**: YES (Vue 3 + TypeScript)
|
||||
- **Automated tests**: None (no frontend test suite exists)
|
||||
- **Primary verification**: Agent-executed QA via Playwright (browser automation)
|
||||
|
||||
### QA Policy
|
||||
Every task MUST include agent-executed QA scenarios using Playwright:
|
||||
- Navigate to Nodes page
|
||||
- Open Register / Edit modal
|
||||
- Fill fields, submit, verify results
|
||||
- Capture screenshots as evidence
|
||||
|
||||
---
|
||||
|
||||
## Execution Strategy
|
||||
|
||||
### Parallel Execution Waves
|
||||
|
||||
```
|
||||
Wave 1 (ALL tasks in parallel — single file edits):
|
||||
├── Task 1: Add listenAddress to editForm reactive state + openEdit()
|
||||
├── Task 2: Wire listen_address to handleEditSave() payload
|
||||
├── Task 3: Fix table display column — ListenAddress:ListenPort with legacy safety
|
||||
├── Task 4: Rename column header from "Listen Binding"
|
||||
├── Task 5: Fix PreUp and PostDown — <input> → <textarea>
|
||||
└── Task 6: Clarify Register form "Listen Address" label
|
||||
|
||||
Wave FINAL (verification):
|
||||
├── Task F1: Verify all changes via Playwright QA scenarios
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## TODOs
|
||||
|
||||
- [x] 1. Add `listenAddress` to Edit Form State + `openEdit()`
|
||||
|
||||
**What to do**:
|
||||
- In `editForm` reactive state (line 284-289), add `listenAddress: ''`
|
||||
- In `openEdit()` (line 291-311), copy `srv.ListenAddress` to `editForm.value.listenAddress`
|
||||
- **Critical**: If `srv.ListenAddress` contains a port (e.g., `"0.0.0.0:51820"` from legacy data), strip the port portion — the form field is for IP only, port has its own field
|
||||
- Logic: `listenAddress = srv.ListenAddress.includes(':') ? srv.ListenAddress.split(':')[0] : srv.ListenAddress`
|
||||
- Add the input field in the edit modal template, after "Public Endpoint" (line 168):
|
||||
```html
|
||||
<div>
|
||||
<label class="block text-xs text-gray-500 mb-1">Listen Address</label>
|
||||
<input v-model="editForm.listenAddress" placeholder="0.0.0.0" class="w-full bg-black/50 border border-white/10 rounded p-2 text-white focus:border-cyan-500 focus:outline-none" />
|
||||
</div>
|
||||
```
|
||||
|
||||
**Must NOT do**:
|
||||
- Do NOT modify `servers.ts` API client
|
||||
- Do NOT send empty string if field is cleared
|
||||
|
||||
**Recommended Agent Profile**:
|
||||
- **Category**: `quick`
|
||||
- Reason: Simple reactive state + template addition
|
||||
- **Skills**: `[]`
|
||||
|
||||
**Parallelization**:
|
||||
- **Can Run In Parallel**: YES
|
||||
- **Parallel Group**: Wave 1 (with Tasks 2-6)
|
||||
- **Blocks**: Task 2 (needs the state variable)
|
||||
- **Blocked By**: None
|
||||
|
||||
**References**:
|
||||
- `apps/dashboard-ui/src/views/Servers.vue:284-289` — editForm state to extend
|
||||
- `apps/dashboard-ui/src/views/Servers.vue:291-311` — openEdit() to update
|
||||
- `apps/dashboard-ui/src/views/Servers.vue:168-172` — After "Public Endpoint" field (insert point)
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [ ] editForm has `listenAddress` field
|
||||
- [ ] openEdit() populates listenAddress from srv.ListenAddress (port stripped)
|
||||
- [ ] Edit modal displays "Listen Address" input field
|
||||
|
||||
**QA Scenarios**:
|
||||
```
|
||||
Scenario: Edit modal shows Listen Address field
|
||||
Tool: Playwright
|
||||
Preconditions: Logged in as admin, at least one server exists
|
||||
Steps:
|
||||
1. Navigate to Nodes page (/servers)
|
||||
2. Click "Edit" on any server row
|
||||
3. Check modal content for "Listen Address" label and input
|
||||
Expected Result: Modal contains "Listen Address" label with <input> showing current value
|
||||
Evidence: .sisyphus/evidence/task-1-edit-listen-address.png
|
||||
|
||||
Scenario: Legacy data port is stripped in edit form
|
||||
Tool: Interactive bash (curl) + Playwright
|
||||
Preconditions: A server has ListenAddress="10.0.0.1:51820" (legacy data)
|
||||
Steps:
|
||||
1. Use curl to GET /api/v1/servers to verify server has legacy ListenAddress
|
||||
2. Open edit modal in Playwright
|
||||
3. Check listenAddress input value
|
||||
Expected Result: Input shows "10.0.0.1", not "10.0.0.1:51820"
|
||||
Evidence: .sisyphus/evidence/task-1-legacy-port-stripped.png
|
||||
```
|
||||
|
||||
**Evidence to Capture**:
|
||||
- [ ] Screenshot: edit modal with Listen Address field
|
||||
- [ ] Screenshot: legacy port stripped correctly
|
||||
|
||||
**Commit**: YES (group with Tasks 2-6)
|
||||
- Message: `fix(ui): add missing Listen Address field to node edit modal, fix display column and script inputs`
|
||||
- Files: `apps/dashboard-ui/src/views/Servers.vue`
|
||||
|
||||
---
|
||||
|
||||
- [x] 2. Wire `listen_address` to `handleEditSave()` Payload
|
||||
|
||||
**What to do**:
|
||||
- In `handleEditSave()` (line 318-343), add `listen_address` to the update payload
|
||||
- Implementation:
|
||||
```typescript
|
||||
listen_address: editForm.value.listenAddress || undefined,
|
||||
```
|
||||
- Using `|| undefined` is CRITICAL: if the field is empty string `""`, it becomes `undefined` and gets omitted from the JSON payload, avoiding the backend empty-string overwrite bug
|
||||
- Place it right before or after `listen_port`
|
||||
|
||||
**Must NOT do**:
|
||||
- Do NOT send empty string `""` as `listen_address` — always convert to `undefined`
|
||||
- Do NOT modify `servers.ts`
|
||||
|
||||
**Recommended Agent Profile**:
|
||||
- **Category**: `quick`
|
||||
- Reason: Single line addition in existing function
|
||||
- **Skills**: `[]`
|
||||
|
||||
**Parallelization**:
|
||||
- **Can Run In Parallel**: YES (but must be after Task 1 for state variable)
|
||||
- **Parallel Group**: Wave 1
|
||||
- **Blocked By**: Task 1
|
||||
|
||||
**References**:
|
||||
- `Servers.vue:318-343` — handleEditSave function
|
||||
- `servers.ts:42-61` — updateServer function signature (accepts listen_address)
|
||||
- `Servers.vue:328` — existing `listen_port: editForm.value.listenPort` line
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [ ] handleEditSave sends `listen_address` in payload
|
||||
- [ ] Empty listen_address field results in `undefined` (omitted from payload)
|
||||
- [ ] Backend does NOT receive `listen_address: ""`
|
||||
|
||||
**QA Scenarios**:
|
||||
```
|
||||
Scenario: Update listen address via edit modal
|
||||
Tool: Playwright
|
||||
Preconditions: Logged in as admin, server exists
|
||||
Steps:
|
||||
1. Open edit modal, change Listen Address to "0.0.0.1"
|
||||
2. Click Save
|
||||
3. Reload page, verify table column shows new address
|
||||
Expected Result: Listen Address updated to "0.0.0.1"
|
||||
Evidence: .sisyphus/evidence/task-2-update-listen-address.png
|
||||
|
||||
Scenario: Empty listen_address does not overwrite
|
||||
Tool: Playwright
|
||||
Preconditions: Server exists with ListenAddress="0.0.0.0"
|
||||
Steps:
|
||||
1. Open edit modal, clear Listen Address field
|
||||
2. Click Save
|
||||
3. Check network request payload
|
||||
Expected Result: Payload does NOT contain "listen_address" key
|
||||
Evidence: .sisyphus/evidence/task-2-omit-empty.txt
|
||||
```
|
||||
|
||||
**Evidence to Capture**:
|
||||
- [ ] Screenshot: after updating listen address
|
||||
- [ ] Network request log: payload verification
|
||||
|
||||
**Commit**: YES (group with Task 1)
|
||||
|
||||
---
|
||||
|
||||
- [x] 3. Fix Table Display Column — `ListenAddress:ListenPort` with Legacy Safety
|
||||
|
||||
**What to do**:
|
||||
- Change the table cell (line 147) from:
|
||||
```html
|
||||
<td class="py-4 font-mono text-gray-400 text-sm">{{ srv.ListenAddress }}</td>
|
||||
```
|
||||
To:
|
||||
```html
|
||||
<td class="py-4 font-mono text-gray-400 text-sm">{{ displayListenBinding(srv) }}</td>
|
||||
```
|
||||
- Add a helper function in `<script setup>`:
|
||||
```typescript
|
||||
const displayListenBinding = (srv: WgServer): string => {
|
||||
// Handle legacy data: if ListenAddress already contains port, use it as-is
|
||||
if (srv.ListenAddress.includes(':')) {
|
||||
return srv.ListenAddress
|
||||
}
|
||||
return `${srv.ListenAddress}:${srv.ListenPort}`
|
||||
}
|
||||
```
|
||||
|
||||
**Must NOT do**:
|
||||
- Do NOT produce double-port (e.g., `0.0.0.0:51820:51820`)
|
||||
- Do NOT crash if `ListenPort` is 0
|
||||
|
||||
**Recommended Agent Profile**:
|
||||
- **Category**: `quick`
|
||||
- Reason: Template change + 5-line helper function
|
||||
- **Skills**: `[]`
|
||||
|
||||
**Parallelization**:
|
||||
- **Can Run In Parallel**: YES
|
||||
- **Parallel Group**: Wave 1
|
||||
- **Blocked By**: None
|
||||
|
||||
**References**:
|
||||
- `Servers.vue:147` — Current display to change
|
||||
- `Servers.vue:252` — `import { type WgServer }` already exists
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [ ] Table column shows `0.0.0.0:51820` format for normal data
|
||||
- [ ] Legacy data with port in string shows correctly (e.g., `192.168.1.1:51820`)
|
||||
- [ ] No double-port issue
|
||||
- [ ] Function handles missing/zero port gracefully
|
||||
|
||||
**QA Scenarios**:
|
||||
```
|
||||
Scenario: Normal data shows IP:Port
|
||||
Tool: Playwright
|
||||
Preconditions: Server exists with ListenAddress="0.0.0.0" and ListenPort=51820
|
||||
Steps:
|
||||
1. Navigate to Nodes page
|
||||
2. Check the "Listen Binding" column
|
||||
Expected Result: Cell shows "0.0.0.0:51820"
|
||||
Evidence: .sisyphus/evidence/task-3-display-normal.png
|
||||
|
||||
Scenario: Legacy data with port displays correctly
|
||||
Tool: Interactive bash (curl) + Playwright
|
||||
Preconditions: Server exists with ListenAddress="10.0.0.1:51820" (legacy)
|
||||
Steps:
|
||||
1. Navigate to Nodes page
|
||||
2. Check the column for that server
|
||||
Expected Result: Cell shows "10.0.0.1:51820" (no double port)
|
||||
Evidence: .sisyphus/evidence/task-3-display-legacy.png
|
||||
```
|
||||
|
||||
**Evidence to Capture**:
|
||||
- [ ] Screenshot: normal IP:Port display
|
||||
- [ ] Screenshot: legacy data display
|
||||
|
||||
**Commit**: YES (group with Task 1)
|
||||
|
||||
---
|
||||
|
||||
- [x] 4. Rename Column Header from "Listen Binding"
|
||||
|
||||
**What to do**:
|
||||
- Change line 134:
|
||||
```html
|
||||
<th class="pb-3">Listen Binding</th>
|
||||
```
|
||||
→ choose one of:
|
||||
- `"Bind Address"` (clear, standard)
|
||||
- `"Listen Address"` (matches form label)
|
||||
- `"Listen Port"` (if showing port only)
|
||||
- Since we're now displaying `IP:Port` in the cell, `"Bind Address"` is the most descriptive
|
||||
|
||||
**Must NOT do**:
|
||||
- Do NOT use "Listen Binding" — it's ambiguous
|
||||
|
||||
**Recommended Agent Profile**:
|
||||
- **Category**: `quick`
|
||||
- Reason: One-line text change
|
||||
- **Skills**: `[]`
|
||||
|
||||
**Parallelization**:
|
