portal-mojo 0.2.2 → 0.2.4

package/src/admin/incidents/EventDetail.tsx

@@ -1,18 +1,157 @@
-import { DetailView, Eyebrow, FlatRow, KnownFieldsCard, StatusPanel, fmt } from '../../ui';
+import { useQuery } from '@tanstack/react-query';
+import { mojoCall } from '../../client/runtime';
+import { DetailView, Eyebrow, FlatRow, JsonBlock, KnownFieldsCard, StatusPanel, fmt, type KnownField } from '../../ui';
 import { EvidenceCard, INCIDENT_METADATA_FIELDS, RequestResponseForensics, TraceForensics, first, metadataOf } from './forensics';
-import { showIncidentDetail, useEventDetail } from './models';
+import { sanitizeEventRow } from './sanitize';
+import { EventModel, showIncidentDetail, type EventRow } from './models';
+
+const MOJOSEC_SUMMARY_FIELDS: KnownField[] = [
+    { key: 'kind', label: 'Detection kind', hideEmpty: true },
+    { key: 'count', label: 'Occurrences', hideEmpty: true },
+    { key: 'event_id', label: 'Sensor event ID', hideEmpty: true },
+    { key: 'sensor_id', label: 'Sensor', hideEmpty: true },
+    { key: 'sensor_severity', label: 'Sensor severity', hideEmpty: true },
+    { key: 'effective_level', label: 'Effective level', hideEmpty: true },
+    { key: 'recommendation', label: 'Recommendation', hideEmpty: true },
+    { key: 'first_seen', label: 'First seen', format: 'datetime', hideEmpty: true },
+    { key: 'last_seen', label: 'Last seen', format: 'datetime', hideEmpty: true },
+    { key: 'protocol_version', label: 'Protocol version', hideEmpty: true },
+    { key: 'installation_key_id', label: 'Installation key ID', hideEmpty: true },
+    { key: 'sensor_policy_revision_sha256', label: 'Sensor policy revision', hideEmpty: true },
+    { key: 'expected_change', label: 'Expected change', hideEmpty: true },
+];
+
+const MOJOSEC_EVIDENCE_FIELDS: KnownField[] = [
+    { key: 'actor', label: 'Actor', hideEmpty: true },
+    { key: 'target_user', label: 'Target user', hideEmpty: true },
+    { key: 'user', label: 'User', hideEmpty: true },
+    { key: 'auth_method', label: 'Authentication method', hideEmpty: true },
+    { key: 'service', label: 'Service', hideEmpty: true },
+    { key: 'attribution', label: 'Attribution', hideEmpty: true },
+    { key: 'command', label: 'Command', hideEmpty: true },
+    { key: 'command_path', label: 'Command path', hideEmpty: true },
+    { key: 'command_family', label: 'Command family', hideEmpty: true },
+    { key: 'command_truncated', label: 'Command truncated', hideEmpty: true },
+    { key: 'command_path_truncated', label: 'Command path truncated', hideEmpty: true },
+    { key: 'cwd', label: 'Working directory', hideEmpty: true },
+    { key: 'cwd_truncated', label: 'Working directory truncated', hideEmpty: true },
+    { key: 'proof_status', label: 'Proof status', hideEmpty: true },
+    { key: 'producer_comm', label: 'Producer process', hideEmpty: true },
+    { key: 'producer_exe', label: 'Producer executable', hideEmpty: true },
+    { key: 'producer_pid', label: 'Producer PID', hideEmpty: true },
+    { key: 'producer_uid', label: 'Producer UID', hideEmpty: true },
+    { key: 'target_uid', label: 'Target UID', hideEmpty: true },
+    { key: 'opener_uid', label: 'Opener UID', hideEmpty: true },
+    { key: 'audit_session', label: 'Audit session', hideEmpty: true },
+    { key: 'audit_loginuid', label: 'Audit login UID', hideEmpty: true },
+    { key: 'tty', label: 'TTY', hideEmpty: true },
+    { key: 'boot_id', label: 'Boot ID', hideEmpty: true },
+    { key: 'monotonic', label: 'Monotonic timestamp', hideEmpty: true },
+    { key: 'systemd_unit', label: 'systemd unit', hideEmpty: true },
+    { key: 'cgroup', label: 'Control group', hideEmpty: true },
+    { key: 'selinux', label: 'SELinux context', hideEmpty: true },
+    { key: 'job_function', label: 'Job function', hideEmpty: true },
+    { key: 'origin_kind', label: 'Origin kind', hideEmpty: true },
+    { key: 'operation_id', label: 'Operation ID', hideEmpty: true },
+    { key: 'execution_id', label: 'Execution ID', hideEmpty: true },
+    { key: 'job_id', label: 'Job ID', hideEmpty: true },
+    { key: 'lineage_sha256', label: 'Lineage digest', hideEmpty: true },
+    { key: 'receipt_semantics', label: 'Receipt semantics', hideEmpty: true },
+    { key: 'ancestors', label: 'Process ancestry', hideEmpty: true },
+    { key: 'peer_ip', label: 'Peer IP', hideEmpty: true },
+    { key: 'method', label: 'HTTP method', hideEmpty: true },
+    { key: 'host', label: 'HTTP host', hideEmpty: true },
+    { key: 'status', label: 'HTTP status', hideEmpty: true },
+    { key: 'response_class', label: 'Response class', hideEmpty: true },
+    { key: 'resource_id', label: 'Resource ID', hideEmpty: true },
+    { key: 'edge_policy_version', label: 'Edge policy version', hideEmpty: true },
+    { key: 'path', label: 'Request path', hideEmpty: true },
+    { key: 'upstream_status', label: 'Upstream status', hideEmpty: true },
+    { key: 'request_id', label: 'Request ID', hideEmpty: true },
+    { key: 'scheme', label: 'Scheme', hideEmpty: true },
+    { key: 'protocol', label: 'Protocol', hideEmpty: true },
+    { key: 'tls_protocol', label: 'TLS protocol', hideEmpty: true },
+    { key: 'tls_cipher', label: 'TLS cipher', hideEmpty: true },
+    { key: 'remote_port', label: 'Remote port', hideEmpty: true },
+    { key: 'peer_port', label: 'Peer port', hideEmpty: true },
+    { key: 'server_port', label: 'Server port', hideEmpty: true },
+    { key: 'request_length', label: 'Request bytes', hideEmpty: true },
+    { key: 'response_bytes', label: 'Response bytes', hideEmpty: true },
+    { key: 'response_body_bytes', label: 'Response body bytes', hideEmpty: true },
+    { key: 'request_time_ms', label: 'Request time (ms)', hideEmpty: true },
+    { key: 'upstream_connect_time_ms', label: 'Upstream connect time (ms)', hideEmpty: true },
+    { key: 'upstream_header_time_ms', label: 'Upstream header time (ms)', hideEmpty: true },
+    { key: 'upstream_response_time_ms', label: 'Upstream response time (ms)', hideEmpty: true },
+    { key: 'upstream_response_length', label: 'Upstream response bytes', hideEmpty: true },
+    { key: 'upstream_bytes_received', label: 'Upstream bytes received', hideEmpty: true },
+    { key: 'upstream_bytes_sent', label: 'Upstream bytes sent', hideEmpty: true },
+    { key: 'referrer_origin', label: 'Referrer origin', hideEmpty: true },
+    { key: 'referrer', label: 'Referrer', hideEmpty: true },
+    { key: 'user_agent', label: 'User agent', hideEmpty: true },
+    { key: 'last_occurrence_sample', label: 'Last occurrence sample', hideEmpty: true },
+    { key: 'unit', label: 'Unit', hideEmpty: true },
+    { key: 'failure_kind', label: 'Failure kind', hideEmpty: true },
+];
+
+function record(value: unknown): Record<string, unknown> | null {
+    return value != null && typeof value === 'object' && !Array.isArray(value)
+        ? value as Record<string, unknown>
+        : null;
+}
+
+export function extractMojosecDetails(metadata: Record<string, unknown>): {
+    summary: Record<string, unknown>;
+    evidence: Record<string, unknown>;
+} | null {
+    const mojosec = record(metadata.mojosec);
+    if (!mojosec) return null;
+    const { evidence: rawEvidence, ...summary } = mojosec;
+    return { summary, evidence: record(rawEvidence) ?? {} };
+}
+
+export function MojosecEventSection({ details }: {
+    details: NonNullable<ReturnType<typeof extractMojosecDetails>>;
+}) {
+    return <>
+        <Eyebrow>Detection and sensor</Eyebrow>
+        <KnownFieldsCard data={details.summary} known={MOJOSEC_SUMMARY_FIELDS} showRaw={false} emptyText="No MojoSec detection summary was recorded." />
+        <Eyebrow>Validated evidence</Eyebrow>
+        <KnownFieldsCard data={details.evidence} known={MOJOSEC_EVIDENCE_FIELDS} showRaw={false} emptyText="No projected evidence was recorded." />
+    </>;
+}
+
+function displayValue(value: unknown): string {
+    if (value == null || value === '') return '—';
+    if (typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean') return String(value);
+    try { return JSON.stringify(value); } catch { return String(value); }
+}
 
