diff --git a/README.md b/README.md index 8fcecb0..28f968e 100644 --- a/README.md +++ b/README.md @@ -31,7 +31,6 @@ API and declares its own permission vocabulary. and upgrade - streamed live over SSE. Auto-detects `dnf`, `apt`, or `pacman`. - **Networking** - List network interfaces, routing tables, and DNS settings; configure IPv4 settings with temporary applying and safety auto-rollback; bring interfaces up or down. - **Audit** - Read-only trail of every privileged write (who, what, when, result). -- **Terminal** - Interactive shell access. Upgrades connection to a WebSocket and spawns a PTY shell as the logged-in user (requires `root` permission). - **Meta** - Self-description for clients: `/api/_modules`, `/api/whoami`, `/api/health`. @@ -453,7 +452,6 @@ internal/modules concrete modules: packages - dnf/apt/pacman install/remove/upgrade (streamed) audit - read-only audit trail networking - network interfaces, routing tables, DNS, and IP configurations - terminal - interactive PTY shell over WebSocket internal/oscmd shared command runner (timeouts, stderr surfacing) + helpers internal/rbac roles, permissions ("*" wildcards), HTTP middleware (RBAC + CSRF) internal/audit SQLite-backed audit log writer diff --git a/cmd/server/server.go b/cmd/server/server.go index f60f2fc..9f16e3e 100644 --- a/cmd/server/server.go +++ b/cmd/server/server.go @@ -31,7 +31,6 @@ import ( "nadir/internal/modules/services" "nadir/internal/modules/storage" "nadir/internal/modules/system" - "nadir/internal/modules/terminal" "nadir/internal/modules/users" "nadir/internal/rbac" @@ -206,13 +205,12 @@ func runServer() { mods := []module.Module{ system.New(), services.New(cfg.LogFiles), - users.New(), + users.New(sessions), groups.New(), packages.New(), networking.New(), storage.New(), audit.New(auditStore), - terminal.New(sessions), } roles := rbac.New() @@ -236,6 +234,8 @@ func runServer() { humaConfig.DocsPath = "" api := humago.New(mux, humaConfig) + rateLimiter := auth.NewRateLimiter(100, time.Minute) + api.UseMiddleware(auth.RateLimitMiddleware(api, rateLimiter)) api.UseMiddleware(rbac.RbacMiddleware(api, sessions, tokenAuth, roles, auditStore)) for _, m := range mods { @@ -277,18 +277,18 @@ func runServer() { }) mux.HandleFunc("GET /docs", func(w http.ResponseWriter, _ *http.Request) { - // /docs needs to execute the Scalar bundle, so loosen the strict CSP set - // by secHeaders for this one page: allow scripts/styles from the jsdelivr - // CDN plus inline (Scalar uses inline