Harden authentication and improve layout (#226)

* Harden authentication and API security

* Show passkey guidance for SSO accounts

* Fix stale auto-hidden APT updates

Fixes #225

* Make page content full width

Author: TheDuffman85

README.md

@@ -145,6 +145,8 @@ docker run -d \
 
 Set `LUDASH_BASE_URL` to the URL users and integrations actually use. Behind a reverse proxy, set the public HTTPS URL and add `LUDASH_TRUST_PROXY=true`.
 
+The API applies a Content Security Policy, limits request bodies to 1 MiB, rejects cross-origin browser mutations, and returns sensitive API responses with `private, no-store`. Command-line clients that do not send browser `Origin` or `Sec-Fetch-Site` headers remain supported. Configure HSTS at the TLS-terminating proxy when appropriate; the application does not set it itself.
+
 ### Docker Compose
 
 ```yaml

client/components/Layout.tsx

@@ -13,7 +13,7 @@ const contentWidthClass: Record<LayoutWidth, string> = {
   full: "max-w-none",
 };
 
-export function Layout({ children, title, actions, contentWidth = "wide" }: {
+export function Layout({ children, title, actions, contentWidth = "full" }: {
   children: ReactNode;
   title: ReactNode;
   actions?: ReactNode;

client/context/AuthContext.tsx

@@ -1,4 +1,12 @@
-import { createContext, useContext, useCallback, useEffect, useRef, useState, type ReactNode } from "react";
+import {
+  createContext,
+  useContext,
+  useCallback,
+  useEffect,
+  useRef,
+  useState,
+  type ReactNode,
+} from "react";
 import { ApiError, apiFetch } from "../lib/client";
 
 interface User {
@@ -13,13 +21,18 @@ export interface AuthState {
   oidcEnabled: boolean;
   passwordLoginDisabled: boolean;
   passkeysEnabled: boolean;
+  passkeysAvailable: boolean;
   hasPassword: boolean;
   totpEnabled: boolean;
   backendUnavailable: boolean;
 }
 
 interface AuthContextType extends AuthState {
-  login: (username: string, password: string, totpCode?: string) => Promise<void>;
+  login: (
+    username: string,
+    password: string,
+    totpCode?: string,
+  ) => Promise<void>;
   logout: () => Promise<void>;
   setup: (username: string, password: string) => Promise<void>;
   refresh: () => Promise<void>;
@@ -28,7 +41,9 @@ interface AuthContextType extends AuthState {
 const AuthContext = createContext<AuthContextType | null>(null);
 
 export function isHardAuthRefreshFailure(error: unknown): boolean {
-  return error instanceof ApiError && (error.status === 401 || error.status === 403);
+  return (
+    error instanceof ApiError && (error.status === 401 || error.status === 403)
+  );
 }
 
 export function getRecoverableAuthRefreshState(state: AuthState): AuthState {
@@ -47,6 +62,7 @@ export function AuthProvider({ children }: { children: ReactNode }) {
     oidcEnabled: false,
     passwordLoginDisabled: false,
     passkeysEnabled: false,
+    passkeysAvailable: false,
     hasPassword: false,
     totpEnabled: false,
     backendUnavailable: false,
@@ -63,6 +79,7 @@ export function AuthProvider({ children }: { children: ReactNode }) {
         oidcEnabled: boolean;
         passwordLoginDisabled: boolean;
         passkeysEnabled: boolean;
+        passkeysAvailable: boolean;
         hasPassword: boolean;
         totpEnabled: boolean;
       }>("/auth/status");