 function incidentId(value: unknown): number | null {
     if (typeof value === 'number') return value;
     if (value && typeof value === 'object' && typeof (value as { id?: unknown }).id === 'number') return (value as { id: number }).id;
     return null;
 }
+
+function prepareEventDetailRecord(rawEvent: EventRow): { rawEvent: EventRow; event: EventRow } {
+    return { rawEvent, event: sanitizeEventRow(rawEvent) };
+}
+
+/** Keep the authorized raw record isolated from every sanitized event cache. */
+function useRawEventDetail(id: number | null) {
+    return useQuery({
+        queryKey: [EventModel.endpoint, 'raw-one', id, { graph: 'detailed' }],
+        queryFn: async () => (await mojoCall(`${EventModel.endpoint}/${id!}`, { params: { graph: 'detailed' } })).data as EventRow,
+        enabled: id != null,
+    });
+}
+
 export function EventDetail({ id, onClose }: { id: number; onClose: () => void }) {
-    const query = useEventDetail(id);
+    const query = useRawEventDetail(id);
     if (query.isPending) return <div className="modal-pad dim">Loading event…</div>;
     if (!query.data || query.error) return <div className="modal-pad text-bad">{query.error?.message ?? 'Event not found'}</div>;
-    const event = query.data;
+    const { rawEvent, event } = prepareEventDetailRecord(query.data);
     const metadata = metadataOf(event);
+    const mojosec = extractMojosecDetails(metadata);
     const linkedIncident = incidentId(event.incident);
     const trace = first(metadata, 'stack_trace', 'traceback');
     const hasOssec = event.category.startsWith('ossec') || metadata.alert_id != null || metadata.logfile != null;
@@ -29,13 +168,16 @@ export function EventDetail({ id, onClose }: { id: number; onClose: () => void }
                 <FlatRow label="Model">{event.model_name ? `${event.model_name} #${event.model_id ?? '—'}` : '—'}</FlatRow>
                 <FlatRow label="Group ID">{event.group_id ?? 'Global'}</FlatRow>
             </> },
-            { key: 'source', label: 'Source', icon: 'bi-globe2', render: () => <><Eyebrow>Source and network</Eyebrow><FlatRow label="Source IP"><code>{event.source_ip || '—'}</code></FlatRow><FlatRow label="Hostname"><code>{event.hostname || '—'}</code></FlatRow><FlatRow label="Country">{String(event.country_code || metadata.country_code || '—')}</FlatRow><FlatRow label="Server">{String(metadata.server ?? '—')}</FlatRow></> },
+            { key: 'source', label: 'Source', icon: 'bi-globe2', render: () => <><Eyebrow>Source and network</Eyebrow><FlatRow label="Source IP"><code>{event.source_ip || '—'}</code></FlatRow><FlatRow label="Hostname"><code>{event.hostname || '—'}</code></FlatRow><FlatRow label="Country">{String(event.country_code || metadata.country_code || '—')}</FlatRow>{event.geo_ip != null && <FlatRow label="GeoIP">{displayValue(event.geo_ip)}</FlatRow>}<FlatRow label="Server">{String(metadata.server ?? '—')}</FlatRow></> },
             { key: 'request', label: 'Request', icon: 'bi-funnel', render: () => <RequestResponseForensics metadata={metadata} /> },
             ...(trace ? [{ key: 'trace', label: 'Stack trace', icon: 'bi-code-square', render: () => <TraceForensics metadata={metadata} /> }] : []),
             ...(hasOssec ? [{ key: 'ossec', label: 'OSSEC', icon: 'bi-shield-exclamation', render: () => <EvidenceCard metadata={metadata} /> }] : []),
+            ...(mojosec ? [{ key: 'mojosec', label: 'MojoSec', icon: 'bi-shield-lock', render: () => <MojosecEventSection details={mojosec} /> }] : []),
             ...(hasBouncer ? [{ key: 'bouncer', label: 'Bouncer', icon: 'bi-shield-shaded', render: () => <KnownFieldsCard data={metadata} showRaw={false} known={[{ key: 'decision', hideEmpty: true }, { key: 'risk_score', hideEmpty: true }, { key: 'page', hideEmpty: true }, { key: 'page_type', hideEmpty: true }, { key: 'muid', hideEmpty: true }, { key: 'duid', hideEmpty: true }, { key: 'triggered_signals', hideEmpty: true }]} /> }] : []),
             ...(hasPermissions ? [{ key: 'permissions', label: 'Auth evidence', icon: 'bi-key', render: () => <KnownFieldsCard data={metadata} showRaw={false} known={[{ key: 'permission_keys', hideEmpty: true }, { key: 'perms', hideEmpty: true }, { key: 'auth_result', hideEmpty: true }, { key: 'user_email', hideEmpty: true }]} /> }] : []),
             { key: 'metadata', label: 'Known fields', icon: 'bi-braces', render: () => <KnownFieldsCard data={metadata} known={[...INCIDENT_METADATA_FIELDS, { key: 'alert_id', hideEmpty: true }, { key: 'logfile', hideEmpty: true }, { key: 'error_code', hideEmpty: true }, { key: 'error_message', hideEmpty: true }]} showRaw={false} /> },
+            { divider: 'Raw' },
+            { key: 'raw', label: 'Raw data', icon: 'bi-filetype-json', render: () => <><Eyebrow>Complete API response</Eyebrow><p className="dim">The complete event record returned by Django, including all metadata.</p><JsonBlock value={rawEvent} label="Event API record" collapsible={false} /></> },
         ]}
         initialSection="overview"
         onClose={onClose}

