<.icon name="hero-document-text" class="mx-auto h-12 w-12 text-gray-400" />
diff --git a/lib/towerops_web/live/help_live/index.ex b/lib/towerops_web/live/help_live/index.ex
index d848c171..ab3551bf 100644
--- a/lib/towerops_web/live/help_live/index.ex
+++ b/lib/towerops_web/live/help_live/index.ex
@@ -192,6 +192,10 @@ defmodule ToweropsWeb.HelpLive.Index do
interface that makes complex monitoring workflows simple and accessible.
+
+ Towerops is not and has no plans to be a replacement for a full WISP/network billing system.
+
diff --git a/lib/towerops_web/live/mikrotik_backup_live/compare.ex b/lib/towerops_web/live/mikrotik_backup_live/compare.ex
index 895ecd78..3d2c2336 100644
--- a/lib/towerops_web/live/mikrotik_backup_live/compare.ex
+++ b/lib/towerops_web/live/mikrotik_backup_live/compare.ex
@@ -56,8 +56,8 @@ defmodule ToweropsWeb.MikrotikBackupLive.Compare do
defp generate_and_display_diff(socket, device, backup_a, backup_b, device_id) do
# Decompress configs
- config_a = MikrotikBackups.decompress_config(backup_a)
- config_b = MikrotikBackups.decompress_config(backup_b)
+ config_a = MikrotikBackups.decompress_config(backup_a.config_compressed)
+ config_b = MikrotikBackups.decompress_config(backup_b.config_compressed)
# Mask sensitive data
config_a_masked = Differ.mask_sensitive_data(config_a)
@@ -88,7 +88,7 @@ defmodule ToweropsWeb.MikrotikBackupLive.Compare do
@impl true
def handle_event("download_config", %{"backup" => "a"}, socket) do
backup = socket.assigns.backup_a
- config_text = MikrotikBackups.decompress_config(backup)
+ config_text = MikrotikBackups.decompress_config(backup.config_compressed)
device = socket.assigns.device
filename = "#{device.name}_backup_#{Calendar.strftime(backup.backed_up_at, "%Y%m%d_%H%M%S")}.rsc"
@@ -99,7 +99,7 @@ defmodule ToweropsWeb.MikrotikBackupLive.Compare do
@impl true
def handle_event("download_config", %{"backup" => "b"}, socket) do
backup = socket.assigns.backup_b
- config_text = MikrotikBackups.decompress_config(backup)
+ config_text = MikrotikBackups.decompress_config(backup.config_compressed)
device = socket.assigns.device
filename = "#{device.name}_backup_#{Calendar.strftime(backup.backed_up_at, "%Y%m%d_%H%M%S")}.rsc"
diff --git a/lib/towerops_web/permissions.ex b/lib/towerops_web/permissions.ex
new file mode 100644
index 00000000..166819be
--- /dev/null
+++ b/lib/towerops_web/permissions.ex
@@ -0,0 +1,161 @@
+defmodule ToweropsWeb.Permissions do
+ @moduledoc """
+ Authorization helpers for checking user permissions in LiveViews, controllers, and templates.
+
+ Integrates with `Towerops.Organizations.Policy` to provide a simple, reusable API
+ for permission checks based on organization membership roles.
+
+ ## Usage in LiveViews
+
+ import ToweropsWeb.Permissions
+
+ def handle_event("delete_backup", _params, socket) do
+ if can?(socket, :delete, :backup) do
+ # Delete backup
+ else
+ {:noreply, put_flash(socket, :error, "You don't have permission to delete backups")}
+ end
+ end
+
+ ## Usage in Templates
+
+ <%= if can?(@current_scope, :delete, :backup) do %>
+
+ <% end %>
+
+ ## Usage in Controllers
+
+ import ToweropsWeb.Permissions
+
+ def delete(conn, _params) do
+ if can?(conn.assigns.current_scope, :delete, :backup) do
+ # Delete backup
+ else
+ conn
+ |> put_flash(:error, "You don't have permission to delete backups")
+ |> redirect(to: ~p"/")
+ end
+ end
+ """
+
+ alias Phoenix.LiveView.Socket
+ alias Towerops.Accounts.Scope
+ alias Towerops.Organizations.Policy
+
+ @doc """
+ Checks if the current user can perform an action on a resource.
