denozord/MikrotikManager
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 104 Wiki Activity

fix(network): защитить ключи WireGuard и режим просмотра операций

Browse Source
This commit is contained in:
Denozordec committed 2026-10-13 20:12:33 +07:00
1 parent c8f9c83f45
commit a404da768d
23 files changed
+1648 -36
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/ux-ui/acceptance/compiled208-result.json
+1054
View File
File diff suppressed because it is too large. Load diff
docs/ux-ui/acceptance/native208-deployment-2026-10-13.json
+15
View File
@@ -0,0 +1,15 @@
{
"date": "2026-10-13",
"block": "12.5.208",
"backendSourceFilesMatched": 470,
"frontendSourceFilesMatched": 527,
"compiledMatched": 1044,
"backendImage": "mmapp-test/backend:ux-native208",
"backendImageId": "sha256:46923e412d3e7c89f79a4c7757a64d8226029988ce4e865398ad224c6fb2b2e7",
"frontendImage": "mmapp-test/frontend:ux-native208",
"frontendImageId": "sha256:5672a5501fb316b5d8885854328607efa6d58ae60804d6b22adab0516b8e0ee56",
"backendHealthy": true,
"ownDatabasesRolesContainersRemoved": 3,
"ownedNativeInterfacesCreatedAndRemoved": 2,
"chrPasswordsChanged": false
}
docs/ux-ui/acceptance/native208-e2e-2026-10-13.json
+18
View File
@@ -0,0 +1,18 @@
{
"date": "2026-10-13",
"block": "12.5.208",
"uniqueCases": 53,
"finalReadonly": {
"startTime": "2026-10-13T12:58:59.011Z",
"duration": 27098.076,
"expected": 20,
"skipped": 0,
"unexpected": 0,
"flaky": 0
},
"unchangedRegressionPassed": 33,
"initialFailedReadonlyFixture": 2,
"initialFailureReason": "GRE fixture omitted required ipsec:null; corrected fixture, writer role UI enabled",
"allUniquePassed": true,
"scope": "20 reader/writer PC/mobile workspaces +33 history/readiness/refresh regressions; no real native mutation"
}
docs/ux-ui/acceptance/native208-live-ui-2026-10-13.json
+175
View File
@@ -0,0 +1,175 @@
{
"date": "2026-10-13",
"block": "12.5.208",
"runtime": "ux-native208",
"cases": [
{
"section": "wireguard",
"role": "reader",
"width": 1440,
"writeControlAllowed": false,
"actualNativeList": true,
"applied": false
},
{
"section": "ipsec",
"role": "reader",
"width": 1440,
"writeControlAllowed": false,
"actualNativeList": true,
"applied": false
},
{
"section": "gre",
"role": "reader",
"width": 1440,
"writeControlAllowed": false,
"actualNativeList": true,
"applied": false
},
{
"section": "firewall",
"role": "reader",
"width": 1440,
"writeControlAllowed": false,
"actualNativeList": true,
"applied": false
},
{
"section": "filters",
"role": "reader",
"width": 1440,
"writeControlAllowed": false,
"actualNativeList": true,
"applied": false
},
{
"section": "wireguard",
"role": "admin",
"width": 1440,
"writeControlAllowed": true,
"actualNativeList": true,
"applied": false
},
{
"section": "ipsec",
"role": "admin",
"width": 1440,
"writeControlAllowed": true,
"actualNativeList": true,
"applied": false
},
{
"section": "gre",
"role": "admin",
"width": 1440,
"writeControlAllowed": true,
"actualNativeList": true,
"applied": false
},
{
"section": "firewall",
"role": "admin",
"width": 1440,
"writeControlAllowed": true,
"actualNativeList": true,
"applied": false
},
{
"section": "filters",
"role": "admin",
"width": 1440,
"writeControlAllowed": true,
"actualNativeList": true,
"applied": false
},
{
"section": "wireguard",
"role": "reader",
"width": 320,
"writeControlAllowed": false,
"actualNativeList": true,
"applied": false
},
{
"section": "ipsec",
"role": "reader",
"width": 320,
"writeControlAllowed": false,
"actualNativeList": true,
"applied": false
},
{
"section": "gre",
"role": "reader",
"width": 320,
"writeControlAllowed": false,
"actualNativeList": true,
"applied": false
},
{
"section": "firewall",
"role": "reader",
"width": 320,
"writeControlAllowed": false,
"actualNativeList": true,
"applied": false
},
{
"section": "filters",
"role": "reader",
"width": 320,
"writeControlAllowed": false,
"actualNativeList": true,
"applied": false
},
{
"section": "wireguard",
"role": "admin",
"width": 320,
"writeControlAllowed": true,
"actualNativeList": true,
"applied": false
},
{
"section": "ipsec",
"role": "admin",
"width": 320,
"writeControlAllowed": true,
"actualNativeList": true,
"applied": false
},
{
"section": "gre",
"role": "admin",
"width": 320,
"writeControlAllowed": true,
"actualNativeList": true,
"applied": false
},
{
"section": "firewall",
"role": "admin",
"width": 320,
"writeControlAllowed": true,
"actualNativeList": true,
"applied": false
},
{
"section": "filters",
"role": "admin",
"width": 320,
"writeControlAllowed": true,
"actualNativeList": true,
"applied": false
}
],
"realPortalJWT": true,
"apiMocks": false,
"mutationRequests": 0,
"pageErrors": 0,
"ownWireguardInterfacesPresent": true,
"scope": "Default create/import/key-export controls on actual data; no operations applied from UI",
"ownWireguardInterfacesRemoved": true,
"ownPortalUserRemoved": true
}
docs/ux-ui/acceptance/native208-profile-result.json
+18
View File
@@ -0,0 +1,18 @@
{
"date": "2026-10-13",
"block": "12.5.208",
"database": "mm_accept_166_1791896427599",
"scope": "ephemeral role and precreated owned database; no copied production credentials",
"tests": [
{
"command": "npm --prefix backend run test:wireguard",
"passed": true,
"durationMs": 14595,
"externalNativeDevices": false,
"originalReportedCommand": "npm --prefix backend run test:traffic-rate",
"labelCorrection": "Runner executed test:wireguard; copied reporting label incorrectly named traffic-rate. Actual profile stdout assertion verified."
