diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 0000000..4613d0b --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,64 @@ +# Changelog + +All notable changes to **NX9-WG (`nx9-wg`)** are documented here. + +## [1.0.0] — 2026-08-18 + +NX9-WG 1.0.0 is the first production release of the native Linux WireGuard + network control plane. + +### Added + +- Native Linux WireGuard lifecycle management through WireGuard Generic Netlink and RTNETLINK. +- Native IPv4/IPv6 address and route management without `wg`, `wg-quick`, `ip`, `iptables`, `nft`, `sysctl`, or shell orchestration from production Rust. +- Native nftables firewall/NAT execution scoped to the managed `table inet nx9_wg` table. +- SQLite authoritative desired-state storage with reconciliation and drift correction. +- Live WireGuard telemetry including learned peer endpoints, handshake timestamps, and RX/TX counters. +- Correct separation of client-side `AllowedIPs` from server-side WireGuard Cryptokey Routing `AllowedIPs`. +- Road-warrior server peer routing derived from assigned tunnel addresses (`/32` and `/128`) unless an explicit server-side override is configured. +- Persistent WireGuard server endpoint configuration for client configuration and QR exports. +- Interface editing through the WebUI with cryptographic identity preservation. +- WebUI peer lifecycle states: Connected, Awaiting Handshake, Disconnected, Disabled, Expired, and Revoked. +- Pure Rust client configuration and QR generation. +- CLI, REST API, WebSocket, embedded SPA, diagnostics, backup/restore, and reconciliation tooling. + +### Changed + +- Peer API responses now merge fresh kernel telemetry instead of relying solely on cached SQLite values. +- Handshake timestamps are serialized as explicit UTC/RFC3339 values and parsed defensively by the WebUI. +- Interface edits preserve interface UUID, private key, public key, and peer associations. +- Server endpoint resolution prefers explicit export overrides, then persistent server endpoint settings, with controlled fallback behavior. +- Reconciliation detects and repairs server-side peer `AllowedIPs` drift. +- Release documentation and testing documentation are promoted to the v1.0.0 baseline. + +### Fixed + +- Fixed road-warrior peers incorrectly receiving client full-tunnel `AllowedIPs` (`0.0.0.0/0, ::/0`) in the server kernel Cryptokey Routing table. +- Fixed server-to-peer routing failure caused by missing `/32` peer routes in WireGuard peer configuration. +- Fixed WebUI active peers appearing Disconnected because backend `NaiveDateTime` values lacked an explicit UTC offset. +- Fixed stale peer telemetry in REST/WebUI responses. +- Fixed missing WebUI interface Edit action. +- Fixed missing persistent server endpoint for QR/config export. +- Fixed reconciliation convergence after deliberate interface-address drift. + +### Networking & Firewall + +- IPv4 forwarding is managed through the native Linux networking engine. +- Outbound masquerading is scoped to the WireGuard client subnet and non-WireGuard egress interfaces. +- Firewall/NAT state is reconciled atomically within the dedicated NX9 nftables table. +- Server-side peer routes and cryptokey routing are kept distinct from client routing policy. + +### Validation + +- Workspace test suite: **162 tests passing** at the documented release baseline. +- Comprehensive CLI suite: **203 passed / 7 skipped**. +- Native integration suite: **19 passed / 1 skipped**. +- Dedicated live-kernel suite: **23 passed / 1 skipped** in SAFE mode baseline. +- Real Android/mobile WireGuard client: **operator-verified** for VPN connectivity and full-tunnel Internet operation during v1.0.0 acceptance. +- WebUI interface editing: **operator-verified**. +- Live peer telemetry/status: **operator-verified** with connected mobile client. +- Final reconciliation: **operator-verified** with zero drift after convergence. +- External cellular/WAN road-warrior acceptance and post-reboot physical-client acceptance remain separate operational gates unless explicitly recorded in the release evidence. + +## [0.8.0] + +Previous development release. See repository history for detailed implementation changes. diff --git a/Cargo.lock b/Cargo.lock index 3b208fb..907ac3c 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1785,7 +1785,7 @@ dependencies = [ [[package]] name = "nx9-wg" -version = "0.8.0" +version = "1.0.0" dependencies = [ "axum", "base64", @@ -1807,7 +1807,7 @@ dependencies = [ [[package]] name = "nx9-wg-api" -version = "0.8.0" +version = "1.0.0" dependencies = [ "axum", "chrono", @@ -1832,7 +1832,7 @@ dependencies = [ [[package]] name = "nx9-wg-core" -version = "0.8.0" +version = "1.0.0" dependencies = [ "argon2", "base64", @@ -1852,7 +1852,7 @@ dependencies = [ [[package]] name = "nx9-wg-db" -version = "0.8.0" +version = "1.0.0" dependencies = [ "chrono", "ipnet", @@ -1869,7 +1869,7 @@ dependencies = [ [[package]] name = "nx9-wg-network" -version = "0.8.0" +version = "1.0.0" dependencies = [ "async-trait", "chrono", @@ -1890,7 +1890,7 @@ dependencies = [ [[package]] name = "nx9-wg-ui" -version = "0.8.0" +version = "1.0.0" dependencies = [ "chrono", "nx9-wg-core", @@ -1901,7 +1901,7 @@ dependencies = [ [[package]] name = "nx9-wireguard" -version = "0.8.0" +version = "1.0.0" dependencies = [ "async-trait", "base64", @@ -3721,9 +3721,9 @@ dependencies = [ [[package]] name = "zerovec-derive" -version = "0.11.4" +version = "0.11.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "47402523226a02bfe5230160dc3ccc089aa6f6f19e7fcbb4e6f824bbb1b4aa62" +checksum = "9f212a141d820099d57ffafb9569be9617a6f27d3dc881fbee8fb56642f917a9" dependencies = [ "proc-macro2", "quote", diff --git a/Cargo.toml b/Cargo.toml index 491f23c..00e82d7 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -10,11 +10,11 @@ members = [ [workspace.package] license = "MIT OR Apache-2.0" -version = "0.8.0" +version = "1.0.0" edition = "2024" authors = ["NX9 Authors "] -repository = "https://github.com/nx9/nx9-wg" -homepage = "https://github.com/nx9/nx9-wg" +repository = "https://github.com/thakares/nx9-wg" +homepage = "https://github.com/thakares/nx9-wg" readme = "README.md" keywords = ["wireguard", "vpn", "netlink", "nftables", "network"] categories = ["network-programming", "command-line-utilities", "system-administration"] diff --git a/NX9-WG-STACK.md b/NX9-WG-STACK.md index 017cc1b..9ab897d 100644 --- a/NX9-WG-STACK.md +++ b/NX9-WG-STACK.md @@ -4,7 +4,7 @@ ![SQLite](https://img.shields.io/badge/SQLite-Embedded-blue) ![Platform](https://img.shields.io/badge/Platform-Linux-lightgrey) ![License](https://img.shields.io/badge/License-MIT%20OR%20Apache--2.0-green) -![Version](https://img.shields.io/badge/Version-v0.8.0-purple) +![Version](https://img.shields.io/badge/Version-v1.0.0-purple) ![Ecosystem](https://img.shields.io/badge/NX9-Ecosystem-6d5df6) > **"Software people can own, understand, and control."