+
+ Accepts either a socket (LiveView) or a Scope struct directly.
+
+ Returns `true` if:
+ - User is a superuser (can do everything)
+ - User's organization membership role allows the action per Policy
+
+ ## Examples
+
+ iex> can?(socket, :delete, :backup)
+ true
+
+ iex> can?(%Scope{}, :edit, :device)
+ false
+ """
+ def can?(%Socket{} = socket, action, resource) do
+ can?(socket.assigns.current_scope, action, resource)
+ end
+
+ def can?(%Scope{} = scope, action, resource) do
+ cond do
+ # Superusers can do everything
+ Scope.superuser?(scope) ->
+ true
+
+ # No organization context - cannot perform action
+ is_nil(scope.organization) ->
+ false
+
+ # Check organization membership role permissions
+ true ->
+ membership = get_membership(scope)
+ Policy.can?(membership, action, resource)
+ end
+ end
+
+ def can?(nil, _action, _resource), do: false
+
+ @doc """
+ Checks if the current user is an organization owner.
+
+ Accepts either a socket (LiveView) or a Scope struct directly.
+
+ ## Examples
+
+ iex> owner?(socket)
+ true
+
+ iex> owner?(%Scope{})
+ false
+ """
+ def owner?(%Socket{} = socket) do
+ owner?(socket.assigns.current_scope)
+ end
+
+ def owner?(%Scope{} = scope) do
+ cond do
+ Scope.superuser?(scope) ->
+ true
+
+ is_nil(scope.organization) ->
+ false
+
+ true ->
+ membership = get_membership(scope)
+ membership && membership.role == :owner
+ end
+ end
+
+ def owner?(nil), do: false
+
+ @doc """
+ Checks if the current user is an organization owner or admin.
+
+ Accepts either a socket (LiveView) or a Scope struct directly.
+
+ ## Examples
+
+ iex> admin?(socket)
+ true
+
+ iex> admin?(%Scope{})
+ false
+ """
+ def admin?(%Socket{} = socket) do
+ admin?(socket.assigns.current_scope)
+ end
+
+ def admin?(%Scope{} = scope) do
+ cond do
+ Scope.superuser?(scope) ->
+ true
+
+ is_nil(scope.organization) ->
+ false
+
+ true ->
+ membership = get_membership(scope)
+ membership && membership.role in [:owner, :admin]
+ end
+ end
+
+ def admin?(nil), do: false
+
+ # Private helper to extract membership from scope
+ defp get_membership(%Scope{organization: org, user: user}) when not is_nil(org) and not is_nil(user) do
+ # Organization should be preloaded with memberships
+ if Ecto.assoc_loaded?(org.memberships) do
+ Enum.find(org.memberships, &(&1.user_id == user.id))
+ # If memberships not preloaded, return nil (permission check will fail safely)
+ end
+ end
+
+ defp get_membership(_scope), do: nil
+end
diff --git a/priv/proto/agent.proto b/priv/proto/agent.proto
index e26ee0b4..24a133c3 100644
--- a/priv/proto/agent.proto
+++ b/priv/proto/agent.proto
@@ -107,64 +107,63 @@ message HeartbeatResponse {
string status = 1;
}
-// Channel-based communication messages
+// WebSocket-specific messages
enum JobType {
- DISCOVER = 0; // Full device discovery
- POLL = 1; // Poll known sensors/interfaces
- MIKROTIK = 2; // MikroTik RouterOS API commands
+ DISCOVER = 0;
+ POLL = 1;
+ MIKROTIK = 2;
}
enum QueryType {
- GET = 0; // SNMP GET operation
- WALK = 1; // SNMP WALK operation
-}
-
-message AgentJob {
- string job_id = 1; // Unique job identifier (e.g., "discover:eq123")
- JobType job_type = 2; // DISCOVER or POLL
- string device_id = 3; // Device UUID
- SnmpDevice snmp_device = 4; // SNMP connection details
- repeated SnmpQuery queries = 5; // Queries to execute
- MikrotikDevice mikrotik_device = 6; // MikroTik API connection details
