v0.5.3: dark-mode branding preview + unified button spacing

UI polish:
- Settings → Branding: each logo swatch now previews on a background
  matching where the mark lands (light page / dark page / dark PXE screen)
  regardless of the current page theme, so the Dark slot reads as dark
  even while viewing Settings in light mode.
- Site-wide button spacing: add one rule (`.card .body > button`) giving
  every primary card action button the same gap above it, and drop the
  ad-hoc per-button inline margins (14/16/6px) so the look is uniform.
  Fixes the Hosts → "Bind MAC to target" button butting against the form.

(Boot-menu highlight intentionally unchanged — a rotating-RGB highlight
isn't possible in iPXE's static single-draw menu; deferred to a future
custom-renderer effort.)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

.claude/settings.json

@@ -1,16 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "Bash(cargo check *)",
-      "Bash(cargo build *)",
-      "Bash(cargo clippy *)",
-      "Bash(cargo fmt *)",
-      "Bash(cargo tree *)",
-      "Bash(cargo doc *)",
-      "Bash(cargo test --workspace --lib)",
-      "Bash(cargo test --workspace)",
-      "Bash(cargo --version)",
-      "Bash(rustc --version)"
-    ]
-  }
-}

Cargo.toml

@@ -12,7 +12,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.5.0"
+version = "0.5.3"
 edition = "2021"
 rust-version = "1.95"
 license = "MIT OR Apache-2.0"
@@ -71,6 +71,20 @@ nfs3_types = "0.5"
 # to match reqwest and stay musl-static-friendly — no OpenSSL.
 lettre = { version = "0.11", default-features = false, features = ["smtp-transport", "tokio1-rustls-tls", "builder", "hostname"] }
 
+# v0.5.1: pure-Rust SAML 2.0 Service Provider. bergshamra does XML-DSig
+# verification + exclusive c14n with RustCrypto (no OpenSSL/xmlsec/libxml2
+# C deps), so the static musl binary stays OpenSSL-free — samael was
+# rejected precisely because it hard-requires OpenSSL. We build the thin
+# SP layer (AuthnRequest, metadata parse, SAMLResponse semantics) on top.
+bergshamra = "0.4"
+roxmltree = "0.21"
+quick-xml = "0.40"
+x509-parser = "0.18"
+# flate2 default backend is miniz_oxide (pure Rust) — do NOT enable the
+# zlib/zlib-ng C backends, which would break the musl-static build.
+flate2 = "1.1"
+base64 = "0.22"
+
 openpxe-core = { path = "crates/core" }
 openpxe-dhcp-proxy = { path = "crates/dhcp-proxy" }
 openpxe-tftp = { path = "crates/tftp" }

crates/core/Cargo.toml

@@ -25,5 +25,19 @@ tokio = { workspace = true, features = ["sync", "rt", "macros", "time"] }
 # for per-ISO boot passwords; just re-exported here.
 bcrypt.workspace = true
 
+# v0.5.1: pure-Rust SAML 2.0 SP. bergshamra = XML-DSig verify + exclusive
+# c14n (no OpenSSL/C). roxmltree/quick-xml parse + build SAML XML;
+# x509-parser pulls the IdP signing cert out of metadata; flate2+base64
+# encode the HTTP-Redirect binding's SAMLRequest.
+bergshamra.workspace = true
+roxmltree.workspace = true
+quick-xml.workspace = true
+x509-parser.workspace = true
+flate2.workspace = true
+base64.workspace = true
+
 [dev-dependencies]
 tempfile = "3.12"
+# v0.5.1: generate a throwaway self-signed signing cert/key so SAML
+# verification tests can produce genuinely signed SAMLResponses.
+rcgen = "0.13"

crates/core/src/branding.rs

@@ -1,11 +1,23 @@
 //! Operator-controlled branding overrides.
 //!
-//! The browser tab's logo (`/assets/logo.svg`) defaults to the bundled
-//! rainbow-horizon mark. Operators who deploy OpenPXE behind their own
-//! branding can upload a replacement that lives at
-//! `<work_dir>/branding/logo.<ext>` and is served in preference to the
-//! bundled SVG when present. Borrowed-from-FleetDM: tenant chrome, same
-//! product.
+//! v0.5.2 splits the single brand mark into **three independent slots**,
+//! FleetDM-style:
+//!
+//! * `light` — shown in the WebUI top-left and on the form-login page
+//!   when the active theme is light.
+//! * `dark` — same surfaces, when the active theme is dark.
+//! * `client` — the raster painted above the iPXE boot menu entries
+//!   (`/branding/pxe-logo`), i.e. what a PXE client sees on the screen.
+//!
+//! Each slot lives at `<work_dir>/branding/logo-<slot>.<ext>` and is
+//! served in preference to the bundled rainbow-horizon mark when present.
+//! Borrowed-from-FleetDM: tenant chrome, same product.
+//!
+//! Legacy continuity: a pre-v0.5.2 single `logo.<ext>` (recorded under
+//! the old `logo_filename`/`logo_mime` keys) is migrated on first load
+//! into both the `dark` and `client` slots — that preserves the previous
+//! behaviour (one mark fed both the dark WebUI and the PXE screen) until
+//! the operator uploads dedicated variants.
 //!
 //! Storage policy mirrors `HostBindings` / `BootLog`: in-memory cache is
 //! authoritative for the current process, disk is the source of truth on
@@ -35,27 +47,104 @@ pub const ALLOWED_LOGO_MIMES: &[&str] = &[
 /// puts a clear bound on memory + serialization cost.
 pub const MAX_LOGO_BYTES: usize = 2 * 1024 * 1024;
 
+/// Which branded surface a logo upload targets.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum LogoSlot {
+    /// WebUI + form-login page, light theme.
+    Light,
+    /// WebUI + form-login page, dark theme.
+    Dark,
+    /// iPXE boot-menu background seen by PXE clients.
+    Client,
+}
+
+impl LogoSlot {
+    #[must_use]
+    pub fn as_str(self) -> &'static str {
+        match self {
+            LogoSlot::Light => "light",
+            LogoSlot::Dark => "dark",
+            LogoSlot::Client => "client",
+        }
+    }
+
+    /// Parse a slot name from the URL path segment. Case-insensitive.
+    #[must_use]
+    pub fn parse(s: &str) -> Option<Self> {
+        match s.trim().to_ascii_lowercase().as_str() {
+            "light" => Some(LogoSlot::Light),
+            "dark" => Some(LogoSlot::Dark),
+            "client" => Some(LogoSlot::Client),
+            _ => None,
+        }
+    }
+}
+
+/// One brand-mark slot: a filename (relative to the branding dir) plus
+/// the MIME we cached at upload time so the HTTP layer can set the
+/// Content-Type without re-sniffing.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+struct Slot {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    filename: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    mime: Option<String>,
+}
+
+impl Slot {
+    fn clear_file(&mut self, dir: &Path) {
+        if let Some(name) = self.filename.take() {
+            let _ = std::fs::remove_file(dir.join(name));
+        }
+        self.mime = None;
+    }
+}
+
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 struct Inner {
-    /// File name (relative to the branding dir) for the active logo, if
-    /// any. Always under `<work_dir>/branding/`; never an absolute path
-    /// from the operator.
-    logo_filename: Option<String>,
-    /// MIME of the active logo, mirroring `logo_filename`. Cached here
-    /// so the HTTP layer can set Content-Type without re-sniffing.
-    logo_mime: Option<String>,
-    /// Monotonic counter bumped on every set/clear. Surfaces as a
-    /// cache-bust token (`/assets/logo.svg?r=<rev>`) so the browser
-    /// fetches the new bytes the moment the operator swaps the logo —
-    /// the app version alone can't do this since it doesn't change on
-    /// upload. Persisted so the token stays stable across restarts and
-    /// keeps climbing across multiple swaps.
+    #[serde(default)]
+    light: Slot,
+    #[serde(default)]
+    dark: Slot,
+    #[serde(default)]
+    client: Slot,
+    /// Monotonic counter bumped on every set/clear (any slot). Surfaces
+    /// as a cache-bust token (`/assets/logo.svg?r=<rev>`) so the browser
+    /// fetches the new bytes the moment the operator swaps a logo — the
+    /// app version alone can't do this since it doesn't change on upload.
+    /// Persisted so the token stays stable across restarts and keeps
+    /// climbing across multiple swaps.
     #[serde(default)]
     rev: u64,
+    // ── Legacy (pre-v0.5.2) single-logo keys ──────────────────────────
+    // Read on load for one-way migration into `dark` + `client`, then
+    // dropped from the persisted form (skip_serializing_if).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    logo_filename: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    logo_mime: Option<String>,
+}
+
+impl Inner {
+    fn slot(&self, slot: LogoSlot) -> &Slot {
+        match slot {
+            LogoSlot::Light => &self.light,
+            LogoSlot::Dark => &self.dark,
+            LogoSlot::Client => &self.client,
+        }
+    }
+
+    fn slot_mut(&mut self, slot: LogoSlot) -> &mut Slot {
+        match slot {
+            LogoSlot::Light => &mut self.light,
+            LogoSlot::Dark => &mut self.dark,
+            LogoSlot::Client => &mut self.client,
+        }
+    }
 }
 
 /// In-memory + on-disk override registry. Cheap to clone; locks are
-/// brief. The `branding.json` cache lives alongside the active asset
+/// brief. The `branding.json` cache lives alongside the active assets
 /// inside `<work_dir>/branding/`.
 #[derive(Debug, Clone)]
 pub struct BrandingStore {
@@ -67,7 +156,8 @@ pub struct BrandingStore {
 impl BrandingStore {
     /// Load (or initialise empty) from `<work_dir>/branding/`. Tolerates
     /// missing directories, partial state, and corrupt JSON — a bad
-    /// cache should never block PXE for the network.
+    /// cache should never block PXE for the network. Migrates a legacy
+    /// single-logo file into the dark + client slots.
     #[must_use]
     pub fn load_or_default(work_dir: &Path) -> Self {
         let dir = work_dir.join("branding");
@@ -75,25 +165,7 @@ impl BrandingStore {
         let mut inner = Inner::default();
         if let Ok(text) = std::fs::read_to_string(&path) {
             match serde_json::from_str::<Inner>(&text) {
-                Ok(parsed) => {
-                    // Sanity: if the JSON says we have a logo but the
-                    // file is gone, clear the in-memory pointer so
-                    // /assets/logo.svg falls back to the bundled SVG
-                    // rather than 500ing on a missing file.
-                    if let Some(name) = parsed.logo_filename.as_deref() {
-                        if dir.join(name).is_file() {
-                            inner = parsed;
-                        } else {
-                            tracing::warn!(
-                                target: "openpxe::branding",
-                                file = %name,
-                                "branding.json points at missing file; clearing"
-                            );
-                        }
-                    } else {
-                        inner = parsed;
-                    }
-                }
+                Ok(parsed) => inner = parsed,
                 Err(e) => {
                     tracing::warn!(
                         target: "openpxe::branding",
@@ -102,102 +174,242 @@ impl BrandingStore {
                 }
             }
         }
-        Self {
+        let store = Self {
             dir: Arc::new(dir),
             inner: Arc::new(RwLock::new(inner)),
-        }
+        };
+        store.migrate_legacy();
+        store.prune_missing();
+        store
     }
 
-    /// Absolute path to the active logo, if one is set and present on
-    /// disk. `None` means the HTTP layer should serve the bundled SVG.
-    #[must_use]
-    pub fn logo_path(&self) -> Option<PathBuf> {
+    /// One-way migration: a pre-v0.5.2 `logo.<ext>` becomes the dark +
+    /// client slots (the old single mark fed both the dark WebUI and the
+    /// PXE screen). Best-effort; failures leave the legacy file in place
+    /// rather than blocking startup.
+    fn migrate_legacy(&self) {
+        let (legacy_name, legacy_mime) = {
             let g = self.inner.read();
-        g.logo_filename.as_deref().map(|n| self.dir.join(n))
+            (g.logo_filename.clone(), g.logo_mime.clone())
+        };
+        let Some(name) = legacy_name else { return };
+        let src = self.dir.join(&name);
+        if !src.is_file() {
+            // Legacy pointer is stale — just drop it.
+            let mut g = self.inner.write();
+            g.logo_filename = None;
+            g.logo_mime = None;
+            drop(g);
+            self.persist();
+            return;
         }
-
-    /// MIME of the active logo, if any. The HTTP layer pairs this with
-    /// the bytes returned by [`Self::logo_path`].
-    #[must_use]
-    pub fn logo_mime(&self) -> Option<String> {
-        self.inner.read().logo_mime.clone()
+        let mime = legacy_mime.unwrap_or_else(|| "image/svg+xml".to_string());
+        let ext = ext_for_mime(&mime).unwrap_or("bin");
+        if let Ok(bytes) = std::fs::read(&src) {
+            // Seed dark + client only when those slots are still empty so
+            // a re-run (or a manual edit) never clobbers operator intent.
+            let needs_dark = self.inner.read().dark.filename.is_none();
+            let needs_client = self.inner.read().client.filename.is_none();
+            if needs_dark {
+                let _ = self.write_slot(LogoSlot::Dark, &mime, ext, &bytes);
             }
-
-    /// Replace the active logo. Returns the chosen on-disk filename so
-    /// the caller can echo it back in the API response. Old logos are
-    /// removed best-effort.
-    pub fn set_logo(&self, mime: &str, ext: &str, bytes: &[u8]) -> std::io::Result<String> {
-        std::fs::create_dir_all(self.dir.as_path())?;
-        // Single canonical filename per upload — overwriting the old one
-        // (after clearing it) keeps the directory tidy and avoids any
-        // path-traversal concern: the operator never supplies the name.
-        let safe_ext = sanitize_ext(ext);
-        let filename = format!("logo.{safe_ext}");
-        let final_path = self.dir.join(&filename);
-        // Atomic write: tmp -> rename. Guarantees the file is either
-        // entirely the old logo or entirely the new one.
-        let tmp = final_path.with_extension(format!("{safe_ext}.tmp"));
-        std::fs::write(&tmp, bytes)?;
-        std::fs::rename(&tmp, &final_path)?;
-        // Clean up any sibling logo.<otherext> so there's exactly one
-        // canonical file at any time.
-        if let Ok(entries) = std::fs::read_dir(self.dir.as_path()) {
-            for e in entries.flatten() {
-                let p = e.path();
-                let name = p
-                    .file_name()
-                    .and_then(|s| s.to_str())
-                    .unwrap_or("");
-                if name.starts_with("logo.") && name != filename {
-                    let _ = std::fs::remove_file(&p);
+            if needs_client {
+                let _ = self.write_slot(LogoSlot::Client, &mime, ext, &bytes);
             }
         }
-        }
-
+        let _ = std::fs::remove_file(&src);
         {
             let mut g = self.inner.write();
-            g.logo_filename = Some(filename.clone());
-            g.logo_mime = Some(mime.to_string());
-            g.rev = g.rev.wrapping_add(1);
+            g.logo_filename = None;
+            g.logo_mime = None;
         }
         self.persist();
         tracing::info!(
             target: "openpxe::branding",
-            file = %filename, mime = %mime, size = bytes.len(),
+            "migrated legacy single logo into dark + client slots"
+        );
+    }
+
+    /// Drop in-memory slot pointers whose backing file vanished from disk
+    /// so the HTTP layer falls back to the bundled mark instead of 500ing.
+    fn prune_missing(&self) {
+        let mut changed = false;
+        {
+            let mut g = self.inner.write();
+            for slot in [LogoSlot::Light, LogoSlot::Dark, LogoSlot::Client] {
+                let present = g
+                    .slot(slot)
+                    .filename
+                    .as_deref()
+                    .is_some_and(|n| self.dir.join(n).is_file());
+                if !present && g.slot(slot).filename.is_some() {
+                    g.slot_mut(slot).filename = None;
+                    g.slot_mut(slot).mime = None;
+                    changed = true;
+                }
+            }
+        }
+        if changed {
+            self.persist();
+        }
+    }
+
+    /// Absolute path to the logo for `slot`, if set and present on disk.
+    #[must_use]
+    pub fn slot_path(&self, slot: LogoSlot) -> Option<PathBuf> {
+        let g = self.inner.read();
+        g.slot(slot).filename.as_deref().map(|n| self.dir.join(n))
+    }
+
+    /// MIME of the logo for `slot`, if any.
+    #[must_use]
+    pub fn slot_mime(&self, slot: LogoSlot) -> Option<String> {
+        self.inner.read().slot(slot).mime.clone()
+    }
+
+    /// Resolve the WebUI logo for a theme, with fallback: light falls
+    /// back to dark and vice-versa, so a single uploaded variant still
+    /// shows on both themes. Returns `(path, mime)` or `None` (→ bundled).
+    #[must_use]
+    pub fn web_logo(&self, theme_is_light: bool) -> Option<(PathBuf, String)> {
+        let (primary, secondary) = if theme_is_light {
+            (LogoSlot::Light, LogoSlot::Dark)
+        } else {
+            (LogoSlot::Dark, LogoSlot::Light)
+        };
+        let g = self.inner.read();
+        let chosen = if g.slot(primary).filename.is_some() {
+            primary
+        } else {
+            secondary
+        };
+        let s = g.slot(chosen);
+        s.filename.as_deref().map(|n| {
+            (
+                self.dir.join(n),
+                s.mime
+                    .clone()
+                    .unwrap_or_else(|| "image/svg+xml".to_string()),
+            )
+        })
+    }
+
+    /// Resolve the PXE client logo (no theme fallback — the PXE screen
+    /// has a single mark). Returns `(path, mime)` or `None` (→ default
+    /// composed background).
+    #[must_use]
+    pub fn client_logo(&self) -> Option<(PathBuf, String)> {
+        let g = self.inner.read();
+        let s = &g.client;
+        s.filename.as_deref().map(|n| {
+            (
+                self.dir.join(n),
+                s.mime
+                    .clone()
+                    .unwrap_or_else(|| "application/octet-stream".to_string()),
+            )
+        })
+    }
+
+    /// Replace the logo for `slot`. Returns the chosen on-disk filename so
+    /// the caller can echo it back in the API response.
+    pub fn set_logo(
+        &self,
+        slot: LogoSlot,
+        mime: &str,
+        ext: &str,
+        bytes: &[u8],
+    ) -> std::io::Result<String> {
+        let filename = self.write_slot(slot, mime, ext, bytes)?;
+        self.persist();
+        tracing::info!(
+            target: "openpxe::branding",
+            slot = slot.as_str(), file = %filename, mime = %mime, size = bytes.len(),
             "custom logo installed"
         );
         Ok(filename)
     }
 