package/src/admin/incidents/IncidentDetail.tsx

@@ -1,25 +1,194 @@
-import { useQueryClient } from '@tanstack/react-query';
-import { createIncidentHistoryAdapter, useCan, useMe } from '../../client/runtime';
-import { Badge, DetailView, Eyebrow, FlatRow, KnownFieldsCard, RecordFeed, StatusPanel, fmt, toast, type Tone } from '../../ui';
+import { useQuery, useQueryClient } from '@tanstack/react-query';
+import { createIncidentHistoryAdapter, mojoCall, useCan, useMe } from '../../client/runtime';
+import { Badge, DetailView, Eyebrow, FlatRow, JsonBlock, KnownFieldsCard, RecordFeed, StatusPanel, fmt, toast, type Tone } from '../../ui';
 import { SECURITY_MANAGE_PERMS } from '../security-permissions';
 import { AssistantContextLauncher } from '../assistant/launchers';
-import { EvidenceCard, INCIDENT_METADATA_FIELDS, RequestResponseForensics, TraceForensics, metadataOf } from './forensics';
-import { INCIDENT_LIFECYCLE, IncidentModel, showEventDetail, useIncidentDetail, useIncidentEvents } from './models';
-import { sanitizeIncidentHistoryRow, sanitizeSecurityText } from './sanitize';
+import { showGeoIpDossier, showGeoIpDossierForAddress } from '../security/geoip/GeoIpDossier';
+import { blockActive, blockExpired, countryFlag, threatTone, whitelistActive, whitelistExpired, type GeoLocatedIPRow } from '../security/geoip/models';
+import { EvidenceCard, INCIDENT_METADATA_FIELDS, RequestResponseForensics, TraceForensics, first, metadataOf } from './forensics';
+import { INCIDENT_LIFECYCLE, IncidentModel, showEventDetail, useIncidentEvents, type IncidentRow } from './models';
+import { sanitizeIncidentHistoryRow, sanitizeIncidentRow, sanitizeSecurityText } from './sanitize';
 
