Files
6e096fa286 Add real preview deployments and strengthen core boundaries (#184)
* fix(security): honour the failed-login time window (#180)

check_failed_logins computed a cutoff from since_hours and never used
it, so the Security -> Events "Failed login attempts (24h)" card and
its alert counted every failure still in /var/log/auth.log or
/var/log/secure: up to a week of SSH attempts under the usual weekly
log rotation.

Each matching line is now dated from its stamp, either RFC 3339
(rsyslog's high-precision format) or the traditional BSD syslog stamp
(no year, so a December line read in January is placed in the previous
year), and lines older than the cutoff are skipped. A line whose stamp
is not recognised is still counted rather than hidden. The log paths
move to SecurityService.AUTH_LOGS so the tests can point at a temp
file.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

* refactor: separate backend startup phases and guard ordering

* refactor: route file operations through capability-checked adapters

* chore: bump version to 1.11.25 [skip ci]

* refactor: split File Manager state and views with regression guards

* test: enforce core boundaries and document extension rules

* test: cover File Manager tree races and listing failures

* fix: preserve File Manager deep links on initial mount

* refactor: keep File Manager download operations in the action hook

* fix: start agent maintenance only in the guarded runtime phase

* test: capture nginx rendering contract before extraction

* refactor: separate nginx configuration rendering from host operations

* test: enforce pure nginx configuration boundaries

* fix: require provisioned runtime before advertising previews

* feat: expose value-free effective environment provenance through app access boundary

* feat: add effective environment inspector with browser regression checks

* feat: provision isolated generic previews with retryable resource cleanup

* feat: queue preview automation and preserve cleanup ownership through app deletion

* feat: add pinned preview deployment controls and queued lifecycle feedback

* fix: preserve container port semantics for previews of slot deployments

* fix: preserve search focus and ignore stale list responses

* feat: run approved assistant deployments through persistent recipe operations

* test: run search and assistant deployment regressions in CI

* fix: refresh preview API and controller boundary inventories

* docs: refresh controller migration count after preview extraction

* fix: bind file editor previews to their storage target

* chore: bump version to 1.11.26 [skip ci]

---------

Co-authored-by: Max Freedom Pollard <272618364+MaxFreedomPollard@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-10-24 15:31:39 -04:00

64 lines
2.6 KiB
Python

"""Render compression directives from supplied nginx dump/version text."""
import re
from . import templates
def _http_level_directives(dump: str, skip_file: str) -> set:
"""Directive names set at http level in an ``nginx -T`` dump.
``nginx -T`` prints each file after a ``# configuration file <path>:``
header. In the main nginx.conf, http level is depth 1 inside
``http {}``; every other file is included from the http block (conf.d)
or a server (sites), so its depth-0 directives are the http-level
ones. ``skip_file`` (our own snippet) is ignored so a rewrite never
mistakes its own lines for someone else's.
"""
found = set()
current = None
depth = 0
in_http = False
for raw in dump.splitlines():
header = re.match(r'^# configuration file (.+):$', raw.strip())
if header:
current = header.group(1)
depth = 0
in_http = False
continue
if current is None or current == skip_file:
continue
line = raw.split('#', 1)[0].strip()
if not line:
continue
is_main = current.endswith('/nginx.conf')
http_level = (depth == 1 and in_http) if is_main else depth == 0
name = line.split(None, 1)[0].rstrip(';{')
if http_level and line.endswith(';'):
found.add(name)
if is_main and depth == 0 and name == 'http' and '{' in line:
in_http = True
depth += line.count('{') - line.count('}')
if is_main and depth == 0:
in_http = False
return found
def render_compression_snippet(dump: str, conf_path: str,
nginx_v: str = '', *, gzip_directives=templates.GZIP_DIRECTIVES, brotli_directives=templates.BROTLI_DIRECTIVES) -> str:
"""The snippet for this box. When the running config already sets
everything it is comments only: still written, so the "already
handled" check stays a file-exists test instead of an ``nginx -T``
on every vhost write."""
present = _http_level_directives(dump, conf_path)
brotli = ('ngx_http_brotli_filter_module' in dump
or 'brotli' in (nginx_v or '').lower())
wanted = list(gzip_directives)
if brotli:
wanted += list(brotli_directives)
lines = [f'{name} {value};' for name, value in wanted if name not in present]
kept = sorted(name for name, _ in wanted if name in present)
header = ['# ServerKit compression (auto-generated; do not edit).']
if kept:
header.append('# Already set elsewhere, left alone: ' + ', '.join(kept))
return '\n'.join(header + lines) + '\n'