-    /// Drop the override and return to the bundled SVG.
-    pub fn clear_logo(&self) -> std::io::Result<()> {
-        let removed = {
-            let mut g = self.inner.write();
-            let removed = g.logo_filename.take();
-            g.logo_mime = None;
-            g.rev = g.rev.wrapping_add(1);
-            removed
-        };
-        if let Some(name) = removed {
-            let p = self.dir.join(&name);
+    /// Write the bytes for a slot and update the in-memory pointer + rev,
+    /// without persisting (the caller decides when to flush). Cleans up
+    /// any sibling `logo-<slot>.*` so there's exactly one file per slot.
+    fn write_slot(
+        &self,
+        slot: LogoSlot,
+        mime: &str,
+        ext: &str,
+        bytes: &[u8],
+    ) -> std::io::Result<String> {
+        std::fs::create_dir_all(self.dir.as_path())?;
+        let safe_ext = sanitize_ext(ext);
+        let stem = format!("logo-{}", slot.as_str());
+        let filename = format!("{stem}.{safe_ext}");
+        let final_path = self.dir.join(&filename);
+        // Atomic write: tmp -> rename.
+        let tmp = final_path.with_extension(format!("{safe_ext}.tmp"));
+        std::fs::write(&tmp, bytes)?;
+        std::fs::rename(&tmp, &final_path)?;
+        // Clean up any sibling `logo-<slot>.<otherext>`.
+        if let Ok(entries) = std::fs::read_dir(self.dir.as_path()) {
+            for e in entries.flatten() {
+                let p = e.path();
+                let name = p.file_name().and_then(|s| s.to_str()).unwrap_or("");
+                if name.starts_with(&format!("{stem}.")) && name != filename {
                     let _ = std::fs::remove_file(&p);
-            tracing::info!(target: "openpxe::branding", file = %name, "custom logo cleared");
+                }
+            }
+        }
+        let mut g = self.inner.write();
+        let s = g.slot_mut(slot);
+        s.filename = Some(filename.clone());
+        s.mime = Some(mime.to_string());
+        g.rev = g.rev.wrapping_add(1);
+        Ok(filename)
+    }
+
+    /// Drop the override for `slot` and return to the bundled / default.
+    pub fn clear_logo(&self, slot: LogoSlot) -> std::io::Result<()> {
+        {
+            let mut g = self.inner.write();
+            let dir = self.dir.as_path();
+            g.slot_mut(slot).clear_file(dir);
+            g.rev = g.rev.wrapping_add(1);
         }
         self.persist();
+        tracing::info!(target: "openpxe::branding", slot = slot.as_str(), "custom logo cleared");
         Ok(())
     }
 
-    /// Convenience: true if a custom logo is configured. Surfaces on
-    /// `/api/status` so the WebUI can show "Custom logo: yes" without
-    /// fetching the asset itself.
+    /// True if a custom logo is configured for `slot`.
     #[must_use]
-    pub fn has_logo(&self) -> bool {
-        self.inner.read().logo_filename.is_some()
+    pub fn has_logo(&self, slot: LogoSlot) -> bool {
+        self.inner.read().slot(slot).filename.is_some()
     }
 
-    /// Cache-bust token for the logo asset URL. Changes on every
+    /// True if either WebUI theme slot has a custom logo — drives the
+    /// FleetDM-style full-width brand block (and the `has-custom-logo`
+    /// class) on the sidebar + login page.
+    #[must_use]
+    pub fn has_any_web_logo(&self) -> bool {
+        let g = self.inner.read();
+        g.light.filename.is_some() || g.dark.filename.is_some()
+    }
+
+    /// Presence triple `(light, dark, client)` for the `/api/me` and
+    /// `/api/status` bootstrap payloads.
+    #[must_use]
+    pub fn presence(&self) -> (bool, bool, bool) {
+        let g = self.inner.read();
+        (
+            g.light.filename.is_some(),
+            g.dark.filename.is_some(),
+            g.client.filename.is_some(),
+        )
+    }
+
+    /// Cache-bust token for the logo asset URLs. Changes on every
     /// set/clear so `/assets/logo.svg?r=<rev>` resolves to a fresh URL
-    /// whenever the operator swaps the brand mark. Stable otherwise.
+    /// whenever the operator swaps a brand mark. Stable otherwise.
     #[must_use]
     pub fn logo_rev(&self) -> u64 {
         self.inner.read().rev
@@ -267,47 +479,87 @@ mod tests {
     fn empty_after_load_when_no_branding_dir() {
         let dir = tempdir().unwrap();
         let b = BrandingStore::load_or_default(dir.path());
-        assert!(!b.has_logo());
-        assert!(b.logo_path().is_none());
-        assert!(b.logo_mime().is_none());
+        assert!(!b.has_logo(LogoSlot::Light));
+        assert!(!b.has_logo(LogoSlot::Dark));
+        assert!(!b.has_logo(LogoSlot::Client));
+        assert!(b.web_logo(false).is_none());
+        assert!(b.client_logo().is_none());
+        assert!(!b.has_any_web_logo());
     }
 
     #[test]
     fn set_clear_round_trip_persists() {
         let dir = tempdir().unwrap();
         let b = BrandingStore::load_or_default(dir.path());
-        let name = b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake").unwrap();
-        assert_eq!(name, "logo.png");
-        assert!(b.has_logo());
-        assert_eq!(b.logo_mime().as_deref(), Some("image/png"));
-        let p = b.logo_path().unwrap();
+        let name = b
+            .set_logo(LogoSlot::Dark, "image/png", "png", b"\x89PNG\r\n\x1a\nfake")
+            .unwrap();
+        assert_eq!(name, "logo-dark.png");
+        assert!(b.has_logo(LogoSlot::Dark));
+        assert_eq!(b.slot_mime(LogoSlot::Dark).as_deref(), Some("image/png"));
+        let (p, _) = b.web_logo(false).unwrap();
         assert!(p.is_file());
 
         // Re-open and confirm the override survives a restart.
         drop(b);
         let b2 = BrandingStore::load_or_default(dir.path());
-        assert!(b2.has_logo());
-        assert_eq!(b2.logo_mime().as_deref(), Some("image/png"));
+        assert!(b2.has_logo(LogoSlot::Dark));
+        assert_eq!(b2.slot_mime(LogoSlot::Dark).as_deref(), Some("image/png"));
 
         // Clear; the file goes away and has_logo flips off.
-        b2.clear_logo().unwrap();
-        assert!(!b2.has_logo());
+        b2.clear_logo(LogoSlot::Dark).unwrap();
+        assert!(!b2.has_logo(LogoSlot::Dark));
         assert!(!p.exists());
     }
 
     #[test]
-    fn replacing_logo_removes_old_extension_sibling() {
-        // PNG then SVG; only the SVG should remain on disk.
+    fn web_logo_falls_back_across_themes() {
         let dir = tempdir().unwrap();
         let b = BrandingStore::load_or_default(dir.path());
-        b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake").unwrap();
-        b.set_logo("image/svg+xml", "svg", br#"<svg xmlns="http://www.w3.org/2000/svg"/>"#).unwrap();
+        // Only dark uploaded — light theme falls back to it.
+        b.set_logo(LogoSlot::Dark, "image/png", "png", b"dark")
+            .unwrap();
+        let (p_light, _) = b.web_logo(true).expect("light falls back to dark");
+        assert!(p_light.ends_with("logo-dark.png"));
+        // Upload a distinct light — now light theme uses its own.
+        b.set_logo(LogoSlot::Light, "image/png", "png", b"light")
+            .unwrap();
+        let (p_light2, _) = b.web_logo(true).unwrap();
+        assert!(p_light2.ends_with("logo-light.png"));
+        // Client is independent and still unset.
+        assert!(b.client_logo().is_none());
+    }
+
+    #[test]
+    fn replacing_slot_removes_old_extension_sibling() {
+        let dir = tempdir().unwrap();
+        let b = BrandingStore::load_or_default(dir.path());
+        b.set_logo(
+            LogoSlot::Client,
+            "image/png",
+            "png",
+            b"\x89PNG\r\n\x1a\nfake",
+        )
+        .unwrap();
+        b.set_logo(
+            LogoSlot::Client,
+            "image/svg+xml",
+            "svg",
+            br#"<svg xmlns="http://www.w3.org/2000/svg"/>"#,
+        )
+        .unwrap();
         let entries: Vec<_> = std::fs::read_dir(dir.path().join("branding"))
             .unwrap()
             .filter_map(|e| e.ok().map(|e| e.file_name().to_string_lossy().into_owned()))
             .collect();
-        assert!(entries.iter().any(|n| n == "logo.svg"), "got {entries:?}");
-        assert!(!entries.iter().any(|n| n == "logo.png"), "stale PNG left over: {entries:?}");
+        assert!(
+            entries.iter().any(|n| n == "logo-client.svg"),
+            "got {entries:?}"
+        );
+        assert!(
+            !entries.iter().any(|n| n == "logo-client.png"),
+            "stale PNG left over: {entries:?}"
+        );
     }
 
     #[test]
@@ -315,54 +567,92 @@ mod tests {
         let dir = tempdir().unwrap();
         let b = BrandingStore::load_or_default(dir.path());
         assert_eq!(b.logo_rev(), 0);
-        b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake").unwrap();
+        b.set_logo(LogoSlot::Light, "image/png", "png", b"a")
+            .unwrap();
         assert_eq!(b.logo_rev(), 1);
-        b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake2").unwrap();
+        b.set_logo(LogoSlot::Dark, "image/png", "png", b"b")
+            .unwrap();
         assert_eq!(b.logo_rev(), 2);
-        b.clear_logo().unwrap();
+        b.clear_logo(LogoSlot::Light).unwrap();
         assert_eq!(b.logo_rev(), 3);
-        // Survives a restart.
         drop(b);
         let b2 = BrandingStore::load_or_default(dir.path());
         assert_eq!(b2.logo_rev(), 3);
     }
 
+    #[test]
+    fn legacy_single_logo_migrates_to_dark_and_client() {
+        // A pre-v0.5.2 branding.json + logo.png migrates on load.
+        let dir = tempdir().unwrap();
+        let brand_dir = dir.path().join("branding");
+        std::fs::create_dir_all(&brand_dir).unwrap();
+        std::fs::write(brand_dir.join("logo.png"), b"\x89PNG\r\n\x1a\nlegacy").unwrap();
+        // Hand-write the old shape (logo_filename/logo_mime, no slots).
+        std::fs::write(
+            brand_dir.join("branding.json"),
+            br#"{"logo_filename":"logo.png","logo_mime":"image/png","rev":4}"#,
+        )
+        .unwrap();
+        let b = BrandingStore::load_or_default(dir.path());
+        assert!(b.has_logo(LogoSlot::Dark), "dark seeded from legacy");
+        assert!(b.has_logo(LogoSlot::Client), "client seeded from legacy");
+        assert!(!b.has_logo(LogoSlot::Light), "light stays empty");
+        // The old logo.png is gone; per-slot files exist.
+        assert!(!brand_dir.join("logo.png").exists());
+        assert!(brand_dir.join("logo-dark.png").is_file());
+        assert!(brand_dir.join("logo-client.png").is_file());
+        // rev carried over from the legacy file and advanced as the two
+        // slots were seeded (each write bumps it), so it never regresses.
+        let migrated_rev = b.logo_rev();
+        assert!(
+            migrated_rev >= 4,
+            "rev should not regress below legacy: {migrated_rev}"
+        );
+        // And the migration is sticky across a restart (no re-migrate, no
+        // further rev churn).
+        drop(b);
+        let b2 = BrandingStore::load_or_default(dir.path());
+        assert!(b2.has_logo(LogoSlot::Dark));
+        assert!(b2.has_logo(LogoSlot::Client));
+        assert!(!b2.has_logo(LogoSlot::Light));
+        assert_eq!(b2.logo_rev(), migrated_rev, "restart must not re-migrate");
+    }
+
     #[test]
     fn sanitize_ext_strips_separators_and_path_chars() {
         assert_eq!(sanitize_ext("svg"), "svg");
-        // Path separators and non-alphanumerics filter out, leaving just
-        // letters. The remaining "etcpasswd" exceeds the 5-char cap so
-        // it collapses to `bin` rather than producing `etcpa`.
         assert_eq!(sanitize_ext("../etc/passwd"), "bin");
-        // Short alphanumeric strip-through stays itself.
         assert_eq!(sanitize_ext("../svg"), "svg");
         assert_eq!(sanitize_ext(""), "bin");
         assert_eq!(sanitize_ext("PNG"), "png");
-        // Anything past five chars is suspicious — collapse to `bin`.
         assert_eq!(sanitize_ext("svgvvvv"), "bin");
     }
 
     #[test]
     fn missing_file_referenced_by_json_resolves_to_empty() {
-        // If the operator nukes the file out from under the JSON cache,
-        // we should silently fall back to no-override rather than
-        // hanging on to a bogus path.
         let dir = tempdir().unwrap();
         let brand_dir = dir.path().join("branding");
         std::fs::create_dir_all(&brand_dir).unwrap();
-        // Hand-write a branding.json claiming logo.png exists.
-        let inner = Inner {
-            logo_filename: Some("logo.png".into()),
-            logo_mime: Some("image/png".into()),
-            rev: 0,
-        };
+        // branding.json claims a dark slot whose file doesn't exist.
         std::fs::write(
             brand_dir.join("branding.json"),
-            serde_json::to_vec_pretty(&inner).unwrap(),
+            br#"{"dark":{"filename":"logo-dark.png","mime":"image/png"},"rev":1}"#,
         )
         .unwrap();
         let b = BrandingStore::load_or_default(dir.path());
-        assert!(!b.has_logo(), "should fall back when referenced file is missing");
+        assert!(
+            !b.has_logo(LogoSlot::Dark),
+            "should fall back when referenced file is missing"
+        );
+    }
+
+    #[test]
+    fn slot_parse_round_trips() {
+        assert_eq!(LogoSlot::parse("light"), Some(LogoSlot::Light));
+        assert_eq!(LogoSlot::parse("DARK"), Some(LogoSlot::Dark));
+        assert_eq!(LogoSlot::parse(" client "), Some(LogoSlot::Client));
+        assert_eq!(LogoSlot::parse("nope"), None);
+        assert_eq!(LogoSlot::Light.as_str(), "light");
     }
 
     #[test]

crates/core/src/config.rs

@@ -74,6 +74,11 @@ pub struct Paths {
     /// Only used when `settings.windows_enabled = true`. Defaults to
     /// `/var/lib/openpxe/smb` in the container image.
     pub smb_dir: PathBuf,
+    /// v0.5.2: directory holding uploaded unattended-install answer files
+    /// (Kickstart / Preseed / Autoinstall / Windows answer files). Kept
+    /// separate from `iso_dir` so answer files never appear in the ISO
+    /// listing or the PXE menu. Defaults to `/var/lib/openpxe/unattended`.
+    pub unattended_dir: PathBuf,
 }
 
 impl Default for ServerConfig {
@@ -109,6 +114,7 @@ impl Default for Paths {
             ipxe_dir: PathBuf::from("/usr/share/openpxe/ipxe"),
             wimboot_path: None,
             smb_dir: PathBuf::from("/var/lib/openpxe/smb"),
+            unattended_dir: PathBuf::from("/var/lib/openpxe/unattended"),
         }
     }
 }

crates/core/src/host_bindings.rs

@@ -21,6 +21,8 @@ use std::path::PathBuf;
 use std::sync::Arc;
 use time::OffsetDateTime;
 
+use crate::profile::DeployProfile;
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct HostBinding {
     /// Lowercase, colon-separated MAC (e.g. `aa:bb:cc:dd:ee:ff`). The
@@ -35,6 +37,11 @@ pub struct HostBinding {
     /// `"rack-3 spine"`). Empty if unset.
     #[serde(default)]
     pub label: String,
+    /// v0.5.2: optional unattended-install hints (auto hostname / IP /
+    /// answer-file id). Flattened into the binding JSON so pre-v0.5.2
+    /// `hosts.json` files (which lack these keys) still deserialize.
+    #[serde(default, flatten)]
+    pub profile: DeployProfile,
     #[serde(with = "time::serde::rfc3339")]
     pub created_at: OffsetDateTime,
     #[serde(with = "time::serde::rfc3339")]
@@ -94,20 +101,31 @@ impl HostBindings {
     }
 
     /// Insert or update. Returns the resulting binding (with timestamps).
-    pub fn upsert(&self, mac: &str, target: &str, label: &str) -> HostBinding {
+    /// The `profile` carries optional unattended-install hints (v0.5.2);
+    /// pass `DeployProfile::default()` for a plain pin.
+    pub fn upsert(
+        &self,
+        mac: &str,
+        target: &str,
+        label: &str,
+        profile: DeployProfile,
+    ) -> HostBinding {
         let key = normalize_mac(mac);
         let now = OffsetDateTime::now_utc();
+        let profile = profile.normalized();
         let binding = {
             let mut g = self.inner.write();
             let entry = g.by_mac.entry(key.clone()).or_insert_with(|| HostBinding {
                 mac: key.clone(),
                 target: target.to_string(),
                 label: label.to_string(),
+                profile: profile.clone(),
                 created_at: now,
                 updated_at: now,
             });
             entry.target = target.to_string();
             entry.label = label.to_string();
+            entry.profile = profile.clone();
             entry.updated_at = now;
             entry.clone()
         };
@@ -179,6 +197,10 @@ mod tests {
     use super::*;
     use tempfile::tempdir;
 
