v0.5.9: El Torito boot detection + retroactive re-introspect; static SSO login button
Storage / boot detection - Add El Torito boot-catalog detection to ISO introspection. This is the authoritative "can this boot at all?" signal: any ISO with a boot catalog (BSDs, ESXi, firmware tools, custom spins) is bootable via iPXE sanboot; a data/appliance ISO (e.g. a VMware vCenter bundle) has none and is honestly flagged. Replaces the crude ">1.5 GB ⇒ unbootable" size guess. - Re-introspect stale LOCAL ISOs on startup via an introspection-revision gate (INTROSPECT_REV). ISOs uploaded by an older binary carried a frozen family/boot profile — most visibly a Windows 11 ISO tagged Unknown before the UDF/UTF-16 detection landed, which then showed "won't boot" forever. An upgrade now re-probes and fixes them in place; no delete-and-re-upload. - WebUI bootability() keys off family / kernel / el_torito / remote-source instead of the size heuristic; dashboard family counts now bucket Windows / Linux / other honestly instead of lumping everything non-Windows under "Linux". SSO login button - The "Sign in with …" button keyed off the auth-gated /api/sso, which 401s pre-auth — so the button only survived on a stale in-memory config and vanished instance-wide on any fresh login-page load. Ship a minimal, non-sensitive SSO descriptor (enabled + idp_name + idp_logo_url, no metadata/entity-ID) on the public /api/me; the login card reads that. The button is now static whenever SSO is usable. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
This commit is contained in:
Miles Ward
co-authored by
Claude Opus 4.8
Claude Opus 4.8
parent
cb51b8db75
commit
06695c3d77
+47
-21
@@ -165,17 +165,30 @@
|
||||
if (fam === 'windows_pe') {
|
||||
return { ok: true };
|
||||
}
|
||||
if (!iso.introspection.kernel_path) {
|
||||
// Not Windows and no Linux kernel/initrd detected. Small images can
|
||||
// still try the sanboot fallback; large ones almost certainly aren't
|
||||
// network-bootable installers (e.g. appliance bundles like VMware
|
||||
// VCSA) — flag them clearly instead of with a Linux-centric message.
|
||||
if (iso.size_bytes > 1.5 * 1024 * 1024 * 1024) {
|
||||
return { ok: false, reason: "not a recognized network-bootable installer (no Windows or Linux boot files found) — this image can't be PXE-booted" };
|
||||
}
|
||||
return { ok: true, warn: 'no kernel detected — sanboot fallback may not work' };
|
||||
// Linux with a detected kernel/initrd — direct kernel+initrd boot.
|
||||
if (iso.introspection.kernel_path) {
|
||||
return { ok: true };
|
||||
}
|
||||
return { ok: true };
|
||||
// v0.5.9: any other ISO that carries an El Torito boot catalog is
|
||||
// bootable via iPXE sanboot (emulated CD) — BSDs, ESXi, firmware
|
||||
// tools, custom Linux spins. This replaces the old "> 1.5 GB ⇒
|
||||
// unbootable" size guess with the authoritative on-disk boot signal,
|
||||
// so a large bootable ISO is no longer mislabeled and a Windows ISO
|
||||
// re-introspected on upgrade lights up correctly.
|
||||
if (iso.introspection.el_torito) {
|
||||
return { ok: true, warn: 'generic bootable ISO — boots via sanboot (emulated CD)' };
|
||||
}
|
||||
// Remote-share ISOs aren't introspected (no random access over the
|
||||
// network), so el_torito is unknown — assume bootable and let sanboot
|
||||
// try rather than cry wolf.
|
||||
const remote = iso.source && iso.source.kind && iso.source.kind !== 'local';
|
||||
if (remote) {
|
||||
return { ok: true, warn: 'remote ISO — not introspected; sanboot is attempted at boot' };
|
||||
}
|
||||
// Local ISO with no Windows/Linux boot files and no El Torito catalog:
|
||||
// a data/appliance image (e.g. a VMware vCenter bundle), not a bootable
|
||||
// installer.
|
||||
return { ok: false, reason: 'data/appliance ISO — no El Torito boot catalog and no Windows/Linux installer files, so it can’t be PXE-booted' };
|
||||
}
|
||||
|
||||
// v0.5.2: pretty label for an unattended file's detected kind.