** @@ -367,7 +367,7 @@ nx9-wg forwarding enable # State Reconciliation & Diagnostics nx9-wg reconcile plan nx9-wg reconcile apply -nx9-wg diagnostics inspect all +nx9-wg diagnostics all # Disaster Recovery nx9-wg backup create --description "Pre-upgrade snapshot" @@ -464,9 +464,9 @@ LogsDirectory=nx9-wg ### Automated Packaging Pipeline ([`scripts/package-release.sh`](file:///home/sunil/Programs/nx9-wg/scripts/package-release.sh)) Generates self-contained, reproducible distribution archives in `target/dist/`: -- `nx9-wg-v0.8.0-linux-x86_64.tar.gz` (7.8 MB) -- `nx9-wg-v0.8.0-linux-x86_64.tar.xz` (5.0 MB) -- `nx9-wg-v0.8.0-linux-x86_64.sha256` (Cryptographic checksum manifest) +- `nx9-wg-v1.0.0-linux-x86_64.tar.gz` (7.8 MB) +- `nx9-wg-v1.0.0-linux-x86_64.tar.xz` (5.0 MB) +- `nx9-wg-v1.0.0-linux-x86_64.sha256` (Cryptographic checksum manifest) ### Production Filesystem Layout & Permissions ``` @@ -492,7 +492,7 @@ All quality gates have been executed and verified clean: | :--- | :--- | :---: | | **Code Formatting** | `cargo fmt --all -- --check` | **PASS** (Zero diffs) | | **Workspace Compilation** | `cargo check --workspace` | **PASS** (Zero errors) | -| **Workspace Unit Tests** | `cargo test --workspace` | **PASS** (**91 / 91 passed**, 100%) | +| **Workspace Unit Tests** | `cargo test --workspace` | **PASS** (**162 / 162 passed**, 100%) | | **Clippy Linter Check** | `cargo clippy --workspace --all-targets --all-features -- -D warnings` | **PASS** (Zero warnings) | | **Comprehensive CLI Suite** | `LIVE=0 bash scripts/test-cli-comprehensive.sh` | **PASS** (**203 passed** / 7 skipped) | | **Native Integration Suite** | `LIVE=0 bash scripts/test-native-integration.sh` | **PASS** (**19 passed** / 1 skipped) | diff --git a/README.md b/README.md index 9f383c6..b6c7e7a 100644 --- a/README.md +++ b/README.md @@ -4,7 +4,7 @@ ![SQLite](https://img.shields.io/badge/SQLite-Embedded-blue) ![Platform](https://img.shields.io/badge/Platform-Linux-lightgrey) ![License](https://img.shields.io/badge/License-MIT%20OR%20Apache--2.0-green) -![Version](https://img.shields.io/badge/Version-v0.8.0-purple) +![Version](https://img.shields.io/badge/Version-v1.0.0-purple) > **Sovereign, self-hosted, Linux-native VPN and network control plane built around the kernel's WireGuard implementation.** @@ -129,7 +129,7 @@ That is why **"native Linux VPN + networking platform"** is the accurate descrip | **Reconciliation Engine** | **Implemented** | Closed-loop drift detection, read-only plan, and serialized apply | | **Web User Interface** | **Verified** | Zero-dependency SPA with theme engine and 15 interactive routes | | **Release & Deployment** | **Implemented** | Standalone installer, uninstaller, packaging script, and systemd unit | -| **SAFE Verification Suite** | **PASS** | 91 workspace tests, 203 CLI tests, 19 integration tests, 23 live tests | +| **SAFE Verification Suite** | **PASS** | 162 workspace tests, 203 CLI tests, 19 integration tests, 23 live tests | | **LIVE Kernel Verification** | **Framework Ready** | SAFE mode (`LIVE=0`) verified; dedicated host ready via `LIVE=1` | --- @@ -152,7 +152,7 @@ That is why **"native Linux VPN + networking platform"** is the accurate descrip # Build the release binary cargo build --release -# Run the complete test suite (91/91 passed) +# Run the complete test suite (162/162 passed) cargo test --workspace ``` @@ -194,8 +194,8 @@ To install `nx9-wg` as a managed systemd service: ```bash # Download and extract release archive: -tar -xzf nx9-wg-v0.8.0-linux-x86_64.tar.gz -cd nx9-wg-v0.8.0-linux-x86_64 +tar -xzf nx9-wg-v1.0.0-linux-x86_64.tar.gz +cd nx9-wg-v1.0.0-linux-x86_64 # Run production installer: sudo bash install.sh @@ -223,7 +223,7 @@ See the [**Installation & Deployment Guide**](docs/installation.md) for step-by- | **Security Architecture** | [**Security Model & Permissions**](docs/security.md) | | **Backup & Recovery** | [**Backup & Disaster Recovery**](docs/backup_restore.md) | | **Release Engineering** | [**Release Packaging & Systemd**](docs/release.md) | -| **Quality Assurance** | [**Testing Strategy**](docs/testing.md) | +| **Quality Assurance** | [**Comprehensive Testing Specification**](docs/TESTING.md) | | **Developer Guide** | [**Development Guide**](docs/development.md) | | **Configuration** | [**Configuration Reference**](docs/configuration.md) | | **Containerization** | [**Docker Deployment**](docs/docker.md) | diff --git a/crates/nx9-wg-api/src/reconciliation.rs b/crates/nx9-wg-api/src/reconciliation.rs index dcf97b8..377159b 100644 --- a/crates/nx9-wg-api/src/reconciliation.rs +++ b/crates/nx9-wg-api/src/reconciliation.rs @@ -3,6 +3,7 @@ use crate::error::{ApiError, ApiResult}; use crate::state::{AppState, SystemEvent}; use chrono::Utc; +use ipnet::IpNet; use nx9_wg_core::types::audit::AuditEventType; use nx9_wg_core::types::wireguard::PeerState; use nx9_wg_network::NetworkEngine; @@ -11,6 +12,36 @@ use serde::{Deserialize, Serialize}; use std::sync::Arc; use std::time::Duration; +/// Check if a slice of live address strings contains the desired IpNet. +fn matches_ipnet(live_addrs: &[String], desired: &IpNet) -> bool { + live_addrs.iter().any(|s| { + if let Ok(net) = s.parse::() { + net.addr() == desired.addr() && net.prefix_len() == desired.prefix_len() + } else { + false + } + }) +} + +/// Check if live WireGuard peer allowed IPs match desired server-side allowed IPs. +fn matches_allowed_ips(live_allowed_ips: &[String], desired_str: &str) -> bool { + let desired_nets: std::collections::BTreeSet = desired_str + .split(',') + .map(|s| s.trim()) + .filter(|s| !s.is_empty()) + .filter_map(|s| s.parse::().ok()) + .collect(); + + let live_nets: std::collections::BTreeSet = live_allowed_ips + .iter() + .map(|s| s.trim()) + .filter(|s| !s.is_empty()) + .filter_map(|s| s.parse::().ok()) + .collect(); + + desired_nets == live_nets +} + /// Individual action proposed or taken by the reconciler. #[derive(Debug, Clone, Serialize, Deserialize)] pub struct ReconciliationAction { @@ -53,6 +84,8 @@ pub struct ReconciliationReport { #[serde(default)] pub status: ReconciliationStatus, pub executed_actions: usize, + #[serde(default)] + pub failed_actions: usize, pub details: Vec, } @@ -132,40 +165,66 @@ impl ReconciliationEngine { .ok() .flatten(); - let live_peer_keys: Vec = live_stats - .as_ref() - .map(|s| s.peers.iter().map(|p| p.public_key.clone()).collect()) - .unwrap_or_default(); + let iface_exists = live_interfaces.contains(&iface.name) || live_stats.is_some(); - match live_stats.as_ref() { - Some(stats) => { - if stats.public_key != iface.public_key.as_str() - || stats.listen_port != iface.listen_port + if iface_exists { + if let Some(stats) = live_stats.as_ref() { + let mut drift_reasons = Vec::new(); + + if !stats.public_key.is_empty() + && stats.public_key != iface.public_key.as_str() { + drift_reasons.push("public key mismatch".to_string()); + } + if stats.listen_port != 0 && stats.listen_port != iface.listen_port { + drift_reasons.push("listen port mismatch".to_string()); + } + if !matches_ipnet(&stats.addresses, &iface.address_v4) { + drift_reasons + .push(format!