Frontend: opciones LUKS/snapshots y CI build-frontend - #19
Conversation
- Añade toggles de cifrado LUKS2 y snapshots btrfs en HomePage. - Permite elegir método keyfile/passphrase para LUKS. - Actualiza tipos InstallRequest con encryption y snapshots. - Test verifica que el POST incluye encryption/snapshots por defecto. - Nuevo job build-frontend en .github/workflows/ci.yml.
|
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | |
|---|---|---|---|---|---|
| 37528304 | Triggered | Generic Password | b427562 | portal/frontend/src/pages/HomePage.tsx | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secret safely. Learn here the best practices.
- Revoke and rotate this secret.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. Note Currently processing new changes in this PR. This may take a few minutes, please wait... ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (4)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit b427562. Configure here.
| } | ||
| if (enableSnapshots) { | ||
| body.snapshots = { enabled: true }; | ||
| } |
There was a problem hiding this comment.
Unchecked options keep profile defaults
High Severity
Unchecking enableEncryption or enableSnapshots omits those objects from the install POST instead of sending enabled: false. The portal merges them only when present, so the default production profile still enables LUKS and snapper. The form states that unchecked encryption formats root and home without LUKS.
Reviewed by Cursor Bugbot for commit b427562. Configure here.
| }; | ||
|
|
||
| if (enableEncryption) { | ||
| body.encryption = { enabled: true, method: encryptionMethod }; |
There was a problem hiding this comment.
Passphrase method sends no secret
Medium Severity
Choosing passphrase posts only { enabled: true, method: 'passphrase' }; InstallRequest has no passphrase field and the form never collects one. The installer formats LUKS with the profile secret or aborts if it is empty, so base and developer fail and production silently uses neubat.
Additional Locations (2)
Reviewed by Cursor Bugbot for commit b427562. Configure here.
1 participant
Añade al formulario web las opciones avanzadas de cifrado y snapshots, y garantiza el build de producción en CI.
Note
Medium Risk
Default-on encryption and snapshots change what
/api/installreceives for every web-created deployment; impact depends on backend handling of those fields.Overview
Adds advanced install options to the portal home form: LUKS2 disk encryption (toggle plus keyfile vs passphrase) and automatic btrfs snapshots, both on by default. Submitting the form now sends optional
encryptionandsnapshotsfields onInstallRequest, matching the extended types.CI gains a
build-frontendjob (aftervalidate) that runsmake build-frontendso production frontend builds are checked on every PR. Tests assert the default POST body includesencryption: { enabled: true, method: 'keyfile' }andsnapshots: { enabled: true }.Reviewed by Cursor Bugbot for commit b427562. Configure here.