}
],
"scopedRoleVerified": true,
"passed": true
}
docs/ux-ui/acceptance/wireguard208-baseline-result.json
+82
View File
@@ -0,0 +1,82 @@
{
"date": "2026-10-13",
"block": "12.5.208",
"database": "mm_accept_166_1791895670647",
"baseline": true,
"cases": [
{
"role": "reader",
"flag": "",
"status": 200,
"privateKeyExposed": false,
"nativeRequestCount": 4
},
{
"role": "reader",
"flag": "?includePrivateKey=1",
"status": 200,
"privateKeyExposed": true,
"nativeRequestCount": 4
},
{
"role": "reader",
"flag": "?includePrivateKey=true",
"status": 200,
"privateKeyExposed": true,
"nativeRequestCount": 4
},
{
"role": "writer",
"flag": "",
"status": 200,
"privateKeyExposed": false,
"nativeRequestCount": 4
},
{
"role": "writer",
"flag": "?includePrivateKey=1",
"status": 200,
"privateKeyExposed": true,
"nativeRequestCount": 4
},
{
"role": "writer",
"flag": "?includePrivateKey=true",
"status": 200,
"privateKeyExposed": true,
"nativeRequestCount": 4
},
{
"role": "admin",
"flag": "",
"status": 200,
"privateKeyExposed": false,
"nativeRequestCount": 4
},
{
"role": "admin",
"flag": "?includePrivateKey=1",
"status": 200,
"privateKeyExposed": true,
"nativeRequestCount": 4
},
{
"role": "admin",
"flag": "?includePrivateKey=true",
"status": 200,
"privateKeyExposed": true,
"nativeRequestCount": 4
},
{
"name": "is_admin alone",
"status": 200,
"permissionRequired": true
},
{
"role": "unauthenticated",
"status": 401
}
],
"scope": "Production compiled WireGuard GET/auth/mapper, own restricted PostgreSQL and local RouterOS HTTP fixture with nonempty synthetic private key; isolated signed JWT",
"passed": true
}
docs/ux-ui/acceptance/wireguard208-fixed-result.json
+82
View File
@@ -0,0 +1,82 @@
{
"date": "2026-10-13",
"block": "12.5.208",
"database": "mm_accept_166_1791896339709",
"baseline": false,
"cases": [
{
"role": "reader",
"flag": "",
"status": 200,
"privateKeyExposed": false,
"nativeRequestCount": 4
},
{
"role": "reader",
"flag": "?includePrivateKey=1",
"status": 403,
"privateKeyExposed": false,
"nativeRequestCount": 0
},
{
"role": "reader",
"flag": "?includePrivateKey=true",
"status": 403,
"privateKeyExposed": false,
"nativeRequestCount": 0
},
{
"role": "writer",
"flag": "",
"status": 200,
"privateKeyExposed": false,
"nativeRequestCount": 4
},
{
"role": "writer",
"flag": "?includePrivateKey=1",
"status": 200,
"privateKeyExposed": true,
"nativeRequestCount": 4
},
{
"role": "writer",
"flag": "?includePrivateKey=true",
"status": 200,
"privateKeyExposed": true,
"nativeRequestCount": 4
},
{
"role": "admin",
"flag": "",
"status": 200,
"privateKeyExposed": false,
"nativeRequestCount": 4
},
{
"role": "admin",
"flag": "?includePrivateKey=1",
"status": 200,
"privateKeyExposed": true,
"nativeRequestCount": 4
},
{
"role": "admin",
"flag": "?includePrivateKey=true",
"status": 200,
"privateKeyExposed": true,
"nativeRequestCount": 4
},
{
"name": "is_admin alone",
"status": 403,
"permissionRequired": true
},
{
"role": "unauthenticated",
"status": 401
}
],
"scope": "Production compiled WireGuard GET/auth/mapper, own restricted PostgreSQL and local RouterOS HTTP fixture with nonempty synthetic private key; isolated signed JWT",
"passed": true
}
docs/ux-ui/acceptance/wireguard208-native-live-2026-10-13.json
+42
View File
@@ -0,0 +1,42 @@
{
"date": "2026-10-13",
"block": "12.5.208",
"runtimeBackend": "ux-native208",
"actualPortalJWT": true,
"cases": [
{
"host": "194.226.121.150",
"serverId": 1,
"ownedInterfaceCreated": true,
"createStatus": 201,
"readerPublicList": 200,
"readerPrivateFlags": [
403,
403
],
"readerPrivateKeyAbsent": true,
"adminPrivateKeyAvailable": true,
"publicKeyPreserved": true,
"dataPlaneTest": false
},
{
"host": "104.165.244.7",
"serverId": 2,
"ownedInterfaceCreated": true,
"createStatus": 201,
"readerPublicList": 200,
"readerPrivateFlags": [
403,
403
],
"readerPrivateKeyAbsent": true,
"adminPrivateKeyAvailable": true,
"publicKeyPreserved": true,
"dataPlaneTest": false
}
],
"privateMaterialPublished": false,
"cleanupCompleted": true,
"scope": "Own WireGuard interface on each CHR; private/public API policy, not handshake or encrypted data-plane test",
"ownPortalUserRemoved": true
}