 function priorityTone(priority: number): Tone { return priority >= 8 ? 'danger' : priority >= 5 ? 'warning' : 'info'; }
 function statusTone(status: string): Tone { return ['resolved', 'closed'].includes(status) ? 'success' : ['new', 'open'].includes(status) ? 'danger' : status === 'investigating' ? 'warning' : 'muted'; }
 
+const DASH = <span className="dim-italic">—</span>;
+
+function asRecord(value: unknown): Record<string, unknown> {
+    return value != null && typeof value === 'object' && !Array.isArray(value)
+        ? value as Record<string, unknown> : {};
+}
+
+function scalar(value: unknown): string | null {
+    if (typeof value === 'string') return value.trim() ? value : null;
+    if (typeof value === 'number' && Number.isFinite(value)) return String(value);
+    return null;
+}
+
+function temporal(value: unknown): string | number | null {
+    if (typeof value === 'number' && Number.isFinite(value)) return value;
+    if (typeof value === 'string' && value.trim()) return value;
+    return null;
+}
+
+function display(value: unknown) {
+    return scalar(value) ?? DASH;
+}
+
+function Timestamp({ value, relative = true }: { value: unknown; relative?: boolean }) {
+    const time = temporal(value);
+    return time == null ? DASH : <>{fmt.datetime(time)}{relative && <span className="dim"> · {fmt.relative(time)}</span>}</>;
+}
+
+const SOURCE_FLAGS: readonly [string, keyof GeoLocatedIPRow][] = [
+    ['Tor', 'is_tor'], ['VPN', 'is_vpn'], ['Proxy', 'is_proxy'],
+    ['Cloud', 'is_cloud'], ['Datacenter', 'is_datacenter'], ['Mobile', 'is_mobile'],
+    ['Known attacker', 'is_known_attacker'], ['Known abuser', 'is_known_abuser'],
+];
+
+function IncidentSourceIntelligence({ incident, metadata }: { incident: IncidentRow; metadata: Record<string, unknown> }) {
+    const infoRecord = asRecord(incident.ip_info);
+    const info = infoRecord as Partial<GeoLocatedIPRow>;
+    const sourceIp = scalar(incident.source_ip)
+        ?? scalar(first(metadata, 'source_ip', 'request_ip'))
+        ?? scalar(info.ip_address);
+    const dossierId = Number.isSafeInteger(info.id) && Number(info.id) > 0 ? Number(info.id) : null;
+    const openDossier = dossierId != null
+        ? () => showGeoIpDossier(dossierId)
+        : sourceIp ? () => showGeoIpDossierForAddress(sourceIp) : null;
+
+    const enforcement = {
+        is_blocked: info.is_blocked === true,
+        blocked_until: temporal(info.blocked_until) as number | null,
+        is_whitelisted: info.is_whitelisted === true,
+        whitelisted_until: temporal(info.whitelisted_until) as number | null,
+    };
+    const blocked = blockActive(enforcement);
+    const whitelisted = whitelistActive(enforcement);
+    const level = scalar(info.threat_level)?.toLowerCase() ?? '';
+    const risk = typeof info.risk_score === 'number' ? info.risk_score : null;
+    const hasAssessment = ['threat_level', 'risk_score', 'is_threat', 'is_suspicious'].some((key) => key in infoRecord);
+    const hasEnforcement = ['is_blocked', 'is_whitelisted', 'blocked_at', 'blocked_until', 'whitelisted_until'].some((key) => key in infoRecord);
+    const hasFirewall = ['firewall_generation', 'firewall_pending', 'firewall_sync_error', 'firewall_observed_at'].some((key) => key in infoRecord);
+    const hasObservation = ['created', 'modified', 'last_seen', 'expires_at'].some((key) => key in infoRecord);
+    const context = [
+        ['Request IP', first(metadata, 'request_ip')],
+        ['Server', first(metadata, 'server')],
+        ['Protocol', first(metadata, 'http_protocol', 'protocol')],
+        ['Connection ID', first(metadata, 'connection_id')],
+        ['User agent', first(metadata, 'http_user_agent', 'user_agent')],
+    ] as const;
+    const contextRows = context.filter(([, value]) => scalar(value) != null);
+    const countryCode = scalar(info.country_code) ?? scalar(incident.country_code) ?? scalar(metadata.country_code);
+    const countryName = scalar(info.country_name) ?? scalar(metadata.country_name);
+    const flag = countryFlag(countryCode);
+    const place = [scalar(info.city) ?? scalar(metadata.city), scalar(info.region) ?? scalar(metadata.region), countryName ?? countryCode].filter(Boolean).join(', ');
+    const status = blocked
+        ? { tone: 'danger' as const, state: 'BLOCKED', headline: scalar(info.blocked_reason) ? `Blocked: ${scalar(info.blocked_reason)}` : 'Currently blocked' }
+        : whitelisted
+            ? { tone: 'success' as const, state: 'WHITELISTED', headline: scalar(info.whitelisted_reason) ? `Whitelisted: ${scalar(info.whitelisted_reason)}` : 'Currently whitelisted' }
+            : hasAssessment && (info.is_threat === true || ['high', 'critical'].includes(level))
+                ? { tone: 'danger' as const, state: 'ALLOWED · HIGH RISK', headline: `${level || 'high'} threat assessment` }
+                : hasAssessment && (info.is_suspicious === true || level === 'medium')
+                    ? { tone: 'warning' as const, state: 'ALLOWED · ELEVATED RISK', headline: 'Suspicious source signals detected' }
+                    : hasAssessment
+                        ? { tone: 'success' as const, state: 'ALLOWED', headline: 'No active threat signals' }