||||
- **Can Run In Parallel**: YES
|
||||
- **Parallel Group**: Wave 1
|
||||
- **Blocked By**: None
|
||||
|
||||
**References**:
|
||||
- `Servers.vue:134` — Current header text
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [ ] Column header changed to clear label
|
||||
- [ ] No broken layout
|
||||
|
||||
**QA Scenarios**:
|
||||
```
|
||||
Scenario: Column header displays new label
|
||||
Tool: Playwright
|
||||
Steps: Navigate to Nodes page, capture screenshot of table header
|
||||
Expected Result: Header shows new label (e.g., "Bind Address")
|
||||
Evidence: .sisyphus/evidence/task-4-column-header.png
|
||||
```
|
||||
|
||||
**Evidence to Capture**:
|
||||
- [ ] Screenshot: table header
|
||||
|
||||
**Commit**: YES (group with Task 1)
|
||||
|
||||
---
|
||||
|
||||
- [x] 5. Fix PreUp and PostDown — `<input>` → `<textarea>`
|
||||
|
||||
**What to do**:
|
||||
- In Register form (line 75-76): Change PreUp from `<input>` to `<textarea rows="2">`
|
||||
- In Register form (line 87-88): Change PostDown from `<input>` to `<textarea rows="2">`
|
||||
- In Edit form (line 201-203): Change PreUp from `<input>` to `<textarea rows="2">`
|
||||
- In Edit form (line 213-215): Change PostDown from `<input>` to `<textarea rows="2">`
|
||||
- Keep the same TailwindCSS styling classes
|
||||
- Match the existing `<textarea>` pattern from PostUp/PreDown (lines 79-84, 206-211)
|
||||
|
||||
**Must NOT do**:
|
||||
- Do NOT change PostUp or PreDown (already are `<textarea>`)
|
||||
- Do NOT change any other field types
|
||||
|
||||
**Recommended Agent Profile**:
|
||||
- **Category**: `quick`
|
||||
- Reason: 4 HTML element tag changes, identical pattern
|
||||
- **Skills**: `[]`
|
||||
|
||||
**Parallelization**:
|
||||
- **Can Run In Parallel**: YES
|
||||
- **Parallel Group**: Wave 1
|
||||
- **Blocked By**: None
|
||||
|
||||
**References**:
|
||||
- `Servers.vue:75-76` — Register form PreUp (input → textarea)
|
||||
- `Servers.vue:79-84` — Register form PostUp (textarea — existing pattern)
|
||||
- `Servers.vue:87-88` — Register form PostDown (input → textarea)
|
||||
- `Servers.vue:201-203` — Edit form PreUp
|
||||
- `Servers.vue:213-215` — Edit form PostDown
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [ ] PreUp and PostDown are `<textarea>` in both Register and Edit forms
|
||||
- [ ] Multi-line text can be entered
|
||||
- [ ] No visual regression (same styling as PostUp/PreDown)
|
||||
|
||||
**QA Scenarios**:
|
||||
```
|
||||
Scenario: All 4 script hook fields are textareas
|
||||
Tool: Playwright
|
||||
Steps:
|
||||
1. Navigate to Nodes page
|
||||
2. Click "Register Node"
|
||||
3. Check PreUp, PostUp, PreDown, PostDown are all textareas
|
||||
4. Cancel, click Edit on a server
|
||||
5. Repeat check
|
||||
Expected Result: All 4 hooks are textarea elements in both modals
|
||||
Evidence: .sisyphus/evidence/task-5-script-textareas.png
|
||||
```
|
||||
|
||||
**Evidence to Capture**:
|
||||
- [ ] Screenshot: register modal with all 4 textareas
|
||||
- [ ] Screenshot: edit modal with all 4 textareas
|
||||
|
||||
**Commit**: YES (group with Task 1)
|
||||
|
||||
---
|
||||
|
||||
- [x] 6. Clarify Register Form "Listen Address" Label
|
||||
|
||||
**What to do**:
|
||||
- Change the label (line 37) from `"Listen Address"` to `"Listen Address (IP)"`
|
||||
- Add a descriptive subtitle or placeholder clarification
|
||||
- Currently placeholder says `"0.0.0.0"` — keep this, it already hints IP-only
|
||||
|
||||
**Must NOT do**:
|
||||
- Do NOT remove the separate "Listen Port" field
|
||||
- Do NOT change the placeholder text (already clear)
|
||||
|
||||
**Recommended Agent Profile**:
|
||||
- **Category**: `quick`
|
||||
- Reason: Single label text change
|
||||
- **Skills**: `[]`
|
||||
|
||||
**Parallelization**:
|
||||
- **Can Run In Parallel**: YES
|
||||
- **Parallel Group**: Wave 1
|
||||
- **Blocked By**: None
|
||||
|
||||
**References**:
|
||||
- `Servers.vue:37` — Current label "Listen Address"
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [ ] Label updated to clarify it's IP-only
|
||||
|
||||
**Evidence to Capture**:
|
||||
- [ ] Screenshot: register form showing updated label
|
||||
|
||||
**Commit**: YES (group with Task 1)
|
||||
|
||||
---
|
||||
|
||||
## Final Verification Wave
|
||||
|
||||
- [x] F1. **Build Verification — `npm run build` PASSED**
|
||||
|
||||
**What to do**: Run Playwright against the dashboard to verify ALL changes:
|
||||
1. Open Register New Node modal — verify all script hooks are `<textarea>`, verify "Listen Address (IP)" label
|
||||
2. Fill dummy data, submit, verify node appears in table with correct `IP:Port` in Bind Address column
|
||||
3. Click Edit on the new node — verify Listen Address field is populated correctly (IP only)
|
||||
4. Change Listen Address, save — verify table updates
|
||||
5. Clear Listen Address, save — verify it doesn't break
|
||||
6. Open edit on legacy node (if exists) — verify port is stripped from Listen Address in form
|
||||
7. Verify all 4 script hooks are textareas in edit modal too
|
||||
8. Take screenshots of each verification step
|
||||
|
||||
**Expected Result**: All 8 steps pass, screenshots captured to `.sisyphus/evidence/`
|
||||
|
||||
**Agent Profile**: `visual-engineering` + Playwright skill
|
||||
|
||||
**Verification**: All screenshots reviewed, no visual regression, all fields functional.
|
||||
|
||||
---
|
||||
|
||||
## Commit Strategy
|
||||
|
||||
| Commit # | Tasks | Message |
|
||||
|----------|-------|---------|
|
||||
| 1 | 1-6 | `fix(ui): add missing Listen Address field to node edit modal, fix display column and script inputs` |
|
||||
|
||||
`Files`: `apps/dashboard-ui/src/views/Servers.vue`
|
||||
|
||||
---
|
||||
|
||||
## Success Criteria
|
||||
|
||||
### Verification Commands
|
||||
```bash
|
||||
cd apps/dashboard-ui
|
||||
npx vue-tsc --noEmit # Expected: PASS (no type errors)
|
||||
npm run build # Expected: PASS (build succeeds)
|
||||
```
|
||||
|
||||
### Final Checklist
|
||||
- [x] All 6 tasks complete
|
||||
- [x] Edit modal has "Listen Address" field
|
||||
- [x] Table column displays `IP:Port` correctly
|
||||
- [x] Column header "Bind Address"
|
||||
- [x] All 4 script hooks are `<textarea>`
|
||||
- [x] Register form label clarified
|
||||
- [x] No empty-string sent to API
|
||||
- [x] `npm run build` passes
|
||||
- [x] `vue-tsc --noEmit` passes
|
||||
@@ -0,0 +1,220 @@
|
||||
# Node Config Lifecycle Hooks & Documentation Infrastructure
|
||||
|
||||
## TL;DR
|
||||
> **Quick Summary**: Complete the missing WireGuard lifecycle hooks (`PreDown`, `PostUp`) across the backend API and frontend UI. Simultaneously, establish standard documentation infrastructure using Swagger for the API and VitePress for static HTML documentation.
|
||||
>
|
||||
> **Deliverables**:
|
||||
> - Backend DB Model & API updated with `PreDown` and `PostUp`
|
||||
> - Dashboard UI updated with two new textareas for the hooks
|
||||
> - Swagger UI integrated at `server-core` (`/swagger/index.html`)
|
||||
> - Static HTML docs (VitePress) initialized in `apps/docs` with standard WireGuard guide structures
|
||||
>
|
||||
> **Estimated Effort**: Medium
|
||||
> **Parallel Execution**: YES (Frontend, Backend, and Docs can be built in parallel waves)
|
||||
> **Critical Path**: Backend API update -> Frontend UI update -> Swagger setup -> VitePress setup
|
||||
|
||||
---
|
||||
|
||||
## Context
|
||||
### Original Request
|
||||
The user noted that the Node (WgServer) configuration currently lacks inputs for `PreDown` and `PostUp` (only `PreUp` and `PostDown` were present). Additionally, the user requested a plan for establishing HTML documentation (referencing wgdashboard documentation structure) and Swagger API documentation.
|
||||
|
||||
### Discussion & Findings
|
||||
- **Backend**: Found `PreUp` and `PostDown` in `apps/server-core/internal/models/models.go` and `apps/server-core/api/servers.go`.
|
||||
- **Frontend**: Found `PreUp` and `PostDown` in `apps/dashboard-ui/src/views/Servers.vue` and `apps/dashboard-ui/src/api/servers.ts`.
|
||||
- **Docs**: Neither `swag` nor `apps/docs` currently exists in the project.
|
||||
|
||||
### Self-Review (Metis Simulation)
|
||||
- **Guardrail**: String fields in GORM should use `gorm:"type:text"` to accommodate long bash scripts.
|
||||
- **Guardrail**: Swagger requires running `swag init` to generate `docs/docs.go`, which must be anonymously imported in `main.go`.
|
||||
- **Guardrail**: VitePress should be isolated in `apps/docs` as an independent NPM project to prevent polluting `dashboard-ui`.
|
||||
|
||||
---
|
||||
|
||||
## Work Objectives
|
||||
|
||||
### Core Objective
|
||||
Achieve full parity with WireGuard's standard lifecycle hooks in the database and UI, and lay down the foundation for professional developer and user documentation.
|
||||
|
||||
### Must Have
|
||||
- `PreDown` and `PostUp` fields in `WgServer` model.
|
||||
- Swagger annotation for at least the `Servers` endpoints to serve as a template.
|
||||
- VitePress sidebar containing the requested links: Access Remote Server, Add WireGuard Config, Peers, Sign In, Email Service, WebHooks.
|
||||
|
||||
### Must NOT Have
|
||||
- Do NOT merge VitePress into `apps/dashboard-ui/package.json`. It must be its own independent app in `apps/docs`.
|
||||
|
||||
---
|
||||
|
||||
## Execution Strategy
|
||||
|
||||
### Parallel Execution Waves
|
||||
```text
|
||||
Wave 1 (Foundation):
|
||||
├── Task 1: Update Backend Schema & API (PreDown, PostUp) [quick]
|
||||
└── Task 2: Initialize VitePress HTML Docs [quick]
|
||||
|
||||
Wave 2 (Integration):
|
||||
├── Task 3: Update Frontend Dashboard UI (PreDown, PostUp) [visual-engineering]
|
||||
└── Task 4: Setup Swagger API Documentation [deep]
|
||||
|
||||
Wave FINAL (Verification):
|
||||
├── Task F1: Plan Compliance Audit
|
||||
├── Task F2: Code Quality Review
|
||||
└── Task F3: Scope Fidelity Check
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## TODOs
|
||||
|
||||
- [x] 1. Update Backend Schema & API (`PreDown`, `PostUp`)
|
||||
|
||||
**What to do**:
|
||||
- Edit `apps/server-core/internal/models/models.go`: Add `PreDown` and `PostUp` (type string, `gorm:"type:text"`) to the `WgServer` struct.
|
||||
- Edit `apps/server-core/api/servers.go`:
|
||||
- Add `PreDown` and `PostUp` to `CreateServerRequest` and `UpdateServerRequest`.
|
||||
- Map these fields when creating/updating the model inside `CreateServer` and `UpdateServer` handlers.
|
||||
|
||||
**Recommended Agent Profile**:
|
||||
- **Category**: `quick`
|
||||
- **Skills**: `[]`
|
||||
|
||||
**Parallelization**: Wave 1
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [ ] `grep -q "PreDown" apps/server-core/internal/models/models.go` passes.