("missing IPv4 address '{}'", iface.address_v4)); + } + if let Some(ref v6) = iface.address_v6 + && !matches_ipnet(&stats.addresses, v6) + { + drift_reasons.push(format!("missing IPv6 address '{v6}'")); + } + if let Some(desired_mtu) = iface.mtu + && let Some(live_mtu) = stats.mtu + && live_mtu != desired_mtu as u32 + { + drift_reasons.push(format!( + "MTU mismatch (live: {live_mtu}, desired: {desired_mtu})" + )); + } + if !stats.is_up { + drift_reasons.push("interface link is down".to_string()); + } + + if !drift_reasons.is_empty() { plan.actions.push(ReconciliationAction { subsystem: "wireguard".to_string(), resource_id: iface.id.to_string(), action_type: "update_interface".to_string(), description: format!( - "Interface '{}' configuration drift detected; update listen port / keys", - iface.name + "Interface '{}' configuration drift detected ({}); synchronize link, address, port, or keys", + iface.name, + drift_reasons.join(", ") ), }); plan.interface_changes += 1; } } - None => { - plan.actions.push(ReconciliationAction { - subsystem: "wireguard".to_string(), - resource_id: iface.id.to_string(), - action_type: "create_interface".to_string(), - description: format!( - "Interface '{}' missing in kernel; create and sync", - iface.name - ), - }); - plan.interface_changes += 1; - } + } else { + plan.actions.push(ReconciliationAction { + subsystem: "wireguard".to_string(), + resource_id: iface.id.to_string(), + action_type: "create_interface".to_string(), + description: format!( + "Interface '{}' missing in kernel; create and sync", + iface.name + ), + }); + plan.interface_changes += 1; } // Check peers (only Active desired peers should be live) @@ -175,16 +234,86 @@ impl ReconciliationEngine { .filter(|p| p.state == PeerState::Active) .collect(); + let live_peers_map: std::collections::HashMap< + String, + &nx9_wireguard::LivePeerStats, + > = if let Some(ref stats) = live_stats { + stats + .peers + .iter() + .map(|p| (p.public_key.clone(), p)) + .collect() + } else { + std::collections::HashMap::new() + }; + for p in &active_desired_peers { - if !live_peer_keys.contains(&p.public_key.as_str().to_string()) { + let pub_key_str = p.public_key.as_str(); + let desired_server_allowed = p.server_wireguard_allowed_ips(); + + if let Some(live_p) = live_peers_map.get(pub_key_str) { + // Peer is present in live kernel interface. Verify semantic drift: + let mut peer_drifts = Vec::new(); + + if !matches_allowed_ips(&live_p.allowed_ips, &desired_server_allowed) { + peer_drifts.push(format!( + "AllowedIPs drift (live: [{:?}], desired: [{desired_server_allowed}])", + live_p.allowed_ips + )); + } + + if let (Some(desired_ka), Some(live_ka)) = + (p.persistent_keepalive, live_p.persistent_keepalive) + && live_ka != desired_ka + { + peer_drifts.push(format!( + "persistent keepalive drift (live: {live_ka}s, desired: {desired_ka}s)" + )); + } + + if !peer_drifts.is_empty() { + plan.actions.push(ReconciliationAction { + subsystem: "wireguard".to_string(), + resource_id: p.id.to_string(), + action_type: "update_peer".to_string(), + description: format!( + "Peer '{}' ({}) drift detected: {}; re-sync in kernel", + p.name, + pub_key_str, + peer_drifts.join(", ") + ), + }); + plan.peer_changes += 1; + } + + // Update operational telemetry (handshake timestamp and learned endpoint) from kernel + if live_p.last_handshake_at.is_some() || live_p.endpoint.is_some() { + let hs_newer = live_p.last_handshake_at.is_some() + && live_p.last_handshake_at != p.last_handshake_at; + let ep_newer = live_p.endpoint.is_some() + && live_p.endpoint.as_deref() != p.endpoint.as_deref(); + + if hs_newer || ep_newer { + let _ = self + .state + .store + .update_peer_learned_telemetry( + p.id, + live_p.last_handshake_at.or(p.last_handshake_at), + live_p.endpoint.as_deref().or(p.endpoint.as_deref()), + ) + .await; + } + } + } else { plan.actions.push(ReconciliationAction { subsystem: "wireguard".to_string(), resource_id: p.id.to_string(), action_type: "add_peer".to_string(), description: format!( - "Peer '{}' ({}) missing in live interface", + "Peer '{}' ({}) missing in live interface; add to kernel with AllowedIPs [{desired_server_allowed}]", p.name, - p.public_key.as_str() + pub_key_str ), }); plan.peer_changes += 1; @@ -293,7 +422,7 @@ impl ReconciliationEngine { .await .unwrap_or_default(); - if expected_ruleset.trim() != active_ruleset.trim() { + if nx9_wg_network::has_nftables_drift(&expected_ruleset, &active_ruleset) { plan.actions.push(ReconciliationAction { subsystem: "firewall".to_string(), resource_id: "nftables".to_string(), @@ -340,6 +469,17 @@ impl ReconciliationEngine { // Sweep expired peers let _ = self.sweep_expired_peers().await; + let initial_plan = self.plan().await.unwrap_or_default(); + if !initial_plan.has_drift { + return Ok(ReconciliationReport { + success: true, + status: ReconciliationStatus::Converged, + executed_actions: 0, + failed_actions: 0, + details: vec!["System is already fully converged; zero drift detected".to_string()], + }); + } + let desired_interfaces = self.state.store.list_interfaces().await?; let mut details = Vec::new(); @@ -419,10 +559,28 @@ impl ReconciliationEngine { // 4. Verify post-apply convergence let post_plan = self.plan().await.unwrap_or_default(); - let (success, status) = if !post_plan.has_drift { - (true, ReconciliationStatus::Converged) + let (success, status, executed_actions, failed_actions) = if !post_plan.has_drift { + ( + true, + ReconciliationStatus::Converged, + initial_plan.actions.len(), + 0, + ) } else { - (false, ReconciliationStatus::DriftRemains) + let remaining = post_plan.actions.len(); + let completed = initial_plan.actions.len().saturating_sub(remaining); + for action in &post_plan.actions { + details.push(format!( + "Unresolved drift: [{}] {}", + action.subsystem, action.description + )); + } + ( + false, + ReconciliationStatus::DriftRemains, + completed, + remaining, + ) }; // 5. Audit reconciliation run @@ -435,8 +593,8 @@ impl ReconciliationEngine { Some("reconciliation"), None, Some(&format!