+    fn np() -> DeployProfile {
+        DeployProfile::default()
+    }
+
     #[test]
     fn normalize_handles_case_and_dashes() {
         assert_eq!(normalize_mac("AA:BB:CC:DD:EE:FF"), "aa:bb:cc:dd:ee:ff");
@@ -191,7 +213,12 @@ mod tests {
         let dir = tempdir().unwrap();
         let h = HostBindings::load_or_default(dir.path());
         assert!(h.is_empty());
-        h.upsert("AA:BB:CC:00:00:01", "ubuntu-24-04-linux", "rack-3 spine");
+        h.upsert(
+            "AA:BB:CC:00:00:01",
+            "ubuntu-24-04-linux",
+            "rack-3 spine",
+            np(),
+        );
         let found = h.lookup("aa-bb-cc-00-00-01").expect("lookup");
         assert_eq!(found.target, "ubuntu-24-04-linux");
         assert_eq!(found.label, "rack-3 spine");
@@ -202,8 +229,8 @@ mod tests {
     fn upsert_replaces_existing_target() {
         let dir = tempdir().unwrap();
         let h = HostBindings::load_or_default(dir.path());
-        h.upsert("aa:bb:cc:00:00:01", "old-target", "label1");
-        h.upsert("aa:bb:cc:00:00:01", "new-target", "label2");
+        h.upsert("aa:bb:cc:00:00:01", "old-target", "label1", np());
+        h.upsert("aa:bb:cc:00:00:01", "new-target", "label2", np());
         assert_eq!(h.len(), 1);
         let b = h.lookup("aa:bb:cc:00:00:01").unwrap();
         assert_eq!(b.target, "new-target");
@@ -214,7 +241,7 @@ mod tests {
     fn remove_works_and_reports_outcome() {
         let dir = tempdir().unwrap();
         let h = HostBindings::load_or_default(dir.path());
-        h.upsert("aa:bb:cc:00:00:01", "x", "");
+        h.upsert("aa:bb:cc:00:00:01", "x", "", np());
         assert!(h.remove("AA:BB:CC:00:00:01"));
         assert!(!h.remove("aa:bb:cc:00:00:01")); // already gone
         assert!(h.is_empty());
@@ -224,11 +251,44 @@ mod tests {
     fn round_trip_persists_to_disk() {
         let dir = tempdir().unwrap();
         let h = HostBindings::load_or_default(dir.path());
-        h.upsert("aa:bb:cc:00:00:01", "ubuntu-linux", "rack-3");
-        h.upsert("aa:bb:cc:00:00:02", "_local", "tom-laptop");
+        h.upsert("aa:bb:cc:00:00:01", "ubuntu-linux", "rack-3", np());
+        h.upsert("aa:bb:cc:00:00:02", "_local", "tom-laptop", np());
         drop(h);
         let h2 = HostBindings::load_or_default(dir.path());
         assert_eq!(h2.len(), 2);
         assert_eq!(h2.lookup("aa:bb:cc:00:00:02").unwrap().target, "_local");
     }
+
+    #[test]
+    fn profile_round_trips_to_disk() {
+        let dir = tempdir().unwrap();
+        let h = HostBindings::load_or_default(dir.path());
+        let prof = DeployProfile {
+            auto_hostname: Some("node-7".into()),
+            auto_ip: Some("10.0.0.7".into()),
+            unattended_file: Some("ubuntu-ks".into()),
+        };
+        h.upsert("aa:bb:cc:00:00:09", "ubuntu-linux", "lab", prof);
+        drop(h);
+        let h2 = HostBindings::load_or_default(dir.path());
+        let b = h2.lookup("aa:bb:cc:00:00:09").unwrap();
+        assert_eq!(b.profile.auto_hostname.as_deref(), Some("node-7"));
+        assert_eq!(b.profile.auto_ip.as_deref(), Some("10.0.0.7"));
+        assert_eq!(b.profile.unattended_file.as_deref(), Some("ubuntu-ks"));
+    }
+
+    #[test]
+    fn legacy_hosts_json_without_profile_still_loads() {
+        // A pre-v0.5.2 hosts.json has no profile keys at all.
+        let dir = tempdir().unwrap();
+        std::fs::write(
+            dir.path().join("hosts.json"),
+            br#"[{"mac":"aa:bb:cc:00:00:01","target":"_local","label":"old","created_at":"2024-01-01T00:00:00Z","updated_at":"2024-01-01T00:00:00Z"}]"#,
+        )
+        .unwrap();
+        let h = HostBindings::load_or_default(dir.path());
+        let b = h.lookup("aa:bb:cc:00:00:01").unwrap();
+        assert_eq!(b.target, "_local");
+        assert!(b.profile.is_empty());
+    }
 }

crates/core/src/lib.rs

@@ -13,7 +13,9 @@ pub mod host_bindings;
 pub mod log_bus;
 pub mod metrics;
 pub mod notify;
+pub mod profile;
 pub mod queue;
+pub mod saml;
 pub mod settings;
 pub mod sso;
 pub mod wol;
@@ -21,14 +23,16 @@ pub mod wol;
 pub use arch::{ClientArch, FirmwareClass};
 pub use auth::{AdminAccount, AdminPublic, AdminStore};
 pub use boot_log::{BootEvent, BootLog};
-pub use branding::{ext_for_mime, BrandingStore, ALLOWED_LOGO_MIMES, MAX_LOGO_BYTES};
+pub use branding::{ext_for_mime, BrandingStore, LogoSlot, ALLOWED_LOGO_MIMES, MAX_LOGO_BYTES};
 pub use client::{ClientEvent, ClientRegistry, ClientSnapshot};
-pub use sso::{SsoConfig, SsoStore};
 pub use config::{Config, DhcpMode, NetworkConfig, Paths, ServerConfig};
 pub use error::{Error, Result};
 pub use host_bindings::{normalize_mac, HostBinding, HostBindings};
 pub use log_bus::{LogBus, LogBusLayer, LogLine};
 pub use metrics::{HttpRoute, Metrics};
 pub use notify::{NotifyConfig, NotifyKind, NotifyStore};
+pub use profile::DeployProfile;
 pub use queue::{DeploymentQueue, QueueEntry};
+pub use saml::{IdpMetadata, SamlError, SpParams, VerifiedPrincipal, VerifiedResponse};
 pub use settings::{Settings, SettingsStore, TimeoutAction};
+pub use sso::{SsoConfig, SsoStore};

crates/core/src/profile.rs

@@ -0,0 +1,122 @@
+//! Per-host deployment profile.
+//!
+//! v0.5.2: a small, optional bundle of "what should this machine do when
+//! it images" attached to either a pinned host binding ([`crate::HostBinding`])
+//! or a queued device ([`crate::QueueEntry`]). All three fields are
+//! optional and independent:
+//!
+//! * `auto_hostname` — substituted into the served unattended answer file
+//!   (`{{HOSTNAME}}`) so the installer sets the machine name.
+//! * `auto_ip` — substituted as `{{IP}}`. OpenPXE is a DHCP **proxy** and
+//!   does not hand out leases, so this is applied by the installer as a
+//!   static-network directive inside the answer file, not by DHCP.
+//! * `unattended_file` — the id of an uploaded file in the unattended
+//!   store (Kickstart / Preseed / Autoinstall / Windows answer file). When
+//!   set, the boot chain injects the appropriate kernel argument so the
+//!   install runs unattended.
+
+use serde::{Deserialize, Serialize};
+
+/// Optional deployment hints carried on a host pin or a queue entry.
+///
+/// The fields are flattened into `HostBinding` / `QueueEntry` on the wire
+/// (so existing JSON stays compatible via `#[serde(default)]`); this type
+/// is the in-code bundle the boot chain consumes.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct DeployProfile {
+    /// Hostname to set on the imaged machine (`{{HOSTNAME}}`). Empty/None
+    /// leaves the installer default.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub auto_hostname: Option<String>,
+    /// Static IPv4/IPv6 the installer should configure (`{{IP}}`). Stored
+    /// as a free-form string — validated lightly at the HTTP layer.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub auto_ip: Option<String>,
+    /// Id of an uploaded file in the unattended store. Empty/None means
+    /// "no unattended install — boot interactively".
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub unattended_file: Option<String>,
+}
+
+/// Cap on the stored hostname / IP strings — generous for any real value
+/// but bounds what an operator can stuff into the JSON.
+pub const MAX_PROFILE_FIELD_LEN: usize = 255;
+
+impl DeployProfile {
+    /// True when nothing is set — lets call sites skip work entirely.
+    #[must_use]
+    pub fn is_empty(&self) -> bool {
+        self.auto_hostname.is_none() && self.auto_ip.is_none() && self.unattended_file.is_none()
+    }
+
+    /// True when an unattended file is selected (drives boot-chain injection).
+    #[must_use]
+    pub fn has_unattended(&self) -> bool {
+        self.unattended_file
+            .as_deref()
+            .is_some_and(|s| !s.trim().is_empty())
+    }
+
+    /// Normalise: trim every field and collapse empty strings to `None`
+    /// so persisted JSON never carries `""` for an unset value.
+    #[must_use]
+    pub fn normalized(mut self) -> Self {
+        fn clean(v: Option<String>) -> Option<String> {
+            v.map(|s| s.trim().to_string())
+                .filter(|s| !s.is_empty())
+                .map(|s| s.chars().take(MAX_PROFILE_FIELD_LEN).collect())
+        }
+        self.auto_hostname = clean(self.auto_hostname);
+        self.auto_ip = clean(self.auto_ip);
+        self.unattended_file = clean(self.unattended_file);
+        self
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn empty_profile_is_empty() {
+        assert!(DeployProfile::default().is_empty());
+        assert!(!DeployProfile::default().has_unattended());
+    }
+
+    #[test]
+    fn normalize_trims_and_nulls_empty() {
+        let p = DeployProfile {
+            auto_hostname: Some("  node-7  ".into()),
+            auto_ip: Some("   ".into()),
+            unattended_file: Some(String::new()),
+        }
+        .normalized();
+        assert_eq!(p.auto_hostname.as_deref(), Some("node-7"));
+        assert_eq!(p.auto_ip, None);
+        assert_eq!(p.unattended_file, None);
+        assert!(!p.is_empty());
+    }
+
+    #[test]
+    fn has_unattended_detects_real_id() {
+        let p = DeployProfile {
+            unattended_file: Some("ubuntu-ks".into()),
+            ..Default::default()
+        };
+        assert!(p.has_unattended());
+    }
+
+    #[test]
+    fn long_field_is_capped() {
+        let long = "a".repeat(1000);
+        let p = DeployProfile {
+            auto_hostname: Some(long),
+            ..Default::default()
+        }
+        .normalized();
+        assert_eq!(
+            p.auto_hostname.as_deref().map(str::len),
+            Some(MAX_PROFILE_FIELD_LEN)
+        );
+    }
+}

crates/core/src/queue.rs

@@ -21,6 +21,7 @@ use time::OffsetDateTime;
 use tokio::sync::Notify;
 use uuid::Uuid;
 
+use crate::profile::DeployProfile;
 use crate::ClientArch;
 
 /// Per-client queue state visible to the WebUI.
@@ -37,6 +38,11 @@ pub struct QueueEntry {
     #[serde(with = "time::serde::rfc3339")]
     pub last_poll_at: OffsetDateTime,
     pub assigned_target: Option<String>,
+    /// v0.5.2: optional per-device deployment profile set via the queue
+    /// "Profile" button (auto hostname / IP / unattended file). Flattened
+    /// so the JSON stays flat alongside the other queue fields.
+    #[serde(default, flatten)]
+    pub profile: DeployProfile,
 }
 
 #[derive(Debug)]
@@ -49,6 +55,7 @@ struct QueueEntryInner {
     joined_at: OffsetDateTime,
     last_poll_at: OffsetDateTime,
     assigned_target: Option<String>,
+    profile: DeployProfile,
     /// Broadcast primitive that wakes the long-poll as soon as an
     /// assignment lands — no polling on our side, no sleep-loops.
     notify: Arc<Notify>,
@@ -65,6 +72,7 @@ impl QueueEntryInner {
             joined_at: self.joined_at,
             last_poll_at: self.last_poll_at,
             assigned_target: self.assigned_target.clone(),
+            profile: self.profile.clone(),
         }
     }
 }
@@ -110,6 +118,7 @@ impl DeploymentQueue {
             joined_at: now,
             last_poll_at: now,
             assigned_target: None,
+            profile: DeployProfile::default(),
             notify: Arc::new(Notify::new()),
         };
         let snap = inner.snapshot();
@@ -133,6 +142,29 @@ impl DeploymentQueue {
         Some(g.snapshot())
     }
 
+    /// Operator sets (or clears) the deployment profile for a queued
+    /// device via the WebUI "Profile" button. Returns the updated
+    /// snapshot, or `None` if the entry has since been released.
+    pub fn set_profile(&self, entry_id: &str, profile: DeployProfile) -> Option<QueueEntry> {
+        let mut guard = self.inner.write();
+        let g = guard.get_mut(entry_id)?;
+        g.profile = profile.normalized();
+        Some(g.snapshot())
+    }
+
+    /// Look up the deployment profile for a queued MAC, if any. Used by
+    /// the boot chain to inject an unattended file / template the
+    /// hostname + IP when an assigned device chains to its target.
+    #[must_use]
+    pub fn profile_for_mac(&self, mac: &str) -> Option<DeployProfile> {
+        let guard = self.inner.read();
+        guard
+            .values()
+            .find(|g| g.mac == mac)
+            .map(|g| g.profile.clone())
+            .filter(|p| !p.is_empty())
+    }
+
     /// Operator assigns an ISO entry (boot_entry id) to one or more clients.
     /// Returns the number of queue entries that were updated. Entries not in the
     /// queue are silently skipped.

crates/core/src/saml/authn_request.rs

@@ -0,0 +1,188 @@
+//! AuthnRequest construction + HTTP-Redirect binding encoding.
+//!
+//! For SP-initiated login we build an `<AuthnRequest>`, then encode it for the
+//! HTTP-Redirect binding: raw DEFLATE (RFC 1951) → base64 → percent-encode,
+//! appended as the `SAMLRequest` query parameter. AuthnRequests are sent
+//! unsigned in this release (the IdP must not require client signatures).
+
+use std::fmt::Write as _;
+use std::io::Write as _;
+
+use base64::Engine;
+use flate2::write::DeflateEncoder;
+use flate2::Compression;
+use time::format_description::well_known::Rfc3339;
+use time::OffsetDateTime;
+
+use super::{SamlError, SpParams};
+
+const NS_PROTOCOL: &str = "urn:oasis:names:tc:SAML:2.0:protocol";
+const NS_ASSERTION: &str = "urn:oasis:names:tc:SAML:2.0:assertion";
+const NAMEID_EMAIL: &str = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress";
+const BINDING_POST: &str = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST";
+
+/// A built AuthnRequest, ready to redirect the browser to the IdP.
+#[derive(Debug, Clone)]
+pub struct AuthnRequest {
+    /// The request `ID` — the caller records this so the matching response's
+    /// `InResponseTo` can be correlated (replay/CSRF protection).
+    pub id: String,
+    /// The full IdP URL to 302 the browser to (includes `SAMLRequest` and,
+    /// when supplied, `RelayState`).
+    pub location: String,
+}
+
+/// Build an AuthnRequest targeting `idp_sso_url` and encode it for the
+/// HTTP-Redirect binding. `relay_state`, if given, round-trips back to us via
+/// the response (we use it to send the operator to their intended page).
+pub fn build(
+    sp: &SpParams,
+    idp_sso_url: &str,
+    relay_state: Option<&str>,
+) -> Result<AuthnRequest, SamlError> {
+    let id = format!("_{}", uuid::Uuid::new_v4().simple());
+    let issue_instant = OffsetDateTime::now_utc()
+        .replace_nanosecond(0)
+        .unwrap_or_else(|_| OffsetDateTime::now_utc())
+        .format(&Rfc3339)
+        .map_err(|e| SamlError::Timestamp(e.to_string()))?;
+
+    let xml = format!(
+        r#"<samlp:AuthnRequest xmlns:samlp="{NS_PROTOCOL}" xmlns:saml="{NS_ASSERTION}" ID="{id}" Version="2.0" IssueInstant="{instant}" Destination="{dest}" ProtocolBinding="{BINDING_POST}" AssertionConsumerServiceURL="{acs}"><saml:Issuer>{issuer}</saml:Issuer><samlp:NameIDPolicy Format="{NAMEID_EMAIL}" AllowCreate="true"/></samlp:AuthnRequest>"#,
+        instant = issue_instant,
+        dest = xml_escape(idp_sso_url),
+        acs = xml_escape(&sp.acs_url),
+        issuer = xml_escape(&sp.entity_id),
+    );
+
+    let encoded = deflate_base64(&xml)?;
+
+    let sep = if idp_sso_url.contains('?') { '&' } else { '?' };
+    let mut location = format!("{idp_sso_url}{sep}SAMLRequest={}", pct_encode(&encoded));
+    if let Some(rs) = relay_state {
+        location.push_str("&RelayState=");
+        location.push_str(&pct_encode(rs));
+    }
+
+    Ok(AuthnRequest { id, location })
+}
+
+/// Raw-DEFLATE then base64 — the HTTP-Redirect binding's `SAMLRequest` payload.
+fn deflate_base64(xml: &str) -> Result<String, SamlError> {
+    let mut enc = DeflateEncoder::new(Vec::new(), Compression::default());
+    enc.write_all(xml.as_bytes())
+        .and_then(|()| enc.try_finish())
+        .map_err(|e| SamlError::Xml(format!("deflate: {e}")))?;
+    let compressed = enc
+        .finish()
+        .map_err(|e| SamlError::Xml(format!("deflate: {e}")))?;
+    Ok(base64::engine::general_purpose::STANDARD.encode(compressed))
+}
+
+/// Percent-encode a query-string component (RFC 3986 unreserved set passes
+/// through; everything else is `%XX`).
+fn pct_encode(s: &str) -> String {
+    let mut out = String::with_capacity(s.len() * 3);
+    for b in s.bytes() {
+        match b {
+            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => {
+                out.push(b as char);
+            }
+            _ => {
+                let _ = write!(out, "%{b:02X}");
+            }
+        }
+    }
+    out
+}
+
+fn xml_escape(s: &str) -> String {
+    let mut out = String::with_capacity(s.len());
+    for c in s.chars() {
+        match c {
+            '&' => out.push_str("&amp;"),
+            '<' => out.push_str("&lt;"),
+            '>' => out.push_str("&gt;"),
+            '"' => out.push_str("&quot;"),
+            '\'' => out.push_str("&apos;"),
+            _ => out.push(c),
+        }
+    }
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use flate2::read::DeflateDecoder;
+    use std::io::Read;
+
+    fn sp() -> SpParams {
+        SpParams {
+            entity_id: "https://pxe.example.com".into(),
+            acs_url: "https://pxe.example.com/api/sso/acs".into(),
+        }
+    }
+
+    fn pct_decode(s: &str) -> Vec<u8> {
+        let bytes = s.as_bytes();
+        let mut out = Vec::with_capacity(bytes.len());
+        let mut i = 0;
+        while i < bytes.len() {
+            if bytes[i] == b'%' && i + 2 < bytes.len() {
+                let hi = (bytes[i + 1] as char).to_digit(16).unwrap();
+                let lo = (bytes[i + 2] as char).to_digit(16).unwrap();
+                out.push((hi * 16 + lo) as u8);
+                i += 3;
+            } else {
+                out.push(bytes[i]);
+                i += 1;
+            }
+        }
+        out
+    }
+
+    #[test]
+    fn id_is_ncname_and_location_has_request() {
+        let req = build(&sp(), "https://idp.example.com/sso", Some("/dashboard")).unwrap();
+        assert!(req.id.starts_with('_'));
+        assert!(req
+            .location
+            .starts_with("https://idp.example.com/sso?SAMLRequest="));
+        assert!(req.location.contains("&RelayState=%2Fdashboard"));
+    }
+
+    #[test]
+    fn redirect_payload_round_trips_to_our_authn_request() {
+        let req = build(&sp(), "https://idp.example.com/sso", None).unwrap();
+        // Pull SAMLRequest value out of the query string.
+        let q = req.location.split("SAMLRequest=").nth(1).unwrap();
+        let val = q.split('&').next().unwrap();
+        let compressed = base64::engine::general_purpose::STANDARD
+            .decode(pct_decode(val))
+            .unwrap();
+        let mut inflate = DeflateDecoder::new(&compressed[..]);
+        let mut xml = String::new();
+        inflate.read_to_string(&mut xml).unwrap();
+
+        let doc = roxmltree::Document::parse(&xml).unwrap();
+        let root = doc.root_element();
+        assert_eq!(root.tag_name().name(), "AuthnRequest");
+        assert_eq!(root.attribute("ID").unwrap(), req.id);
+        assert_eq!(
+            root.attribute("AssertionConsumerServiceURL").unwrap(),
+            "https://pxe.example.com/api/sso/acs"
+        );
+        let issuer = root
+            .descendants()
+            .find(|n| n.tag_name().name() == "Issuer")
+            .unwrap();
+        assert_eq!(issuer.text().unwrap(), "https://pxe.example.com");
+    }
+
+    #[test]
+    fn existing_query_uses_ampersand_separator() {
+        let req = build(&sp(), "https://idp.example.com/sso?foo=bar", None).unwrap();
+        assert!(req.location.contains("?foo=bar&SAMLRequest="));
+    }
+}

