infracensus-collector 1.4.1 → 1.4.3

package/dist/index.js

@@ -14604,6 +14604,8 @@ function renderPage() {
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <meta name="referrer" content="no-referrer">
 <title>InfraCensus Collector</title>
+<!-- An empty icon, declared so the browser never asks for /favicon.ico. -->
+<link rel="icon" href="data:,">
 <style>
 ${tokenCss()}
 
@@ -14786,6 +14788,16 @@ ${tokenCss()}
   }
   .bldpill .count { color: var(--muted); font-size: 0.6875rem; }
 
+  /* A textarea cannot be type=password, and a list of logins pasted into one
+     is every device password in the estate sitting in plain text on a screen
+     somebody else can walk past. The -webkit-text-security property is the only thing
+     that masks a multi-line field; it is supported in Chromium, Edge, Safari
+     and Firefox 119+, and the unprefixed property is written beside it for
+     whatever standardises. Where neither is honoured the field simply reads
+     as it always did \u2014 so the toggle says SHOW/HIDE rather than promising
+     secrecy the browser might not deliver. */
+  textarea.masked { -webkit-text-security: disc; text-security: disc; }
+
   .ok { color: var(--ok); } .bad { color: var(--bad); } .dim { color: var(--muted); }
   .warntext { color: var(--warn); }
 
@@ -14933,7 +14945,8 @@ ${tokenCss()}
 </head>
 <body>
 <main>
-  <!-- Login: shown whenever /ui/api/status answers 401. The only credential
+  <!-- Login: shown whenever /ui/api/session says signed out, or a route behind
+       the session answers 401 because it lapsed. The only credential
        fields here that belong to a PERSON \u2014 they are a cloud account of this
        collector's tenant, verified by the control plane, and nothing typed here
        is stored. Device credentials are a different thing entirely and live on
@@ -15919,14 +15932,32 @@ ${tokenCss()}
     if (b && b.getAttribute && b.getAttribute("id") === "refreshModules") refreshEntitlement(b);
   });
 
+  // Signed in or not, asked BEFORE anything behind the session. A signed-out
+  // page used to learn it from a 401 on /ui/api/status (and on credentials and
+  // sites right after), which the browser logs as a failed request on every
+  // load and every poll. null means the daemon did not answer at all.
+  async function signedIn() {
+    try {
+      const res = await fetch("/ui/api/session", { cache: "no-store" });
+      if (!res.ok) return null;
+      return (await res.json()).signedIn === true;
+    } catch (e) { return null; }
+  }
+
+  // Resolves true when the app view is showing live status and false otherwise,
+  // so the startup chain can skip the two directories on a signed-out load.
   async function refresh() {
+    const live = await signedIn();
+    if (live === false) { showLogin(); return false; }
+    if (live === null) return false; // daemon restarting \u2014 the next tick retries
     try {
       const res = await fetch("/ui/api/status", { cache: "no-store" });
-      if (res.status === 401) { showLogin(); return; }
-      if (!res.ok) return; // transient \u2014 keep the last good view
+      if (res.status === 401) { showLogin(); return false; } // lapsed between the two asks
+      if (!res.ok) return false; // transient \u2014 keep the last good view
       render(await res.json());
       showApp();
-    } catch (e) { /* server restarting \u2014 the next tick retries */ }
+      return true;
+    } catch (e) { return false; /* server restarting \u2014 the next tick retries */ }
   }
 