@@ -74,6 +91,7 @@ export function AuthProvider({ children }: { children: ReactNode }) {
         oidcEnabled: data.oidcEnabled,
         passwordLoginDisabled: data.passwordLoginDisabled,
         passkeysEnabled: data.passkeysEnabled,
+        passkeysAvailable: data.passkeysAvailable,
         hasPassword: data.hasPassword,
         totpEnabled: data.totpEnabled,
         backendUnavailable: false,
@@ -101,7 +119,11 @@ export function AuthProvider({ children }: { children: ReactNode }) {
     return () => clearTimeout(retryTimer.current);
   }, [refresh]);
 
-  const login = async (username: string, password: string, totpCode?: string) => {
+  const login = async (
+    username: string,
+    password: string,
+    totpCode?: string,
+  ) => {
     await apiFetch("/auth/login", {
       method: "POST",
       body: JSON.stringify({ username, password, totpCode }),

client/lib/systems.ts

@@ -144,6 +144,7 @@ export interface HiddenUpdate {
   repository: string | null;
   isSecurity: number;
   isKeptBack: number;
+  hideReason: "manual" | "kept_back";
   active: number;
   lastMatchedAt: string;
   inactiveSince: string | null;

client/locales/ar.json

@@ -243,6 +243,7 @@
   "pages.login.continueWithSso": "المتابعة باستخدام SSO",
   "pages.login.loginFailed": "فشل تسجيل الدخول",
   "pages.login.noCredentialReturned": "لم يتم إرجاع بيانات اعتماد",
+  "pages.login.oidcOnlyPasskey": "ينتمي مفتاح المرور هذا إلى حساب يستخدم تسجيل الدخول الموحّد فقط. سجّل الدخول عبر SSO بدلاً من ذلك.",
   "pages.login.passkeyAuthenticationFailed": "فشلت مصادقة مفتاح المرور",
   "pages.login.passkeysRequireASecureContextOrLocalhost": "تتطلب مفاتيح المرور سياقا آمنا (HTTPS أو localhost)",
   "pages.login.password": "كلمة المرور",
@@ -907,7 +908,7 @@
   "pages.systemDetail.fullUpgrade": "ترقية كاملة",
   "pages.systemDetail.fullUpgradeAllMessage": "إجراء ترقية كاملة على {systemName}؟ قد يثبت هذا اعتماديات جديدة أو يزيل حزما قديمة لإكمال ترقية كل الحزم وعددها {count}.",
   "pages.systemDetail.fullUpgradeAllPackages": "ترقية كاملة لكل الحزم",
-  "pages.systemDetail.hiddenUntilExactUpdateDisappears": "مخفي حتى يختفي هذا التحديث بالضبط",
+  "pages.systemDetail.hiddenUntilExactUpdateDisappears": "تظل التحديثات المخفية يدويًا مخفية حتى يختفي الإصدار المحدد؛ وتعود التحديثات المخفية تلقائيًا عند توقف تأجيلها",
   "pages.systemDetail.hiddenUpdates": "التحديثات المخفية",
   "pages.systemDetail.hiddenVersion": "الإصدار المخفي",
   "pages.systemDetail.hidePackageVersion": "إخفاء {packageName} {version}",

client/locales/de.json

@@ -243,6 +243,7 @@
   "pages.login.continueWithSso": "Mit SSO fortfahren",
   "pages.login.loginFailed": "Anmeldung fehlgeschlagen",
   "pages.login.noCredentialReturned": "Keine Anmeldedaten zurückgegeben",
+  "pages.login.oidcOnlyPasskey": "Dieser Passkey gehört zu einem Konto, das nur SSO verwendet. Melden Sie sich stattdessen per SSO an.",
   "pages.login.passkeyAuthenticationFailed": "Passkey-Authentifizierung fehlgeschlagen",
   "pages.login.passkeysRequireASecureContextOrLocalhost": "Passkeys erfordern einen sicheren Kontext (HTTPS oder localhost)",
   "pages.login.password": "Passwort",
@@ -907,7 +908,7 @@
   "pages.systemDetail.fullUpgrade": "Vollständiges Upgrade",
   "pages.systemDetail.fullUpgradeAllMessage": "Vollständiges Upgrade auf {systemName} ausführen? Dabei können neue Abhängigkeiten installiert oder veraltete Pakete entfernt werden, um das Upgrade aller {count} Pakete abzuschließen.",