+                        : { tone: 'info' as const, state: 'SOURCE RECORDED', headline: 'No cached IP intelligence was attached' };
+
+    return <>
+        <StatusPanel
+            tone={status.tone}
+            state={status.state}
+            headline={status.headline}
+            meta={`${place || sourceIp || 'Unknown source'}${risk == null ? '' : ` · risk ${risk}/100`}`}
+            actions={openDossier && <button type="button" className="btn btn-compact" onClick={openDossier}><i className="bi bi-box-arrow-up-right" /> Open full IP dossier</button>}
+        />
+
+        <Eyebrow>Location &amp; network</Eyebrow>
+        <FlatRow label="IP address">{sourceIp ? (openDossier ? <button type="button" className="btn-link" onClick={openDossier}><code>{sourceIp}</code></button> : <code>{sourceIp}</code>) : DASH}</FlatRow>
+        <FlatRow label="Hostname"><code>{incident.hostname || '—'}</code></FlatRow>
+        <FlatRow label="Country">{countryCode || countryName ? <>{flag && <span className="geoip-flag">{flag}</span>}{countryName || countryCode}{countryCode && <code className="dim geoip-cc">{countryCode}</code>}</> : DASH}</FlatRow>
+        <FlatRow label="Region">{display(info.region ?? metadata.region)}{info.region_code && <code className="dim geoip-cc">{info.region_code}</code>}</FlatRow>
+        <FlatRow label="City / postal">{[scalar(info.city ?? metadata.city), scalar(info.postal_code)].filter(Boolean).join(' · ') || DASH}</FlatRow>
+        <FlatRow label="Timezone">{display(info.timezone ?? metadata.timezone)}</FlatRow>
+        <FlatRow label="Coordinates">{info.latitude != null && info.longitude != null ? <code>{info.latitude}, {info.longitude}</code> : DASH}</FlatRow>
+        <FlatRow label="Subnet"><code>{scalar(info.subnet) || '—'}</code></FlatRow>
+        <FlatRow label="ASN">{display(info.asn)}</FlatRow>
+        <FlatRow label="ASN organization">{display(info.asn_org)}</FlatRow>
+        <FlatRow label="ISP">{display(info.isp)}</FlatRow>
+        <FlatRow label="Connection">{[scalar(info.connection_type), scalar(info.mobile_carrier)].filter(Boolean).join(' · ') || DASH}</FlatRow>
+
+        {hasAssessment && <>
+            <Eyebrow>Risk &amp; reputation</Eyebrow>
+            <FlatRow label="Threat level"><Badge tone={threatTone(info.threat_level) as Tone}>{info.threat_level || 'none'}</Badge></FlatRow>
+            <FlatRow label="Risk score">{risk == null ? DASH : <strong>{risk}/100</strong>}</FlatRow>
+            <FlatRow label="Threat"><Badge tone={info.is_threat ? 'danger' : 'muted'}>{info.is_threat ? 'Yes' : 'No'}</Badge></FlatRow>
+            <FlatRow label="Suspicious"><Badge tone={info.is_suspicious ? 'warning' : 'muted'}>{info.is_suspicious ? 'Yes' : 'No'}</Badge></FlatRow>
+            <div className="netsec-flags">
+                {SOURCE_FLAGS.map(([label, key]) => {
+                    const active = info[key] === true;
+                    return <span key={label} className={`chip ${active ? 'chip-danger' : 'chip-muted'}`}><i className={`bi ${active ? 'bi-check-lg' : 'bi-dash'}`} /> {label}</span>;
+                })}
+            </div>
+        </>}
+
+        {hasEnforcement && <>
+            <Eyebrow>Enforcement</Eyebrow>
+            <FlatRow label="Effective state"><Badge tone={blocked ? 'danger' : whitelisted ? 'success' : 'muted'}>{blocked ? 'Blocked' : whitelisted ? 'Whitelisted' : blockExpired(enforcement) ? 'Block expired' : whitelistExpired(enforcement) ? 'Whitelist expired' : 'Allowed'}</Badge></FlatRow>
+            <FlatRow label="Blocked at"><Timestamp value={info.blocked_at} /></FlatRow>
+            <FlatRow label="Blocked until"><Timestamp value={info.blocked_until} relative={false} /></FlatRow>
+            <FlatRow label="Block reason">{display(info.blocked_reason)}</FlatRow>
+            <FlatRow label="Block count">{typeof info.block_count === 'number' ? info.block_count : DASH}</FlatRow>
+            <FlatRow label="Whitelist until"><Timestamp value={info.whitelisted_until} relative={false} /></FlatRow>
+            <FlatRow label="Whitelist reason">{display(info.whitelisted_reason)}</FlatRow>
+        </>}
+
+        {hasFirewall && <>
+            <Eyebrow>Firewall reconciliation</Eyebrow>
+            <FlatRow label="State"><Badge tone={info.firewall_pending ? 'warning' : info.firewall_sync_error ? 'danger' : 'success'}>{info.firewall_pending ? 'Pending' : info.firewall_sync_error ? 'Error' : 'In sync'}</Badge></FlatRow>
+            <FlatRow label="Generation">{typeof info.firewall_generation === 'number' ? info.firewall_generation : DASH}</FlatRow>
+            <FlatRow label="Observed"><Timestamp value={info.firewall_observed_at} /></FlatRow>
+            <FlatRow label="Sync error">{display(info.firewall_sync_error)}</FlatRow>
+        </>}
+
+        {hasObservation && <>
+            <Eyebrow>Observation</Eyebrow>
+            <FlatRow label="First recorded"><Timestamp value={info.created} /></FlatRow>
+            <FlatRow label="Modified"><Timestamp value={info.modified} /></FlatRow>
+            <FlatRow label="Last seen"><Timestamp value={info.last_seen} /></FlatRow>