   function schedulePoll() {
@@ -16601,11 +16632,24 @@ ${tokenCss()}
       const pasteSummary = el("summary", { style: "cursor:pointer",
         text: "Paste several logins at once" });
       pasteWrap.appendChild(pasteSummary);
-      const pasteBox = el("textarea", { id: prefix + "SshPaste", spellcheck: "false", rows: "4",
-        placeholder: "admin,P@ssw0rd,EnableSecret\\nreadonly:viewpass\\nsvc-net secret123" });
+      const pasteBox = el("textarea", {
+        id: prefix + "SshPaste",
+        class: "masked",
+        spellcheck: "false",
+        rows: "4",
+        placeholder: "admin,P@ssw0rd,EnableSecret\\nreadonly:viewpass\\nsvc-net secret123",
+      });
       pasteWrap.appendChild(field("One login per line \u2014 username, password, enable secret", pasteBox,
         "Separate the fields with a comma, a colon, a tab, or spaces. The enable secret is optional. A password that itself contains a comma or colon has to go in the rows above, because a flat line cannot say which separator was part of the password."));
       const pasteBtn = el("button", { type: "button", class: "subtle", text: "Add these logins" });
+      // SHOW/HIDE, because the box is masked by default and somebody has to be
+      // able to check what they pasted. Toggling a class rather than swapping
+      // the element keeps the text \u2014 a re-render would lose it.
+      const peek = el("button", { type: "button", class: "subtle", text: "Show" });
+      peek.addEventListener("click", () => {
+        const masked = pasteBox.classList.toggle("masked");
+        peek.textContent = masked ? "Show" : "Hide";
+      });
       const pasteNote = el("div", { class: "hint" });
       pasteBtn.addEventListener("click", () => {
         const parsed = parsePastedLogins(pasteBox.value);
@@ -16617,26 +16661,39 @@ ${tokenCss()}
         // pastes six means eight, and silently discarding the two would be the
         // kind of data loss that is only noticed when a scan comes back short.
         //
-        // A row whose username is already listed is skipped rather than
-        // duplicated: the SSH loop tries each credential in turn against every
-        // host, so a duplicate is a second identical login attempt per device \u2014
-        // which on a locked-down estate is how an account lockout policy trips.
-        const already = sshRows.values().map((r) => trimmed(r.username)).filter(Boolean);
+        // \u2500\u2500 IDENTICAL MEANS THE WHOLE CREDENTIAL, NOT THE USERNAME \u2500\u2500\u2500\u2500\u2500\u2500\u2500
+        //
+        // This compared USERNAMES, and that was wrong in the one way that
+        // matters: fifteen lines reading admin/pass1 ... admin/pass15 are not
+        // fifteen copies of one login, they are the fifteen passwords an
+        // operator wants tried in order \u2014 the exact reason the box exists.
+        // Fourteen of them were silently discarded.
+        //
+        // The rule it was reaching for is still worth keeping: the SSH loop
+        // tries every credential against every host, so a genuinely identical
+        // entry is a second identical login attempt per device, which is how a
+        // lockout policy trips. Identical is username AND password AND enable.
+        const key = (c) => JSON.stringify([c.username, c.password, c.enable || ""]);
+        const already = sshRows.values()
+          .filter((r) => trimmed(r.username) !== "")
+          .map((r) => key({ username: trimmed(r.username), password: r.password, enable: r.enable }));
         let added = 0;
         let skipped = 0;
         for (const cred of parsed) {
-          if (already.indexOf(cred.username) >= 0) { skipped += 1; continue; }
-          already.push(cred.username);
+          const k = key(cred);
+          if (already.indexOf(k) >= 0) { skipped += 1; continue; }
+          already.push(k);
           sshRows.add(cred);
           added += 1;
         }
         pasteBox.value = "";
         pasteNote.textContent =
           "Added " + added + " login" + (added === 1 ? "" : "s")
-          + (skipped ? ", skipped " + skipped + " already listed by that username" : "")
+          + (skipped ? ", skipped " + skipped + " already listed" : "")
           + ". They are tried in the order shown, top first.";
       });
       pasteWrap.appendChild(pasteBtn);
+      pasteWrap.appendChild(peek);
       pasteWrap.appendChild(pasteNote);
       host.appendChild(pasteWrap);
       host.appendChild(el("h3", { text: "Windows logins (WMI enrichment)" }));
@@ -17446,8 +17503,10 @@ ${tokenCss()}
 
   // Status first, then the two directories this page offers choices from. The
   // site list lands after the status seed on purpose: the seed points the picker
-  // at the configured id, and this only resolves it into a name.
-  refresh().then(loadCredentials).then(loadSites);
+  // at the configured id, and this only resolves it into a name. Signed out,
+  // neither directory is asked for: both sit behind the session and would only
+  // answer 401. A successful login loads them itself.
+  refresh().then((ok) => { if (ok) return loadCredentials().then(loadSites); });
   schedulePoll();
 })();
 </script>
@@ -18455,6 +18514,15 @@ async function startUiServer(deps, port = resolveUiPort()) {
       json(res, 200, { ok: true }, { "set-cookie": auth.clearCookie() });
       return;
     }
+    if (method === "GET" && url === "/favicon.ico") {
+      res.writeHead(204, { "cache-control": "max-age=86400" });
+      res.end();
+      return;
+    }
+    if (url === "/ui/api/session" && method === "GET") {
+      json(res, 200, { signedIn: auth.verify(req.headers.cookie) });
+      return;
+    }
     if (!auth.verify(req.headers.cookie)) {
       json(res, 401, UNAUTHORIZED_BODY);
       return;