24ba393954
Fix 22 audit findings across security, performance, and architecture
...
Production Deployment / Run ExUnit Tests (push) Failing after 1m0s
Production Deployment / Build and Push Docker Image (push) Has been skipped
Security (11 items):
- SEC-C1: Cross-tenant agent token disclosure -> org-scoped lookup
- SEC-H1/H2/H3/M7: IDOR cluster -> org-scoped context functions
- SEC-H4: Impersonation session bypass -> unified token validation
- SEC-H5: X-Forwarded-For spoofing -> right-to-left XFF walk
- SEC-M1: SSRF in vendor integrations -> URL/IP validation + no redirects
- SEC-M2: Agent tokens plaintext -> SHA-256 hash, expires_at, rotation
- SEC-M4: SNMP communities logged cleartext -> boolean indicators
- SEC-M5: API tokens survive membership revocation -> re-check membership
- SEC-M8: Superuser API unrated-limited -> rate_limit_api pipeline
- SEC-M9: Internal exceptions in API responses -> generic messages
- SEC-L1/L3/L4: Cloak key assertion, channel topic binding, download audit
Performance (5 items):
- PERF-C1: Alert LiveView full reload -> grouped COUNT + debounce
- PERF-H3: Device list plain assign -> stream/3 with dom_id
- PERF-H4: RateLimit GenServer serialization -> direct ETS access
- PERF-H5: EventLogger serial insert -> batch buffer + insert_all
- PERF-H6: StormDetector broken under k8s -> global registration
Architecture (3 items):
- 4 controllers now use context modules instead of direct Repo calls
- 6 vendor HTTP clients consolidated onto Towerops.HTTP
- equipment->device renames across 18 files (69 call sites)
Dependencies (3 items):
- bandit 1.12.0 -> 1.12.3
- Removed unused gen_smtp
- Updated vendor/README.md versions
Test Health:
- 3 test files flipped to async: true
- Duplicated fixtures consolidated to shared modules
- agent_channel_test (2279 lines) split into 5 files
- SNMP community encryption migration + data migration script
- MikroTik config download audit logging
2026-07-26 15:31:25 -05:00
Graham McInitre
ed3c251142
fix: vendor oban_web — never pull oban_pro from live repo
...
Remove conditional oban_repo_configured?() check that would pull
oban_pro from repo.oban.pro when hex config contained credentials.
The root mix.exs already provides oban_pro via vendored path.
2026-07-16 09:19:02 -05:00
Graham McInitre
eb444cb012
chore: update dependencies to latest versions
...
- hackney: 4.5.2 → 4.6.0 (constraint ~> 4.4 → ~> 4.6)
- stream_data: 1.3.0 → 1.4.0
- mint: 1.9.1 → 1.9.2 (fixes CVE-2026-58229, CVE-2026-59246)
- oban_pro: 1.7.6 → 1.7.8 (vendor sync from Oban Pro private repo)
- oban_web: lock synced to 2.12.6 (vendor already had it)
2026-07-15 12:50:20 -05:00
a719135c1e
chore: update dependencies. phoenix 1.8.8→1.8.9, swoosh 1.26.2→1.26.3, oban_pro 1.7.6→1.7.7, oban_web 2.12.5→2.12.6, hackney 4.4.5→4.5.2, plus transitive deps
2026-07-08 10:47:26 -05:00
86ad19fc74
chore: update vendored oban_pro to 1.7.6
2026-06-23 09:57:21 -05:00
5bb55180a7
Fix all mix credo --strict and compiler warnings
2026-06-13 15:45:09 -05:00
a797bc7cef
upgrade: re-vendor oban_pro 1.7.5, oban_web 2.12.5, oban_met 1.2.0; fix Oban unique states warnings; update deps and elixir to 1.19
2026-06-03 14:38:34 -05:00
1f9fe2ee29
chore: add gaiia library dep, remove stale honeybadger/tidewave/cbor
...
- Add vendored Gaiia library (path: vendor/gaiia) with auto-generated GraphQL
queries and mutations from the Gaiia API schema
- Add startAddInventoryItemsJob + updateInventoryItem mutations
- Remove `:cbor` (was unused — no references anywhere)
- Remove stale Honeybadger filter module, tests, router plug, and config
- Remove stale Tidewave plug from endpoint (dev-only, dep already gone)
- Unlock leftover deps from lock file
2026-05-11 14:46:27 -05:00
6c05d45dd6
deps: upgrade oban_pro to 1.7.0
...
Bumps vendored Oban Pro from 1.6.13 to 1.7.0, which transitively bumps
oban core to 2.22.1 (requires migrations v14) and db_connection to 2.10.0.
- mix.exs constraint: ~> 1.6 → ~> 1.7
- vendor/oban_pro/ replaced with v1.7.0 hex package
- migration 20260430142200: Oban core v12 → v14 (must run first)
- migration 20260430142241: Oban Pro 1.7.0 schema additions
Also corrects a pre-existing constraint name in AgentAssignment that was
left stale by the equipment→devices rename migration (20260117190134).
The unique index is named agent_assignments_device_id_index, but the
schema's unique_constraint/3 still pointed at the old equipment_id name,
causing the test suite to surface Ecto.ConstraintError instead of a
changeset error. Required to get the suite green for this upgrade.
2026-04-30 10:26:18 -05:00
0399b30d21
Update Elixir dependencies ( #194 )
...
Updated packages:
- bandit: 1.10.3 → 1.10.4
- phoenix_live_view: 1.1.27 → 1.1.28
- phoenix_pubsub_redis: 3.0.1 → 3.1.0
- oban_met: 1.0.6 → 1.1.0 (vendored)
- oban_web: 2.11.8 → 2.12.1 (vendored)
All tests passing (8923 tests, 0 failures).
Reviewed-on: graham/towerops-web#194
2026-03-27 17:13:12 -05:00
70838af14d
chore: update vendored Oban packages
...
- oban_pro: 1.6.11 → 1.6.13
- Enhanced Smart engine functionality
- Refactored Dynamic Cron plugin
- Added diagnostics and executing stage modules
- oban_met: already at 1.0.6 (verified)
- oban_web: already at 2.11.8 (latest)
2026-03-04 16:51:55 -06:00
01ebb8968d
chore: filter out external uptime monitor HEAD requests from logs
2026-03-04 16:48:59 -06:00
24236dbe30
update oban_web
2026-02-08 10:11:53 -06:00
234ff7cbd2
add upsert support for geoip imports to prevent duplicates
2026-01-28 13:37:02 -06:00
e94cae3435
add vendor dir to dockerfile
2026-01-26 17:22:31 -06:00
bb86dec559
add oban pro
2026-01-26 17:07:42 -06:00