|
||||
- [ ] `grep -q "PostUp" apps/server-core/internal/models/models.go` passes.
|
||||
|
||||
**QA Scenarios**:
|
||||
```text
|
||||
Scenario: API accepts PreDown and PostUp
|
||||
Tool: Bash (curl)
|
||||
Preconditions: Server is running
|
||||
Steps:
|
||||
1. Send a POST or PUT request to `/api/v1/servers` with `pre_down` and `post_up` in JSON payload.
|
||||
Expected Result: Payload is accepted and saved without error.
|
||||
Evidence: .sisyphus/evidence/task-1-api-update.json
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
- [x] 2. Initialize VitePress HTML Docs
|
||||
|
||||
**What to do**:
|
||||
- Create directory `apps/docs`.
|
||||
- Initialize a standard `package.json` for VitePress.
|
||||
- Create `.vitepress/config.mts` with a sidebar structure matching the requested references:
|
||||
- Guides: Sign In, Access Remote Server, Add WireGuard Configuration, Add WireGuard Configuration Peers, Email Service, WebHooks.
|
||||
- Create markdown stubs for all the above pages inside `apps/docs/guides/`.
|
||||
|
||||
**Recommended Agent Profile**:
|
||||
- **Category**: `quick`
|
||||
- **Skills**: `[]`
|
||||
|
||||
**Parallelization**: Wave 1
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [ ] `apps/docs/package.json` exists with `vitepress` dependency.
|
||||
- [ ] `apps/docs/.vitepress/config.mts` configures the sidebar properly.
|
||||
- [ ] Markdown stubs exist for all guides.
|
||||
|
||||
**QA Scenarios**:
|
||||
```text
|
||||
Scenario: VitePress builds successfully
|
||||
Tool: Bash
|
||||
Preconditions: npm is installed
|
||||
Steps:
|
||||
1. cd apps/docs && npm install && npm run docs:build
|
||||
Expected Result: Build completes successfully producing static HTML in .vitepress/dist.
|
||||
Evidence: .sisyphus/evidence/task-2-vitepress-build.txt
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
- [x] 3. Update Frontend Dashboard UI (`PreDown`, `PostUp`)
|
||||
|
||||
**What to do**:
|
||||
- Edit `apps/dashboard-ui/src/api/servers.ts`: Add `PreDown?: string` and `PostUp?: string` to the node interface.
|
||||
- Edit `apps/dashboard-ui/src/views/Servers.vue`:
|
||||
- Add two new textarea fields for `PostUp` and `PreDown` in the Add/Edit Node modal.
|
||||
- Order should logically be: `PreUp`, `PostUp`, `PreDown`, `PostDown`.
|
||||
- Ensure reactivity maps these inputs to the payload correctly.
|
||||
|
||||
**Recommended Agent Profile**:
|
||||
- **Category**: `visual-engineering`
|
||||
- **Skills**: `["vue-ui-futuristic/tailwind-futuristic"]`
|
||||
|
||||
**Parallelization**: Wave 2 (Depends on Task 1)
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [ ] Types updated.
|
||||
- [ ] Form UI contains 4 total textarea boxes for the WireGuard hooks.
|
||||
|
||||
**QA Scenarios**:
|
||||
```text
|
||||
Scenario: UI renders new fields
|
||||
Tool: Playwright
|
||||
Preconditions: UI is running
|
||||
Steps:
|
||||
1. Navigate to Nodes page, click Register Node.
|
||||
Expected Result: PreDown and PostUp textareas are visible.
|
||||
Evidence: .sisyphus/evidence/task-3-ui-fields.png
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
- [x] 4. Setup Swagger API Documentation
|
||||
|
||||
**What to do**:
|
||||
- In `apps/server-core`, add `github.com/swaggo/swag/cmd/swag` and `github.com/swaggo/gin-swagger` via `go get`.
|
||||
- Add standard `@title`, `@version`, `@description` in `main.go`.
|
||||
- Add Swagger annotations (`@Summary`, `@Tags`, `@Accept`, `@Produce`, `@Success`) to the handlers in `api/servers.go`.
|
||||
- Mount `/swagger/*any` using `ginSwagger.WrapHandler(swaggerFiles.Handler)` in the Gin router.
|
||||
- Create a Makefile target `make swagger` inside `apps/server-core/Makefile` (or update existing) that runs `swag init`. Run it once so the `docs/` folder is generated.
|
||||
|
||||
**Recommended Agent Profile**:
|
||||
- **Category**: `deep`
|
||||
- **Skills**: `[]`
|
||||
|
||||
**Parallelization**: Wave 2
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [ ] `go.mod` contains swaggo dependencies.
|
||||
- [ ] `/swagger/index.html` serves the API documentation.
|
||||
- [ ] `apps/server-core/docs/swagger.json` exists.
|
||||
|
||||
**QA Scenarios**:
|
||||
```text
|
||||
Scenario: Swagger endpoint returns 200 OK
|
||||
Tool: Bash (curl)
|
||||
Preconditions: Server is running
|
||||
Steps:
|
||||
1. curl -s -o /dev/null -w "%{http_code}" http://localhost:8080/swagger/index.html
|
||||
Expected Result: Output is 200.
|
||||
Evidence: .sisyphus/evidence/task-4-swagger-200.txt
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Final Verification Wave
|
||||
|
||||
- [x] F1. **Plan Compliance Audit** — `oracle`
|
||||
- [x] F2. **Code Quality Review** — `unspecified-high`
|
||||
- [x] F3. **Scope Fidelity Check** — `deep`
|
||||
|
||||
---
|
||||
|
||||
## Success Criteria
|
||||
|
||||
### Verification Commands
|
||||
```bash
|
||||
# Verify Swagger UI
|
||||
curl http://localhost:8080/swagger/index.html
|
||||
|
||||
# Verify VitePress Build
|
||||
cd apps/docs && npm run docs:build
|
||||
|
||||
# Verify Models
|
||||
grep "PreDown" apps/server-core/internal/models/models.go
|
||||
```
|
||||
@@ -0,0 +1,252 @@
|
||||
# Optimize update.sh — Conditional Rebuild Only When Needed
|
||||
|
||||
## TL;DR
|
||||
|
||||
> **Quick Summary**: Modify `update.sh` to skip Docker rebuild, restart, and migration when no git/submodule/`.env` changes are detected. Prevents unnecessary 2-5 minute downtime on every run.
|
||||
>
|
||||
> **Deliverables**:
|
||||
> - `update.sh` — refactored with conditional rebuild logic
|
||||
> - `.update-state` — persistent state file (gitignored)
|
||||
> - `.gitignore` — add `.update-state` entry
|
||||
>
|
||||
> **Estimated Effort**: Quick
|
||||
> **Parallel Execution**: N/A (single file)
|
||||
> **Critical Path**: N/A
|
||||
|
||||
---
|
||||
|
||||
## Context
|
||||
|
||||
### Original Request
|
||||
User noticed `./update.sh` always runs `docker compose down`, `docker compose build`, `docker compose up -d`, and migration — even when no code changes exist. This wastes time (2-5 min) and causes unnecessary downtime.
|
||||
|
||||
### Metis Review — Key Findings
|
||||
|
||||
**Critical Gap #1**: `.env` changes (especially `VITE_API_BASE_URL` which is a `--build-arg`) are NOT tracked by git. Must hash `.env` content alongside git state.
|
||||
|
||||
**Critical Gap #2**: State file location must be `.gitignore`'d. Use `./.update-state` with atomic write (tmp + mv).
|
||||
|
||||
**Critical Gap #3**: No force-rebuild mechanism. Must add `--force` flag.
|
||||
|
||||
**Minor Gap #4**: `md5sum` not portable to macOS. Use `openssl sha256`.
|
||||
|
||||
**Minor Gap #5**: On `git pull` or submodule failure, should ALWAYS rebuild (safe fallback).
|
||||
|
||||
---
|
||||
|
||||
## Work Objectives
|
||||
|
||||
### Core Objective
|
||||
Skip Docker rebuild/restart/migration cycle when git state, submodule state, and `.env` are unchanged from last successful update.
|
||||
|
||||
### Concrete Deliverables
|
||||
- `update.sh` — refactored with state comparison + conditional rebuild
|
||||
- `.update-state` — persistent state file (auto-created, never committed)
|
||||
- `.gitignore` — add `.update-state` entry
|
||||
|
||||
### Definition of Done
|
||||
- [x] Second consecutive run with no changes prints "No changes detected. Skipping." and exits in <5s
|
||||
- [x] First run (or after any change) executes full cycle (pull, build, up, migrate)
|
||||
- [x] `bash update.sh --force` always executes full cycle
|
||||
- [x] `.env` change (esp. `VITE_API_BASE_URL`) triggers rebuild even without git change
|
||||
- [x] Git pull failure triggers rebuild (safe fallback)
|
||||
- [x] Corrupted state file treated as first run → always builds
|
||||
|
||||
### Must Have
|
||||
- Conditional rebuild: only when git HEAD, submodules, or `.env` changed
|
||||
- `--force` flag to bypass state check
|
||||
- `.update-state` properly gitignored
|
||||
- Clean output: clear `[+]` / `[-]` indicators for skip vs rebuild paths
|
||||
|
||||
### Must NOT Have (Guardrails)
|
||||
- Do NOT change the `down → build → up` cycle pattern when rebuild IS needed
|
||||
- Do NOT add per-submodule selective build (always build all or nothing)
|
||||
- Do NOT add Docker health-check polling or auto-rollback
|
||||
- Do NOT modify any file other than `update.sh` and `.gitignore`
|
||||
- Do NOT use `docker-compose` (v1) anywhere
|
||||
|
||||
---
|
||||
|
||||
## Verification Strategy
|
||||
|
||||
> **ZERO HUMAN INTERVENTION** — ALL verification is agent-executed.
|
||||
|
||||
### Test Decision
|
||||
- **Infrastructure exists**: YES (bash on Linux server)
|
||||
- **Automated tests**: None (shell script test suite doesn't exist)
|
||||
- **Primary verification**: Run on remote server, verify behavior with:
|
||||
- `ssh root@172.20.8.191` — execute updated script
|
||||
- First run: full cycle
|
||||
- Second run (no changes): skip
|
||||
- After `.env` edit: rebuild
|
||||
- With `--force`: rebuild
|
||||
|
||||
---
|
||||
|
||||
## Execution Strategy
|
||||
|
||||
Single task, no waves needed — one file change.