+            <FlatRow label="Cache expires"><Timestamp value={info.expires_at} relative={false} /></FlatRow>
+        </>}
+
+        {contextRows.length > 0 && <>
+            <Eyebrow>Incident context</Eyebrow>
+            {contextRows.map(([label, value]) => <FlatRow key={label} label={label}>{label === 'Connection ID' || label === 'Request IP' ? <code>{scalar(value)}</code> : scalar(value)}</FlatRow>)}
+        </>}
+    </>;
+}
+
+function prepareIncidentDetailRecord(rawIncident: IncidentRow): { rawIncident: IncidentRow; incident: IncidentRow } {
+    return { rawIncident, incident: sanitizeIncidentRow(rawIncident) };
+}
+
+/** Keep the authorized raw record isolated from every sanitized incident cache. */
+function useRawIncidentDetail(id: number | null) {
+    return useQuery({
+        queryKey: [IncidentModel.endpoint, 'raw-one', id, { graph: 'detailed' }],
+        queryFn: async () => (await mojoCall(`${IncidentModel.endpoint}/${id!}`, { params: { graph: 'detailed' } })).data as IncidentRow,
+        enabled: id != null,
+    });
+}
+
 export function IncidentDetail({ id, onClose }: { id: number; onClose: () => void }) {
     const queryClient = useQueryClient();
-    const query = useIncidentDetail(id);
+    const query = useRawIncidentDetail(id);
     const events = useIncidentEvents(id);
     const save = IncidentModel.useSave();
     const { can: canManage } = useCan(SECURITY_MANAGE_PERMS);
     const { data: me } = useMe();
     if (query.isPending) return <div className="modal-pad dim">Loading incident…</div>;
     if (!query.data || query.error) return <div className="modal-pad text-bad">{query.error?.message ?? 'Incident not found'}</div>;
-    const incident = query.data;
+    const { rawIncident, incident } = prepareIncidentDetailRecord(query.data);
     const groupId = Number.isSafeInteger(incident.group_id) && Number(incident.group_id) > 0
         ? Number(incident.group_id) : null;
     const adapter = createIncidentHistoryAdapter(id, {
@@ -36,6 +205,7 @@ export function IncidentDetail({ id, onClose }: { id: number; onClose: () => voi
         } catch (error) { toast.error(error instanceof Error ? error.message : 'Status update failed'); }
     };
     const trace = metadata.stack_trace ?? metadata.traceback;
+    const hasSource = Boolean(scalar(incident.source_ip) || Object.keys(asRecord(incident.ip_info)).length || scalar(first(metadata, 'source_ip', 'request_ip')));
     return <DetailView
         icon="bi-shield-exclamation"
         title={incident.title || `Incident #${incident.id}`}
@@ -55,12 +225,15 @@ export function IncidentDetail({ id, onClose }: { id: number; onClose: () => voi
                 <FlatRow label="Hostname"><code>{incident.hostname || '—'}</code></FlatRow>
                 <FlatRow label="Model">{incident.model_name ? `${incident.model_name} #${incident.model_id ?? '—'}` : '—'}</FlatRow>
             </> },
+            ...(hasSource ? [{ key: 'source', label: 'Source', icon: 'bi-globe2', render: () => <IncidentSourceIntelligence incident={incident} metadata={metadata} /> }] : []),
             { key: 'evidence', label: 'Evidence', icon: 'bi-funnel', render: () => <EvidenceCard metadata={{ ...metadata, model_name: incident.model_name, model_id: incident.model_id }} /> },
             { key: 'events', label: 'Events', icon: 'bi-list-ul', render: () => events.isPending ? <p className="dim">Loading events…</p> : events.data?.rows.length ? <div className="incident-events-list">{events.data.rows.map((event) => <button type="button" className="incident-event-row" key={event.id} onClick={() => showEventDetail(event.id)}><Badge tone={event.level >= 8 ? 'danger' : event.level >= 4 ? 'warning' : 'muted'}>L{event.level}</Badge><span><strong>{event.title || event.category}</strong><small>{fmt.datetime(event.created)} · {event.details || 'No details'}</small></span></button>)}</div> : <p className="dim-italic">No events on this incident.</p> },
             { key: 'request', label: 'Request', icon: 'bi-globe2', render: () => <RequestResponseForensics metadata={metadata} /> },
             ...(trace ? [{ key: 'trace', label: 'Stack trace', icon: 'bi-code-square', render: () => <TraceForensics metadata={metadata} /> }] : []),
             { key: 'history', label: 'History', icon: 'bi-chat-left-text', render: () => <RecordFeed adapter={adapter} variant="compact" showInput={canManage} currentUserId={me?.id ?? null} placeholder="Add an incident note…" attachmentUpload={{ destination: groupId == null ? {} : { groupId, use: 'uploads' }, expectedGroupId: groupId }} /> },
             { key: 'metadata', label: 'Known fields', icon: 'bi-braces', render: () => <KnownFieldsCard data={metadata} known={[...INCIDENT_METADATA_FIELDS]} showRaw={false} emptyText="No curated forensic metadata." /> },
+            { divider: 'Raw' },
+            { key: 'raw', label: 'Raw data', icon: 'bi-filetype-json', render: () => <><Eyebrow>Complete API response</Eyebrow><p className="dim">The complete incident record returned by Django, including all metadata and IP information.</p><JsonBlock value={rawIncident} label="Incident API record" collapsible={false} /></> },
         ]}
         initialSection="overview"
         onClose={onClose}