crates/core/src/saml/metadata.rs

@@ -0,0 +1,241 @@
+//! IdP metadata parsing + SP metadata generation.
+//!
+//! We parse only what the SP flow needs: the IdP Entity ID, its
+//! `SingleSignOnService` endpoints (HTTP-Redirect / HTTP-POST), and the
+//! X.509 signing certificate(s). Everything else in the document is ignored.
+
+use base64::Engine;
+
+use super::{SamlError, SpParams};
+
+/// SAML 2.0 binding URIs.
+pub const BINDING_REDIRECT: &str = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect";
+pub const BINDING_POST: &str = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST";
+
+/// The subset of an IdP's `EntityDescriptor` the SP flow consumes.
+#[derive(Debug, Clone)]
+pub struct IdpMetadata {
+    /// The IdP's Entity ID — we require incoming assertions to be issued by it.
+    pub entity_id: String,
+    /// SSO endpoint for the HTTP-Redirect binding (where we send AuthnRequests).
+    pub sso_redirect_url: Option<String>,
+    /// SSO endpoint for the HTTP-POST binding (fallback target).
+    pub sso_post_url: Option<String>,
+    /// DER-encoded X.509 signing certificate(s). More than one appears during
+    /// key rotation; verification tries each.
+    pub signing_certs_der: Vec<Vec<u8>>,
+}
+
+impl IdpMetadata {
+    /// Parse an IdP `EntityDescriptor` document.
+    ///
+    /// Robust to namespace-prefix variation (matches on local element names),
+    /// since IdPs disagree on prefixes (`md:`, `ns0:`, default, …).
+    pub fn parse(xml: &str) -> Result<Self, SamlError> {
+        let doc = roxmltree::Document::parse(xml).map_err(|e| SamlError::Xml(e.to_string()))?;
+        let root = doc.root_element();
+
+        // The signing IDP descriptor. Some metadata wraps multiple
+        // descriptors (AA, SP) in one document; we want IDPSSODescriptor.
+        let idp_desc = root
+            .descendants()
+            .find(|n| n.is_element() && n.tag_name().name() == "IDPSSODescriptor")
+            .ok_or_else(|| SamlError::Metadata("IDPSSODescriptor".into()))?;
+
+        // Entity ID lives on the EntityDescriptor (root, or an ancestor of the
+        // IDPSSODescriptor when several are nested).
+        let entity_id = idp_desc
+            .ancestors()
+            .find_map(|n| {
+                if n.tag_name().name() == "EntityDescriptor" {
+                    n.attribute("entityID")
+                } else {
+                    None
+                }
+            })
+            .or_else(|| root.attribute("entityID"))
+            .map(str::to_owned)
+            .ok_or_else(|| SamlError::Metadata("entityID".into()))?;
+
+        let mut sso_redirect_url = None;
+        let mut sso_post_url = None;
+        for sso in idp_desc
+            .children()
+            .filter(|n| n.is_element() && n.tag_name().name() == "SingleSignOnService")
+        {
+            let binding = sso.attribute("Binding").unwrap_or("");
+            let location = sso.attribute("Location").map(str::to_owned);
+            match binding {
+                BINDING_REDIRECT if sso_redirect_url.is_none() => sso_redirect_url = location,
+                BINDING_POST if sso_post_url.is_none() => sso_post_url = location,
+                _ => {}
+            }
+        }
+
+        // Signing certs: KeyDescriptor with use="signing" or no use attribute
+        // (a bare KeyDescriptor is valid for both signing and encryption).
+        let mut signing_certs_der = Vec::new();
+        for kd in idp_desc
+            .children()
+            .filter(|n| n.is_element() && n.tag_name().name() == "KeyDescriptor")
+        {
+            match kd.attribute("use") {
+                Some("signing") | None => {}
+                Some(_) => continue, // encryption-only key — skip
+            }
+            for cert_node in kd
+                .descendants()
+                .filter(|n| n.is_element() && n.tag_name().name() == "X509Certificate")
+            {
+                let b64: String = node_text(&cert_node)
+                    .chars()
+                    .filter(|c| !c.is_whitespace())
+                    .collect();
+                if b64.is_empty() {
+                    continue;
+                }
+                let der = base64::engine::general_purpose::STANDARD
+                    .decode(b64.as_bytes())
+                    .map_err(|e| SamlError::Base64(e.to_string()))?;
+                signing_certs_der.push(der);
+            }
+        }
+
+        if signing_certs_der.is_empty() {
+            return Err(SamlError::NoSigningCert);
+        }
+
+        Ok(Self {
+            entity_id,
+            sso_redirect_url,
+            sso_post_url,
+            signing_certs_der,
+        })
+    }
+
+    /// Preferred SSO destination for an outbound AuthnRequest: HTTP-Redirect
+    /// if advertised, otherwise HTTP-POST.
+    pub fn sso_destination(&self) -> Option<&str> {
+        self.sso_redirect_url
+            .as_deref()
+            .or(self.sso_post_url.as_deref())
+    }
+}
+
+/// Build our SP `EntityDescriptor` XML so an IdP admin can import OpenPXE as a
+/// relying party. Advertises the ACS URL (HTTP-POST binding) and an emailAddress
+/// NameID format — matching what the response path expects.
+pub fn build_sp_metadata(sp: &SpParams) -> String {
+    let entity = xml_escape(&sp.entity_id);
+    let acs = xml_escape(&sp.acs_url);
+    format!(
+        r#"<?xml version="1.0" encoding="UTF-8"?>
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="{entity}">
+  <SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
+    <AssertionConsumerService Binding="{BINDING_POST}" Location="{acs}" index="0" isDefault="true"/>
+  </SPSSODescriptor>
+</EntityDescriptor>
+"#
+    )
+}
+
+/// Collect the concatenated text of an element's direct text children.
+fn node_text(n: &roxmltree::Node<'_, '_>) -> String {
+    n.children()
+        .filter(roxmltree::Node::is_text)
+        .filter_map(|c| c.text())
+        .collect()
+}
+
+/// Minimal XML attribute/text escaping for the values we interpolate.
+fn xml_escape(s: &str) -> String {
+    let mut out = String::with_capacity(s.len());
+    for c in s.chars() {
+        match c {
+            '&' => out.push_str("&amp;"),
+            '<' => out.push_str("&lt;"),
+            '>' => out.push_str("&gt;"),
+            '"' => out.push_str("&quot;"),
+            '\'' => out.push_str("&apos;"),
+            _ => out.push(c),
+        }
+    }
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    // A trimmed-down Keycloak-style IdP descriptor (cert body is a stand-in;
+    // signing tests build real certs in the parent module's tests).
+    const SAMPLE: &str = r#"<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
+        xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
+        entityID="https://idp.example.com/realms/fleet">
+      <md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+        <md:KeyDescriptor use="signing">
+          <ds:KeyInfo><ds:X509Data><ds:X509Certificate>
+            QUJDREVG
+          </ds:X509Certificate></ds:X509Data></ds:KeyInfo>
+        </md:KeyDescriptor>
+        <md:KeyDescriptor use="encryption">
+          <ds:KeyInfo><ds:X509Data><ds:X509Certificate>WlpaWg==</ds:X509Certificate></ds:X509Data></ds:KeyInfo>
+        </md:KeyDescriptor>
+        <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
+            Location="https://idp.example.com/realms/fleet/protocol/saml"/>
+        <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
+            Location="https://idp.example.com/realms/fleet/protocol/saml"/>
+      </md:IDPSSODescriptor>
+    </md:EntityDescriptor>"#;
+
+    #[test]
+    fn parses_entity_sso_and_signing_cert() {
+        let m = IdpMetadata::parse(SAMPLE).unwrap();
+        assert_eq!(m.entity_id, "https://idp.example.com/realms/fleet");
+        assert_eq!(
+            m.sso_redirect_url.as_deref(),
+            Some("https://idp.example.com/realms/fleet/protocol/saml")
+        );
+        assert!(m.sso_post_url.is_some());
+        // Only the signing KeyDescriptor's cert is collected (ABCDEF), not the
+        // encryption one (ZZZZ).
+        assert_eq!(m.signing_certs_der.len(), 1);
+        assert_eq!(m.signing_certs_der[0], b"ABCDEF");
+    }
+
+    #[test]
+    fn missing_signing_cert_is_rejected() {
+        let xml = r#"<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="x">
+            <IDPSSODescriptor>
+              <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://x/sso"/>
+            </IDPSSODescriptor></EntityDescriptor>"#;
+        assert!(matches!(
+            IdpMetadata::parse(xml),
+            Err(SamlError::NoSigningCert)
+        ));
+    }
+
+    #[test]
+    fn missing_idp_descriptor_is_rejected() {
+        let xml = r#"<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="x"></EntityDescriptor>"#;
+        assert!(matches!(
+            IdpMetadata::parse(xml),
+            Err(SamlError::Metadata(_))
+        ));
+    }
+
+    #[test]
+    fn sp_metadata_contains_entity_and_acs() {
+        let sp = SpParams {
+            entity_id: "https://pxe.example.com".into(),
+            acs_url: "https://pxe.example.com/api/sso/acs".into(),
+        };
+        let xml = build_sp_metadata(&sp);
+        assert!(xml.contains(r#"entityID="https://pxe.example.com""#));
+        assert!(xml.contains("https://pxe.example.com/api/sso/acs"));
+        assert!(xml.contains(BINDING_POST));
+        // Must be well-formed.
+        roxmltree::Document::parse(&xml).unwrap();
+    }
+}

crates/core/src/saml/mod.rs

@@ -0,0 +1,92 @@
+//! Pure-Rust SAML 2.0 Service Provider (v0.5.1).
+//!
+//! This module implements the SP half of a SAML Web-Browser-SSO profile:
+//!
+//! * [`metadata`] — parse the IdP's `EntityDescriptor` (SSO URLs + signing
+//!   certificates) and build *our* SP metadata for the IdP admin to import.
+//! * [`authn_request`] — build an `AuthnRequest` and encode it for the
+//!   HTTP-Redirect binding.
+//! * [`response`] — decode a `SAMLResponse`, **verify its XML signature**
+//!   against the IdP's pinned certificate (via the pure-Rust `bergshamra`
+//!   crate — no OpenSSL/libxml2/xmlsec, so the static musl binary stays
+//!   C-free), then enforce the SP-side semantic checks (Status, Destination,
+//!   Audience, time bounds) that are where SAML SPs actually get attacked.
+//!
+//! Stateful checks (replay of assertion IDs, correlating `InResponseTo`
+//! against requests *we* issued, gating IdP-initiated login) live in the
+//! HTTP layer — [`response::consume`] is deliberately stateless and returns
+//! the IDs the caller needs to perform them.
+//!
+//! Access model: any assertion the IdP authenticates and we cryptographically
+//! verify yields an operator [`VerifiedPrincipal`]. OpenPXE is single-tier —
+//! there is no per-user role table — and the local admin account remains a
+//! guaranteed fallback owner regardless of SSO state.
+
+pub mod authn_request;
+pub mod metadata;
+pub mod response;
+
+pub use authn_request::AuthnRequest;
+pub use metadata::IdpMetadata;
+pub use response::{VerifiedPrincipal, VerifiedResponse};
+
+use thiserror::Error;
+
+/// Default clock-skew tolerance applied to assertion time bounds. SAML IdPs
+/// and SPs rarely have perfectly synced clocks; 60s matches common practice
+/// (Shibboleth/FleetDM defaults are in this ballpark).
+pub const DEFAULT_CLOCK_SKEW_SECS: i64 = 60;
+
+/// Runtime SP parameters, derived from [`crate::SsoConfig`] + the advertised
+/// public base URL by the HTTP layer.
+#[derive(Debug, Clone)]
+pub struct SpParams {
+    /// Our SP Entity ID (the `<Issuer>` we send and the `Audience` we require
+    /// in responses). Defaults to the public base URL when the operator left
+    /// the Entity ID field blank.
+    pub entity_id: String,
+    /// The Assertion Consumer Service URL the IdP POSTs the response to —
+    /// `<public_base_url>/api/sso/acs`.
+    pub acs_url: String,
+}
+
+/// Everything that can go wrong consuming a SAML response. Kept coarse on
+/// purpose: the HTTP layer logs the detail and shows the operator a generic
+/// "SSO sign-in failed" — we never leak which specific check tripped to the
+/// browser, since that aids an attacker probing the SP.
+#[derive(Debug, Error)]
+pub enum SamlError {
+    #[error("SAML XML parse error: {0}")]
+    Xml(String),
+    #[error("IdP metadata is missing a required element: {0}")]
+    Metadata(String),
+    #[error("no usable IdP signing certificate in metadata")]
+    NoSigningCert,
+    #[error("signature verification failed: {0}")]
+    Signature(String),
+    #[error("the signature does not cover the assertion we read")]
+    SignatureScope,
+    #[error("SAML response status was not Success: {0}")]
+    Status(String),
+    #[error("response is missing a required element: {0}")]
+    MissingElement(String),
+    #[error("encrypted assertions are not supported in this release")]
+    EncryptedAssertionUnsupported,
+    #[error("expected exactly one assertion, found {0}")]
+    AssertionCount(usize),
+    #[error("issuer mismatch: response was not issued by the configured IdP")]
+    IssuerMismatch,
+    #[error("audience mismatch: assertion is not addressed to this service provider")]
+    AudienceMismatch,
+    #[error("response destination does not match our ACS URL")]
+    DestinationMismatch,
+    #[error("assertion is expired or not yet valid")]
+    TimeBounds,
+    #[error("invalid SAML timestamp: {0}")]
+    Timestamp(String),
+    #[error("base64 decode failed: {0}")]
+    Base64(String),
+}
+
+#[cfg(test)]
+mod tests;

crates/core/src/saml/response.rs

@@ -0,0 +1,294 @@
+//! SAMLResponse consumption: signature verification + SP-side validation.
+//!
+//! [`consume`] is intentionally **stateless** — it verifies the XML signature
+//! against the IdP's pinned certificate(s) and enforces every check that can
+//! be made from the response alone (Status, Destination, Issuer, Audience,
+//! time bounds, signature scope). It then returns the `assertion_id` and
+//! `in_response_to` so the HTTP layer can perform the *stateful* checks it
+//! owns: replay rejection, correlating the request we issued, and gating
+//! IdP-initiated login.
+
+use roxmltree::{Document, Node};
+use time::format_description::well_known::Rfc3339;
+use time::{Duration, OffsetDateTime};
+
+use super::metadata::IdpMetadata;
+use super::{SamlError, SpParams};
+
+const STATUS_SUCCESS: &str = "urn:oasis:names:tc:SAML:2.0:status:Success";
+
+/// The verified subject of a SAML assertion. OpenPXE is single-tier, so this
+/// is all an operator session needs.
+#[derive(Debug, Clone)]
+pub struct VerifiedPrincipal {
+    /// The `<NameID>` value (an email, per our requested NameID format).
+    pub name_id: String,
+    /// Email used as the session identity. Equals `name_id` for the
+    /// emailAddress NameID format.
+    pub email: String,
+    /// Human-readable display name, if the IdP sent one as an attribute.
+    pub display_name: Option<String>,
+}
+
+/// Result of a successful [`consume`]. The IDs/expiry feed the HTTP layer's
+/// stateful checks.
+#[derive(Debug, Clone)]
+pub struct VerifiedResponse {
+    pub principal: VerifiedPrincipal,
+    /// `InResponseTo` from the response, if present. `None` = unsolicited
+    /// (IdP-initiated) — the HTTP layer only accepts that when the operator
+    /// enabled it.
+    pub in_response_to: Option<String>,
+    /// The assertion's `ID` — used by the caller as the replay-guard key.
+    pub assertion_id: String,
+    /// The assertion's expiry (`Conditions/@NotOnOrAfter`) — the replay
+    /// guard can drop the consumed ID after this instant.
+    pub assertion_expiry: OffsetDateTime,
+    /// `AuthnStatement/@SessionIndex`, if present (useful for future SLO).
+    pub session_index: Option<String>,
+}
+
+/// Verify and validate a decoded `SAMLResponse` XML document.
+pub fn consume(
+    xml: &str,
+    sp: &SpParams,
+    idp: &IdpMetadata,
+    now: OffsetDateTime,
+    clock_skew: Duration,
+) -> Result<VerifiedResponse, SamlError> {
+    // 1. Cryptographically verify the signature against the pinned IdP cert(s).
+    //    `trusted_keys_only` ignores any cert embedded in the document's
+    //    KeyInfo, so an attacker can't substitute their own key.
+    let verified_uris = verify_signature(xml, &idp.signing_certs_der)?;
+
+    // 2. Parse for semantic validation.
+    let doc = Document::parse(xml).map_err(|e| SamlError::Xml(e.to_string()))?;
+    let root = doc.root_element();
+    if root.tag_name().name() != "Response" {
+        return Err(SamlError::MissingElement("Response".into()));
+    }
+    let response_id = root.attribute("ID").map(str::to_owned);
+    let in_response_to = root.attribute("InResponseTo").map(str::to_owned);
+
+    // 3. Status must be Success.
+    let status_value = root
+        .descendants()
+        .find(|n| n.is_element() && n.tag_name().name() == "StatusCode")
+        .and_then(|sc| sc.attribute("Value"))
+        .unwrap_or("");
+    if status_value != STATUS_SUCCESS && !status_value.ends_with(":Success") {
+        return Err(SamlError::Status(status_value.to_owned()));
+    }
+
+    // 4. Destination (if the IdP set one) must be our ACS.
+    if let Some(dest) = root.attribute("Destination") {
+        if !urls_equal(dest, &sp.acs_url) {
+            return Err(SamlError::DestinationMismatch);
+        }
+    }
+
+    // 5. Exactly one (unencrypted) Assertion.
+    if root
+        .descendants()
+        .any(|n| n.is_element() && n.tag_name().name() == "EncryptedAssertion")
+    {
+        return Err(SamlError::EncryptedAssertionUnsupported);
+    }
+    let assertions: Vec<Node<'_, '_>> = root
+        .children()
+        .filter(|c| c.is_element() && c.tag_name().name() == "Assertion")
+        .collect();
+    if assertions.len() != 1 {
+        return Err(SamlError::AssertionCount(assertions.len()));
+    }
+    let assertion = assertions[0];
+    let assertion_id = assertion
+        .attribute("ID")
+        .map(str::to_owned)
+        .ok_or_else(|| SamlError::MissingElement("Assertion/@ID".into()))?;
+
+    // 6. The signature must actually cover the assertion we're about to trust:
+    //    either the assertion itself, the enclosing response, or the whole
+    //    document. (bergshamra's strict_verification already constrains where
+    //    the signed element may sit; this ties it to *our* assertion.)
+    let covers_assertion = verified_uris.iter().any(|u| {
+        u.is_empty()
+            || u == &format!("#{assertion_id}")
+            || response_id
+                .as_ref()
+                .is_some_and(|rid| u == &format!("#{rid}"))
+    });
+    if !covers_assertion {
+        return Err(SamlError::SignatureScope);
+    }
+
+    // 7. Issuer must be the configured IdP.
+    let issuer = first_child(assertion, "Issuer")
+        .map(text_of)
+        .unwrap_or_default();
+    if !idp.entity_id.is_empty() && issuer != idp.entity_id {
+        return Err(SamlError::IssuerMismatch);
+    }
+
+    // 8. Subject → NameID + SubjectConfirmationData time/recipient checks.
+    let subject = first_child(assertion, "Subject")
+        .ok_or_else(|| SamlError::MissingElement("Subject".into()))?;
+    let name_id = first_child(subject, "NameID")
+        .map(text_of)
+        .filter(|s| !s.is_empty())
+        .ok_or_else(|| SamlError::MissingElement("NameID".into()))?;
+    if let Some(scd) = subject
+        .descendants()
+        .find(|n| n.is_element() && n.tag_name().name() == "SubjectConfirmationData")
+    {
+        if let Some(recipient) = scd.attribute("Recipient") {
+            if !urls_equal(recipient, &sp.acs_url) {
+                return Err(SamlError::DestinationMismatch);
+            }
+        }
+        if let Some(noa) = scd.attribute("NotOnOrAfter") {
+            let noa = parse_instant(noa)?;
+            if now >= noa + clock_skew {
+                return Err(SamlError::TimeBounds);
+            }
+        }
+    }
+
+    // 9. Conditions: time window + audience.
+    let conditions = first_child(assertion, "Conditions");
+    if let Some(cond) = conditions {
+        if let Some(nb) = cond.attribute("NotBefore") {
+            let nb = parse_instant(nb)?;
+            if now < nb - clock_skew {
+                return Err(SamlError::TimeBounds);
+            }
+        }
+    }
+    let assertion_expiry = conditions
+        .and_then(|c| c.attribute("NotOnOrAfter"))
+        .map(parse_instant)
+        .transpose()?
+        .ok_or_else(|| SamlError::MissingElement("Conditions/@NotOnOrAfter".into()))?;
+    if now >= assertion_expiry + clock_skew {
+        return Err(SamlError::TimeBounds);
+    }
+
+    let audience_ok = conditions.is_some_and(|c| {
+        c.descendants()
+            .filter(|n| n.is_element() && n.tag_name().name() == "Audience")
+            .any(|a| text_of(a) == sp.entity_id)
+    });
+    if !audience_ok {
+        return Err(SamlError::AudienceMismatch);
+    }
+
+    // 10. Optional: SessionIndex + display-name attribute.
+    let session_index = assertion
+        .descendants()
+        .find(|n| n.is_element() && n.tag_name().name() == "AuthnStatement")
+        .and_then(|a| a.attribute("SessionIndex"))
+        .map(str::to_owned);
+
+    let display_name = extract_display_name(assertion);
+
+    Ok(VerifiedResponse {
+        principal: VerifiedPrincipal {
+            email: name_id.clone(),
+            name_id,
+            display_name,
+        },
+        in_response_to,
+        assertion_id,
+        assertion_expiry,
+        session_index,
+    })
+}
+
+/// Verify the document's XML-DSig against each pinned IdP cert in turn
+/// (handles key rotation), returning the verified `<Reference>` URIs.
+fn verify_signature(xml: &str, certs_der: &[Vec<u8>]) -> Result<Vec<String>, SamlError> {
+    let mut last_err = String::from("no signing certificate matched");
+    for der in certs_der {
+        let key = match bergshamra::keys::loader::load_x509_cert_der(der) {
+            Ok(k) => k,
+            Err(e) => {
+                last_err = e.to_string();
+                continue;
+            }
+        };
+        let mut km = bergshamra::keys::KeysManager::new();
+        km.add_key(key);
+        // trusted_keys_only: only ever trust the pinned IdP key, never an
+        // inline KeyInfo cert. strict_verification: XSW positional defense.
+        let ctx = bergshamra::DsigContext::new(km)
+            .with_trusted_keys_only(true)
+            .with_strict_verification(true);
+        match bergshamra::verify(&ctx, xml) {
+            Ok(bergshamra::VerifyResult::Valid { references, .. }) => {
+                return Ok(references.into_iter().map(|r| r.uri).collect());
+            }
+            Ok(bergshamra::VerifyResult::Invalid { reason }) => last_err = reason,
+            Err(e) => last_err = e.to_string(),
+        }
+    }
+    Err(SamlError::Signature(last_err))
+}
+
+/// Pull a display name from the assertion's attribute statement, trying the
+/// common attribute names IdPs use (FleetDM checks the same set).
+fn extract_display_name(assertion: Node<'_, '_>) -> Option<String> {
+    const WANTED: &[&str] = &[
+        "name",
+        "displayname",
+        "cn",
+        "urn:oid:2.5.4.3",
+        "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
+    ];
+    for attr in assertion
+        .descendants()
+        .filter(|n| n.is_element() && n.tag_name().name() == "Attribute")
+    {
+        let key = attr
+            .attribute("Name")
+            .or_else(|| attr.attribute("FriendlyName"))
+            .unwrap_or("")
+            .to_ascii_lowercase();
+        if WANTED.contains(&key.as_str()) {
+            if let Some(val) = attr
+                .descendants()
+                .find(|n| n.is_element() && n.tag_name().name() == "AttributeValue")
+            {
+                let v = text_of(val);
+                if !v.is_empty() {
+                    return Some(v);
+                }
+            }
+        }
+    }
+    None
+}
+
+fn first_child<'a, 'i>(n: Node<'a, 'i>, local: &str) -> Option<Node<'a, 'i>> {
+    n.children()
+        .find(|c| c.is_element() && c.tag_name().name() == local)
+}
+
+fn text_of(n: Node<'_, '_>) -> String {
+    n.children()
+        .filter(Node::is_text)
+        .filter_map(|c| c.text())
+        .collect::<String>()
+        .trim()
+        .to_owned()
+}
+
+/// Parse an `xs:dateTime` (e.g. `2026-05-31T12:00:00.000Z`).
+fn parse_instant(s: &str) -> Result<OffsetDateTime, SamlError> {
+    OffsetDateTime::parse(s.trim(), &Rfc3339).map_err(|e| SamlError::Timestamp(format!("{s}: {e}")))
+}
+
+/// Compare two URLs for SAML endpoint-matching purposes: exact, or differing
+/// only by a single trailing slash.
+fn urls_equal(a: &str, b: &str) -> bool {
+    a == b || a.trim_end_matches('/') == b.trim_end_matches('/')
+}