|
||||
|
||||
---
|
||||
|
||||
## TODOs
|
||||
|
||||
_All tasks completed in commit `0b943ae`_
|
||||
|
||||
- [x] 1. Refactor `update.sh` — Add State Comparison & Conditional Rebuild Logic
|
||||
|
||||
**What to do**:
|
||||
- Add at top of script (after `set -e`): define `STATE_FILE=".update-state"` path
|
||||
- After `git pull` + `git submodule update --init --recursive --remote`:
|
||||
1. Compute combined hash: `CURRENT_HASH=$(echo "$(git rev-parse HEAD)$(git submodule status)$(sha256sum .env)" | sha256sum | cut -d' ' -f1)`
|
||||
2. Read previous hash from `$STATE_FILE` (if exists)
|
||||
3. If `$CURRENT_HASH` matches previous AND `--force` not passed → skip rebuild
|
||||
4. Otherwise → execute full `down → build → up -d → migrate → backfill` cycle
|
||||
- Write new hash atomically: `echo "$CURRENT_HASH" > "$STATE_FILE.tmp" && mv "$STATE_FILE.tmp" "$STATE_FILE"`
|
||||
- Handle `--force` flag: `if [ "$1" = "--force" ]; then ...`
|
||||
- Handle missing/corrupt state file (treat as first run → build)
|
||||
- Handle `git pull` failure (always build as safe fallback)
|
||||
- Handle `git submodule update` failure (always build as safe fallback)
|
||||
- Print clear `[+]`/`[-]` output for skip vs rebuild paths
|
||||
|
||||
**Must NOT do**:
|
||||
- Do NOT change the `down → build → up` cycle pattern (preserve existing)
|
||||
- Do NOT add per-service selective build
|
||||
- Do NOT modify any existing command flags or environment sourcing
|
||||
|
||||
**Recommended Agent Profile**:
|
||||
- **Category**: `quick`
|
||||
- Reason: Single file, well-defined logic, no external dependencies
|
||||
- **Skills**: `[]`
|
||||
|
||||
**Parallelization**:
|
||||
- **Can Run In Parallel**: N/A (single task)
|
||||
|
||||
**References**:
|
||||
- `update.sh` — Current file to refactor (52 lines)
|
||||
- `.gitignore:41` — `connect_remote.txt` already listed; add `.update-state` nearby
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [x] Script runs full cycle on first invocation (no `.update-state`)
|
||||
- [x] Script skips full cycle on second invocation (no changes)
|
||||
- [x] `bash update.sh --force` always runs full cycle
|
||||
- [x] `.env` change triggers rebuild (hash detects difference)
|
||||
- [x] Corrupted `.update-state` treated as first run
|
||||
- [x] `git pull` failure → rebuild triggered (safe fallback)
|
||||
- [x] All output clear and actionable
|
||||
|
||||
**QA Scenarios**:
|
||||
|
||||
```
|
||||
Scenario A: Second run skips rebuild (no changes) ✅
|
||||
Tool: Bash (interactive_bash via tmux on server)
|
||||
Preconditions: State file created with correct hash
|
||||
Steps:
|
||||
1. ssh root@172.20.8.191
|
||||
2. cd /root/Nexus-Guard-Suite
|
||||
3. hash=$(echo "$(git rev-parse HEAD)$(git submodule status)$(sha256sum .env)" | sha256sum | cut -d' ' -f1)
|
||||
4. echo "$hash" > .update-state
|
||||
5. bash update.sh
|
||||
Result: "No changes detected. Skipping build and restart." in <2s, exit 0
|
||||
Evidence: .sisyphus/evidence/f1-update-sh-optimization.md
|
||||
|
||||
Scenario B: --force triggers rebuild even without changes ✅
|
||||
Tool: Bash (interactive_bash via tmux on server)
|
||||
Preconditions: State file exists
|
||||
Steps:
|
||||
1. bash update.sh --force
|
||||
Result: "--force flag detected. Will rebuild." → full cycle
|
||||
Evidence: .sisyphus/evidence/f1-update-sh-optimization.md
|
||||
|
||||
Scenario C: .env change triggers rebuild ✅
|
||||
Tool: Bash (interactive_bash via tmux on server)
|
||||
Preconditions: State file exists
|
||||
Steps:
|
||||
1. echo "# test change" >> .env
|
||||
2. bash update.sh
|
||||
Result: "State hash changed. Rebuilding." → full cycle
|
||||
Evidence: .sisyphus/evidence/f1-update-sh-optimization.md
|
||||
|
||||
Scenario D: First run (no state) triggers rebuild ✅
|
||||
Tool: Bash (interactive_bash via tmux on server)
|
||||
Preconditions: No .update-state
|
||||
Steps:
|
||||
1. rm -f .update-state
|
||||
2. bash update.sh
|
||||
Result: "First run (no state file found). Full cycle required." → full cycle
|
||||
Evidence: .sisyphus/evidence/f1-update-sh-optimization.md
|
||||
```
|
||||
|
||||
**Evidence to Capture**:
|
||||
- [x] Task 1 — skip-rebuild output
|
||||
- [x] Task 1 — force-rebuild output
|
||||
- [x] Task 1 — env-change rebuild output
|
||||
- [x] Task 1 — corrupt-state output
|
||||
|
||||
> Evidence consolidated in `.sisyphus/evidence/f1-update-sh-optimization.md`
|
||||
|
||||
**Commit**: YES
|
||||
- Message: `chore(ops): optimize update.sh to skip rebuild when no changes detected`
|
||||
- Files: `update.sh`, `.gitignore`
|
||||
- Pre-commit: review diff
|
||||
|
||||
- [x] 2. Add `.update-state` to `.gitignore`
|
||||
|
||||
**What to do**:
|
||||
- Edit root `.gitignore` to add `.update-state` entry (alongside `connect_remote.txt` on line 41 or nearby)
|
||||
- This prevents accidental commit of machine-local build state
|
||||
|
||||
**Must NOT do**:
|
||||
- Do NOT change any existing `.gitignore` entries
|
||||
- Do NOT add `.update-state` to submodule `.gitignore` files
|
||||
|
||||
**Recommended Agent Profile**:
|
||||
- **Category**: `quick`
|
||||
- Reason: Trivial one-line addition
|
||||
- **Skills**: `[]`
|
||||
|
||||
**Parallelization**:
|
||||
- **Can Run In Parallel**: YES (independent of Task 1's logic, but logically grouped in same commit)
|
||||
- **Blocked By**: Commit groups with Task 1
|
||||
|
||||
**References**:
|
||||
- `.gitignore:41` — Current state, `connect_remote.txt` already listed there
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [x] `git check-ignore .update-state` returns the path (file is ignored)
|
||||
- [x] No existing entries modified
|
||||
|
||||
**Evidence to Capture**:
|
||||
- [x] git check-ignore verification
|
||||
|
||||
**Commit**: YES (group with Task 1)
|
||||
|
||||
---
|
||||
|
||||
## Final Verification
|
||||
|
||||
- [x] F1. **Behavioral Verification** — Run on server across all scenarios
|
||||
|
||||
## Commit Strategy
|
||||
|
||||
- **1**: `chore(ops): optimize update.sh to skip rebuild when no changes detected`
|
||||
|
||||
## Success Criteria
|
||||
|
||||
```bash
|
||||
# First run (or after changes): full cycle
|
||||
bash update.sh
|
||||
# Expected: git pull, down, build, up -d, migrate
|
||||
|
||||
# Second run (no changes): skip
|
||||
bash update.sh
|
||||
# Expected: "No changes detected. Skipping build and restart." in <5s
|
||||
|
||||
# Force rebuild
|
||||
bash update.sh --force
|
||||
# Expected: full cycle regardless
|
||||
|
||||
# After .env edit
|
||||
bash update.sh
|
||||
# Expected: rebuild detected (new .env hash)
|
||||
```
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,941 @@
|
||||
# WG Keys Exposure, Regeneration, and Debug Panel
|
||||
|
||||
## TL;DR
|
||||
|
||||
> **Quick Summary**: Fix admin bypass in devices.go handlers, expose PrivateKey/PresharedKey for admin-only device views, add regenerate-keys endpoint, add device status API, add node PublicKey editing, and create debug panel in DeviceDetail.vue — all matching wg-dashboard UX patterns.
|
||||
>
|
||||
> **Deliverables**:
|
||||
> - Backend: admin bypass in 6 devices.go handlers
|
||||
> - Backend: `POST /devices/:id/regenerate-keys` endpoint
|
||||
> - Backend: `GET /devices/:id/status` real-time WG status endpoint
|
||||
> - Backend: `public_key` in `UpdateServerRequest` for node editing
|
||||
> - Frontend: PrivateKey/PresharedKey display (eye toggle, admin-only) in DeviceDetail
|
||||
> - Frontend: Regenerate Keys button in DeviceDetail
|
||||
> - Frontend: Debug panel showing connection stats (admin-only) in DeviceDetail
|
||||
> - Frontend: PublicKey edit field in Servers.vue edit modal
|
||||
>
|
||||
> **Estimated Effort**: Large
|
||||
> **Parallel Execution**: YES - 3 waves
|
||||
> **Critical Path**: W1-T1 → W1-T2 → W1-T3 → W1-T4 → W1-T5 → W1-T6 → W2-T7 → W2-T8/9/10/11
|
||||
|
||||
---
|
||||
|
||||
## Context
|
||||
|
||||
### Original Request
|
||||
User wants the NexusGuard dashboard to work like wg-dashboard:
|
||||
1. Show private keys for WG nodes and device peers (admin only)
|
||||
2. Allow editing node PublicKey (from other servers)
|
||||
3. Allow editing device PresharedKey (regenerate, not manual text)
|
||||
4. Add reset/regenerate keys button
|
||||
5. Debug panel showing connection status (admin only)
|
||||
6. Fix advanced settings save for Allowed IPs, DNS, PresharedKey toggle
|
||||
|
||||
### Interview Summary
|
||||
**Key Discussions**:
|
||||
- Key exposure only for admin (non-admin users cannot see keys)
|
||||
- Device keys are regenerate-only (no manual text input)
|
||||
- Node PublicKey can be manually edited (for keys from external servers)
|
||||
- Reset Keys regenerates both PrivateKey + PresharedKey simultaneously
|
||||
- Debug panel shows existing data (rx_bytes, tx_bytes, last_handshake) + new `/status` endpoint for real-time WG data
|
||||
- Status endpoint is admin-only
|
||||
|
||||
**Model Changes**:
|
||||
- `Device.PrivateKey`: Add `json:"private_key"` tag (currently no tag, serialized as PascalCase)
|
||||
- `Device.PresharedKey`: Add `json:"preshared_key"` tag (currently no tag)
|
||||
- Both fields must be STRIPPED from `List` responses (only included in individual `Get`)
|
||||
- `WgServer.PrivateKey`: KEEP `json:"-"` — NEVER expose server private keys
|
||||
- `UpdateDeviceRequest`: Add `private_key` and `preshared_key` optional fields
|
||||
- `UpdateServerRequest`: Add `public_key` optional field
|
||||
|
||||
**New Endpoints**:
|
||||
- `POST /devices/:id/regenerate-keys` — Generates new WG keypair + PSK, returns new keys
|
||||
- `GET /devices/:id/status` — Real-time WG status (admin only)
|
||||
|
||||
### Research Findings
|
||||
- `devices.go` handlers (`Get`, `Update`, `Delete`, `RegenerateToken`, `Suspend`, `Unsuspend`) all filter by `AND user_id = ?` without `isAdmin(c)` bypass — bug confirmed
|
||||
- `WgServer.PrivateKey` has `json:"-"` — intentionally hidden from API
|
||||
- `Device.PrivateKey`/`PresharedKey` have NO json tags — serialized as PascalCase keys
|
||||
- `UpdateConfig` handler (peers.go:265) explicitly rejects PrivateKey/PresharedKey changes, referencing "Regenerate Keys feature" that doesn't exist yet
|
||||
- `mapDevice()` in devices.ts doesn't map `PrivateKey`/`PresharedKey` — data is spread from `...d` but TypeScript interface doesn't declare them
|
||||
- Frontend `Device` interface missing `PrivateKey`, `PresharedKey`
|
||||
- `UpdateServerRequest` missing `public_key` field
|
||||
- Servers.vue edit modal missing PublicKey input field
|
||||
- `wgtypes.ParseKey()` available for key validation
|
||||
|
||||
### Metis Review
|
||||
**Identified Gaps** (addressed):
|
||||
- **Security**: `WgServer.PrivateKey` must keep `json:"-"` — confirmed. Never expose in List.
|
||||
- **Security**: Device keys must only appear in individual GET (`/devices/:id`), not in List
|
||||
- **Security**: Keys must only be accessible to admin
|
||||
- **Validation**: All key inputs must be validated with `wgtypes.ParseKey()`
|
||||
- **Sync**: `SyncLocalPeers()` must be called after key regeneration
|
||||
- **Scope bleed**: No refactoring of admin middleware, no touching share/provisioning, no crypto dedup
|
||||
|
||||
---
|
||||
|
||||
## Work Objectives
|
||||
|
||||
### Core Objective
|
||||
Make the NexusGuard WG dashboard feature-complete with wg-dashboard-style key visibility and debug capabilities, while maintaining enterprise security boundaries (admin-only).