- repeated MikrotikCommand mikrotik_commands = 7; // MikroTik commands to execute
+ GET = 0;
+ WALK = 1;
}
message AgentJobList {
repeated AgentJob jobs = 1;
}
+message AgentJob {
+ string job_id = 1;
+ JobType job_type = 2;
+ string device_id = 3;
+ SnmpDevice snmp_device = 4;
+ repeated SnmpQuery queries = 5;
+ MikrotikDevice mikrotik_device = 6;
+ repeated MikrotikCommand mikrotik_commands = 7;
+}
+
message SnmpDevice {
string ip = 1;
string community = 2;
- string version = 3; // "1", "2c", or "3"
+ string version = 3;
uint32 port = 4;
}
message SnmpQuery {
QueryType query_type = 1;
- repeated string oids = 2; // OIDs to query (GET) or walk (WALK)
+ repeated string oids = 2;
}
message SnmpResult {
string device_id = 1;
JobType job_type = 2;
- map oid_values = 3; // OID → value mapping
- int64 timestamp = 4; // Unix timestamp in seconds
+ map oid_values = 3;
+ int64 timestamp = 4;
}
message AgentHeartbeat {
string version = 1;
string hostname = 2;
uint64 uptime_seconds = 3;
- string ip_address = 4; // Agent's IP address
+ string ip_address = 4;
}
message AgentError {
string device_id = 1;
- string job_id = 2;
- string message = 3;
- int64 timestamp = 4;
+ string error_message = 2;
+ int64 timestamp = 3;
}
// MikroTik RouterOS API messages
@@ -174,22 +173,23 @@ message MikrotikDevice {
uint32 port = 2;
string username = 3;
string password = 4;
- bool use_ssl = 5; // true = API-SSL (port 8729), false = plain API (port 8728)
+ bool use_ssl = 5;
+ uint32 ssh_port = 6;
}
message MikrotikCommand {
- string command = 1; // RouterOS command path (e.g., "/system/identity/print")
- map args = 2; // Command arguments
+ string command = 1;
+ map args = 2;
}
message MikrotikResult {
string device_id = 1;
string job_id = 2;
- repeated MikrotikSentence sentences = 3; // Response sentences from RouterOS
- string error = 4; // Error message if command failed
- int64 timestamp = 5; // Unix timestamp in seconds
+ repeated MikrotikSentence sentences = 3;
+ string error = 4;
+ int64 timestamp = 5;
}
message MikrotikSentence {
- map attributes = 1; // Key-value pairs from RouterOS response
+ map attributes = 1;
}
diff --git a/priv/repo/migrations/20260202215155_add_mikrotik_ssh_port.exs b/priv/repo/migrations/20260202215155_add_mikrotik_ssh_port.exs
new file mode 100644
index 00000000..a900e7f2
--- /dev/null
+++ b/priv/repo/migrations/20260202215155_add_mikrotik_ssh_port.exs
@@ -0,0 +1,20 @@
+defmodule Towerops.Repo.Migrations.AddMikrotikSshPort do
+ use Ecto.Migration
+
+ def change do
+ # Add SSH port to organizations (default 22 for new orgs)
+ alter table(:organizations) do
+ add :mikrotik_ssh_port, :integer, default: 22
+ end
+
+ # Add SSH port to sites (nullable for inheritance)
+ alter table(:sites) do
+ add :mikrotik_ssh_port, :integer
+ end
+
+ # Add SSH port to devices (nullable for inheritance)
+ alter table(:devices) do
+ add :mikrotik_ssh_port, :integer
+ end
+ end
+end
diff --git a/priv/repo/migrations/20260202221637_add_source_to_backup_requests.exs b/priv/repo/migrations/20260202221637_add_source_to_backup_requests.exs
new file mode 100644
index 00000000..d4b4b786
--- /dev/null
+++ b/priv/repo/migrations/20260202221637_add_source_to_backup_requests.exs
@@ -0,0 +1,9 @@
+defmodule Towerops.Repo.Migrations.AddSourceToBackupRequests do
+ use Ecto.Migration
+
+ def change do
+ alter table(:device_backup_requests) do
+ add :source, :string, default: "daily_cron"
+ end
+ end
+end