crates/core/src/saml/tests.rs

@@ -0,0 +1,287 @@
+//! End-to-end SAML SP tests.
+//!
+//! We mint a throwaway self-signed cert/key with `rcgen`, sign a SAML Response
+//! template with `bergshamra::sign` (the same engine that verifies it), and
+//! drive [`response::consume`] through the accept path and every reject path.
+//! This proves both the signature wiring and the SP-semantic checks.
+
+use time::format_description::well_known::Rfc3339;
+use time::{Duration, OffsetDateTime};
+
+use super::metadata::IdpMetadata;
+use super::{response, SamlError, SpParams};
+
+const SP_ENTITY: &str = "https://pxe.example.com";
+const ACS: &str = "https://pxe.example.com/api/sso/acs";
+const IDP_ENTITY: &str = "https://idp.example.com/realms/fleet";
+const EMAIL: &str = "[email protected]";
+
+struct TestIdp {
+    cert_der: Vec<u8>,
+    key_pem: String,
+}
+
+fn test_idp() -> TestIdp {
+    let ck = rcgen::generate_simple_self_signed(vec!["idp.example.com".to_string()]).unwrap();
+    TestIdp {
+        cert_der: ck.cert.der().as_ref().to_vec(),
+        key_pem: ck.key_pair.serialize_pem(),
+    }
+}
+
+fn fmt(t: OffsetDateTime) -> String {
+    t.replace_nanosecond(0).unwrap().format(&Rfc3339).unwrap()
+}
+
+/// Knobs for building a response template — defaults are a valid response.
+struct Resp {
+    issuer: String,
+    audience: String,
+    status: String,
+    not_before: OffsetDateTime,
+    not_on_or_after: OffsetDateTime,
+    in_response_to: Option<String>,
+    recipient: String,
+}
+
+impl Default for Resp {
+    fn default() -> Self {
+        let now = OffsetDateTime::now_utc();
+        Self {
+            issuer: IDP_ENTITY.into(),
+            audience: SP_ENTITY.into(),
+            status: "urn:oasis:names:tc:SAML:2.0:status:Success".into(),
+            not_before: now - Duration::minutes(5),
+            not_on_or_after: now + Duration::hours(1),
+            in_response_to: Some("_req-abc".into()),
+            recipient: ACS.into(),
+        }
+    }
+}
+
+impl Resp {
+    /// The unsigned template (a `<ds:Signature>` with empty values).
+    fn template(&self) -> String {
+        let now = fmt(OffsetDateTime::now_utc());
+        let irt = self
+            .in_response_to
+            .as_ref()
+            .map(|v| format!(r#" InResponseTo="{v}""#))
+            .unwrap_or_default();
+        format!(
+            r##"<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_resp1" Version="2.0" IssueInstant="{now}" Destination="{ACS}"{irt}>
+  <saml:Issuer>{issuer}</saml:Issuer>
+  <samlp:Status><samlp:StatusCode Value="{status}"/></samlp:Status>
+  <saml:Assertion ID="_assertion1" Version="2.0" IssueInstant="{now}">
+    <saml:Issuer>{issuer}</saml:Issuer>
+    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+      <ds:SignedInfo>
+        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+        <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256"/>
+        <ds:Reference URI="#_assertion1">
+          <ds:Transforms>
+            <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
+            <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+          </ds:Transforms>
+          <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
+          <ds:DigestValue></ds:DigestValue>
+        </ds:Reference>
+      </ds:SignedInfo>
+      <ds:SignatureValue></ds:SignatureValue>
+    </ds:Signature>
+    <saml:Subject>
+      <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">{EMAIL}</saml:NameID>
+      <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
+        <saml:SubjectConfirmationData Recipient="{recipient}" NotOnOrAfter="{noa}"{irt}/>
+      </saml:SubjectConfirmation>
+    </saml:Subject>
+    <saml:Conditions NotBefore="{nb}" NotOnOrAfter="{noa}">
+      <saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction>
+    </saml:Conditions>
+    <saml:AuthnStatement AuthnInstant="{now}" SessionIndex="sess-123">
+      <saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef></saml:AuthnContext>
+    </saml:AuthnStatement>
+    <saml:AttributeStatement>
+      <saml:Attribute Name="displayName"><saml:AttributeValue>Miles Ward</saml:AttributeValue></saml:Attribute>
+    </saml:AttributeStatement>
+  </saml:Assertion>
+</samlp:Response>"##,
+            issuer = self.issuer,
+            status = self.status,
+            audience = self.audience,
+            recipient = self.recipient,
+            nb = fmt(self.not_before),
+            noa = fmt(self.not_on_or_after),
+        )
+    }
+}
+
+fn sign(template: &str, key_pem: &str) -> String {
+    let key = bergshamra::keys::loader::load_pem_auto(key_pem.as_bytes(), None)
+        .expect("load test signing key");
+    let mut km = bergshamra::keys::KeysManager::new();
+    km.add_key(key);
+    let ctx = bergshamra::DsigContext::new(km);
+    bergshamra::sign(&ctx, template).expect("sign test response")
+}
+
+fn sp() -> SpParams {
+    SpParams {
+        entity_id: SP_ENTITY.into(),
+        acs_url: ACS.into(),
+    }
+}
+
+fn idp(cert_der: Vec<u8>) -> IdpMetadata {
+    IdpMetadata {
+        entity_id: IDP_ENTITY.into(),
+        sso_redirect_url: None,
+        sso_post_url: None,
+        signing_certs_der: vec![cert_der],
+    }
+}
+
+fn consume(xml: &str, cert_der: Vec<u8>) -> Result<response::VerifiedResponse, SamlError> {
+    response::consume(
+        xml,
+        &sp(),
+        &idp(cert_der),
+        OffsetDateTime::now_utc(),
+        Duration::seconds(60),
+    )
+}
+
+#[test]
+fn good_response_yields_principal() {
+    let t = test_idp();
+    let signed = sign(&Resp::default().template(), &t.key_pem);
+    let out = consume(&signed, t.cert_der).expect("valid response should verify");
+    assert_eq!(out.principal.email, EMAIL);
+    assert_eq!(out.principal.name_id, EMAIL);
+    assert_eq!(out.principal.display_name.as_deref(), Some("Miles Ward"));
+    assert_eq!(out.in_response_to.as_deref(), Some("_req-abc"));
+    assert_eq!(out.assertion_id, "_assertion1");
+    assert_eq!(out.session_index.as_deref(), Some("sess-123"));
+}
+
+#[test]
+fn tampered_assertion_is_rejected() {
+    let t = test_idp();
+    let signed = sign(&Resp::default().template(), &t.key_pem);
+    // Flip the subject email after signing — breaks the digest.
+    let tampered = signed.replace(EMAIL, "[email protected]");
+    assert_ne!(signed, tampered);
+    assert!(matches!(
+        consume(&tampered, t.cert_der),
+        Err(SamlError::Signature(_) | SamlError::SignatureScope)
+    ));
+}
+
+#[test]
+fn unsigned_response_is_rejected() {
+    let t = test_idp();
+    // Feed the *unsigned* template (empty SignatureValue) straight in.
+    let unsigned = Resp::default().template();
+    assert!(matches!(
+        consume(&unsigned, t.cert_der),
+        Err(SamlError::Signature(_))
+    ));
+}
+
+#[test]
+fn wrong_signing_key_is_rejected() {
+    let signer = test_idp();
+    let other = test_idp(); // different keypair pinned as the "IdP" cert
+    let signed = sign(&Resp::default().template(), &signer.key_pem);
+    assert!(matches!(
+        consume(&signed, other.cert_der),
+        Err(SamlError::Signature(_))
+    ));
+}
+
+#[test]
+fn wrong_audience_is_rejected() {
+    let t = test_idp();
+    let r = Resp {
+        audience: "https://someone-else.example".into(),
+        ..Resp::default()
+    };
+    let signed = sign(&r.template(), &t.key_pem);
+    assert!(matches!(
+        consume(&signed, t.cert_der),
+        Err(SamlError::AudienceMismatch)
+    ));
+}
+
+#[test]
+fn expired_assertion_is_rejected() {
+    let t = test_idp();
+    let now = OffsetDateTime::now_utc();
+    let r = Resp {
+        not_before: now - Duration::hours(2),
+        not_on_or_after: now - Duration::hours(1),
+        ..Resp::default()
+    };
+    let signed = sign(&r.template(), &t.key_pem);
+    assert!(matches!(
+        consume(&signed, t.cert_der),
+        Err(SamlError::TimeBounds)
+    ));
+}
+
+#[test]
+fn future_assertion_is_rejected() {
+    let t = test_idp();
+    let now = OffsetDateTime::now_utc();
+    let r = Resp {
+        not_before: now + Duration::hours(1),
+        not_on_or_after: now + Duration::hours(2),
+        ..Resp::default()
+    };
+    let signed = sign(&r.template(), &t.key_pem);
+    assert!(matches!(
+        consume(&signed, t.cert_der),
+        Err(SamlError::TimeBounds)
+    ));
+}
+
+#[test]
+fn wrong_issuer_is_rejected() {
+    let t = test_idp();
+    let r = Resp {
+        issuer: "https://evil-idp.example".into(),
+        ..Resp::default()
+    };
+    let signed = sign(&r.template(), &t.key_pem);
+    assert!(matches!(
+        consume(&signed, t.cert_der),
+        Err(SamlError::IssuerMismatch)
+    ));
+}
+
+#[test]
+fn non_success_status_is_rejected() {
+    let t = test_idp();
+    let r = Resp {
+        status: "urn:oasis:names:tc:SAML:2.0:status:Requester".into(),
+        ..Resp::default()
+    };
+    let signed = sign(&r.template(), &t.key_pem);
+    assert!(matches!(
+        consume(&signed, t.cert_der),
+        Err(SamlError::Status(_))
+    ));
+}
+
+#[test]
+fn idp_initiated_has_no_in_response_to() {
+    // No InResponseTo => the HTTP layer must gate it behind allow_idp_initiated.
+    let t = test_idp();
+    let r = Resp {
+        in_response_to: None,
+        ..Resp::default()
+    };
+    let signed = sign(&r.template(), &t.key_pem);
+    let out = consume(&signed, t.cert_der).expect("unsolicited but otherwise valid");
+    assert!(out.in_response_to.is_none());
+}

crates/core/src/sso.rs

@@ -1,16 +1,17 @@
-//! SAML SSO configuration — FleetDM-shaped, storage-only for v0.4.5.
+//! SAML SSO configuration — FleetDM-shaped.
 //!
 //! The operator pastes their IdP's metadata XML (or its URL) and a
-//! human-readable label; v0.4.5 just persists it. The actual SAML
-//! response-validation / JIT-provisioning flow lands in a later release
-//! — for now we cover the "configurable" half so an operator can teach
-//! OpenPXE about their IdP today and flip the switch on next upgrade.
+//! human-readable label. As of v0.5.1 the SAML login flow is wired
+//! end-to-end (see [`crate::saml`]): SP-initiated AuthnRequest, the ACS
+//! endpoint, pure-Rust signature verification, and operator-session
+//! minting. This module owns only the persisted *configuration*.
 //!
 //! Shape borrowed from <https://github.com/fleetdm/fleet>'s app-config
-//! SSO block, minus the user-RBAC fields (OpenPXE is single-tier: you
-//! have access or you don't). Entity ID is omitted from the operator
-//! UI per the v0.4.5 brief — it defaults to the advertised public base
-//! URL when SAML wiring lands, which is what most IdPs expect anyway.
+//! SSO block, minus the user-RBAC fields (OpenPXE is single-tier: any
+//! IdP-authenticated user the SP cryptographically verifies gets an
+//! operator session; there is no per-user role table). Entity ID is
+//! exposed (FleetDM-style) but defaults to the advertised public base
+//! URL when blank, which is what most IdPs expect anyway.
 
 use parking_lot::RwLock;
 use serde::{Deserialize, Serialize};
@@ -47,6 +48,18 @@ pub struct SsoConfig {
     /// future SAML flow; not validated here beyond a basic length cap.
     #[serde(default)]
     pub metadata_url: String,
+    /// SP Entity ID advertised to the IdP — mirrors FleetDM's "Entity ID".
+    /// Must exactly match the SP/Relying-Party entry configured on the IdP.
+    /// Empty falls back to the advertised public base URL at runtime, which
+    /// is what most IdPs expect. Length-capped at [`MAX_URL_LEN`].
+    #[serde(default)]
+    pub entity_id: String,
+    /// Allow IdP-initiated login — an unsolicited `<Response>` POSTed to the
+    /// ACS with no `InResponseTo`. Mirrors FleetDM's "Allow SSO login
+    /// initiated by identity provider". Default off; SP-initiated (the
+    /// "Sign in with X" button) is always allowed regardless.
+    #[serde(default)]
+    pub allow_idp_initiated: bool,
 }
 
 impl SsoConfig {
@@ -56,8 +69,7 @@ impl SsoConfig {
     /// surface a yellow "configured but not live yet" hint.
     #[must_use]
     pub fn is_usable(&self) -> bool {
-        self.enabled
-            && (!self.metadata.trim().is_empty() || !self.metadata_url.trim().is_empty())
+        self.enabled && (!self.metadata.trim().is_empty() || !self.metadata_url.trim().is_empty())
     }
 }
 