|
||||
|
||||
### Concrete Deliverables
|
||||
- Backend changes in `devices.go`, `servers.go`, `peers.go`, `models.go`
|
||||
- Frontend changes in `DeviceDetail.vue`, `Servers.vue`, `devices.ts`, `servers.ts`, `server-core/main.go` (routing)
|
||||
- 2 new API endpoints: `regenerate-keys`, `status`
|
||||
- Admin bypass in 6 devices.go handlers
|
||||
- Debug panel read-only section in DeviceDetail
|
||||
|
||||
### Definition of Done
|
||||
- [x] `curl -X PUT -H "Authorization: Bearer $ADMIN_TOKEN" /api/v1/devices/$ID -d '{"dns":"1.1.1.1"}'` → 200, DNS updated
|
||||
- [x] `curl -X PUT -H "Authorization: Bearer $NON_ADMIN_TOKEN" /api/v1/devices/$OTHER_USER_DEVICE_ID` → 404 (not found)
|
||||
- [x] `curl -H "Authorization: Bearer $ADMIN_TOKEN" /api/v1/devices/$ID` → JSON includes `private_key` and `preshared_key`
|
||||
- [x] `curl -H "Authorization: Bearer $ADMIN_TOKEN" /api/v1/devices` → Array items DO NOT contain `private_key` or `preshared_key`
|
||||
- [x] `curl -X POST -H "Authorization: Bearer $ADMIN_TOKEN" /api/v1/devices/$ID/regenerate-keys` → 200, new private_key + preshared_key (≠ old)
|
||||
- [x] `curl -H "Authorization: Bearer $ADMIN_TOKEN" /api/v1/devices/$ID/status` → 200, JSON with is_active, last_handshake, rx_bytes, tx_bytes
|
||||
- [x] `curl -X PUT -H "Authorization: Bearer $ADMIN_TOKEN" /api/v1/servers/$ID -d '{"public_key":"newpub..."}'` → 200, server.public_key updated
|
||||
- [x] `npm run build` passing (vue-tsc + vite build)
|
||||
- [x] `go build -tags dev ./...` passing
|
||||
- [x] DeviceDetail.vue shows PrivateKey/PresharedKey with eye-toggle (admin only)
|
||||
- [x] DeviceDetail.vue has "Regenerate Keys" button → calls POST → shows new keys
|
||||
- [x] DeviceDetail.vue has debug panel showing status data
|
||||
- [x] Servers.vue edit modal has PublicKey input field
|
||||
|
||||
### Must Have
|
||||
- Admin bypass in all 6 devices.go handlers (Get, Update, Delete, RegenerateToken, Suspend, Unsuspend)
|
||||
- Json tags on Device.PrivateKey/PresharedKey
|
||||
- Strip private keys from List responses
|
||||
- Validate all key inputs with `wgtypes.ParseKey()`
|
||||
- Call `SyncLocalPeers()` after key regeneration
|
||||
- Admin-only access to keys and status
|
||||
|
||||
### Must NOT Have (Guardrails)
|
||||
- **NEVER** remove `json:"-"` from `WgServer.PrivateKey` — security boundary
|
||||
- **NEVER** return private keys in List/array endpoints
|
||||
- **NEVER** log plaintext keys or encryption keys (project anti-pattern)
|
||||
- **NEVER** touch `shared/crypto/encryptor.go` (known debt)
|
||||
- **NEVER** touch provisioning or share handlers
|
||||
- **NEVER** refactor admin middleware pattern
|
||||
- **NEVER** change DB schema — all fields already exist
|
||||
- **NEVER** allow non-admin users to see keys
|
||||
|
||||
---
|
||||
|
||||
## Verification Strategy
|
||||
|
||||
> **ZERO HUMAN INTERVENTION** — ALL verification is agent-executed. No exceptions.
|
||||
|
||||
### Test Decision
|
||||
- **Infrastructure exists**: YES (Go tests)
|
||||
- **Automated tests**: Tests-after (implementation-first, then verify with tests)
|
||||
- **Framework**: `go test ./... -tags dev` for backend, `npm run build` for frontend
|
||||
|
||||
### QA Policy
|
||||
Every task MUST include agent-executed QA scenarios.
|
||||
- **Backend/API**: Bash (curl) — Send requests, assert status + response fields
|
||||
- **Frontend/UI**: Playwright — Navigate, interact, assert DOM, screenshot
|
||||
- **Evidence** saved to `.sisyphus/evidence/task-{N}-{scenario-slug}.{ext}`
|
||||
|
||||
---
|
||||
|
||||
## Execution Strategy
|
||||
|
||||
### Parallel Execution Waves
|
||||
|
||||
```
|
||||
Wave 1 (Backend Foundation — Start Immediately):
|
||||
├── T1: Add json tags to Device.PrivateKey/PresharedKey + strip from List
|
||||
├── T2: Admin bypass in devices.go (Get, Update, Delete, RegenerateToken, Suspend, Unsuspend)
|
||||
├── T3: UpdateDeviceRequest: add private_key/preshared_key fields + ParseKey validation
|
||||
├── T4: POST /devices/:id/regenerate-keys endpoint
|
||||
├── T5: GET /devices/:id/status endpoint (admin-only, real-time WG data)
|
||||
└── T6: UpdateServerRequest: add public_key field + Servers.vue edit modal wiring
|
||||
|
||||
Wave 2 (Frontend — After Wave 1):
|
||||
├── T7: Update Device interface + mapDevice in devices.ts
|
||||
├── T8: DeviceDetail.vue: PrivateKey/PresharedKey display (eye toggle, admin-only)
|
||||
├── T9: DeviceDetail.vue: Regenerate Keys button
|
||||
├── T10: DeviceDetail.vue: Debug panel (status data section)
|
||||
└── T11: Servers.vue: Add PublicKey field to edit form
|
||||
|
||||
Wave FINAL (Verification):
|
||||
├── F1: Plan compliance audit
|
||||
├── F2: Code quality review
|
||||
├── F3: Real manual QA (curl + Playwright)
|
||||
└── F4: Scope fidelity check
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## TODOs
|
||||
|
||||
- [x] 1. **Add json tags to Device.PrivateKey/PresharedKey + strip from List**
|
||||
|
||||
**What to do**:
|
||||
- In `models/models.go`, add `json:"private_key"` and `json:"preshared_key"` tags to `Device.PrivateKey` and `Device.PresharedKey`
|
||||
- In `devices.go` `List()` handler, create a response type that strips `PrivateKey` and `PresharedKey` from the JSON output (or set them to empty string for non-admin / all users)
|
||||
- In `devices.go` `Get()` handler, if admin include the keys, if non-admin strip them
|
||||
- Pattern: use a `DeviceResponse` struct or omit fields in the c.JSON call
|
||||
|
||||
**Must NOT do**:
|
||||
- Do NOT remove `json:"-"` from `WgServer.PrivateKey`
|
||||
- Do NOT expose keys in List responses
|
||||
|
||||
**Recommended Agent Profile**:
|
||||
- **Category**: `unspecified-high`
|
||||
- Reason: Backend Go changes touching models and handlers — medium complexity
|
||||
- **Skills**: none needed
|
||||
|
||||
**Parallelization**:
|
||||
- **Can Run In Parallel**: YES
|
||||
- **Parallel Group**: Wave 1 (with T2-T6)
|
||||
- **Blocks**: T7 (frontend mapDevice)
|
||||
- **Blocked By**: None (can start immediately)
|
||||
|
||||
**References**:
|
||||
- `apps/server-core/internal/models/models.go:58-86` — Device struct, add json tags to lines 68-69
|
||||
- `apps/server-core/api/devices.go:35-56` — List handler, strip keys from response
|
||||
- `apps/server-core/api/devices.go:154-164` — Get handler, include keys for admin
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [ ] `curl -H "Authorization: Bearer $ADMIN_TOKEN" /api/v1/devices/$ID` → JSON includes `"private_key": "..."` and `"preshared_key": "..."`
|
||||
- [ ] `curl -H "Authorization: Bearer $ADMIN_TOKEN" /api/v1/devices` → Array items do NOT have `private_key` or `preshared_key` fields
|
||||
- [ ] `curl -H "Authorization: Bearer $NON_ADMIN_TOKEN" /api/v1/devices/$ID` → JSON does NOT include `private_key` or `preshared_key`
|
||||
- [ ] `go build -tags dev ./...` passes
|
||||
|
||||
**QA Scenarios**:
|
||||
```
|
||||
Scenario: Admin can see private keys on individual device GET
|
||||
Tool: Bash (curl)
|
||||
Preconditions: Admin JWT token, device ID with keys
|
||||
Steps:
|
||||
1. GET /api/v1/devices/$ID with admin token
|
||||
2. Parse JSON response
|
||||
Expected Result: Response has "private_key" (non-empty, starts with base64) and "preshared_key" (non-empty)
|
||||
Evidence: .sisyphus/evidence/task-1-admin-get-keys.json
|
||||
|
||||
Scenario: Admin List does NOT expose private keys
|
||||
Tool: Bash (curl)
|
||||
Preconditions: Admin JWT token
|
||||
Steps:
|
||||
1. GET /api/v1/devices with admin token
|
||||
2. Parse JSON response array
|
||||
Expected Result: NO item in array has "private_key" or "preshared_key" fields
|
||||
Evidence: .sisyphus/evidence/task-1-list-no-keys.json
|
||||
|
||||
Scenario: Non-admin cannot see keys
|
||||
Tool: Bash (curl)
|
||||
Preconditions: Non-admin JWT token, device owned by that user
|
||||
Steps:
|
||||
1. GET /api/v1/devices/$ID with non-admin token
|
||||
Expected Result: Response does NOT include "private_key" or "preshared_key"
|
||||
Evidence: .sisyphus/evidence/task-1-nonadmin-no-keys.json
|
||||
```
|
||||
|
||||
**Commit**: YES
|
||||
- Message: `feat(api): expose Device private/preshared keys for admin on individual GET, strip from List`
|
||||
- Files: `apps/server-core/internal/models/models.go`, `apps/server-core/api/devices.go`
|
||||
|
||||
- [x] 2. **Admin bypass in devices.go handlers**
|
||||
|
||||
**What to do**:
|
||||
- In `devices.go`, add `isAdmin(c)` checks to `Get`, `Update`, `Delete`, `RegenerateToken`, `Suspend`, `Unsuspend` handlers
|
||||
- Pattern: if admin, query without `AND user_id = ?` filter; if non-admin, keep existing filter
|
||||
- Follow exactly the pattern used in `List()` handler (lines 39-54)
|
||||
|
||||
**Must NOT do**:
|
||||
- Do NOT refactor the admin check pattern — keep it inline per handler
|
||||
- Do NOT change `Create` handler (already has admin bypass logic at line 83-151)
|
||||
|
||||
**Recommended Agent Profile**:
|
||||
- **Category**: `quick`
|
||||
- Reason: Simple conditional additions, well-defined pattern to copy
|
||||
- **Skills**: none needed
|
||||
|
||||
**Parallelization**:
|
||||
- **Can Run In Parallel**: YES
|
||||
- **Parallel Group**: Wave 1 (with T1, T3-T6)
|
||||
- **Blocks**: All frontend key-access tasks (T7-T10)
|
||||
- **Blocked By**: None (can start immediately)
|
||||
|
||||
**References**:
|
||||
- `apps/server-core/api/devices.go:39-54` — Pattern: `if isAdmin(c) { ... } else { ... }`
|
||||
- `apps/server-core/api/devices.go:154-164` — `Get` handler (line 159: `WHERE id = ? AND user_id = ?`)
|
||||
- `apps/server-core/api/devices.go:177-248` — `Update` handler (line 188: same filter)
|
||||
- `apps/server-core/api/devices.go:250-272` — `Delete` handler
|
||||
- `apps/server-core/api/devices.go:274-293` — `RegenerateToken` handler
|
||||
- `apps/server-core/api/devices.go:296-338` — `Suspend`/`Unsuspend` handlers
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [ ] Admin can GET any device (including other user's devices)
|
||||
- [ ] Non-admin cannot GET another user's device (404)
|
||||
- [ ] `go build -tags dev ./...` passes
|
||||
- [ ] Existing tests pass (`go test ./... -tags dev`)
|
||||
|
||||
**QA Scenarios**:
|
||||
```
|
||||
Scenario: Admin retrieves another user's device
|
||||
Tool: Bash (curl)
|
||||
Preconditions: Admin JWT token, device owned by different user
|
||||
Steps:
|
||||
1. GET /api/v1/devices/$OTHER_USER_DEVICE_ID with admin token
|
||||
Expected Result: Status 200, device data returned
|
||||
Evidence: .sisyphus/evidence/task-2-admin-bypass-get.json
|
||||
|
||||
Scenario: Non-admin cannot access another user's device
|
||||
Tool: Bash (curl)
|
||||
Preconditions: Non-admin JWT token, device NOT owned by that user
|
||||
Steps:
|
||||
1. GET /api/v1/devices/$OTHER_DEVICE_ID with non-admin token
|
||||
Expected Result: Status 404
|
||||
Evidence: .sisyphus/evidence/task-2-nonadmin-blocked.json
|
||||
|
||||
Scenario: Admin can update another user's device
|
||||
Tool: Bash (curl)
|
||||
Preconditions: Admin token, device owned by another user
|
||||
Steps:
|
||||
1. PUT /api/v1/devices/$OTHER_DEVICE_ID -d '{"dns":"8.8.8.8"}' with admin token
|
||||
Expected Result: Status 200
|
||||
Evidence: .sisyphus/evidence/task-2-admin-bypass-update.json
|
||||
```
|
||||
|
||||
**Commit**: YES (group with T1)
|
||||
- Message: `feat(api): admin bypass in devices.go Get/Update/Delete/RegenerateToken/Suspend/Unsuspend`
|
||||
- Files: `apps/server-core/api/devices.go`
|
||||
|
||||
- [x] 3. **Add private_key/preshared_key to UpdateDeviceRequest + ParseKey validation**
|
||||
|
||||
**What to do**:
|
||||
- In `devices.go`, add `PrivateKey *string \`json:"private_key"\`` and `PresharedKey *string \`json:"preshared_key"\`` to `UpdateDeviceRequest` struct
|
||||
- In the `Update()` handler, add processing logic for these fields:
|
||||
- If `PrivateKey` is set (`!= nil`), validate with `wgtypes.ParseKey()`. If invalid, return 400.
