mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-29 13:59:40 +00:00
122cd6cebc
* docs(spec+plan): WebUI obfuscation design and implementation plan (ref #44) Spec: docs/superpowers/specs/2026-05-12-webui-obfuscation-design.md Plan: docs/superpowers/plans/2026-05-12-webui-obfuscation.md The design locks the SecuBox WebUI to admin.<HOSTNAME>.<DOMAIN_SUFFIX> via strict-regex ACLs in HAProxy AND nginx, both driven by /etc/default/secubox as the single source of truth. New package secubox-defaults ships the env file; secubox-haproxy API exposes /webui/admin-domain (info), /webui/nginx-config (JWT, rendered vhost), /webui/refresh (JWT, cache invalidate). A safe renderer script writes the nginx vhost atomically; haproxyctl + Python /generate both inject the strict ACL at the top of http-in and https-in frontends. Plan has 15 tasks with TDD steps, exact file paths, and complete code in every step (no TBD/TODO). Acceptance criteria + integration test script included. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(secubox-defaults): scaffold package skeleton (ref #44) * feat(secubox-defaults): ship /etc/default/secubox env file (ref #44) * feat(secubox-defaults): postinst autodetect + dpkg-trigger (ref #44) * feat(secubox-haproxy): webui_identity helper + tests (ref #44) Implement webui_identity module that parses /etc/default/secubox and exposes canonical admin URL + regex pattern for HAProxy acl. New module: - api/webui_identity.py: Parses SECUBOX_HOSTNAME and SECUBOX_DOMAIN_SUFFIX with LRU cache and invalidation support. Tests (TDD): - tests/test_webui_identity.py: 5 test cases covering basic parsing, missing hostname validation, custom suffix handling, comment handling, and cache invalidation. - tests/conftest.py: sys.path bootstrap for api/ imports. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(webui_identity): catch OSError on defaults read + test (ref #44) * feat(secubox-haproxy): GET /webui/admin-domain endpoint (ref #44) * feat(secubox-haproxy): GET /webui/nginx-config rendered vhost (ref #44) * feat(secubox-haproxy): POST /webui/refresh cache invalidation (ref #44) * feat(secubox-haproxy): secubox-render-nginx-webui safe renderer (ref #44) * feat(haproxyctl): inject strict-regex WebUI ACL at frontend top (ref #44) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(secubox-haproxy): /generate symmetry with strict WebUI ACL (ref #44) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(secubox-haproxy): dpkg-trigger refresh on secubox-defaults-changed (ref #44) * build(secubox-haproxy): depend on secubox-defaults (ref #44) * test(infra): integration test for WebUI obfuscation (ref #44) * docs: HISTORY Session 159 — WebUI obfuscation (ref #44) Records the complete WebUI obfuscation work: new secubox-defaults package, three /webui/* endpoints, nginx renderer script, haproxyctl + Python generator symmetry, dpkg trigger plumbing, integration test. Includes notes on the brainstorming → spec → plan → subagent-driven execution flow and the 6 fix iterations caught by reviewers. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: CyberMind-FR <gandalf@Gk2.net> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
11 lines
401 B
Python
11 lines
401 B
Python
"""Add the package's api/ directory and common/ to sys.path for tests."""
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
# Add the secubox-haproxy package root
|
|
sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
|
|
|
|
# Add the common/ directory which contains secubox_core
|
|
repo_root = Path(__file__).resolve().parents[3] # Go up from tests/ -> .. -> .. -> ..
|
|
sys.path.insert(0, str(repo_root / "common"))
|