@@ -108,6 +120,12 @@ impl SsoStore {
         cfg.idp_logo_url = cfg.idp_logo_url.trim().to_string();
         cfg.metadata = cfg.metadata.trim().to_string();
         cfg.metadata_url = cfg.metadata_url.trim().to_string();
+        cfg.entity_id = cfg.entity_id.trim().to_string();
+        if cfg.entity_id.len() > MAX_URL_LEN {
+            return Err(Error::Invalid(format!(
+                "entity_id exceeds {MAX_URL_LEN}-char cap"
+            )));
+        }
         if cfg.metadata.len() > MAX_METADATA_BYTES {
             return Err(Error::Invalid(format!(
                 "metadata XML exceeds {MAX_METADATA_BYTES}-byte cap"
@@ -217,6 +235,8 @@ mod tests {
             metadata: String::new(),
             metadata_url: "https://idp.example.com/metadata".into(),
             idp_logo_url: String::new(),
+            entity_id: String::new(),
+            allow_idp_initiated: false,
         })
         .unwrap();
         drop(s);
@@ -239,6 +259,8 @@ mod tests {
             metadata: xml.into(),
             metadata_url: String::new(),
             idp_logo_url: String::new(),
+            entity_id: String::new(),
+            allow_idp_initiated: false,
         })
         .unwrap();
         assert!(s.snapshot().is_usable());
@@ -254,6 +276,8 @@ mod tests {
             metadata: String::new(),
             metadata_url: String::new(),
             idp_logo_url: String::new(),
+            entity_id: String::new(),
+            allow_idp_initiated: false,
         });
         assert!(matches!(r, Err(Error::Invalid(_))));
         // …and a disabled blank config is fine.
@@ -270,6 +294,8 @@ mod tests {
             metadata: String::new(),
             metadata_url: "ftp://idp.example.com/metadata".into(),
             idp_logo_url: String::new(),
+            entity_id: String::new(),
+            allow_idp_initiated: false,
         });
         assert!(matches!(r, Err(Error::Invalid(_))));
     }
@@ -287,6 +313,8 @@ mod tests {
             metadata: String::new(),
             metadata_url: String::new(),
             idp_logo_url: "data:image/png;base64,...".into(),
+            entity_id: String::new(),
+            allow_idp_initiated: false,
         });
         assert!(matches!(r, Err(Error::Invalid(_))));
         // Real HTTPS URL is fine.
@@ -296,9 +324,51 @@ mod tests {
             metadata: String::new(),
             metadata_url: String::new(),
             idp_logo_url: "https://idp.example.com/logo.png".into(),
+            entity_id: String::new(),
+            allow_idp_initiated: false,
         })
         .unwrap();
-        assert_eq!(s.snapshot().idp_logo_url, "https://idp.example.com/logo.png");
+        assert_eq!(
+            s.snapshot().idp_logo_url,
+            "https://idp.example.com/logo.png"
+        );
+    }
+
+    #[test]
+    fn entity_id_and_idp_initiated_round_trip() {
+        // v0.5.1: SP Entity ID + IdP-initiated toggle persist across reload.
+        let dir = tempdir().unwrap();
+        let s = SsoStore::load_or_default(dir.path());
+        s.replace(SsoConfig {
+            enabled: true,
+            idp_name: "Keycloak".into(),
+            metadata: String::new(),
+            metadata_url: "https://idp.example.com/metadata".into(),
+            idp_logo_url: String::new(),
+            entity_id: "https://pxe.example.com".into(),
+            allow_idp_initiated: true,
+        })
+        .unwrap();
+        drop(s);
+        let cfg = SsoStore::load_or_default(dir.path()).snapshot();
+        assert_eq!(cfg.entity_id, "https://pxe.example.com");
+        assert!(cfg.allow_idp_initiated);
+    }
+
+    #[test]
+    fn entity_id_cap_enforced() {
+        let dir = tempdir().unwrap();
+        let s = SsoStore::load_or_default(dir.path());
+        let r = s.replace(SsoConfig {
+            enabled: false,
+            idp_name: String::new(),
+            metadata: String::new(),
+            metadata_url: String::new(),
+            idp_logo_url: String::new(),
+            entity_id: "x".repeat(MAX_URL_LEN + 1),
+            allow_idp_initiated: false,
+        });
+        assert!(matches!(r, Err(Error::Invalid(_))));
     }
 
     #[test]
@@ -312,6 +382,8 @@ mod tests {
             metadata: oversize,
             metadata_url: String::new(),
             idp_logo_url: String::new(),
+            entity_id: String::new(),
+            allow_idp_initiated: false,
         });
         assert!(matches!(r, Err(Error::Invalid(_))));
     }

crates/http-api/Cargo.toml

@@ -44,6 +44,8 @@ parking_lot.workspace = true
 # OpenSSL-free.
 reqwest.workspace = true
 lettre.workspace = true
+# v0.5.1: decode the base64 SAMLResponse at the ACS endpoint.
+base64.workspace = true
 
 [dev-dependencies]
 tokio = { workspace = true, features = ["macros", "rt", "rt-multi-thread", "time"] }
@@ -54,3 +56,8 @@ time = { workspace = true }
 # v0.4.61: integration tests need to generate real PNG bytes for the
 # `/branding/pxe-logo` compositor; hand-rolled CRCs are too fragile.
 image = { version = "0.25", default-features = false, features = ["png"] }
+# v0.5.1: the SAML ACS integration tests mint a throwaway IdP keypair
+# (rcgen) and sign a SAMLResponse with bergshamra so the happy-path,
+# replay, and IdP-initiated-gating flows exercise real signatures.
+rcgen = "0.13"
+bergshamra = { workspace = true }

crates/http-api/src/app.rs

@@ -31,11 +31,14 @@ use axum::{
     Json, Router,
 };
 use openpxe_core::{
-    ext_for_mime, wol, BootEvent, ClientEvent, Error, NotifyConfig, Settings, SsoConfig,
-    ALLOWED_LOGO_MIMES, MAX_LOGO_BYTES,
+    ext_for_mime, wol, BootEvent, ClientEvent, DeployProfile, Error, LogoSlot, NotifyConfig,
+    Settings, SsoConfig, ALLOWED_LOGO_MIMES, MAX_LOGO_BYTES,
 };
 use openpxe_ipxe_assets::asset_bytes;
-use openpxe_iso_store::{IsoCategory, IsoMeta, IsoSource, NfsAddRequest, SmbAddRequest};
+use openpxe_iso_store::{
+    render_template, IsoCategory, IsoMeta, IsoSource, NfsAddRequest, SmbAddRequest, UnattendedKind,
+    UnattendedMeta,
+};
 use serde::Deserialize;
 use serde_json::json;
 use std::net::SocketAddr;
@@ -49,7 +52,14 @@ pub fn build_router(state: AppState) -> Router {
         .route("/", get(index))
         .route("/assets/app.js", get(ui_js))
         .route("/assets/app.css", get(ui_css))
+        // v0.5.2: theme-aware brand mark. `?theme=light|dark` selects the
+        // operator's per-theme logo slot (falling back across themes, then
+        // to the bundled mark). The WebUI swaps `?theme=` on theme toggle.
         .route("/assets/logo.svg", get(ui_logo))
+        // v0.5.2: favicon is pinned to the *bundled* OpenPXE mark for
+        // continuity — it never follows the operator's custom branding, so
+        // the browser-tab icon stays recognisably "OpenPXE".
+        .route("/assets/favicon.svg", get(ui_favicon))
         .route("/assets/loader.svg", get(ui_loader))
         // v0.4.6: PXE menu logo — the raster form of the operator's
         // uploaded mark, served so iPXE's `console --picture` can
@@ -61,6 +71,16 @@ pub fn build_router(state: AppState) -> Router {
         // iPXE script endpoints.
         .route("/boot.ipxe", get(boot_top_menu))
         .route("/boot/:filename", get(boot_sub))
+        // v0.5.2: unattended answer-file *serving* — public (like /iso),
+        // because the booting installer fetches these with no session.
+        // `/unattended/:id` serves a Kickstart/Preseed with `{{HOSTNAME}}`
+        // / `{{IP}}` / `{{MAC}}` substituted from the query string. The
+        // 3-segment form is the cloud-init NoCloud seed dir for Ubuntu
+        // autoinstall (`…/<ctx>/user-data` + `/meta-data`), where `<ctx>`
+        // base64url-encodes the per-host hostname/ip/mac. Management
+        // (upload/list/delete) lives under the gated `/api/unattended`.
+        .route("/unattended/:id", get(serve_unattended))
+        .route("/unattended/:id/:ctx/:sub", get(serve_unattended_seed))
         // Bundled binaries and raw ISO access.
         .route("/ipxe/:name", get(ipxe_binary))
         .route("/iso/:filename", get(iso_raw))
@@ -95,12 +115,21 @@ pub fn build_router(state: AppState) -> Router {
         // volume — surfaced as a small card on the Storage tab so the
         // operator knows when they're about to run out of room.
         .route("/api/storage/disk", get(api_storage_disk))
-        // v0.4.4: operator-controlled WebUI branding overrides
-        // (custom logo). Multipart upload to POST; DELETE clears.
+        // v0.4.4: operator-controlled WebUI branding overrides (custom
+        // logo). v0.5.2: split into three slots — `light` / `dark` /
+        // `client`. Multipart upload to POST; DELETE clears one slot.
         .route(
-            "/api/branding/logo",
+            "/api/branding/logo/:slot",
             post(api_branding_upload).delete(api_branding_clear),
         )
+        // v0.5.2: unattended-install answer-file management (gated).
+        // Multipart upload, list, delete. Serving is the public
+        // `/unattended/*` routes above.
+        .route(
+            "/api/unattended",
+            get(api_unattended_list).post(api_unattended_upload),
+        )
+        .route("/api/unattended/:id", delete(api_unattended_delete))
         // v0.4.4: self-rendered API reference, served as JSON so the UI
         // can format it consistently with the rest of the chrome. Lives
         // under the Settings tab — operators chasing an integration get
@@ -116,14 +145,16 @@ pub fn build_router(state: AppState) -> Router {
         .route("/api/login", post(auth_api::api_login))
         .route("/api/logout", post(auth_api::api_logout))
         .route("/api/me", get(auth_api::api_me))
-        .route(
-            "/api/me/credentials",
-            put(auth_api::api_update_credentials),
-        )
-        // v0.4.5: SAML SSO configuration (FleetDM-shaped, storage-only).
-        // The actual sign-in flow lands in a later release; this just
-        // gives operators a place to paste their IdP metadata today.
+        .route("/api/me/credentials", put(auth_api::api_update_credentials))
+        // SAML SSO configuration (FleetDM-shaped). Gated behind auth — the
+        // operator pastes their IdP metadata, Entity ID, and toggles here.
         .route("/api/sso", get(api_sso_get).put(api_sso_put))
+        // v0.5.1: SAML SP login flow (pre-auth — see the require_auth
+        // allowlist). /login redirects to the IdP, /acs consumes the signed
+        // response + mints a session, /metadata serves our SP descriptor.
+        .route("/api/sso/login", get(crate::saml_routes::sso_login))
+        .route("/api/sso/acs", post(crate::saml_routes::sso_acs))
+        .route("/api/sso/metadata", get(crate::saml_routes::sso_metadata))
         .route("/api/clients", get(api_list_clients))
         .route("/api/status", get(api_status))
         .route("/api/settings", get(api_get_settings).put(api_put_settings))
@@ -131,6 +162,9 @@ pub fn build_router(state: AppState) -> Router {
         .route("/api/queue/join", get(api_queue_join))
         .route("/api/queue/poll/:entry_id", get(api_queue_poll))
         .route("/api/queue/assign", post(api_queue_assign))
+        // v0.5.2: per-device deployment profile (auto hostname / IP /
+        // unattended file) set from the queue "Profile" button.
+        .route("/api/queue/:entry_id/profile", put(api_queue_set_profile))
         .route("/api/queue/:entry_id", delete(api_queue_release))
         // v0.4.65: SMB share manager (userspace via smbclient). The
         // kernel-mount NFS routes that v0.4.64 shipped are gone — they
@@ -138,13 +172,19 @@ pub fn build_router(state: AppState) -> Router {
         // modules (Unraid), and no container-side configuration could
         // load a host kernel module. `smbclient` speaks SMB over a
         // plain TCP socket in userspace, works in every container.
-        .route("/api/smb-shares", get(api_smb_shares_list).post(api_smb_shares_add))
+        .route(
+            "/api/smb-shares",
+            get(api_smb_shares_list).post(api_smb_shares_add),
+        )
         .route("/api/smb-shares/:id", delete(api_smb_shares_remove))
         .route("/api/smb-shares/:id/scan", post(api_smb_shares_scan))
         // v0.4.67: NFSv3 share manager (pure-Rust in-process client).
         // Ships alongside SMB. Routes are parallel so the UI can
         // reuse the same form/error/hint rendering for both.
-        .route("/api/nfs-shares", get(api_nfs_shares_list).post(api_nfs_shares_add))
+        .route(
+            "/api/nfs-shares",
+            get(api_nfs_shares_list).post(api_nfs_shares_add),
+        )
         .route("/api/nfs-shares/:id", delete(api_nfs_shares_remove))
         .route("/api/nfs-shares/:id/scan", post(api_nfs_shares_scan))
         // Phase 4: Network info (read-only) + DNS edit.
@@ -204,9 +244,7 @@ async fn api_sso_get(State(state): State<AppState>) -> Json<SsoConfig> {
 async fn api_sso_put(State(state): State<AppState>, Json(body): Json<SsoConfig>) -> Response {
     match state.sso.replace(body) {
         Ok(cfg) => (StatusCode::OK, Json(cfg)).into_response(),
-        Err(Error::Invalid(msg)) => {
-            (StatusCode::BAD_REQUEST, msg).into_response()
-        }
+        Err(Error::Invalid(msg)) => (StatusCode::BAD_REQUEST, msg).into_response(),
         Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
     }
 }
@@ -225,7 +263,7 @@ async fn index(State(state): State<AppState>) -> Response {
         &state.public_base_url,
         env!("CARGO_PKG_VERSION"),
         state.branding.logo_rev(),
-        state.branding.has_logo(),
+        state.branding.has_any_web_logo(),
     );
     (
         [
@@ -251,8 +289,7 @@ async fn index(State(state): State<AppState>) -> Response {
 /// with the `?v=<version>` query string in index.html, the practical
 /// upper bound on caching across an upgrade is "until the operator
 /// reloads".
-const ASSET_CACHE_CONTROL: HeaderValue =
-    HeaderValue::from_static("no-cache, must-revalidate");
+const ASSET_CACHE_CONTROL: HeaderValue = HeaderValue::from_static("no-cache, must-revalidate");
 
 async fn ui_js() -> Response {
     (
@@ -279,23 +316,28 @@ async fn ui_css() -> Response {
         .into_response()
 }
 
-async fn ui_logo(State(state): State<AppState>) -> Response {
+#[derive(Debug, Deserialize)]
+struct LogoQuery {
+    /// `light` or `dark` — which theme variant the page is currently
+    /// showing. Anything else (or absent) resolves to the dark slot,
+    /// which matches the default theme.
+    #[serde(default)]
+    theme: Option<String>,
+}
+
+async fn ui_logo(State(state): State<AppState>, Query(q): Query<LogoQuery>) -> Response {
     // Custom override first; fall back to the bundled rainbow-horizon
     // SVG. We resolve the override on each request rather than caching
     // because operators may upload/clear from the Settings tab while the
     // server is live, and we want them to see their change immediately
-    // without bouncing the binary.
-    if let Some(path) = state.branding.logo_path() {
-        let mime = state
-            .branding
-            .logo_mime()
-            .unwrap_or_else(|| "image/svg+xml".to_string());
+    // without bouncing the binary. The theme query selects the per-theme
+    // slot, with cross-theme + bundled fallback handled in BrandingStore.
+    let theme_is_light = q.theme.as_deref() == Some("light");
+    if let Some((path, mime)) = state.branding.web_logo(theme_is_light) {
         match tokio::fs::read(&path).await {
             Ok(bytes) => {
-                let ct = match HeaderValue::from_str(&mime) {
-                    Ok(v) => v,
-                    Err(_) => HeaderValue::from_static("application/octet-stream"),
-                };
+                let ct = HeaderValue::from_str(&mime)
+                    .unwrap_or_else(|_| HeaderValue::from_static("application/octet-stream"));
                 return (
                     [
                         (header::CONTENT_TYPE, ct),
@@ -316,6 +358,17 @@ async fn ui_logo(State(state): State<AppState>) -> Response {
             }
         }
     }
+    bundled_logo_response()
+}
+
+/// Favicon — always the bundled OpenPXE mark, decoupled from operator
+/// branding (v0.5.2) so the browser-tab icon stays "OpenPXE" for
+/// continuity regardless of any uploaded light/dark logo.
+async fn ui_favicon() -> Response {
+    bundled_logo_response()
+}
+
+fn bundled_logo_response() -> Response {
     (
         [
             (
@@ -346,10 +399,8 @@ async fn ui_pxe_logo(State(state): State<AppState>) -> Response {
     // Resolve the operator's raster upload, if any and if it's a format
     // iPXE/our compositor can consume. SVG (or a missing/unreadable
     // file) yields `None`, which composes the default background.
-    let raster: Option<Vec<u8>> = match (state.branding.logo_path(), state.branding.logo_mime()) {
-        (Some(path), Some(mime)) if mime != "image/svg+xml" => {
-            tokio::fs::read(&path).await.ok()
-        }
+    let raster: Option<Vec<u8>> = match state.branding.client_logo() {
+        Some((path, mime)) if mime != "image/svg+xml" => tokio::fs::read(&path).await.ok(),
         _ => None,
     };
 
@@ -639,7 +690,26 @@ async fn boot_sub(
                             "PXE boot started",
                             &format!("{who} started booting {} ({}).", iso.filename, entry.title),
                         );
-                        return text_plain(render_entry(entry, &settings, base));
+                        // v0.5.2: if this MAC has a deployment profile with
+                        // an unattended answer file selected (via a host
+                        // pin or queue Profile), inject the right kernel
+                        // arg so the install runs unattended.
+                        let unattended_args = mac_normalized.as_deref().and_then(|m| {
+                            resolve_profile(&state, m).and_then(|p| {
+                                p.unattended_file
+                                    .as_deref()
+                                    .and_then(|fid| state.unattended.get(fid))
+                                    .and_then(|meta| {
+                                        build_unattended_args(base, &meta, Some(m), &p)
+                                    })
+                            })
+                        });
+                        return text_plain(render_entry(
+                            entry,
+                            &settings,
+                            base,
+                            unattended_args.as_deref(),
+                        ));
                     }
                 }
             }
@@ -693,9 +763,7 @@ async fn iso_raw(
             };
             match stream_file_range(&path, headers.get(header::RANGE)).await {
                 Ok(r) => r,
-                Err(e) => {
-                    (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response()
-                }
+                Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
             }
         }
         IsoSource::Smb {
@@ -710,7 +778,10 @@ async fn iso_raw(
             if headers.get(header::RANGE).is_some() {
                 return Response::builder()
                     .status(StatusCode::RANGE_NOT_SATISFIABLE)
-                    .header(header::CONTENT_RANGE, format!("bytes */{}", meta.size_bytes))
+                    .header(
+                        header::CONTENT_RANGE,
+                        format!("bytes */{}", meta.size_bytes),
+                    )
                     .body(Body::empty())
                     .unwrap();
             }
@@ -1050,8 +1121,16 @@ async fn api_storage_disk(State(state): State<AppState>) -> Json<serde_json::Val
 
 async fn api_branding_upload(
     State(state): State<AppState>,
+    AxumPath(slot): AxumPath<String>,
     mut multipart: Multipart,
 ) -> Response {
+    let Some(slot) = LogoSlot::parse(&slot) else {
+        return (
+            StatusCode::BAD_REQUEST,
+            "unknown logo slot; expected light, dark, or client",
+        )
+            .into_response();
+    };
     while let Ok(Some(field)) = multipart.next_field().await {
         let name = field.name().unwrap_or("").to_string();
         if name != "file" && name != "logo" {
@@ -1072,9 +1151,7 @@ async fn api_branding_upload(
         // hitting disk. Logos are tiny by definition.
         let bytes = match field.bytes().await {
             Ok(b) => b,
-            Err(e) => {
-                return (StatusCode::BAD_REQUEST, format!("read body: {e}")).into_response()
-            }
+            Err(e) => return (StatusCode::BAD_REQUEST, format!("read body: {e}")).into_response(),
         };
         if bytes.len() > MAX_LOGO_BYTES {
             return (
@@ -1090,11 +1167,21 @@ async fn api_branding_upload(
         let Some(ext) = ext_for_mime(&mime) else {
             return (StatusCode::BAD_REQUEST, "unsupported MIME").into_response();
         };
-        match state.branding.set_logo(&mime, ext, &bytes) {
+        // The PXE "client" logo is rasterized for the boot screen; an SVG
+        // there can't be composited, so steer operators to a raster.
+        if slot == LogoSlot::Client && mime == "image/svg+xml" {
+            return (
+                StatusCode::BAD_REQUEST,
+                "the client (PXE) logo must be a raster image (PNG/JPEG/WebP/GIF); SVG can't be painted on the boot screen",
+            )
+                .into_response();
+        }
+        match state.branding.set_logo(slot, &mime, ext, &bytes) {
             Ok(filename) => {
                 return (
                     StatusCode::OK,
                     Json(json!({
+                        "slot": slot.as_str(),
                         "filename": filename,
                         "mime": mime,
                         "size_bytes": bytes.len(),
@@ -1102,21 +1189,244 @@ async fn api_branding_upload(
                 )
                     .into_response()
             }
-            Err(e) => {
-                return (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response()
-            }
+            Err(e) => return (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
         }
     }
     (StatusCode::BAD_REQUEST, "no 'file' part").into_response()
 }
 