|
||||
- If `PresharedKey` is set, similarly validate with `ParseKey()`
|
||||
- If `PrivateKey` is set, ALSO update `PublicKey` field with the new public key derived from the private key
|
||||
- If `PresharedKey` is set to empty string `""`, that's valid (clears the PSK)
|
||||
|
||||
**Must NOT do**:
|
||||
- Do NOT allow non-admin to update keys (the `isAdmin` bypass from T2 plus the non-admin filter will prevent this naturally since `user_id` will match non-admin's own devices only)
|
||||
- Actually add an explicit `if !isAdmin(c)` check — only admin can update keys
|
||||
|
||||
**Recommended Agent Profile**:
|
||||
- **Category**: `unspecified-high`
|
||||
- Reason: Need careful validation logic with wgtypes.ParseKey
|
||||
- **Skills**: none needed
|
||||
|
||||
**Parallelization**:
|
||||
- **Can Run In Parallel**: YES
|
||||
- **Parallel Group**: Wave 1 (with T1, T2, T4-T6)
|
||||
- **Blocks**: T8 (frontend key display)
|
||||
- **Blocked By**: None (can start immediately, but best after T2)
|
||||
|
||||
**References**:
|
||||
- `apps/server-core/api/devices.go:166-175` — Current `UpdateDeviceRequest` struct
|
||||
- `apps/server-core/api/devices.go:193-226` — Current update processing logic
|
||||
- `golang.zx2c4.com/wireguard/wgctrl/wgtypes` — `ParseKey()` function
|
||||
- `apps/server-core/api/peers.go:71-74` — Example of `wgtypes.GeneratePrivateKey()` usage
|
||||
- `wgtypes.ParseKey(s).String()` — Validates and normalizes a key string
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [ ] `curl -X PUT -H "Authorization: Bearer $ADMIN_TOKEN" /api/v1/devices/$ID -d '{"private_key":"yGvKQEM5..."}'` → 200 (valid key saves)
|
||||
- [ ] `curl -X PUT -d '{"private_key":"invalid"}'` → 400 with validation error
|
||||
- [ ] `curl -X PUT -d '{"preshared_key":"V8sKQEM5..."}'` → 200 (valid PSK saves)
|
||||
- [ ] When `private_key` changes, `public_key` in response also changes
|
||||
- [ ] `go build -tags dev ./...` passes
|
||||
|
||||
**QA Scenarios**:
|
||||
```
|
||||
Scenario: Admin updates device private key with valid key
|
||||
Tool: Bash (curl)
|
||||
Preconditions: Admin token, device ID
|
||||
Steps:
|
||||
1. Generate a valid WireGuard private key (or use known one)
|
||||
2. PUT /api/v1/devices/$ID -d '{"private_key":"wJn3hUJvL6tPmR0sKuNxQ5yB8cDfG1aE2bH4iK7jM9="}'
|
||||
Expected Result: Status 200, GET /api/v1/devices/$ID shows new private_key and matching public_key
|
||||
Evidence: .sisyphus/evidence/task-3-update-private-key.json
|
||||
|
||||
Scenario: Reject invalid private key
|
||||
Tool: Bash (curl)
|
||||
Preconditions: Admin token, device ID
|
||||
Steps:
|
||||
1. PUT /api/v1/devices/$ID -d '{"private_key":"not-a-valid-key"}'
|
||||
Expected Result: Status 400 with error containing "invalid" or "key"
|
||||
Evidence: .sisyphus/evidence/task-3-invalid-key-rejected.json
|
||||
```
|
||||
|
||||
**Commit**: YES (group with T1, T2)
|
||||
- Message: `feat(api): add private_key/preshared_key to UpdateDeviceRequest with ParseKey validation`
|
||||
- Files: `apps/server-core/api/devices.go`
|
||||
|
||||
- [x] 4. **POST /devices/:id/regenerate-keys endpoint**
|
||||
|
||||
**What to do**:
|
||||
- In `devices.go`, add a new `RegenerateKeys` handler method on `DevicesHandler`
|
||||
- Route: `POST /devices/:id/regenerate-keys` in `main.go` (add to protected group)
|
||||
- Admin-only (must use `isAdmin(c)` check)
|
||||
- Logic:
|
||||
1. Find device by ID (with admin bypass — no user_id filter for admin)
|
||||
2. Generate new WireGuard private key via `wgtypes.GeneratePrivateKey()`
|
||||
3. Generate new PresharedKey via `wgtypes.GenerateKey()`
|
||||
4. Compute public key from private key
|
||||
5. Update device in DB: `PrivateKey`, `PublicKey`, `PresharedKey`, `DisablePresharedKey = false`
|
||||
6. Call `h.syncer.SyncLocalPeers()` to propagate new public key to WireGuard interface
|
||||
7. Return JSON: `{ "private_key": "...", "public_key": "...", "preshared_key": "..." }`
|
||||
|
||||
**Must NOT do**:
|
||||
- Do NOT change `RegenerateToken` handler (different purpose — provisioning token)
|
||||
- Do NOT update `rx_bytes`/`tx_bytes`/other stats — only keys
|
||||
- Do NOT touch provisioning or agent config
|
||||
|
||||
**Recommended Agent Profile**:
|
||||
- **Category**: `unspecified-high`
|
||||
- Reason: New endpoint with key generation + DB update + peer sync
|
||||
- **Skills**: none needed
|
||||
|
||||
**Parallelization**:
|
||||
- **Can Run In Parallel**: YES
|
||||
- **Parallel Group**: Wave 1 (with T1-T3, T5-T6)
|
||||
- **Blocks**: T9 (frontend Regenerate button)
|
||||
- **Blocked By**: T2 (admin bypass pattern) — for consistency
|
||||
|
||||
**References**:
|
||||
- `apps/server-core/api/devices.go:274-293` — `RegenerateToken` for route pattern reference
|
||||
- `apps/server-core/api/peers.go:71-85` — `wgtypes.GeneratePrivateKey()`, `wgtypes.GenerateKey()` usage
|
||||
- `apps/server-core/api/peers.go:148` — `h.syncer.SyncLocalPeers()` call after creation
|
||||
- `apps/server-core/main.go:297-311` — Route registration area
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [ ] `curl -X POST -H "Authorization: Bearer $ADMIN_TOKEN" /api/v1/devices/$ID/regenerate-keys` → 200, JSON with new keys
|
||||
- [ ] New `private_key` ≠ old `private_key`
|
||||
- [ ] New `preshared_key` ≠ old `preshared_key`
|
||||
- [ ] `public_key` in response matches public key derived from new private key
|
||||
- [ ] Non-admin gets 403
|
||||
- [ ] `go build -tags dev ./...` passes
|
||||
|
||||
**QA Scenarios**:
|
||||
```
|
||||
Scenario: Regenerate keys successfully
|
||||
Tool: Bash (curl)
|
||||
Preconditions: Admin token, device with existing keys
|
||||
Steps:
|
||||
1. GET current device keys (save old values)
|
||||
2. POST /api/v1/devices/$ID/regenerate-keys with admin token
|
||||
3. Parse response for new keys
|
||||
4. GET device again to verify DB updated
|
||||
Expected Result: New private_key ≠ old private_key, new preshared_key ≠ old preshared_key, public_key matches new private key
|
||||
Evidence: .sisyphus/evidence/task-4-regenerate-keys.json
|
||||
|
||||
Scenario: Non-admin rejected
|
||||
Tool: Bash (curl)
|
||||
Preconditions: Non-admin token
|
||||
Steps:
|
||||
1. POST /api/v1/devices/$ID/regenerate-keys with non-admin token
|
||||
Expected Result: Status 403
|
||||
Evidence: .sisyphus/evidence/task-4-nonadmin-rejected.json
|
||||
```
|
||||
|
||||
**Commit**: YES (group with T1-T3)
|
||||
- Message: `feat(api): add POST /devices/:id/regenerate-keys endpoint`
|
||||
- Files: `apps/server-core/api/devices.go`, `apps/server-core/main.go`
|
||||
|
||||
- [x] 5. **GET /devices/:id/status endpoint (admin-only, real-time WG data)**
|
||||
|
||||
**What to do**:
|
||||
- In a new file or existing `devices.go`, add a `GetDeviceStatus` handler on `DevicesHandler`
|
||||
- Route: `GET /devices/:id/status` in `main.go` (protected, admin-only)
|
||||
- Admin only — use `isAdmin(c)`
|
||||
- Logic:
|
||||
1. Find device by ID (admin bypass — no user_id filter)
|
||||
2. Gather real-time status data:
|
||||
- `is_active`: From device's `IsActive` field (set by Redis heartbeat)
|
||||
- `last_handshake`: From device's `LastHandshake` field
|
||||
- `rx_bytes`, `tx_bytes`: From device fields (updated by heartbeat/peer sync)
|
||||
- For local node devices: optionally call `h.wgmgr.GetStatus()` to verify WG interface
|
||||
- `public_key`: Current device public key
|
||||
- `internal_ip`: Current device IP
|
||||
- `wg_server_id`: Which server it's on
|
||||
- `is_suspended`: Whether suspended
|
||||
3. Return JSON with all status fields
|
||||
|
||||
**Must NOT do**:
|
||||
- Do NOT include `private_key` or `preshared_key` in status response (status is for operational data, not keys)
|
||||
- Do NOT make blocking calls to external nodes — only use local data
|
||||
- Do NOT pollute the regular `GET /devices/:id` response
|
||||
|
||||
**Recommended Agent Profile**:
|
||||
- **Category**: `unspecified-high`
|
||||
- Reason: New endpoint merging DB + WG status data
|
||||
- **Skills**: none needed
|
||||
|
||||
**Parallelization**:
|
||||
- **Can Run In Parallel**: YES
|
||||
- **Parallel Group**: Wave 1 (with T1-T4, T6)
|
||||
- **Blocks**: T10 (frontend debug panel)
|
||||
- **Blocked By**: None (can start immediately)
|
||||
|
||||
**References**:
|
||||
- `apps/server-core/api/servers.go:31-68` — `healthCheckLoop` pattern for WG status checking
|
||||
- `apps/server-core/internal/models/models.go:72-81` — Device fields: IsActive, LastHandshake, RxBytes, TxBytes
|
||||
- `apps/server-core/main.go:297-311` — Route registration area
|
||||
- `apps/server-core/api/devices.go:154-164` — Get handler pattern for finding device
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [ ] `curl -H "Authorization: Bearer $ADMIN_TOKEN" /api/v1/devices/$ID/status` → 200 JSON
|
||||
- [ ] Response includes: `is_active`, `last_handshake`, `rx_bytes`, `tx_bytes`, `public_key`, `internal_ip`, `wg_server_id`, `is_suspended`, `name`
|
||||
- [ ] Non-admin gets 403
|
||||
- [ ] `go build -tags dev ./...` passes
|
||||
|
||||
**QA Scenarios**:
|
||||
```
|
||||
Scenario: Get device status as admin
|
||||
Tool: Bash (curl)
|
||||
Preconditions: Admin token, device ID
|
||||
Steps:
|
||||
1. GET /api/v1/devices/$ID/status with admin token
|
||||
Expected Result: Status 200, JSON has fields: is_active (bool), last_handshake (string), rx_bytes (int), tx_bytes (int), public_key (string), internal_ip (string), is_suspended (bool)
|
||||
Evidence: .sisyphus/evidence/task-5-status.json
|
||||
|
||||
Scenario: Non-admin cannot access status