( - "Reconciliation applied {} actions (status: {status:?})", - details.len() + "Reconciliation applied {} actions (status: {status:?}, failed: {failed_actions})", + executed_actions )), None, None, @@ -446,8 +604,8 @@ impl ReconciliationEngine { self.state.broadcast(SystemEvent::AuditEvent { event_type: AuditEventType::ReconciliationRun, message: Some(format!( - "Reconciliation applied {} actions (status: {status:?})", - details.len() + "Reconciliation applied {} actions (status: {status:?}, failed: {failed_actions})", + executed_actions )), resource_type: Some("reconciliation".to_string()), resource_id: None, @@ -456,7 +614,8 @@ impl ReconciliationEngine { Ok(ReconciliationReport { success, status, - executed_actions: details.len(), + executed_actions, + failed_actions, details, }) } diff --git a/crates/nx9-wg-api/src/routes/app_client_js.js b/crates/nx9-wg-api/src/routes/app_client_js.js index 1723700..f9fd8e3 100644 --- a/crates/nx9-wg-api/src/routes/app_client_js.js +++ b/crates/nx9-wg-api/src/routes/app_client_js.js @@ -3,12 +3,65 @@ 'use strict'; // ── State ─────────────────────────────────────────────────────────────────── + let isAuthenticated = false; + let currentUser = null; let currentPage = 'dashboard'; let ws = null; let peersData = []; let interfacesData = []; let networksData = []; + // ── Authentication & UI State Transitions ────────────────────────────────── + function showAuthenticatedState(user) { + isAuthenticated = true; + currentUser = user || { username: 'admin' }; + const loginView = document.getElementById('login-view'); + const appLayout = document.getElementById('app-layout'); + const adminLabel = document.getElementById('admin-user-label'); + const loginPassword = document.getElementById('login-password'); + const errorMsg = document.getElementById('login-error-msg'); + + if (loginView) loginView.style.display = 'none'; + if (appLayout) appLayout.style.display = 'flex'; + if (adminLabel && currentUser && currentUser.username) { + adminLabel.textContent = currentUser.username; + } + if (loginPassword) loginPassword.value = ''; + if (errorMsg) { + errorMsg.style.display = 'none'; + errorMsg.textContent = ''; + } + + initWebSocket(); + } + + function showUnauthenticatedState() { + isAuthenticated = false; + currentUser = null; + peersData = []; + interfacesData = []; + networksData = []; + + closeWebSocket(); + + const appLayout = document.getElementById('app-layout'); + const loginView = document.getElementById('login-view'); + const pageContainer = document.getElementById('page-container'); + const loginPassword = document.getElementById('login-password'); + + if (appLayout) appLayout.style.display = 'none'; + if (loginView) loginView.style.display = 'flex'; + if (pageContainer) { + pageContainer.innerHTML = ''; + } + if (loginPassword) { + loginPassword.value = ''; + setTimeout(() => loginPassword.focus(), 50); + } + window.closeModal(); + window.closeSidebar(); + } + // ── Theme Management ──────────────────────────────────────────────────────── function initTheme() { const saved = localStorage.getItem('nx9_wg_theme') || 'dark'; @@ -54,7 +107,24 @@ }); // ── WebSocket Live Connection ─────────────────────────────────────────────── + function closeWebSocket() { + if (ws) { + try { + ws.onclose = null; + ws.close(); + } catch (_) {} + ws = null; + } + const dot = document.getElementById('ws-dot'); + const indicator = document.getElementById('ws-indicator'); + if (dot) dot.style.color = 'var(--status-fail-text)'; + if (indicator) indicator.classList.remove('connected'); + } + function initWebSocket() { + if (!isAuthenticated) return; + closeWebSocket(); + const protocol = window.location.protocol === 'https:' ? 'wss:' : 'ws:'; const wsUrl = `${protocol}//${window.location.host}/api/v1/ws`; @@ -77,12 +147,15 @@ const indicator = document.getElementById('ws-indicator'); if (dot) dot.style.color = 'var(--status-fail-text)'; if (indicator) indicator.classList.remove('connected'); - setTimeout(initWebSocket, 3000); + if (isAuthenticated) { + setTimeout(initWebSocket, 3000); + } }; } catch (_) {} } function handleLiveEvent(evt) { + if (!isAuthenticated) return; if (currentPage === 'dashboard' || currentPage === 'live-state' || currentPage === 'reconciliation') { renderPage(currentPage); } @@ -90,6 +163,15 @@ // ── Navigation Router ─────────────────────────────────────────────────────── window.navigateTo = function(pageId) { + if (!isAuthenticated) { + showUnauthenticatedState(); + return; + } + + if (!pageId || pageId === 'login') { + pageId = 'dashboard'; + } + currentPage = pageId; window.location.hash = pageId; window.closeSidebar(); @@ -105,7 +187,28 @@ renderPage(pageId); }; - // ── API Helpers ───────────────────────────────────────────────────────────── + // ── Error Extraction & API Helpers ────────────────────────────────────────── + window.extractErrorMessage = function(err) { + if (!err) return 'Unknown error occurred'; + if (typeof err === 'string') return err; + if (typeof err === 'object') { + if (err.error) { + if (typeof err.error === 'string') return err.error; + if (typeof err.error === 'object') { + if (err.error.message && typeof err.error.message === 'string') return err.error.message; + if (err.error.code && typeof err.error.code === 'string') return `[${err.error.code}] ${err.error.message || 'Validation error'}`; + } + } + if (err.message && typeof err.message === 'string') return err.message; + try { + return JSON.stringify(err); + } catch (_) { + return 'An error occurred'; + } + } + return String(err); + }; + async function api(path, options = {}) { try { const res = await fetch(`/api/v1${path}`, { @@ -116,7 +219,7 @@ ...options }); if (res.status === 401 && !path.includes('/auth/login')) { - renderLoginPage(); + showUnauthenticatedState(); return null; } if (!res.ok) { @@ -124,8 +227,9 @@ try { errData = await res.json(); } catch (_) {} + const errorMsg = extractErrorMessage(errData || `HTTP ${res.status}: ${res.statusText}`); return { - error: errData?.error || errData?.message || `HTTP ${res.status}: ${res.statusText}`, + error: errorMsg, status: res.status }; } @@ -137,8 +241,17 @@ } window.handleLogout = async function() { - await api('/auth/logout', { method: 'POST' }); - renderLoginPage(); + try { + await fetch('/api/v1/auth/logout', { + method: 'POST', + headers: { 'Content-Type': 'application/json' } + }); + } catch (e) { + console.error('Logout error:', e); + } finally { + showUnauthenticatedState(); + window.location.hash = ''; + } }; // ── Clipboard Copy ────────────────────────────────────────────────────────── @@ -305,10 +418,11 @@

Peers

-
Enrolled cryptographic peers, assigned tunnel addresses, and export profiles.