-async fn api_branding_clear(State(state): State<AppState>) -> Response {
-    match state.branding.clear_logo() {
+async fn api_branding_clear(
+    State(state): State<AppState>,
+    AxumPath(slot): AxumPath<String>,
+) -> Response {
+    let Some(slot) = LogoSlot::parse(&slot) else {
+        return (StatusCode::BAD_REQUEST, "unknown logo slot").into_response();
+    };
+    match state.branding.clear_logo(slot) {
         Ok(()) => StatusCode::NO_CONTENT.into_response(),
         Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
     }
 }
 
+// ─── Unattended answer files (v0.5.2) ──────────────────────────────────────
+//
+// Management (list/upload/delete) is gated behind the auth middleware.
+// *Serving* the files to the booting installer is the public
+// `/unattended/*` route pair below — the installer has no session.
+
+async fn api_unattended_list(State(state): State<AppState>) -> Json<serde_json::Value> {
+    Json(json!({ "files": state.unattended.list() }))
+}
+
+async fn api_unattended_upload(
+    State(state): State<AppState>,
+    mut multipart: Multipart,
+) -> Response {
+    while let Ok(Some(field)) = multipart.next_field().await {
+        let name = field.name().unwrap_or("").to_string();
+        if name != "file" && name != "unattended" {
+            continue;
+        }
+        let filename = field.file_name().map(str::to_string).unwrap_or_default();
+        if filename.trim().is_empty() {
+            return (StatusCode::BAD_REQUEST, "missing filename on upload").into_response();
+        }
+        let bytes = match field.bytes().await {
+            Ok(b) => b,
+            Err(e) => return (StatusCode::BAD_REQUEST, format!("read body: {e}")).into_response(),
+        };
+        return match state.unattended.add(&filename, &bytes).await {
+            Ok(meta) => (StatusCode::CREATED, Json(meta)).into_response(),
+            Err(Error::Invalid(msg)) => (StatusCode::BAD_REQUEST, msg).into_response(),
+            Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
+        };
+    }
+    (StatusCode::BAD_REQUEST, "no 'file' part").into_response()
+}
+
+async fn api_unattended_delete(
+    State(state): State<AppState>,
+    AxumPath(id): AxumPath<String>,
+) -> StatusCode {
+    if state.unattended.remove(&id).await {
+        StatusCode::NO_CONTENT
+    } else {
+        StatusCode::NOT_FOUND
+    }
+}
+
+#[derive(Debug, Deserialize)]
+struct UnattendedServeQuery {
+    #[serde(default)]
+    mac: Option<String>,
+    #[serde(default)]
+    hostname: Option<String>,
+    #[serde(default)]
+    ip: Option<String>,
+}
+
+/// Public: serve a Kickstart/Preseed/answer file with `{{HOSTNAME}}` /
+/// `{{IP}}` / `{{MAC}}` substituted from the query string. Returns
+/// `text/plain` so installers (anaconda, debian-installer, Windows setup
+/// fetching over HTTP) read it verbatim.
+async fn serve_unattended(
+    State(state): State<AppState>,
+    AxumPath(id): AxumPath<String>,
+    Query(q): Query<UnattendedServeQuery>,
+) -> Response {
+    let Ok(bytes) = state.unattended.read(&id).await else {
+        return (StatusCode::NOT_FOUND, "no such unattended file").into_response();
+    };
+    let content = String::from_utf8_lossy(&bytes);
+    let rendered = render_template(
+        &content,
+        q.mac.as_deref(),
+        q.hostname.as_deref(),
+        q.ip.as_deref(),
+    );
+    text_plain(rendered)
+}
+
+/// Public: cloud-init NoCloud seed directory for Ubuntu autoinstall. The
+/// kernel arg points iPXE/cloud-init at `…/<id>/<ctx>/`; cloud-init then
+/// fetches `user-data`, `meta-data`, (and `vendor-data`). `<ctx>`
+/// base64url-encodes the per-host hostname/ip/mac so they survive the
+/// seedfrom URL (which can't carry a query string).
+async fn serve_unattended_seed(
+    State(state): State<AppState>,
+    AxumPath((id, ctx, sub)): AxumPath<(String, String, String)>,
+) -> Response {
+    let (mac, hostname, ip) = decode_seed_ctx(&ctx);
+    match sub.as_str() {
+        "user-data" => {
+            let Ok(bytes) = state.unattended.read(&id).await else {
+                return (StatusCode::NOT_FOUND, "no such unattended file").into_response();
+            };
+            let content = String::from_utf8_lossy(&bytes);
+            let rendered =
+                render_template(&content, mac.as_deref(), hostname.as_deref(), ip.as_deref());
+            text_plain(rendered)
+        }
+        "meta-data" => {
+            let host_line = hostname
+                .as_deref()
+                .map(|h| format!("local-hostname: {h}\n"))
+                .unwrap_or_default();
+            text_plain(format!("instance-id: openpxe-{id}\n{host_line}"))
+        }
+        // cloud-init probes vendor-data too; an empty 200 keeps it quiet.
+        "vendor-data" => text_plain(String::new()),
+        _ => (StatusCode::NOT_FOUND, "unknown seed resource").into_response(),
+    }
+}
+
+/// Resolve the deployment profile for a booting MAC: a host pin wins, else
+/// a queued device's Profile. `None` when neither carries one.
+fn resolve_profile(state: &AppState, mac: &str) -> Option<DeployProfile> {
+    if let Some(b) = state.hosts.lookup(mac) {
+        if !b.profile.is_empty() {
+            return Some(b.profile);
+        }
+    }
+    state.queue.profile_for_mac(mac)
+}
+
+/// Build the per-host unattended kernel arguments for a Linux entry.
+/// Returns `None` for Windows answer files / unclassified uploads (no
+/// kernel cmdline injection applies).
+fn build_unattended_args(
+    base: &str,
+    meta: &UnattendedMeta,
+    mac: Option<&str>,
+    profile: &DeployProfile,
+) -> Option<String> {
+    let base = base.trim_end_matches('/');
+    let id = &meta.id;
+    let host = profile.auto_hostname.as_deref();
+    let ip = profile.auto_ip.as_deref();
+    let query = build_query(&[("mac", mac), ("hostname", host), ("ip", ip)]);
+    match meta.kind {
+        UnattendedKind::Kickstart => Some(format!("inst.ks={base}/unattended/{id}{query}")),
+        UnattendedKind::Preseed => {
+            let mut s = format!("auto=true priority=critical url={base}/unattended/{id}{query}");
+            if let Some(h) = host {
+                s.push_str(" hostname=");
+                s.push_str(h);
+            }
+            Some(s)
+        }
+        UnattendedKind::Autoinstall => {
+            let ctx = encode_seed_ctx(mac, host, ip);
+            Some(format!(
+                "autoinstall ds=nocloud-net;s={base}/unattended/{id}/{ctx}/"
+            ))
+        }
+        UnattendedKind::AnswerFile | UnattendedKind::Unknown => None,
+    }
+}
+
+/// Build a `?k=v&…` query string from present key/value pairs, percent-
+/// encoding the values. Empty when nothing is present.
+fn build_query(pairs: &[(&str, Option<&str>)]) -> String {
+    use std::fmt::Write as _;
+    let mut out = String::new();
+    for (k, v) in pairs {
+        if let Some(val) = v {
+            out.push(if out.is_empty() { '?' } else { '&' });
+            let _ = write!(out, "{k}={}", pct_encode(val));
+        }
+    }
+    out
+}
+
+/// Minimal RFC 3986 percent-encoding for query values (unreserved set
+/// passes through; everything else becomes `%XX`).
+fn pct_encode(s: &str) -> String {
+    use std::fmt::Write as _;
+    let mut out = String::with_capacity(s.len());
+    for b in s.bytes() {
+        match b {
+            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => {
+                out.push(b as char);
+            }
+            _ => {
+                let _ = write!(out, "%{b:02X}");
+            }
+        }
+    }
+    out
+}
+
+/// Encode `(hostname, ip, mac)` into a single base64url path segment for
+/// the cloud-init seed directory. Empty values become empty fields.
+fn encode_seed_ctx(mac: Option<&str>, hostname: Option<&str>, ip: Option<&str>) -> String {
+    use base64::Engine as _;
+    let raw = format!(
+        "{}\n{}\n{}",
+        hostname.unwrap_or(""),
+        ip.unwrap_or(""),
+        mac.unwrap_or("")
+    );
+    base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(raw.as_bytes())
+}
+
+/// Inverse of [`encode_seed_ctx`]; returns `(mac, hostname, ip)`. A bad
+/// or empty segment yields all-`None` so the seed still serves (just
+/// without per-host substitution).
+fn decode_seed_ctx(ctx: &str) -> (Option<String>, Option<String>, Option<String>) {
+    use base64::Engine as _;
+    let Ok(bytes) = base64::engine::general_purpose::URL_SAFE_NO_PAD.decode(ctx.as_bytes()) else {
+        return (None, None, None);
+    };
+    let s = String::from_utf8_lossy(&bytes).into_owned();
+    let mut it = s.splitn(3, '\n');
+    let clean = |v: Option<&str>| v.map(str::to_string).filter(|x| !x.is_empty());
+    let hostname = clean(it.next());
+    let ip = clean(it.next());
+    let mac = clean(it.next());
+    (mac, hostname, ip)
+}
+
 // ─── API reference (Settings → bottom) ────────────────────────────────────
 
 async fn api_docs() -> Json<serde_json::Value> {
@@ -1212,12 +1522,12 @@ async fn api_docs() -> Json<serde_json::Value> {
                      "summary": "Current runtime settings (Windows toggle, timeout, dns hint, …)."},
                     {"method": "PUT", "path": "/api/settings",
                      "summary": "Replace runtime settings. Guards against enabling Windows when wimboot isn't bundled."},
-                    {"method": "POST", "path": "/api/branding/logo",
-                     "summary": "Upload a custom WebUI logo (multipart 'file', PNG/SVG/JPEG/WebP/GIF up to 2 MB)."},
-                    {"method": "DELETE", "path": "/api/branding/logo",
-                     "summary": "Remove the custom logo and revert to the bundled mark."},
+                    {"method": "POST", "path": "/api/branding/logo/:slot",
+                     "summary": "Upload a custom logo for a slot (light | dark | client). Multipart 'file', PNG/SVG/JPEG/WebP/GIF up to 2 MB. The client slot is raster-only."},
+                    {"method": "DELETE", "path": "/api/branding/logo/:slot",
+                     "summary": "Remove the custom logo for a slot and revert to the bundled mark."},
                     {"method": "GET", "path": "/branding/pxe-logo",
-                     "summary": "Raster form of the operator's logo for the iPXE menu's `console --picture`. SVG uploads 404 here."},
+                     "summary": "Raster form of the operator's 'client' logo for the iPXE menu's `console --picture`. Default background when unset/SVG."},
                     {"method": "GET", "path": "/api/sso",
                      "summary": "Current SAML SSO configuration."},
                     {"method": "PUT", "path": "/api/sso",
@@ -1248,13 +1558,28 @@ async fn api_docs() -> Json<serde_json::Value> {
                      "summary": "Free / used / total bytes for the volume hosting the ISO directory."},
                 ],
             },
+            {
+                "name": "Unattended answer files",
+                "endpoints": [
+                    {"method": "GET", "path": "/api/unattended",
+                     "summary": "List uploaded answer files (Kickstart / Preseed / Autoinstall / Windows answer file)."},
+                    {"method": "POST", "path": "/api/unattended",
+                     "summary": "Upload an answer file (multipart 'file', .ks/.cfg/.seed/.yaml/.yml/.xml/user-data, up to 1 MB)."},
+                    {"method": "DELETE", "path": "/api/unattended/:id",
+                     "summary": "Delete an uploaded answer file."},
+                    {"method": "GET", "path": "/unattended/:id",
+                     "summary": "Public: serve an answer file with {{HOSTNAME}}/{{IP}}/{{MAC}} substituted from the query string."},
+                ],
+            },
             {
                 "name": "Queued Deployment",
                 "endpoints": [
                     {"method": "GET", "path": "/api/queue",
-                     "summary": "List queue entries (waiting + assigned)."},
+                     "summary": "List queue entries (waiting + assigned, with any deployment profile)."},
                     {"method": "POST", "path": "/api/queue/assign",
                      "summary": "Assign a target image to queued clients. Body: { target, entry_ids }."},
+                    {"method": "PUT", "path": "/api/queue/:entry_id/profile",
+                     "summary": "Set a queued device's deployment profile. Body: { auto_hostname?, auto_ip?, unattended_file? }."},
                     {"method": "DELETE", "path": "/api/queue/:entry_id",
                      "summary": "Release a queue entry without assigning."},
                 ],
@@ -1265,7 +1590,7 @@ async fn api_docs() -> Json<serde_json::Value> {
                     {"method": "GET", "path": "/api/hosts",
                      "summary": "List per-MAC boot bindings."},
                     {"method": "POST", "path": "/api/hosts",
-                     "summary": "Pin a MAC to a boot target. Body: { mac, target, label }."},
+                     "summary": "Pin a MAC to a boot target. Body: { mac, target, label, auto_hostname?, auto_ip?, unattended_file? }."},
                     {"method": "DELETE", "path": "/api/hosts/:mac",
                      "summary": "Remove a binding."},
                     {"method": "POST", "path": "/api/hosts/:mac/wol",
@@ -1675,7 +2000,14 @@ async fn api_status(State(state): State<AppState>) -> Json<serde_json::Value> {
         "nfs_share_count": nfs_shares.len(),
         "nfs_share_reachable": nfs_reachable,
         "host_bindings": state.hosts.len(),
-        "custom_logo": state.branding.has_logo(),
+        "custom_logo": state.branding.has_any_web_logo(),
+        "branding": {
+            "light": state.branding.has_logo(LogoSlot::Light),
+            "dark": state.branding.has_logo(LogoSlot::Dark),
+            "client": state.branding.has_logo(LogoSlot::Client),
+            "rev": state.branding.logo_rev(),
+        },
+        "unattended_count": state.unattended.len(),
         "uptime_secs": uptime_secs,
         "started_at": state.started_at,
         "nic_name": state.nic_name,
@@ -1822,10 +2154,15 @@ async fn api_queue_poll(
                 entry_id=%entry_id, mac=%g.mac, target=%target,
                 "queue assignment delivered"
             );
+            // Carry `?mac=` so the per-entry handler can resolve this
+            // device's deployment profile (auto hostname/IP + unattended
+            // file) and inject the unattended kernel args, mirroring the
+            // pinned-host path.
+            let qmac = g.mac.clone();
             text_plain(format!(
                 "#!ipxe\n\
                  echo Queue assignment received: {target}\n\
-                 chain {base}/boot/{target}.ipxe || chain {base}/api/queue/poll/{entry_id}\n"
+                 chain {base}/boot/{target}.ipxe?mac={qmac} || chain {base}/api/queue/poll/{entry_id}\n"
             ))
         }
         Some(g) => {
@@ -1878,6 +2215,21 @@ async fn api_queue_assign(
     Json(json!({ "ok": true, "assigned": n, "target": body.target }))
 }
 
+async fn api_queue_set_profile(
+    State(state): State<AppState>,
+    AxumPath(entry_id): AxumPath<String>,
+    Json(body): Json<DeployProfile>,
+) -> Response {
+    let profile = body.normalized();
+    if let Err(msg) = validate_profile(&state, &profile) {
+        return (StatusCode::BAD_REQUEST, msg).into_response();
+    }
+    match state.queue.set_profile(&entry_id, profile) {
+        Some(entry) => (StatusCode::OK, Json(entry)).into_response(),
+        None => (StatusCode::NOT_FOUND, "no such queue entry").into_response(),
+    }
+}
+
 async fn api_queue_release(
     State(state): State<AppState>,
     AxumPath(entry_id): AxumPath<String>,
@@ -2016,6 +2368,11 @@ struct HostsUpsertBody {
     target: String,
     #[serde(default)]
     label: String,
+    /// v0.5.2: optional unattended-install profile. Flattened so the
+    /// front-end posts `auto_hostname` / `auto_ip` / `unattended_file`
+    /// at the top level alongside mac/target/label.
+    #[serde(default, flatten)]
+    profile: DeployProfile,
 }
 
 async fn api_hosts_upsert(
@@ -2043,10 +2400,32 @@ async fn api_hosts_upsert(
         )
             .into_response();
     }
-    let binding = state.hosts.upsert(mac, target, body.label.trim());
+    let profile = body.profile.normalized();
+    if let Err(msg) = validate_profile(&state, &profile) {
+        return (StatusCode::BAD_REQUEST, msg).into_response();
+    }
+    let binding = state.hosts.upsert(mac, target, body.label.trim(), profile);
     (StatusCode::CREATED, Json(binding)).into_response()
 }
 