|
||||
@@ -291,14 +304,23 @@
|
||||
el('div', {class: 'card'}, el('div', {class: 'stat'}, [
|
||||
el('div', {class: 'label'}, 'Images available'),
|
||||
el('div', {class: 'value'}, String(isos.length)),
|
||||
el('div', {class: 'trend'},
|
||||
isos.filter(i => i.introspection.family === 'windows_pe').length + ' Windows · ' +
|
||||
isos.filter(i => i.introspection.family !== 'windows_pe').length + ' Linux · ' +
|
||||
el('div', {class: 'trend'}, (() => {
|
||||
// v0.5.9: count families honestly. Anything that isn't a known
|
||||
// Linux family or Windows lands in "other" (data/appliance ISOs
|
||||
// like VMware VCSA, or as-yet-unclassified images) instead of
|
||||
// being lumped under "Linux".
|
||||
const LINUX = ['debian_ubuntu', 'rhel_fedora', 'opensuse', 'arch', 'alpine'];
|
||||
const win = isos.filter(i => i.introspection.family === 'windows_pe').length;
|
||||
const lin = isos.filter(i => LINUX.includes(i.introspection.family)).length;
|
||||
const other = isos.length - win - lin;
|
||||
// v0.4.67+v0.5.5: count all remote-share protocols. Label
|
||||
// generically since operators may use any mix of SMB/NFS/SFTP.
|
||||
((status.smb_share_reachable || 0) + (status.nfs_share_reachable || 0) + (status.sftp_share_reachable || 0)) +
|
||||
' remote share' +
|
||||
(((status.smb_share_reachable || 0) + (status.nfs_share_reachable || 0) + (status.sftp_share_reachable || 0)) === 1 ? '' : 's')),
|
||||
const remote = (status.smb_share_reachable || 0) + (status.nfs_share_reachable || 0) + (status.sftp_share_reachable || 0);
|
||||
const parts = [win + ' Windows', lin + ' Linux'];
|
||||
if (other > 0) parts.push(other + ' other');
|
||||
parts.push(remote + ' remote share' + (remote === 1 ? '' : 's'));
|
||||
return parts.join(' · ');
|
||||
})()),
|
||||
])),
|
||||
el('div', {class: 'card'}, el('div', {class: 'stat'}, [
|
||||
el('div', {class: 'label'}, 'Uptime'),
|
||||
@@ -2280,7 +2302,9 @@
|
||||
// own self-contained <form>; when SSO is enabled, a distinct
|
||||
// "Sign in with …" button sits below a divider — the credential
|
||||
// fields no longer double as the SSO trigger.
|
||||
const ssoLive = ssoConfig && ssoConfig.enabled && (ssoConfig.metadata_url || ssoConfig.metadata);
|
||||
// `enabled` from /api/me already means "usable" (enabled AND a metadata
|
||||
// source is configured), so the button only shows when SSO will work.
|
||||
const ssoLive = !!(ssoConfig && ssoConfig.enabled);
|
||||
const ssoBlock = ssoLive
|
||||
? el('div', {class:'sso-block'}, [
|
||||
el('div', {class:'auth-divider'}, el('span', {}, 'or')),
|
||||
@@ -2525,10 +2549,12 @@
|
||||
])));
|
||||
return;
|
||||
}
|
||||
// Preload the SSO config so the login card can offer the operator
|
||||
// an "Sign in with X" button when configured. Failure is harmless.
|
||||
try { ssoConfig = await fetch('/api/sso').then(r => r.ok ? r.json() : null); }
|
||||
catch { ssoConfig = null; }
|
||||
// v0.5.9: the login card's "Sign in with …" button keys off the SSO
|
||||
// descriptor that /api/me now carries (public, non-sensitive: enabled
|
||||
// + idp_name + idp_logo_url). It's available signed in or out, so the
|
||||
// button is static — it no longer relied on the auth-gated /api/sso,
|
||||
// which 401s pre-auth and made the button vanish on fresh login loads.
|
||||
ssoConfig = me.sso || null;
|
||||
|
||||
if (me.setup_required) {
|
||||
showAuthScreen('setup');
|
||||
|
||||
Reference in New Issue
Block a user