package/src/admin/incidents/models.ts

@@ -18,7 +18,7 @@ export interface EventRow {
     source_ip: string | null; hostname: string | null; uid: number | null;
     country_code: string | null; title: string | null; details: string | null;
     model_name: string | null; model_id: number | null; metadata: Record<string, unknown>;
-    group_id: number | null; incident?: Relation; geo_ip?: Record<string, unknown> | null;
+    group_id: number | null; incident?: Relation; geo_ip?: string | Record<string, unknown> | null;
 }
 
 const COMMON = new Set(['start', 'size', 'sort', 'search', 'dr_field', 'dr_start', 'dr_end']);

package/src/admin/jobs/RunnerDetail.tsx

@@ -15,7 +15,9 @@
 //   · the `version` chip — the heartbeat payload has no version field.
 //   · trusted-HTML interpolation throughout — every slot here is a ReactNode.
 import { useState, type ReactNode } from 'react';
+import { downloadBlob, useCan } from '../../client/runtime';
 import {
+    ArmedButton,
     Badge,
     DetailView,
     Eyebrow,
@@ -23,13 +25,11 @@ import {
     JsonBlock,
     KnownFieldsCard,
     StatusPanel,
-    ArmedButton,
     fmt,
     modal,
     toast,
     type Tone,
 } from '../../ui';
-import { downloadBlob } from '../../client/runtime';
 import {
     BROADCAST_COMMANDS,
     broadcastCommand,
@@ -56,7 +56,6 @@ import {
     useRunnerJobLogs,
     useRunnerSysinfo,
 } from './queries';
-import { useCan } from '../../client/runtime';
 
 // ── Small presentational pieces ───────────────────────────────────────
 
@@ -439,6 +438,7 @@ export function RunnerDetail({ runner, onClose }: { runner: RunnerRow; onClose:
                 active: activeRows.length || null,
                 history: history.data?.count || null,
             }}
+            contextMenu={[{ label: 'Runner controls…', permissions: JOBS_MANAGE_PERMS, onSelect: () => void modal.open(close => <div className="modal-pad"><h2 className="modal-title">Runner controls</h2><ControlSection runner={runner} onClose={() => close(null)} /><div className="modal-actions"><button className="btn" onClick={() => close(null)}>Close</button></div></div>) }]}
             sections={[
                 {
                     key: 'overview', label: 'Overview', icon: 'bi-grid-1x2', render: () => (
@@ -558,11 +558,8 @@ export function RunnerDetail({ runner, onClose }: { runner: RunnerRow; onClose:
                         </>
                     ),
                 },
-                { divider: 'Control' },
-                {
-                    key: 'control', label: 'Control', icon: 'bi-power',
-                    render: () => <ControlSection runner={runner} onClose={onClose} />,
-                },
+
+
             ]}
             initialSection="overview"
             onClose={onClose}

package/src/admin/jobs/ScheduledTaskDetail.tsx

@@ -25,11 +25,10 @@
 //     tool `_tool_run_scheduled_task_now`. There is no REST route and no
 //     publish endpoint to synthesize one, so the control stays ABSENT rather
 //     than shipping disabled (wave-7a precedent). Tracked as django-mojo #1309.
-import type { ReactNode } from 'react';
 import { useQuery, useQueryClient } from '@tanstack/react-query';
+import type { ReactNode } from 'react';
 import { mojoList, useCan } from '../../client/runtime';
 import {
-    ArmedButton,
     Badge,
     DetailView,
     Eyebrow,
@@ -211,7 +210,7 @@ export function ScheduledTaskDetail({ id, onClose }: { id: string; onClose: () =
     const queryClient = useQueryClient();
     const query = ScheduledTaskModel.useOne(id);
     const save = ScheduledTaskModel.useSave();
-    const remove = ScheduledTaskModel.useDelete();
+
     const { can: canManage } = useCan(SCHEDULED_TASK_MANAGE_PERMS);
 
     if (query.isPending) return <div className="modal-pad dim">Loading scheduled task…</div>;
@@ -243,16 +242,7 @@ export function ScheduledTaskDetail({ id, onClose }: { id: string; onClose: () =
         }
     };
 