   "pages.systemDetail.fullUpgradeAllPackages": "Vollständiges Upgrade aller Pakete",
-  "pages.systemDetail.hiddenUntilExactUpdateDisappears": "Ausgeblendet, bis genau dieses Update verschwindet",
+  "pages.systemDetail.hiddenUntilExactUpdateDisappears": "Manuell ausgeblendete Updates bleiben bis zum Verschwinden der exakten Version verborgen; automatisch ausgeblendete Updates kehren zurück, sobald sie nicht mehr zurückgehalten werden",
   "pages.systemDetail.hiddenUpdates": "Ausgeblendete Updates",
   "pages.systemDetail.hiddenVersion": "Ausgeblendete Version",
   "pages.systemDetail.hidePackageVersion": "{packageName} {version} ausblenden",

client/locales/en.json

@@ -243,6 +243,7 @@
   "pages.login.continueWithSso": "Continue with SSO",
   "pages.login.loginFailed": "Login failed",
   "pages.login.noCredentialReturned": "No credential returned",
+  "pages.login.oidcOnlyPasskey": "This passkey belongs to an SSO-only account. Sign in with SSO instead.",
   "pages.login.passkeyAuthenticationFailed": "Passkey authentication failed",
   "pages.login.passkeysRequireASecureContextOrLocalhost": "Passkeys require a secure context (HTTPS or localhost)",
   "pages.login.password": "Password",
@@ -907,7 +908,7 @@
   "pages.systemDetail.fullUpgrade": "Full Upgrade",
   "pages.systemDetail.fullUpgradeAllMessage": "Perform a full upgrade on {systemName}? This may install new dependencies or remove obsolete packages to complete the upgrade of all {count} packages.",
   "pages.systemDetail.fullUpgradeAllPackages": "Full Upgrade All Packages",
-  "pages.systemDetail.hiddenUntilExactUpdateDisappears": "Hidden until this exact update disappears",
+  "pages.systemDetail.hiddenUntilExactUpdateDisappears": "Manual hides last until the exact update disappears; auto-hidden updates return when no longer kept back",
   "pages.systemDetail.hiddenUpdates": "Hidden Updates",
   "pages.systemDetail.hiddenVersion": "Hidden Version",
   "pages.systemDetail.hidePackageVersion": "Hide {packageName} {version}",

client/locales/es.json

@@ -243,6 +243,7 @@
   "pages.login.continueWithSso": "Continuar con SSO",
   "pages.login.loginFailed": "Inicio de sesión fallido",
   "pages.login.noCredentialReturned": "No se devolvió ninguna credencial",
+  "pages.login.oidcOnlyPasskey": "Esta clave de acceso pertenece a una cuenta solo con SSO. Inicie sesión con SSO.",
   "pages.login.passkeyAuthenticationFailed": "Autenticación con passkey fallida",
   "pages.login.passkeysRequireASecureContextOrLocalhost": "Las passkeys requieren un contexto seguro (HTTPS o localhost)",
   "pages.login.password": "Contraseña",
@@ -907,7 +908,7 @@
   "pages.systemDetail.fullUpgrade": "Actualización completa",
   "pages.systemDetail.fullUpgradeAllMessage": "¿Realizar una actualización completa en {systemName}? Esto puede instalar nuevas dependencias o eliminar paquetes obsoletos para completar la actualización de los {count} paquetes.",
   "pages.systemDetail.fullUpgradeAllPackages": "Actualización completa de todos los paquetes",
-  "pages.systemDetail.hiddenUntilExactUpdateDisappears": "Oculto hasta que desaparezca esta actualización exacta",