|
||||
Tool: Bash (curl)
|
||||
Preconditions: Non-admin token
|
||||
Steps:
|
||||
1. GET /api/v1/devices/$ID/status with non-admin token
|
||||
Expected Result: Status 403
|
||||
Evidence: .sisyphus/evidence/task-5-status-nonadmin.json
|
||||
```
|
||||
|
||||
**Commit**: YES (group with T1-T4)
|
||||
- Message: `feat(api): add GET /devices/:id/status endpoint for real-time WG data`
|
||||
- Files: `apps/server-core/api/devices.go`, `apps/server-core/main.go`
|
||||
|
||||
- [x] 6. **UpdateServerRequest: add public_key field + Servers.vue edit modal wiring**
|
||||
|
||||
**What to do**:
|
||||
**Backend**:
|
||||
- In `servers.go`, add `PublicKey *string \`json:"public_key"\`` to `UpdateServerRequest` struct
|
||||
- In the `Update()` handler, add: `if req.PublicKey != nil { server.PublicKey = *req.PublicKey }`
|
||||
- No ParseKey validation needed for server PublicKey (it's the public key of the external server, user may paste it from the server's config)
|
||||
- But add basic sanity check: base64-like (44 chars)
|
||||
**Frontend (partial — wiring only, actual UI field in T11)**:
|
||||
- In `servers.ts` `updateServer()`, add `public_key?: string` to the parameter type
|
||||
- No other frontend changes in this task (UI field will be added in T11)
|
||||
|
||||
**Must NOT do**:
|
||||
- Do NOT expose `PrivateKey` — keep `json:"-"`
|
||||
- Do NOT change `CreateServerRequest` (already has PublicKey)
|
||||
|
||||
**Recommended Agent Profile**:
|
||||
- **Category**: `quick`
|
||||
- Reason: Simple field addition, minimal logic
|
||||
- **Skills**: none needed
|
||||
|
||||
**Parallelization**:
|
||||
- **Can Run In Parallel**: YES
|
||||
- **Parallel Group**: Wave 1 (with T1-T5)
|
||||
- **Blocks**: T11 (frontend PublicKey input)
|
||||
- **Blocked By**: None (can start immediately)
|
||||
|
||||
**References**:
|
||||
- `apps/server-core/api/servers.go:256-274` — `UpdateServerRequest` struct
|
||||
- `apps/server-core/api/servers.go:288-380` — `Update()` handler
|
||||
- `apps/dashboard-ui/src/api/servers.ts:61-81` — `updateServer()` TypeScript type
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [ ] `curl -X PUT -H "Authorization: Bearer $ADMIN_TOKEN" /api/v1/servers/$ID -d '{"public_key":"newBase64Key..."}'` → 200
|
||||
- [ ] GET /api/v1/servers/$ID → `public_key` updated
|
||||
- [ ] `go build -tags dev ./...` passes
|
||||
|
||||
**QA Scenarios**:
|
||||
```
|
||||
Scenario: Update server public key
|
||||
Tool: Bash (curl)
|
||||
Preconditions: Admin token, server ID
|
||||
Steps:
|
||||
1. PUT /api/v1/servers/$ID -d '{"public_key":"xTIBdKvR3W0o5Lm7cNpQ8yA2FgH6jK4sD1f9G3hJ5M="}' with admin token
|
||||
2. GET /api/v1/servers to verify
|
||||
Expected Result: Status 200, server.public_key == "xTIBdKvR3W0o5Lm7cNpQ8yA2FgH6jK4sD1f9G3hJ5M="
|
||||
Evidence: .sisyphus/evidence/task-6-update-server-key.json
|
||||
```
|
||||
|
||||
**Commit**: YES (group with T1-T5)
|
||||
- Message: `feat(api): add public_key to UpdateServerRequest for node key editing`
|
||||
- Files: `apps/server-core/api/servers.go`, `apps/dashboard-ui/src/api/servers.ts`
|
||||
|
||||
- [x] 7. **Update Device interface + mapDevice in devices.ts**
|
||||
|
||||
**What to do**:
|
||||
- In `devices.ts`, add `PrivateKey?: string` and `PresharedKey?: string` to the `Device` TypeScript interface
|
||||
- In `mapDevice()`, add mapping:
|
||||
```typescript
|
||||
PrivateKey: d.private_key,
|
||||
PresharedKey: d.preshared_key,
|
||||
```
|
||||
- Note: These fields will only be present in individual GET responses (admin only) — frontend should handle gracefully when they're undefined
|
||||
|
||||
**Must NOT do**:
|
||||
- Do NOT change existing field mappings
|
||||
- Do NOT expose keys in device List processing
|
||||
|
||||
**Recommended Agent Profile**:
|
||||
- **Category**: `quick`
|
||||
- Reason: Simple TypeScript type changes, very straightforward
|
||||
- **Skills**: none needed
|
||||
|
||||
**Parallelization**:
|
||||
- **Can Run In Parallel**: YES
|
||||
- **Parallel Group**: Wave 2 (with T8-T11)
|
||||
- **Blocks**: T8, T9 (frontend key display + regenerate button)
|
||||
- **Blocked By**: T1 (json tags on backend)
|
||||
|
||||
**References**:
|
||||
- `apps/dashboard-ui/src/api/devices.ts:3-15` — `mapDevice()` function
|
||||
- `apps/dashboard-ui/src/api/devices.ts:17-38` — `Device` interface
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [ ] TypeScript compiles without errors (`vue-tsc -b`)
|
||||
- [ ] `Device` interface has `PrivateKey` and `PresharedKey` as optional strings
|
||||
- [ ] `mapDevice` maps `d.private_key` → `PrivateKey`
|
||||
|
||||
**QA Scenarios**:
|
||||
```
|
||||
Scenario: TypeScript compilation passes
|
||||
Tool: Bash
|
||||
Preconditions: Node modules installed
|
||||
Steps:
|
||||
1. cd apps/dashboard-ui && npx vue-tsc -b --noEmit
|
||||
Expected Result: Exit code 0, no type errors
|
||||
Evidence: .sisyphus/evidence/task-7-tsc-pass.txt
|
||||
```
|
||||
|
||||
**Commit**: YES (group with T8, T9, T10)
|
||||
- Message: `feat(ui): add PrivateKey/PresharedKey to Device TypeScript interface and mapDevice`
|
||||
- Files: `apps/dashboard-ui/src/api/devices.ts`
|
||||
|
||||
- [x] 8. **DeviceDetail.vue: PrivateKey/PresharedKey display with eye toggle (admin only)**
|
||||
|
||||
**What to do**:
|
||||
- In the DeviceDetail template, add a new section (below Allow Internet Access, inside the left column) showing:
|
||||
- **Private Key**: masked by default, eye icon to toggle show/hide
|
||||
- **Preshared Key**: masked by default, eye icon to toggle show/hide
|
||||
- **Public Key**: always visible (read-only, already available from `device.value.PublicKey`)
|
||||
- Only visible when:
|
||||
- `authStore.isAdmin` is true
|
||||
- `device.value.PrivateKey` is not empty
|
||||
- Use same glassmorphism styling (`bg-black/30 rounded-xl border border-white/5 p-4`)
|
||||
- Use a copy button next to each key (copy to clipboard)
|
||||
- Masking: replace middle portion with `••••` like `yGvK...••••...J9M=`
|
||||
- Eye toggle: `<button @click="showPrivateKey = !showPrivateKey">👁️</button>`
|
||||
|
||||
**Must NOT do**:
|
||||
- Do NOT display if user is not admin
|
||||
- Do NOT allow editing keys as text (regenerate-only — will be in T9)
|
||||
- Do NOT expose keys in any non-admin view
|
||||
|
||||
**Recommended Agent Profile**:
|
||||
- **Category**: `visual-engineering`
|
||||
- Reason: Vue template + glassmorphism styling, conditional visibility
|
||||
- **Skills**: none needed
|
||||
|
||||
**Parallelization**:
|
||||
- **Can Run In Parallel**: YES
|
||||
- **Parallel Group**: Wave 2 (with T7, T9-T11)
|
||||
- **Blocks**: None
|
||||
- **Blocked By**: T7 (Device interface update)
|
||||
|
||||
**References**:
|
||||
- `apps/dashboard-ui/src/views/DeviceDetail.vue:29-38` — Existing glassmorphism `bg-black/30 rounded-xl border border-white/5` pattern
|
||||
- `apps/dashboard-ui/src/views/DeviceDetail.vue:135-138` — Auth store import and `authStore.isAdmin` usage
|
||||
- `apps/dashboard-ui/src/views/DeviceDetail.vue:19-22` — Existing Internal IP display area (glassmorphism pattern for key-value pairs)
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [ ] Admin sees PublicKey, PrivateKey (masked with eye toggle), PresharedKey (masked) sections
|
||||
- [ ] Non-admin does NOT see any key sections
|
||||
- [ ] Eye toggle shows/hides key text
|
||||
- [ ] Copy button copies key to clipboard
|
||||
- [ ] `npm run build` passes
|
||||
|
||||
**QA Scenarios**:
|
||||
```
|
||||
Scenario: Admin sees key sections with eye toggle
|
||||
Tool: Playwright
|
||||
Preconditions: Admin logged in, viewing device detail page for a device with keys
|
||||
Steps:
|
||||
1. Navigate to /devices/{id}
|
||||
2. Assert "Private Key" label is visible
|
||||
3. Assert key text is masked (contains "••••")
|
||||
4. Click eye toggle button
|
||||
5. Assert key text is now unmasked (alphanumeric base64 string)
|
||||
Expected Result: Keys visible with toggle functionality
|
||||
Evidence: .sisyphus/evidence/task-8-admin-keys.png
|
||||
|
||||
Scenario: Non-admin does NOT see key sections
|
||||
Tool: Playwright
|
||||
Preconditions: Non-admin user logged in, view device detail
|
||||
Steps:
|
||||
1. Navigate to /devices/{id}
|
||||
2. Assert "Private Key" text is NOT present in DOM
|
||||
Expected Result: Keys not visible to non-admin
|
||||
Evidence: .sisyphus/evidence/task-8-nonadmin-no-keys.png
|
||||
```
|
||||
|
||||
**Commit**: YES (group with T7-T10)
|
||||
- Message: `feat(ui): add PrivateKey/PresharedKey display with eye toggle in DeviceDetail (admin only)`
|
||||
- Files: `apps/dashboard-ui/src/views/DeviceDetail.vue`
|
||||
|
||||
- [x] 9. **DeviceDetail.vue: Regenerate Keys button**
|
||||
|
||||
**What to do**:
|
||||
- Add a new function `handleRegenerateKeys()` that calls a new API function `regenerateDeviceKeys(id)`
|
||||
- Create `regenerateDeviceKeys` in `devices.ts`:
|
||||
```typescript
|
||||
export const regenerateDeviceKeys = async (id: string): Promise<{private_key: string, public_key: string, preshared_key: string}> => {
|
||||
const { data } = await api.post(`/devices/${id}/regenerate-keys`)
|
||||
return data
|
||||
}
|
||||
```
|
||||
- In DeviceDetail.vue, add a "🔄 Regenerate Keys" button styled like the existing "Regenerate Token" button (line 100-101)
|
||||
- Place it near the key display section (below Private Key / Preshared Key display from T8)
|
||||
- On click:
|
||||
1. Show confirmation dialog: "This will invalidate the current WireGuard keys. All connected peers will need to update their config. Continue?"