+
Enrolled WireGuard clients, cryptokey routes, and live data-plane telemetry.
-
- +
+ +
@@ -332,9 +446,9 @@ Status Name - IPv4 / IPv6 - Public Key - MTU + Tunnel IP + Peer Endpoint + Transfer (RX / TX) Last Handshake Actions @@ -354,23 +468,55 @@ } return peers.map(p => { - const statusClass = p.state === 'active' ? 'status-pass' : (p.state === 'disabled' ? 'status-warning' : 'status-fail'); + let statusLabel = 'Active'; + let statusClass = 'status-pass'; + + if (p.state === 'disabled') { + statusLabel = 'Disabled'; + statusClass = 'status-warning'; + } else if (p.state === 'expired' || p.state === 'revoked') { + statusLabel = capitalize(p.state); + statusClass = 'status-fail'; + } else if (p.state === 'active') { + if (!p.last_handshake_at) { + statusLabel = 'Awaiting Handshake'; + statusClass = 'status-warning'; + } else { + // Explicit UTC parsing + const hsStr = p.last_handshake_at.endsWith('Z') || p.last_handshake_at.includes('+') ? p.last_handshake_at : p.last_handshake_at + 'Z'; + let hsTime = new Date(hsStr).getTime(); + if (isNaN(hsTime)) { + hsTime = new Date(p.last_handshake_at).getTime(); + } + const now = Date.now(); + const diffSec = (now - hsTime) / 1000; + if (diffSec >= 0 && diffSec < 180) { + statusLabel = 'Connected'; + statusClass = 'status-pass'; + } else { + statusLabel = 'Disconnected'; + statusClass = 'status-fail'; + } + } + } + const pubKey = p.public_key || ''; const truncKey = pubKey.length > 12 ? `${pubKey.substring(0,6)}...${pubKey.substring(pubKey.length-6)}` : pubKey; const ipv4 = p.address_v4 || '—'; - const mtu = p.mtu || 1420; + const learnedEndpoint = p.endpoint ? `${escapeHtml(p.endpoint)}` : '—'; + const rxTx = (p.rx_bytes != null || p.tx_bytes != null) + ? `⬇ ${formatBytes(p.rx_bytes || 0)} • ⬆ ${formatBytes(p.tx_bytes || 0)}` + : '—'; + const relativeHandshake = p.last_handshake_at ? `${formatRelativeTime(p.last_handshake_at)}` : 'Never'; return ` - ${capitalize(p.state)} + ${statusLabel} ${escapeHtml(p.name)} ${ipv4} - - ${truncKey} - - - ${mtu} - ${p.last_handshake_at || 'Never'} + ${learnedEndpoint} + ${rxTx} + ${relativeHandshake}
@@ -388,7 +534,8 @@ const filtered = peersData.filter(p => p.name.toLowerCase().includes(q) || (p.address_v4 && p.address_v4.includes(q)) || - (p.public_key && p.public_key.toLowerCase().includes(q)) + (p.public_key && p.public_key.toLowerCase().includes(q)) || + (p.endpoint && p.endpoint.toLowerCase().includes(q)) ); const tbody = document.querySelector('#peers-table tbody'); if (tbody) tbody.innerHTML = renderPeerTableRows(filtered); @@ -431,6 +578,7 @@
+
1. Identity & Target Interface
@@ -521,13 +669,19 @@ }; window.submitCreatePeer = async function() { - const name = document.getElementById('peer-name')?.value; + const errBox = document.getElementById('peer-modal-error'); + if (errBox) errBox.style.display = 'none'; + + const name = document.getElementById('peer-name')?.value?.trim(); const ifaceId = document.getElementById('peer-iface')?.value; const network = document.getElementById('peer-network')?.value; const mtu = parseInt(document.getElementById('rec-mtu-val')?.textContent || '1420', 10); if (!name || !ifaceId) { - alert('Please provide a Peer Name and select a Target Interface.'); + if (errBox) { + errBox.style.display = 'block'; + errBox.textContent = '❌ Please provide a Peer Name and select a Target Interface.'; + } return; } @@ -552,12 +706,26 @@ renderPage('peers'); openClientExportModal(res.id); } else { - alert('Failed to create peer: ' + (res?.error || 'Unknown error')); + const errMsg = extractErrorMessage(res); + if (errBox) { + errBox.style.display = 'block'; + errBox.textContent = '❌ Failed to create peer: ' + errMsg; + } } }; // ── Modals: Client Export & QR ───────────────────────────────────────────── window.openClientExportModal = async function(peerId) { + let defaultEndpoint = ''; + try { + const settings = await api('/system/settings'); + if (Array.isArray(settings)) { + const srvEp = settings.find(s => s.key === 'server_endpoint')?.value; + const pubEp = settings.find(s => s.key === 'public_endpoint')?.value; + defaultEndpoint = (srvEp || pubEp || '').trim(); + } + } catch (_) {} + openModal(`
@@ -567,7 +735,7 @@
-
Client Transport Profile
+
Client Transport & Endpoint Profile
@@ -589,26 +757,32 @@
+
+ + +
-
+
-
-
- Generating SVG QR Code... + +
+
+ Generating QR Code...