+  "pages.systemDetail.hiddenUntilExactUpdateDisappears": "Las ocultaciones manuales duran hasta que desaparece la versión exacta; las actualizaciones ocultadas automáticamente vuelven cuando dejan de estar retenidas",
   "pages.systemDetail.hiddenUpdates": "Actualizaciones ocultas",
   "pages.systemDetail.hiddenVersion": "Versión oculta",
   "pages.systemDetail.hidePackageVersion": "Ocultar {packageName} {version}",

client/locales/fr.json

@@ -243,6 +243,7 @@
   "pages.login.continueWithSso": "Continuer avec SSO",
   "pages.login.loginFailed": "Connexion échouée",
   "pages.login.noCredentialReturned": "Aucun identifiant retourné",
+  "pages.login.oidcOnlyPasskey": "Cette clé d’accès appartient à un compte utilisant uniquement le SSO. Connectez-vous avec le SSO.",
   "pages.login.passkeyAuthenticationFailed": "Authentification par passkey échouée",
   "pages.login.passkeysRequireASecureContextOrLocalhost": "Les passkeys nécessitent un contexte sécurisé (HTTPS ou localhost)",
   "pages.login.password": "Mot de passe",
@@ -907,7 +908,7 @@
   "pages.systemDetail.fullUpgrade": "Mise à niveau complète",
   "pages.systemDetail.fullUpgradeAllMessage": "Effectuer une mise à niveau complète sur {systemName} ? Cela peut installer de nouvelles dépendances ou supprimer des paquets obsolètes afin de terminer la mise à niveau des {count} paquets.",
   "pages.systemDetail.fullUpgradeAllPackages": "Mise à niveau complète de tous les paquets",
-  "pages.systemDetail.hiddenUntilExactUpdateDisappears": "Masqué jusqu’à la disparition exacte de cette mise à jour",
+  "pages.systemDetail.hiddenUntilExactUpdateDisappears": "Les masquages manuels durent jusqu’à la disparition de la version exacte ; les mises à jour masquées automatiquement réapparaissent lorsqu’elles ne sont plus retenues",
   "pages.systemDetail.hiddenUpdates": "Mises à jour masquées",
   "pages.systemDetail.hiddenVersion": "Version masquée",
   "pages.systemDetail.hidePackageVersion": "Masquer {packageName} {version}",

client/locales/hi.json

@@ -243,6 +243,7 @@
   "pages.login.continueWithSso": "SSO के साथ जारी रखें",
   "pages.login.loginFailed": "लॉगिन विफल",
   "pages.login.noCredentialReturned": "कोई क्रेडेंशियल वापस नहीं मिला",
+  "pages.login.oidcOnlyPasskey": "यह पासकी केवल SSO वाले खाते से जुड़ी है। इसके बजाय SSO से साइन इन करें।",
   "pages.login.passkeyAuthenticationFailed": "पासकी प्रमाणीकरण विफल",
   "pages.login.passkeysRequireASecureContextOrLocalhost": "पासकी के लिए सुरक्षित संदर्भ (HTTPS या localhost) चाहिए",
   "pages.login.password": "पासवर्ड",
@@ -907,7 +908,7 @@
   "pages.systemDetail.fullUpgrade": "पूर्ण अपग्रेड",
   "pages.systemDetail.fullUpgradeAllMessage": "{systemName} पर पूर्ण अपग्रेड करें? यह सभी {count} पैकेजों का अपग्रेड पूरा करने के लिए नई निर्भरताएं इंस्टॉल कर सकता है या पुराने पैकेज हटा सकता है.",
   "pages.systemDetail.fullUpgradeAllPackages": "सभी पैकेजों का पूर्ण अपग्रेड",
-  "pages.systemDetail.hiddenUntilExactUpdateDisappears": "यह exact update गायब होने तक छिपा हुआ",
+  "pages.systemDetail.hiddenUntilExactUpdateDisappears": "मैन्युअल रूप से छिपे अपडेट सटीक संस्करण के गायब होने तक छिपे रहते हैं; अपने आप छिपे अपडेट रोके न जाने पर फिर दिखाई देते हैं",
   "pages.systemDetail.hiddenUpdates": "छिपे अपडेट",
   "pages.systemDetail.hiddenVersion": "छिपा संस्करण",
   "pages.systemDetail.hidePackageVersion": "{packageName} {version} छिपाएं",