|
||||
2. If confirmed, call `regenerateDeviceKeys(id)`
|
||||
3. On success, show the new keys in a success banner (similar to "New Registration Token Generated" at line 116-123)
|
||||
4. Re-load device data
|
||||
|
||||
**Must NOT do**:
|
||||
- Do NOT allow regenerating keys for non-admin users (button should be v-if="authStore.isAdmin")
|
||||
- Do NOT modify the existing "Regenerate Token" button behavior
|
||||
|
||||
**Recommended Agent Profile**:
|
||||
- **Category**: `visual-engineering`
|
||||
- Reason: Vue template + API integration + UX flow
|
||||
- **Skills**: none needed
|
||||
|
||||
**Parallelization**:
|
||||
- **Can Run In Parallel**: YES
|
||||
- **Parallel Group**: Wave 2 (with T7, T8, T10, T11)
|
||||
- **Blocks**: None
|
||||
- **Blocked By**: T4 (regenerate-keys endpoint), T7 (Device interface)
|
||||
|
||||
**References**:
|
||||
- `apps/dashboard-ui/src/views/DeviceDetail.vue:100-101` — Existing "Regenerate Token" button pattern (bg-blue-600/20 text-blue-400)
|
||||
- `apps/dashboard-ui/src/views/DeviceDetail.vue:116-123` — Success banner pattern
|
||||
- `apps/dashboard-ui/src/views/DeviceDetail.vue:186-196` — `handleRegenerate` function pattern
|
||||
- `apps/dashboard-ui/src/api/devices.ts:72-75` — `regenerateToken()` as pattern for new function
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [ ] Admin sees "Regenerate Keys" button
|
||||
- [ ] Non-admin does NOT see the button
|
||||
- [ ] Clicking triggers confirmation dialog
|
||||
- [ ] After confirmation, new keys appear in success banner
|
||||
- [ ] Keys in the detail section are updated after regeneration
|
||||
- [ ] `npm run build` passes
|
||||
|
||||
**QA Scenarios**:
|
||||
```
|
||||
Scenario: Regenerate keys via button
|
||||
Tool: Playwright
|
||||
Preconditions: Admin logged in, viewing device with keys
|
||||
Steps:
|
||||
1. Note current keys shown
|
||||
2. Click "Regenerate Keys" button
|
||||
3. Confirm dialog appears — click "OK"
|
||||
4. Wait for success banner
|
||||
5. Assert success banner shows new private_key, public_key, preshared_key
|
||||
Expected Result: New keys generated and displayed
|
||||
Evidence: .sisyphus/evidence/task-9-regenerate-btn.png
|
||||
```
|
||||
|
||||
**Commit**: YES (group with T7-T10)
|
||||
- Message: `feat(ui): add Regenerate Keys button and API in DeviceDetail`
|
||||
- Files: `apps/dashboard-ui/src/views/DeviceDetail.vue`, `apps/dashboard-ui/src/api/devices.ts`
|
||||
|
||||
- [x] 10. **DeviceDetail.vue: Debug panel (status data section)**
|
||||
|
||||
**What to do**:
|
||||
- Add a "🔍 Connection Status" section in DeviceDetail.vue (below Advanced Settings if admin)
|
||||
- Only visible when admin (`v-if="authStore.isAdmin"`)
|
||||
- Shows real-time data from the `/status` endpoint:
|
||||
- **Status**: Online/Offline badge (existing, but also show last check time)
|
||||
- **Last Handshake**: formatted timestamp (from `device.value.LastHandshake`)
|
||||
- **Data Transferred**: Rx / Tx bytes (formatted: KB/MB/GB)
|
||||
- **Public Key**: display-only (already exists from T8)
|
||||
- **Internal IP**: display-only (already exists in the page)
|
||||
- **Suspended**: yes/no badge
|
||||
- Add a data refresh function that calls the new `getDeviceStatus(id)` API function
|
||||
- Create `getDeviceStatus` in `devices.ts`:
|
||||
```typescript
|
||||
export const getDeviceStatus = async (id: string): Promise<{
|
||||
is_active: boolean
|
||||
last_handshake: string
|
||||
rx_bytes: number
|
||||
tx_bytes: number
|
||||
public_key: string
|
||||
internal_ip: string
|
||||
is_suspended: boolean
|
||||
name: string
|
||||
}> => {
|
||||
const { data } = await api.get(`/devices/${id}/status`)
|
||||
return data
|
||||
}
|
||||
```
|
||||
- Use a glassmorphism card section with the same styling
|
||||
- Add a small "Refresh" button to manually refresh the status
|
||||
- Optionally auto-refresh every 30s using `setInterval` (clean up in `onUnmounted`)
|
||||
|
||||
**Must NOT do**:
|
||||
- Do NOT show to non-admin users
|
||||
- Do NOT include private keys in this section (already in T8 section)
|
||||
- Do NOT create complex charts or graphs — keep it simple text-based
|
||||
|
||||
**Recommended Agent Profile**:
|
||||
- **Category**: `visual-engineering`
|
||||
- Reason: Vue template + API integration + auto-refresh logic
|
||||
- **Skills**: none needed
|
||||
|
||||
**Parallelization**:
|
||||
- **Can Run In Parallel**: YES
|
||||
- **Parallel Group**: Wave 2 (with T7-T9, T11)
|
||||
- **Blocks**: None
|
||||
- **Blocked By**: T5 (status endpoint), T7 (Device interface)
|
||||
|
||||
**References**:
|
||||
- `apps/dashboard-ui/src/views/DeviceDetail.vue:41-81` — Advanced Settings accordion pattern
|
||||
- `apps/dashboard-ui/src/views/DeviceDetail.vue:11-14` — Existing Online/Offline badge pattern
|
||||
- `apps/dashboard-ui/src/views/DeviceDetail.vue:24-26` — Existing `LastHandshake` display
|
||||
- `apps/dashboard-ui/src/api/devices.ts` — Add `getDeviceStatus` function
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [ ] Admin sees "Connection Status" section with all fields
|
||||
- [ ] Non-admin does NOT see the section
|
||||
- [ ] Refresh button works and updates displayed data
|
||||
- [ ] Rx/Tx bytes formatted nicely (e.g., "1.5 MB" not "1500000")
|
||||
- [ ] `npm run build` passes
|
||||
|
||||
**QA Scenarios**:
|
||||
```
|
||||
Scenario: Admin sees status section with live data
|
||||
Tool: Playwright
|
||||
Preconditions: Admin logged in, device detail page
|
||||
Steps:
|
||||
1. Navigate to /devices/{id}
|
||||
2. Assert "Connection Status" section is visible
|
||||
3. Assert fields: Status, Last Handshake, Rx/Tx bytes, Public Key
|
||||
4. Click "Refresh" button
|
||||
Expected Result: Status section visible with formatted data
|
||||
Evidence: .sisyphus/evidence/task-10-debug-panel.png
|
||||
```
|
||||
|
||||
**Commit**: YES (group with T7-T10)
|
||||
- Message: `feat(ui): add Connection Status debug panel and getDeviceStatus API`
|
||||
- Files: `apps/dashboard-ui/src/views/DeviceDetail.vue`, `apps/dashboard-ui/src/api/devices.ts`
|
||||
|
||||
- [x] 11. **Servers.vue: Add PublicKey field to edit modal**
|
||||
|
||||
**What to do**:
|
||||
- In `Servers.vue` edit modal (lines 162-262), add a Public Key input field in the "Network" section
|
||||
- Place it after "Public Endpoint" and before "Listen Address"
|
||||
- Use the same styling as other inputs (`w-full bg-black/50 border border-white/10 rounded p-2 text-white focus:border-cyan-500 focus:outline-none`)
|
||||
- Add `publicKey: srv.PublicKey || ''` to the `editForm` initialization in `openEdit()` (around line 339-359)
|
||||
- Add `public_key: editForm.value.publicKey || undefined` to the `updateServer` call in `handleEditSave()` (around line 452-470)
|
||||
- This works with T6 backend changes
|
||||
|
||||
**Must NOT do**:
|
||||
- Do NOT add Private Key field (server PrivateKey has `json:"-"` and must stay hidden)
|
||||
- Do NOT add PresharedKey field here (not relevant for servers)
|
||||
|
||||
**Recommended Agent Profile**:
|
||||
- **Category**: `visual-engineering`
|
||||
- Reason: Vue template form field addition
|
||||
- **Skills**: none needed
|
||||
|
||||
**Parallelization**:
|
||||
- **Can Run In Parallel**: YES
|
||||
- **Parallel Group**: Wave 2 (with T7-T10)
|
||||
- **Blocks**: None
|
||||
- **Blocked By**: T6 (backend public_key in UpdateServerRequest)
|
||||
|
||||
**References**:
|
||||
- `apps/dashboard-ui/src/views/Servers.vue:162-262` — Edit modal template
|
||||
- `apps/dashboard-ui/src/views/Servers.vue:322-368` — `openEdit()` function, editForm initialization
|
||||
- `apps/dashboard-ui/src/views/Servers.vue:442-476` — `handleEditSave()` function
|
||||
|
||||
**Acceptance Criteria**:
|
||||
- [ ] Edit modal shows Public Key input
|
||||
- [ ] Public Key input is pre-filled with current server's PublicKey
|
||||
- [ ] Changing Public Key and saving updates the server
|
||||
- [ ] `npm run build` passes
|
||||
|
||||
**QA Scenarios**:
|
||||
```
|
||||
Scenario: Edit server public key in modal
|
||||
Tool: Playwright
|
||||
Preconditions: Admin logged in, nodes page
|
||||
Steps:
|
||||
1. Click "Edit" on a server
|
||||
2. Assert "Public Key" input field is visible and pre-filled
|
||||
3. Change the value to a new key
|
||||
4. Click "Save"
|
||||
5. Modal closes, reopen edit to verify
|
||||
Expected Result: Public key updated and persists
|
||||
Evidence: .sisyphus/evidence/task-11-server-publickey.png
|
||||
```
|
||||
|
||||
**Commit**: YES
|
||||
- Message: `feat(ui): add PublicKey field to server edit modal`
|
||||
- Files: `apps/dashboard-ui/src/views/Servers.vue`
|
||||
|
||||
---
|
||||
|
||||
## Final Verification Wave (MANDATORY — after ALL implementation tasks)
|
||||
|
||||
- [x] F1. **Plan Compliance Audit** — `oracle`
|
||||
Read the plan end-to-end. For each "Must Have": verify implementation exists (read file, curl endpoint, run command). For each "Must NOT Have": search codebase for forbidden patterns — reject with file:line if found. Check evidence files exist in .sisyphus/evidence/. Compare deliverables against plan.
|
||||
Output: `Must Have [N/N] | Must NOT Have [N/N] | Tasks [N/N] | VERDICT: APPROVE/REJECT`
|
||||
|
||||
- [x] F2. **Code Quality Review** — `unspecified-high`
|
||||
Run `tsc --noEmit` + `go build -tags dev ./...` + `go vet ./...`. Review all changed files for: `as any`/`@ts-ignore`, empty catches, console.log in prod, commented-out code, unused imports. Check AI slop: excessive comments, over-abstraction, generic names. Check no PrivateKey is logged anywhere (grep for `log.*PrivateKey`, `fmt.Print.*PrivateKey`).
|
||||
Output: `Build [PASS/FAIL] | Vet [PASS/FAIL] | TSC [PASS/FAIL] | Files [N clean/N issues] | VERDICT`
|
||||
|
||||
- [x] F3. **Real Manual QA** — `unspecified-high` (+ `playwright` skill)
|
||||
Start from clean state. Execute EVERY QA scenario from EVERY task — follow exact steps, capture evidence. Test cross-task integration (admin bypass + key display working together). Test edge cases: non-admin attempts, invalid keys, regenerate on unprovisioned device. Save to `.sisyphus/evidence/final-qa/`.
|
||||
Output: `Scenarios [N/N pass] | Integration [N/N] | Edge Cases [N tested] | VERDICT`
|
||||
|
||||
- [x] F4. **Scope Fidelity Check** — `deep`
|
||||
For each task: read "What to do", read actual diff (git log/diff). Verify 1:1 — everything in spec was built (no missing), nothing beyond spec was built (no creep). Check "Must NOT do" compliance. Detect cross-task contamination: Task N touching Task M's files. Flag unaccounted changes.
|
||||
Output: `Tasks [N/N compliant] | Contamination [CLEAN/N issues] | Unaccounted [CLEAN/N files] | VERDICT`
|
||||
|
||||
---
|
||||
|
||||
## Commit Strategy
|
||||
|
||||
| Commit | Files | Message |
|
||||
|--------|-------|---------|
|
||||
| #1 (T1-T6) | `models/models.go`, `api/devices.go`, `api/servers.go`, `main.go`, `api/servers.ts` | `feat(api): expose device keys for admin, admin bypass, regenerate-keys endpoint, status endpoint, server public_key editing` |
|
||||
| #2 (T7-T10) | `api/devices.ts`, `views/DeviceDetail.vue` | `feat(ui): add key display with eye toggle, regenerate keys button, and connection status debug panel` |
|
||||
| #3 (T11) | `views/Servers.vue` | `feat(ui): add PublicKey field to server edit modal` |
|
||||
|
||||
---
|
||||
|
||||
## Success Criteria
|
||||
|
||||
### Verification Commands
|
||||
```bash
|
||||
# Backend build
|
||||
cd apps/server-core && go build -tags dev ./...
|
||||
|
||||
# Frontend build
|
||||
cd apps/dashboard-ui && npm run build
|
||||
|
||||
# Tests
|
||||
cd apps/server-core && go test ./... -tags dev
|
||||
```
|
||||
|
||||
### Final Checklist
|
||||
- [x] Admin can see/edit keys on individual device GET
|
||||
- [x] Non-admin cannot see any keys
|
||||
- [x] Keys not exposed in List responses
|
||||
- [x] `POST /devices/:id/regenerate-keys` works and calls SyncLocalPeers
|
||||
- [x] `GET /devices/:id/status` returns real-time data
|
||||
- [x] Server PublicKey editable in edit modal
|
||||
- [x] Admin bypass works for all 6 handlers
|
||||
- [x] No security regressions (keys not logged, not in lists)
|
||||
- [x] `json:"-"` on WgServer.PrivateKey preserved
|
||||
Reference in New Issue
Block a user