-
+
Scan with the official WireGuard app on iOS or Android
-
+
@@ -773,14 +984,20 @@ }; window.submitCreateInterface = async function() { - const name = document.getElementById('iface-name')?.value; - const address_v4 = document.getElementById('iface-v4')?.value; + const errBox = document.getElementById('iface-modal-error'); + if (errBox) errBox.style.display = 'none'; + + const name = document.getElementById('iface-name')?.value?.trim(); + const address_v4 = document.getElementById('iface-v4')?.value?.trim(); const listen_port = parseInt(document.getElementById('iface-port')?.value || '51820', 10); const mtu = parseInt(document.getElementById('iface-mtu')?.value || '1420', 10); - const address_v6 = document.getElementById('iface-v6')?.value || null; + const address_v6 = document.getElementById('iface-v6')?.value?.trim() || null; if (!name || !address_v4) { - alert('Please provide Interface Name and IPv4 Subnet Address.'); + if (errBox) { + errBox.style.display = 'block'; + errBox.textContent = '❌ Please provide Interface Name and IPv4 Subnet Address.'; + } return; } @@ -793,7 +1010,127 @@ closeModal(); renderPage('interfaces'); } else { - alert('Failed to create interface: ' + (res?.error || 'Unknown error')); + const errMsg = extractErrorMessage(res); + if (errBox) { + errBox.style.display = 'block'; + errBox.textContent = '❌ Failed to create interface: ' + errMsg; + } + } + }; + + window.openEditInterfaceModal = async function(ifaceId) { + let iface = interfacesData.find(i => i.id === ifaceId); + if (!iface) { + iface = await api(`/interfaces/${ifaceId}`); + } + if (!iface || iface.error) { + alert('Failed to load interface: ' + extractErrorMessage(iface)); + return; + } + + openModal(` +
+
+
+
Edit WireGuard Interface (${escapeHtml(iface.name)})
+ +
+
+ + +
+
Interface Public Key (Read-Only • Private key strictly preserved)
+ ${escapeHtml(iface.public_key || '—')} +
+ +
+ + +
+
+
+ + +
+
+ + +
+
+
+
+ + +
+
+ + +
+
+
+ + +
+
+ +
+
+
+ + +
+
+
+ `); + }; + + window.submitEditInterface = async function(ifaceId) { + const errBox = document.getElementById('edit-iface-modal-error'); + if (errBox) errBox.style.display = 'none'; + + const name = document.getElementById('edit-iface-name')?.value?.trim(); + const address_v4 = document.getElementById('edit-iface-v4')?.value?.trim(); + const listen_port = parseInt(document.getElementById('edit-iface-port')?.value || '51820', 10); + const mtu = parseInt(document.getElementById('edit-iface-mtu')?.value || '1420', 10); + const address_v6 = document.getElementById('edit-iface-v6')?.value?.trim() || ''; + const dns = document.getElementById('edit-iface-dns')?.value?.trim() || ''; + const enabled = document.getElementById('edit-iface-enabled')?.checked ?? true; + + if (!name || !address_v4) { + if (errBox) { + errBox.style.display = 'block'; + errBox.textContent = '❌ Please provide Interface Name and IPv4 Subnet Address.'; + } + return; + } + + const payload = { + name, + address_v4, + listen_port, + mtu, + address_v6, + dns, + enabled + }; + + const res = await api(`/interfaces/${ifaceId}`, { + method: 'PUT', + body: JSON.stringify(payload) + }); + + if (res && !res.error) { + closeModal(); + renderPage('interfaces'); + } else { + const errMsg = extractErrorMessage(res); + if (errBox) { + errBox.style.display = 'block'; + errBox.textContent = '❌ Failed to update interface: ' + errMsg; + } } }; @@ -856,6 +1193,7 @@
+
@@ -879,12 +1217,18 @@ }; window.submitCreateNetwork = async function() { - const name = document.getElementById('net-name')?.value; - const cidr = document.getElementById('net-cidr')?.value; - const description = document.getElementById('net-desc')?.value || null; + const errBox = document.getElementById('net-modal-error'); + if (errBox) errBox.style.display = 'none'; + + const name = document.getElementById('net-name')?.value?.trim(); + const cidr = document.getElementById('net-cidr')?.value?.trim(); + const description = document.getElementById('net-desc')?.value?.trim() || null; if (!name || !cidr) { - alert('Please provide Network Name and CIDR.'); + if (errBox) { + errBox.style.display = 'block'; + errBox.textContent = '❌ Please provide Network Name and CIDR.'; + } return; } @@ -897,7 +1241,11 @@ closeModal(); renderPage('networks'); } else { - alert('Failed to create network: ' + (res?.error || 'Unknown error')); + const errMsg = extractErrorMessage(res); + if (errBox) { + errBox.style.display = 'block'; + errBox.textContent = '❌ Failed to create network: ' + errMsg; + } } }; @@ -956,6 +1304,7 @@
+
@@ -985,13 +1334,19 @@ }; window.submitCreateRoute = async function() { - const destination = document.getElementById('route-dest')?.value; - const gateway = document.getElementById('route-gw')?.value || null; - const interface_name = document.getElementById('route-iface')?.value || null; + const errBox = document.getElementById('route-modal-error'); + if (errBox) errBox.style.display = 'none'; + + const destination = document.getElementById('route-dest')?.value?.trim(); + const gateway = document.getElementById('route-gw')?.value?.trim() || null; + const interface_name = document.getElementById('route-iface')?.value?.trim() || null; const metric = parseInt(document.getElementById('route-metric')?.value || '100', 10); if (!destination) { - alert('Please provide Destination CIDR.'); + if (errBox) { + errBox.style.display = 'block'; + errBox.textContent = '❌ Please provide Destination CIDR.'; + } return; } @@ -1004,7 +1359,11 @@ closeModal(); renderPage('routes'); } else { - alert('Failed to create route: ' + (res?.error || 'Unknown error')); + const errMsg = extractErrorMessage(res); + if (errBox) { + errBox.style.display = 'block'; + errBox.textContent = '❌ Failed to create route: ' + errMsg; + } } }; @@ -1067,6 +1426,7 @@
+
@@ -1111,14 +1471,20 @@ }; window.submitCreateFirewallRule = async function() { - const name = document.getElementById('fw-name')?.value; + const errBox = document.getElementById('fw-modal-error'); + if (errBox) errBox.style.display = 'none'; + + const name = document.getElementById('fw-name')?.value?.trim(); const protocol = document.getElementById('fw-proto')?.value || 'udp'; const action = document.getElementById('fw-action')?.value || 'accept'; - const port = document.getElementById('fw-port')?.value || null; + const port = document.getElementById('fw-port')?.value?.trim() || null; const priority = parseInt(document.getElementById('fw-prio')?.value || '100', 10); if (!name) { - alert('Please provide Rule Name.'); + if (errBox) { + errBox.style.display = 'block'; + errBox.textContent = '❌ Please provide Rule Name.'; + } return; } @@ -1131,7 +1497,11 @@ closeModal(); renderPage('firewall'); } else { - alert('Failed to create firewall rule: ' + (res?.error || 'Unknown error')); + const errMsg = extractErrorMessage(res); + if (errBox) { + errBox.style.display = 'block'; + errBox.textContent = '❌ Failed to create firewall rule: ' + errMsg; + } } }; @@ -1326,15 +1696,92 @@ const report = await api('/reconcile/apply', { method: 'POST' }); + if (btn) { + btn.disabled = false; + btn.innerHTML = 'Run Reconcile (Apply)'; + } + if (report && !report.error) { - alert(`Reconciliation Completed!\n\nStatus: ${report.status}\nSuccess: ${report.success}\nApplied Actions: ${report.total_applied}\nFailed Actions: ${report.total_failed}`); + const isSuccess = report.success === true && report.status === 'converged'; + const isWarning = report.status === 'drift_remains' || ((report.failed_actions || 0) > 0 && (report.executed_actions || 0) > 0); + + const statusBadgeClass = isSuccess + ? 'status-pass' + : isWarning + ? 'status-warning' + : 'status-fail'; + + const statusTitle = isSuccess + ? 'Reconciliation Successful (Converged)' + : isWarning + ? 'Reconciliation Warning (Drift Remains)' + : 'Reconciliation Failed'; + + const executed = typeof report.executed_actions === 'number' ? report.executed_actions : 0; + const failed = typeof report.failed_actions === 'number' ? report.failed_actions : 0; + const detailsList = Array.isArray(report.details) ? report.details : []; + + openModal(` +
+
+
+
Reconciliation Execution Result
+ +
+
+
+

${escapeHtml(statusTitle)}

+ ${escapeHtml(report.status || 'unknown')} +
+ +
+
+
Executed Actions
+
${executed}
+
+
+
Failed Actions
+
${failed}
+
+
+ + ${detailsList.length > 0 ? ` +
+
Execution Details:
+
+
    + ${detailsList.map(d => `
  • ${escapeHtml(d)}
    • `).join('')} +
+
+
+ ` : ''} +
+
+ +
+
+
+ `); renderPage('reconciliation'); } else { - alert('Reconciliation failed: ' + (report?.error || 'Unknown error')); - if (btn) { - btn.disabled = false; - btn.innerHTML = 'Run Reconcile (Apply)'; - } + openModal(` +
+
+
+
Reconciliation Failed
+ +
+
+
+ ❌ ${escapeHtml(report?.error || 'Reconciliation execution failed')} +
+
+
+ +
+
+
+ `); } }; @@ -1376,43 +1823,95 @@ // ── Live State View ───────────────────────────────────────────────────────── async function renderLiveStatePage(container) { - const [ifaces, routes] = await Promise.all([ - api('/interfaces'), - api('/routes') - ]); + const live = await api('/system/live-state'); - const ifaceList = Array.isArray(ifaces) ? ifaces : []; - const routeList = Array.isArray(routes) ? routes : []; + if (!live || live.error) { + container.innerHTML = ` +
+
+

Live State

+
Actual Linux netlink kernel telemetry and active routing entries.