-    const destroy = async () => {
-        try {
-            await remove.mutateAsync({ id });
-            await invalidate();
-            toast.success(`Deleted ${task.name || 'scheduled task'}`);
-            onClose();
-        } catch (error) {
-            toast.error(error instanceof Error ? error.message : 'Delete failed');
-        }
-    };
+
 
     const schedule = formatSchedule(task);
     const stateTone: Tone = task.enabled ? 'success' : 'muted';
@@ -271,6 +261,7 @@ export function ScheduledTaskDetail({ id, onClose }: { id: string; onClose: () =
                 ...(task.run_once ? [{ icon: 'bi-1-circle', text: 'Run once', tone: 'info' as const }] : []),
                 { icon: 'bi-broadcast', text: task.channel, tone: 'muted' },
             ]}
+            active={canManage ? { value: task.enabled, disabled: save.isPending, onChange: next => void setEnabled(next) } : undefined}
             badges={{ overview: task.last_error ? <Badge tone="danger">error</Badge> : null }}
             menuContext={task}
             contextMenu={[
@@ -283,6 +274,7 @@ export function ScheduledTaskDetail({ id, onClose }: { id: string; onClose: () =
                     label: task.enabled ? 'Disable' : 'Enable',
                     icon: task.enabled ? 'bi-pause-circle' : 'bi-play-circle',
                     permissions: SCHEDULED_TASK_MANAGE_PERMS,
+                    disabled: save.isPending,
                     onSelect: () => { void setEnabled(!task.enabled); },
                 },
             ]}
@@ -348,66 +340,8 @@ export function ScheduledTaskDetail({ id, onClose }: { id: string; onClose: () =
                 },
                 { key: 'config', label: 'Configuration', icon: 'bi-sliders', render: () => <ConfigurationSection task={task} /> },
                 { key: 'results', label: 'Results', icon: 'bi-list-check', render: () => <ResultsSection taskId={id} /> },
-                { divider: 'Manage' },
-                {
-                    key: 'manage', label: 'Manage', icon: 'bi-gear', permissions: SCHEDULED_TASK_MANAGE_PERMS, render: () => (
-                        <>
-                            <Eyebrow>Operates on {task.name || 'this task'}</Eyebrow>
-                            <div className="jobs-op-row">
-                                <div className="jobs-op-label">
-                                    <i className={`bi ${task.enabled ? 'bi-pause-circle' : 'bi-play-circle'}`} />
-                                    {task.enabled ? 'Disable' : 'Enable'}
-                                </div>
-                                <div className="jobs-op-desc">
-                                    {task.enabled
-                                        ? 'The hourly dispatcher skips disabled tasks. Nothing already published is affected.'
-                                        : 'The hourly dispatcher will pick this task up again on its next matching hour.'}
-                                </div>
-                                <div className="jobs-op-action">
-                                    <button
-                                        type="button" className="btn btn-compact" disabled={!canManage || save.isPending}
-                                        onClick={() => void setEnabled(!task.enabled)}
-                                    >
-                                        {task.enabled ? 'Disable' : 'Enable'}
-                                    </button>
-                                </div>
-                            </div>
 
-                            <div className="jobs-op-row">
-                                <div className="jobs-op-label"><i className="bi bi-pencil" /> Edit</div>
-                                <div className="jobs-op-desc">
-                                    Change the schedule, notification channels and configuration. The task type is fixed
-                                    after creation.
-                                </div>
-                                <div className="jobs-op-action">
-                                    <button type="button" className="btn btn-compact" disabled={!canManage} onClick={() => void edit()}>
-                                        Edit task…
-                                    </button>
-                                </div>
-                            </div>
 
-                            <div className="danger-zone">
-                                <div className="jobs-op-row">
-                                    <div className="jobs-op-label"><i className="bi bi-trash" /> Delete</div>
-                                    <div className="jobs-op-desc">
-                                        Removes the task and cascades to every one of its execution results. Jobs already
-                                        published stay queued.
-                                    </div>
-                                    <div className="jobs-op-action">
-                                        <ArmedButton
-                                            className="btn-compact btn-danger-ghost"
-                                            label="Delete task"
-                                            armedLabel="Click again — the task and all its results are gone"
-                                            icon="bi-trash"
-                                            disabled={!canManage || remove.isPending}
-                                            onConfirm={destroy}
-                                        />
-                                    </div>
-                                </div>
-                            </div>
-                        </>
-                    ),
-                },
             ]}
             initialSection="overview"
             onClose={onClose}

package/src/admin/jobs/index.ts

@@ -14,7 +14,7 @@ export * from './RunnerDetail';
 export * from './sections/JobRunnersStrip';
 export * from './sections/JobChannelsPanel';
 export * from './sections/JobThroughputSection';
-export * from './sections/JobOperationsSection';
+export { JobOperationsSection } from './sections/JobOperationsSection';
 // Stage C — scheduled tasks (plan step 10).
 export * from './ScheduledTasksPage';
 export * from './ScheduledTaskDetail';