+
+
+
+
+ ❌ Failed to query kernel telemetry: ${escapeHtml(extractErrorMessage(live))} +
+
+ `; + return; + } + + const ifaceList = Array.isArray(live.interfaces) ? live.interfaces : []; + const routeList = Array.isArray(live.routes) ? live.routes : []; container.innerHTML = `

Live State

-
Actual Linux netlink kernel telemetry and active routing entries.
+
Authoritative Linux kernel netlink telemetry and active routing entries.
-
Active Linux WireGuard Interfaces
+
+
Kernel IP Forwarding Status
+
+ IPv4: ${live.ipv4_forwarding ? 'ENABLED' : 'DISABLED'} + IPv6: ${live.ipv6_forwarding ? 'ENABLED' : 'DISABLED'} +
+
+
+ +
+
Active Linux WireGuard Interfaces (${ifaceList.length})
- ${ifaceList.length === 0 ? `
No active interfaces.
` : ifaceList.map(i => ` -
- Interface: ${escapeHtml(i.name)} • Port: ${i.listen_port} • Address: ${i.address_v4} • Status: ${i.enabled ? 'UP' : 'DOWN'} + ${ifaceList.length === 0 ? `
No WireGuard interfaces observed in Linux kernel.
` : ifaceList.map(i => { + const addrs = Array.isArray(i.addresses) && i.addresses.length > 0 + ? i.addresses.map(a => `${escapeHtml(a)}`).join(' ') + : `No IPv4/IPv6 address assigned in kernel`; + return ` +
+
+
+ Interface: ${escapeHtml(i.name)} • Listen Port: ${i.listen_port} • MTU: ${i.mtu || 'Default'} +
+ ${i.is_up ? 'LINK UP' : 'LINK DOWN'} +
+
+ Kernel Addresses: ${addrs} +
+
+ Public Key: ${escapeHtml(i.public_key)} • Active Netlink Peers: ${i.peer_count || 0} +
+
+ `; + }).join('')} +
+
+ +
+
Active RTNETLINK Routes (${routeList.length})
+
+ ${routeList.length === 0 ? `
No routing entries active in kernel.
` : routeList.map(r => ` +
+
+ Destination: ${escapeHtml(r.destination)} • Gateway: ${escapeHtml(r.gateway || 'direct')} +
+
+ Metric: ${r.metric || 0} • Table: ${r.table || 254} +
`).join('')}
-
-
Active Routing Table Entries
-
- ${routeList.length === 0 ? `
No custom routes.
` : routeList.map(r => ` -
- Destination: ${r.destination} • Gateway: ${r.gateway || 'direct'} • Metric: ${r.metric || 0} -
- `).join('')} + ${live.active_nftables ? ` +
+
Active Kernel nftables Ruleset (table inet nx9_wg)
+ 
${escapeHtml(live.active_nftables)}
-
+ ` : ''}
`; } @@ -1422,6 +1921,10 @@ const settings = await api('/system/settings') || []; const settingList = Array.isArray(settings) ? settings : []; + const srvEpSetting = settingList.find(s => s.key === 'server_endpoint')?.value || ''; + const pubEpSetting = settingList.find(s => s.key === 'public_endpoint')?.value || ''; + const currentEndpoint = srvEpSetting || pubEpSetting || ''; + container.innerHTML = `
@@ -1430,6 +1933,19 @@
+ +
+
WireGuard Server Endpoint (Client Reachable)
+
+ The publicly or locally reachable host and port where WireGuard clients connect (e.g. 192.168.1.8:51820 or vpn.example.com:51820). This value is automatically embedded into exported client configurations and QR codes. +
+ +
+ + +
+
+
Appliance Parameters
@@ -1459,6 +1975,47 @@ `; } + window.saveServerEndpoint = async function() { + const alertBox = document.getElementById('server-endpoint-alert'); + if (alertBox) alertBox.style.display = 'none'; + + const inputVal = document.getElementById('setting-server-endpoint')?.value?.trim(); + if (!inputVal) { + if (alertBox) { + alertBox.className = 'alert-box danger'; + alertBox.style.display = 'block'; + alertBox.textContent = '❌ Server endpoint cannot be empty. Specify host:port (e.g. 192.168.1.8:51820).'; + } + return; + } + + const res = await api('/system/settings', { + method: 'PUT', + body: JSON.stringify({ + key: 'server_endpoint', + value: inputVal, + is_secret: false, + description: 'Reachable WireGuard server host:port endpoint' + }) + }); + + if (res && !res.error) { + if (alertBox) { + alertBox.className = 'alert-box success'; + alertBox.style.display = 'block'; + alertBox.textContent = '✅ Server endpoint saved successfully.'; + } + setTimeout(() => renderPage('settings'), 1200); + } else { + const errMsg = extractErrorMessage(res); + if (alertBox) { + alertBox.className = 'alert-box danger'; + alertBox.style.display = 'block'; + alertBox.textContent = '❌ Failed to save endpoint: ' + errMsg; + } + } + }; + // ── Backups Management ────────────────────────────────────────────────────── async function renderBackupsPage(container) { const backups = await api('/backups') || []; @@ -1599,6 +2156,7 @@
+
@@ -1622,16 +2180,25 @@ }; window.submitChangePassword = async function() { + const errBox = document.getElementById('pw-modal-error'); + if (errBox) errBox.style.display = 'none'; + const current_password = document.getElementById('pw-current')?.value; const new_password = document.getElementById('pw-new')?.value; const confirm_password = document.getElementById('pw-confirm')?.value; if (!current_password || !new_password) { - alert('Please fill in all password fields.'); + if (errBox) { + errBox.style.display = 'block'; + errBox.textContent = '❌ Please fill in all password fields.'; + } return; } if (new_password !== confirm_password) { - alert('New password and confirmation do not match.'); + if (errBox) { + errBox.style.display = 'block'; + errBox.textContent = '❌ New password and confirmation do not match.'; + } return; } @@ -1641,10 +2208,14 @@ }); if (res && !res.error) { - alert('Administrator password successfully changed.'); closeModal(); + renderPage('administrator'); } else { - alert('Failed to change password: ' + (res?.error || 'Invalid current password')); + const errMsg = extractErrorMessage(res); + if (errBox) { + errBox.style.display = 'block'; + errBox.textContent = '❌ Failed to change password: ' + errMsg; + } } }; @@ -1657,6 +2228,7 @@
+
@@ -1676,11 +2248,17 @@ }; window.submitCreateToken = async function() { - const name = document.getElementById('token-name')?.value; + const errBox = document.getElementById('token-modal-error'); + if (errBox) errBox.style.display = 'none'; + + const name = document.getElementById('token-name')?.value?.trim(); const expires_in_days = parseInt(document.getElementById('token-expiry')?.value || '30', 10); if (!name) { - alert('Please provide Token Name.'); + if (errBox) { + errBox.style.display = 'block'; + errBox.textContent = '❌ Please provide Token Name.'; + } return; } @@ -1716,7 +2294,11 @@
`); } else { - alert('Failed to create token: ' + (res?.error || 'Unknown error')); + const errMsg = extractErrorMessage(res); + if (errBox) { + errBox.style.display = 'block'; + errBox.textContent = '❌ Failed to create token: ' + errMsg; + } } }; @@ -1727,45 +2309,55 @@ } }; - // ── Login Page ────────────────────────────────────────────────────────────── - function renderLoginPage() { - const container = document.getElementById('page-container'); - if (!container) return; - container.innerHTML = ` -
-
- NX9 -

Administrator Login

-
Sign in to nx9-wg Appliance
-
-
-
- - -
-
- - -
- -
-
- `; - } - + // ── Login Action ──────────────────────────────────────────────────────────── window.submitLogin = async function() { - const username = document.getElementById('login-username')?.value; + const username = document.getElementById('login-username')?.value?.trim(); const password = document.getElementById('login-password')?.value; + const errorMsg = document.getElementById('login-error-msg'); + const submitBtn = document.getElementById('login-submit-btn'); - const res = await api('/auth/login', { - method: 'POST', - body: JSON.stringify({ username, password }) - }); + if (errorMsg) { + errorMsg.style.display = 'none'; + errorMsg.textContent = ''; + } + if (submitBtn) submitBtn.disabled = true; - if (res && res.session_id) { - renderPage('dashboard'); - } else { - alert('Authentication failed: Invalid administrator credentials.'); + try { + const res = await fetch('/api/v1/auth/login', { + method: 'POST', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify({ username, password }) + }); + + if (res.ok) { + const data = await res.json(); + if (data && data.session_id) { + showAuthenticatedState({ username: username || 'admin', session_id: data.session_id }); + const hash = window.location.hash.replace('#', '') || 'dashboard'; + navigateTo(hash === 'login' ? 'dashboard' : hash); + return; + } + } + + let errorText = 'Authentication failed: Invalid administrator credentials.'; + try { + const errData = await res.json(); + if (errData?.error || errData?.message) { + errorText = errData.error || errData.message; + } + } catch (_) {} + + if (errorMsg) { + errorMsg.textContent = errorText; + errorMsg.style.display = 'block'; + } + } catch (e) { + if (errorMsg) { + errorMsg.textContent = 'Network error during login: ' + e.message; + errorMsg.style.display = 'block'; + } + } finally { + if (submitBtn) submitBtn.disabled = false; } }; @@ -1777,6 +2369,34 @@ return `${d}d ${h}h ${m}m`; } + function formatBytes(bytes) { + if (!bytes || bytes === 0) return '0 B'; + const k = 1024; + const sizes = ['B', 'KB', 'MB', 'GB', 'TB']; + const i = Math.floor(Math.log(bytes) / Math.log(k)); + return parseFloat((bytes / Math.pow(k, i)).toFixed(1)) + ' ' + sizes[i]; + } + + function formatRelativeTime(dateStr) { + if (!dateStr) return 'Never'; + let str = dateStr; + if (!str.endsWith('Z') && !str.includes('+')) { + str += 'Z'; + } + let d = new Date(str); + if (isNaN(d.getTime())) { + d = new Date(dateStr); + } + if (isNaN(d.getTime())) return dateStr; + const now = Date.now(); + const diffSec = Math.max(0, Math.floor((now - d.getTime()) / 1000)); + if (diffSec < 10) return 'Just now'; + if (diffSec < 60) return `${diffSec}s ago`; + if (diffSec < 3600) return `${Math.floor(diffSec / 60)}m ago`; + if (diffSec < 86400) return `${Math.floor(diffSec / 3600)}h ago`; + return `${Math.floor(diffSec / 86400)}d ago`; + } + function capitalize(s) { if (!s) return ''; return s.charAt(0).toUpperCase() + s.slice(1); @@ -1787,13 +2407,45 @@ return s.toString().replace(/&/g, '&').replace(//g, '>').replace(/"/g, '"'); } - // ── Application Initialization ────────────────────────────────────────────── - window.addEventListener('DOMContentLoaded', () => { + // ── Application Initialization & History Management ──────────────────────── + async function checkAuthAndInit() { initTheme(); - initWebSocket(); - const hash = window.location.hash.replace('#', '') || 'dashboard'; - navigateTo(hash); + try { + const res = await fetch('/api/v1/auth/session', { + headers: { 'Content-Type': 'application/json' } + }); + if (res.ok) { + const user = await res.json(); + showAuthenticatedState(user); + const hash = window.location.hash.replace('#', '') || 'dashboard'; + navigateTo(hash === 'login' ? 'dashboard' : hash); + } else { + showUnauthenticatedState(); + } + } catch (e) { + showUnauthenticatedState(); + } + } + + window.addEventListener('hashchange', () => { + const hash = window.location.hash.replace('#', ''); + if (!isAuthenticated) { + showUnauthenticatedState(); + } else if (hash && hash !== currentPage) { + navigateTo(hash); + } }); + window.addEventListener('popstate', () => { + const hash = window.location.hash.replace('#', ''); + if (!isAuthenticated) { + showUnauthenticatedState(); + } else if (hash && hash !== currentPage) { + navigateTo(hash); + } + }); + + window.addEventListener('DOMContentLoaded', checkAuthAndInit); + })(); diff --git a/crates/nx9-wg-api/src/routes/app_index.html b/crates/nx9-wg-api/src/routes/app_index.html index 717b6d2..4c76f9a 100644 --- a/crates/nx9-wg-api/src/routes/app_index.html +++ b/crates/nx9-wg-api/src/routes/app_index.html @@ -10,7 +10,31 @@ -
+ + + + +