+/// Shared validation for a deployment profile (host pin + queue profile):
+/// the referenced unattended file must exist, and a supplied IP must
+/// parse. Hostname is free-form (installers vary), so we only length-cap
+/// it (done in `DeployProfile::normalized`).
+fn validate_profile(state: &AppState, profile: &DeployProfile) -> Result<(), String> {
+    if let Some(id) = profile.unattended_file.as_deref() {
+        if state.unattended.get(id).is_none() {
+            return Err(format!("unknown unattended file: {id}"));
+        }
+    }
+    if let Some(ip) = profile.auto_ip.as_deref() {
+        if ip.parse::<std::net::IpAddr>().is_err() {
+            return Err(format!("auto_ip is not a valid IP address: {ip}"));
+        }
+    }
+    Ok(())
+}
+
 async fn api_hosts_remove(
     State(state): State<AppState>,
     AxumPath(mac): AxumPath<String>,
@@ -2064,10 +2443,7 @@ async fn api_hosts_remove(
 /// common "same VLAN as OpenPXE" case with zero network config. We only
 /// wake MACs that are actually bound — keeps this from being an open
 /// "spray packets at any MAC" endpoint.
-async fn api_hosts_wol(
-    State(state): State<AppState>,
-    AxumPath(mac): AxumPath<String>,
-) -> Response {
+async fn api_hosts_wol(State(state): State<AppState>, AxumPath(mac): AxumPath<String>) -> Response {
     if state.hosts.lookup(&mac).is_none() {
         return (
             StatusCode::NOT_FOUND,
@@ -2097,8 +2473,7 @@ async fn api_hosts_wol(
     // The send is a blocking std UDP call; push it off the async
     // executor.
     let mac_owned = mac.clone();
-    let result =
-        tokio::task::spawn_blocking(move || wol::wake(&mac_owned, &broadcasts)).await;
+    let result = tokio::task::spawn_blocking(move || wol::wake(&mac_owned, &broadcasts)).await;
     match result {
         Ok(Ok(n)) => {
             // Fire-and-forget notification — nice "someone woke a box"
@@ -2111,7 +2486,11 @@ async fn api_hosts_wol(
             Json(json!({ "ok": true, "broadcasts": n })).into_response()
         }
         Ok(Err(e)) => (StatusCode::BAD_REQUEST, format!("{e}")).into_response(),
-        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("wol task failed: {e}")).into_response(),
+        Err(e) => (
+            StatusCode::INTERNAL_SERVER_ERROR,
+            format!("wol task failed: {e}"),
+        )
+            .into_response(),
     }
 }
 
@@ -2122,10 +2501,7 @@ async fn api_notify_get(State(state): State<AppState>) -> Json<NotifyConfig> {
     Json(state.notify.snapshot().redacted())
 }
 
-async fn api_notify_put(
-    State(state): State<AppState>,
-    Json(cfg): Json<NotifyConfig>,
-) -> Response {
+async fn api_notify_put(State(state): State<AppState>, Json(cfg): Json<NotifyConfig>) -> Response {
     match state.notify.replace(cfg) {
         Ok(saved) => (StatusCode::OK, Json(saved.redacted())).into_response(),
         Err(e) => (StatusCode::BAD_REQUEST, format!("{e}")).into_response(),
@@ -2191,10 +2567,7 @@ async fn api_updates_check() -> Response {
                 .and_then(|v| v.as_str())
                 .unwrap_or("")
                 .to_string();
-            let update_available = version_is_newer(
-                latest_tag.trim_start_matches('v'),
-                current,
-            );
+            let update_available = version_is_newer(latest_tag.trim_start_matches('v'), current);
             Json(json!({
                 "current": current,
                 "latest": latest_tag,
@@ -2241,7 +2614,11 @@ fn gitea_releases_api_url() -> Option<String> {
 fn version_is_newer(latest: &str, current: &str) -> bool {
     fn parts(v: &str) -> Vec<u64> {
         v.split('.')
-            .map(|p| p.chars().take_while(char::is_ascii_digit).collect::<String>())
+            .map(|p| {
+                p.chars()
+                    .take_while(char::is_ascii_digit)
+                    .collect::<String>()
+            })
             .map(|s| s.parse::<u64>().unwrap_or(0))
             .collect()
     }
@@ -2331,6 +2708,107 @@ async fn api_metrics(State(state): State<AppState>) -> Response {
 mod tests {
     use super::*;
 
+    fn meta(kind: UnattendedKind) -> UnattendedMeta {
+        UnattendedMeta {
+            id: "ks1".into(),
+            filename: "f".into(),
+            kind,
+            size_bytes: 0,
+            uploaded_at: time::OffsetDateTime::UNIX_EPOCH,
+        }
+    }
+
+    #[test]
+    fn unattended_kickstart_arg_carries_query() {
+        let p = DeployProfile {
+            auto_hostname: Some("node7".into()),
+            auto_ip: Some("10.0.0.7".into()),
+            unattended_file: Some("ks1".into()),
+        };
+        let a = build_unattended_args(
+            "http://h",
+            &meta(UnattendedKind::Kickstart),
+            Some("aa:bb:cc:dd:ee:ff"),
+            &p,
+        )
+        .unwrap();
+        assert!(a.starts_with("inst.ks=http://h/unattended/ks1?"), "{a}");
+        assert!(a.contains("hostname=node7"), "{a}");
+        assert!(a.contains("ip=10.0.0.7"), "{a}");
+        // MAC colons are percent-encoded.
+        assert!(a.contains("mac=aa%3Abb%3Acc%3Add%3Aee%3Aff"), "{a}");
+    }
+
+    #[test]
+    fn unattended_preseed_appends_hostname_kernel_arg() {
+        let p = DeployProfile {
+            auto_hostname: Some("deb1".into()),
+            ..Default::default()
+        };
+        let a =
+            build_unattended_args("http://h/", &meta(UnattendedKind::Preseed), None, &p).unwrap();
+        assert!(
+            a.starts_with("auto=true priority=critical url=http://h/unattended/ks1"),
+            "{a}"
+        );
+        assert!(a.ends_with(" hostname=deb1"), "{a}");
+    }
+
+    #[test]
+    fn unattended_autoinstall_uses_nocloud_seed_dir() {
+        let p = DeployProfile {
+            auto_hostname: Some("u1".into()),
+            auto_ip: Some("10.1.1.5".into()),
+            unattended_file: Some("ks1".into()),
+        };
+        let a = build_unattended_args(
+            "http://h",
+            &meta(UnattendedKind::Autoinstall),
+            Some("aa:bb"),
+            &p,
+        )
+        .unwrap();
+        assert!(
+            a.starts_with("autoinstall ds=nocloud-net;s=http://h/unattended/ks1/"),
+            "{a}"
+        );
+        assert!(a.ends_with('/'), "seed URL must end with '/': {a}");
+        // The ctx segment round-trips back to the per-host values.
+        let ctx = a.trim_end_matches('/').rsplit('/').next().unwrap();
+        let (mac, host, ip) = decode_seed_ctx(ctx);
+        assert_eq!(mac.as_deref(), Some("aa:bb"));
+        assert_eq!(host.as_deref(), Some("u1"));
+        assert_eq!(ip.as_deref(), Some("10.1.1.5"));
+    }
+
+    #[test]
+    fn windows_answer_file_is_not_injected() {
+        let p = DeployProfile {
+            unattended_file: Some("ks1".into()),
+            ..Default::default()
+        };
+        assert!(
+            build_unattended_args("http://h", &meta(UnattendedKind::AnswerFile), None, &p)
+                .is_none()
+        );
+    }
+
+    #[test]
+    fn seed_ctx_empty_segment_decodes_to_none() {
+        let ctx = encode_seed_ctx(None, None, None);
+        let (m, h, i) = decode_seed_ctx(&ctx);
+        assert!(m.is_none() && h.is_none() && i.is_none());
+        // Garbage decodes safely to all-None.
+        let (m2, h2, i2) = decode_seed_ctx("!!!not-base64!!!");
+        assert!(m2.is_none() && h2.is_none() && i2.is_none());
+    }
+
+    #[test]
+    fn pct_encode_escapes_reserved() {
+        assert_eq!(pct_encode("aa:bb cc"), "aa%3Abb%20cc");
+        assert_eq!(pct_encode("node-7.lab_1~"), "node-7.lab_1~");
+    }
+
     #[test]
     fn version_newer_detects_updates() {
         assert!(version_is_newer("0.5.1", "0.5.0"));

crates/http-api/src/auth.rs

@@ -140,9 +140,16 @@ fn cookie_attrs(value: &str, max_age: Option<i64>) -> String {
     // never overflow i64, but clippy's `cast_possible_wrap` lint wants
     // us to be explicit. `cast_signed` is the documented form.
     let lifetime = max_age.unwrap_or_else(|| SESSION_TTL.as_secs().cast_signed());
-    format!(
-        "{SESSION_COOKIE}={value}; Path=/; HttpOnly; SameSite=Lax; Max-Age={lifetime}"
-    )
+    format!("{SESSION_COOKIE}={value}; Path=/; HttpOnly; SameSite=Lax; Max-Age={lifetime}")
+}
+
+/// Build the `Set-Cookie` header value that establishes a fresh operator
+/// session with the default 24h TTL. Exposed so the SAML ACS handler can
+/// attach an operator session to its post-login redirect, exactly as the
+/// Forms-login path does via [`login_response`].
+#[must_use]
+pub fn session_cookie(session: &str) -> String {
+    cookie_attrs(session, None)
 }
 
 fn parse_cookie(headers: &axum::http::HeaderMap) -> Option<String> {
@@ -169,9 +176,18 @@ fn is_public_path(path: &str) -> bool {
         return true;
     }
     // Auth surface and iPXE long-poll endpoints (no cookie available).
+    // The SAML SP endpoints are pre-auth by nature — the operator hasn't a
+    // session yet when they start (or arrive from) the IdP. `/api/sso`
+    // (the config GET/PUT, no trailing slash) stays gated.
     matches!(
         path,
-        "/api/setup" | "/api/login" | "/api/logout" | "/api/me"
+        "/api/setup"
+            | "/api/login"
+            | "/api/logout"
+            | "/api/me"
+            | "/api/sso/login"
+            | "/api/sso/acs"
+            | "/api/sso/metadata"
     ) || path.starts_with("/api/queue/join")
         || path.starts_with("/api/queue/poll/")
 }
@@ -222,10 +238,7 @@ pub struct SetupBody {
 /// guards against a leaked WebUI being re-bootstrapped by an attacker
 /// who's seen the deployment URL. After bootstrap, the new session
 /// cookie is set so the operator goes straight to the dashboard.
-pub async fn api_setup(
-    State(state): State<AppState>,
-    Json(body): Json<SetupBody>,
-) -> Response {
+pub async fn api_setup(State(state): State<AppState>, Json(body): Json<SetupBody>) -> Response {
     if state.admin.is_configured() {
         return (
             StatusCode::CONFLICT,
@@ -280,10 +293,7 @@ pub async fn api_login(State(state): State<AppState>, Json(body): Json<LoginBody
     login_response(StatusCode::OK, &pub_, &session)
 }
 
-pub async fn api_logout(
-    State(state): State<AppState>,
-    headers: axum::http::HeaderMap,
-) -> Response {
+pub async fn api_logout(State(state): State<AppState>, headers: axum::http::HeaderMap) -> Response {
     if let Some(t) = parse_cookie(&headers) {
         state.sessions.revoke(&t);
     }
@@ -307,7 +317,7 @@ pub async fn api_me(State(state): State<AppState>, headers: axum::http::HeaderMa
     // screens can render the FleetDM-style full-width custom logo (and
     // cache-bust it) without an extra round trip. `/api/me` is public,
     // and the logo asset is public, so this leaks nothing sensitive.
-    let has_custom_logo = state.branding.has_logo();
+    let has_custom_logo = state.branding.has_any_web_logo();
     let logo_rev = state.branding.logo_rev();
     if !state.admin.is_configured() {
         return (
@@ -449,8 +459,14 @@ mod tests {
     fn public_path_allowlist() {
         // PXE + chrome paths bypass auth.
         for p in [
-            "/", "/assets/app.js", "/boot.ipxe", "/boot/fake.ipxe",
-            "/iso/fake.iso", "/ipxe/snponly.efi", "/healthz", "/readyz",
+            "/",
+            "/assets/app.js",
+            "/boot.ipxe",
+            "/boot/fake.ipxe",
+            "/iso/fake.iso",
+            "/ipxe/snponly.efi",
+            "/healthz",
+            "/readyz",
             "/metrics",
             // v0.4.6: iPXE fetches this for `console --picture` before
             // it can possibly have a session cookie.
@@ -462,6 +478,10 @@ mod tests {
         for p in ["/api/setup", "/api/login", "/api/logout", "/api/me"] {
             assert!(is_public_path(p), "expected {p} to be public");
         }
+        // v0.5.1: SAML SP endpoints are pre-auth (no session yet).
+        for p in ["/api/sso/login", "/api/sso/acs", "/api/sso/metadata"] {
+            assert!(is_public_path(p), "expected {p} to be public");
+        }
         // iPXE long-poll endpoints are public (no cookie available).
         assert!(is_public_path("/api/queue/join"));
         assert!(is_public_path("/api/queue/poll/abc"));
@@ -483,8 +503,7 @@ mod tests {
         let mut h = axum::http::HeaderMap::new();
         h.insert(
             header::COOKIE,
-            HeaderValue::from_str(&format!("foo=bar; {SESSION_COOKIE}=abc123; baz=qux"))
-                .unwrap(),
+            HeaderValue::from_str(&format!("foo=bar; {SESSION_COOKIE}=abc123; baz=qux")).unwrap(),
         );
         assert_eq!(parse_cookie(&h).as_deref(), Some("abc123"));
         // Different name → None.

crates/http-api/src/ipxe_script.rs

@@ -460,8 +460,21 @@ pub fn render_queue_entry(base_url: &str) -> String {
 }
 
 /// Per-entry boot script (same as Phase 1, with extra_kernel_args appended).
+///
+/// `unattended_args` (v0.5.2) carries the per-host unattended-install
+/// kernel arguments (`inst.ks=…`, `auto=true … url=…`, or
+/// `autoinstall ds=nocloud-net;s=…`) when the requesting MAC has a
+/// deployment profile with an answer file selected. It's appended to the
+/// Linux kernel command line after the operator's global extra args, and
+/// ignored for Windows (wimboot) / sanboot entries which don't take a
+/// kernel cmdline.
 #[must_use]
-pub fn render_entry(entry: &BootEntry, settings: &Settings, base_url: &str) -> String {
+pub fn render_entry(
+    entry: &BootEntry,
+    settings: &Settings,
+    base_url: &str,
+    unattended_args: Option<&str>,
+) -> String {
     let mut s = String::new();
     let base = base_url.trim_end_matches('/');
     let _ = writeln!(s, "#!ipxe");
@@ -477,6 +490,12 @@ pub fn render_entry(entry: &BootEntry, settings: &Settings, base_url: &str) -> S
                 cmdline.push(' ');
                 cmdline.push_str(settings.extra_kernel_args.trim());
             }
+            if let Some(extra) = unattended_args {
+                if !extra.trim().is_empty() {
+                    cmdline.push(' ');
+                    cmdline.push_str(extra.trim());
+                }
+            }
             let _ = writeln!(s, "kernel {base}/{kernel_url} {cmdline}");
             for u in initrd_urls {
                 let _ = writeln!(s, "initrd {base}/{u}");

crates/http-api/src/lib.rs

@@ -19,6 +19,7 @@ pub mod ipxe_script;
 pub mod iso_fs;
 pub mod log_stream;
 pub mod notify;
+pub mod saml_routes;
 pub mod state;
 pub mod terminal;
 pub mod uploads;

crates/http-api/src/saml_routes.rs

@@ -0,0 +1,338 @@
+//! SAML 2.0 Service Provider HTTP endpoints (v0.5.1).
+//!
+//! * `GET  /api/sso/login`    — SP-initiated: build an AuthnRequest, record its
+//!   ID, and 302 the browser to the IdP.
+//! * `POST /api/sso/acs`      — Assertion Consumer Service: verify + validate
+//!   the IdP's `SAMLResponse`, perform the stateful checks (InResponseTo
+//!   correlation, IdP-initiated gating, assertion replay), mint an operator
+//!   session, and 302 to the dashboard. (Mirrors FleetDM's `/sso/callback`.)
+//! * `GET  /api/sso/metadata` — serve our SP metadata XML for IdP import.
+//!
+//! Stateless crypto + semantic validation live in `openpxe_core::saml`; this
+//! module owns only the HTTP glue and the in-memory state the SP needs.
+
+use std::collections::HashMap;
+use std::sync::Arc;
+use std::time::{Duration as StdDuration, Instant};
+
+use axum::{
+    body::Body,
+    extract::{Form, Query, State},
+    http::{header, StatusCode},
+    response::{IntoResponse, Response},
+};
+use base64::Engine;
+use parking_lot::Mutex;
+use serde::Deserialize;
+use time::{Duration, OffsetDateTime};
+
+use openpxe_core::saml::{self, metadata::IdpMetadata, SamlError, SpParams};
+use openpxe_core::SsoConfig;
+
+use crate::auth;
+use crate::state::AppState;
+
+/// Outstanding AuthnRequest IDs live at most this long before a matching
+/// response is considered stale (covers a slow human at the IdP login form).
+const REQUEST_TTL: StdDuration = StdDuration::from_mins(10);
+/// How long we fetch-cache IdP metadata loaded from a URL.
+const METADATA_FETCH_TIMEOUT: StdDuration = StdDuration::from_secs(10);
+
+/// In-memory SAML runtime state. Cheap to clone (Arc-shared).
+#[derive(Clone, Default)]
+pub struct SamlRuntime {
+    /// request_id → issued_at. Correlates a response's `InResponseTo` to a
+    /// request *we* actually sent (replay / CSRF defense for SP-initiated).
+    outstanding: Arc<Mutex<HashMap<String, Instant>>>,
+    /// assertion_id → expiry. A consumed assertion may not be replayed.
+    consumed: Arc<Mutex<HashMap<String, Instant>>>,
+    /// Cache of IdP metadata fetched from a URL: (url, parsed).
+    metadata_cache: Arc<Mutex<Option<(String, IdpMetadata)>>>,
+}
+
+impl SamlRuntime {
+    /// Record an AuthnRequest we just sent.
+    pub fn register_request(&self, id: &str) {
+        let mut g = self.outstanding.lock();
+        prune(&mut g);
+        g.insert(id.to_owned(), Instant::now());
+    }
+
+    /// Consume an outstanding request ID, returning `true` if it was present
+    /// and still fresh. A miss means the response doesn't correlate to any
+    /// live request we issued.
+    pub fn take_request(&self, id: &str) -> bool {
+        let mut g = self.outstanding.lock();
+        prune(&mut g);
+        g.remove(id).is_some()
+    }
+
+    /// Record a consumed assertion. Returns `false` if it was already
+    /// consumed (a replay) — in which case the caller must reject.
+    pub fn record_assertion(&self, id: &str, expiry: OffsetDateTime) -> bool {
+        let mut g = self.consumed.lock();
+        prune(&mut g);
+        if g.contains_key(id) {
+            return false;
+        }
+        let ttl = (expiry - OffsetDateTime::now_utc())
+            .max(Duration::ZERO)
+            .unsigned_abs();
+        g.insert(id.to_owned(), Instant::now() + ttl);
+        true
+    }
+
+    fn cached_metadata(&self, url: &str) -> Option<IdpMetadata> {
+        let g = self.metadata_cache.lock();
+        match &*g {
+            Some((cached_url, md)) if cached_url == url => Some(md.clone()),
+            _ => None,
+        }
+    }
+
+    fn cache_metadata(&self, url: String, md: IdpMetadata) {
+        *self.metadata_cache.lock() = Some((url, md));
+    }
+}
+
+/// Drop expired entries so neither map grows unbounded.
+fn prune(map: &mut HashMap<String, Instant>) {
+    let now = Instant::now();
+    // For the request map this over-prunes (entries store issued_at, not
+    // expiry), so cap by REQUEST_TTL; the consumed map stores absolute
+    // expiry instants. Using saturating logic keeps both correct: request
+    // entries older than REQUEST_TTL go, consumed entries past expiry go.
+    map.retain(|_, &mut t| now.saturating_duration_since(t) < REQUEST_TTL || t > now);
+}
+
+// ─── GET /api/sso/login ───────────────────────────────────────────────────
+
+#[derive(Debug, Deserialize)]
+pub struct LoginQuery {
+    /// Optional local path to return to after login (becomes RelayState).
+    #[serde(default)]
+    pub next: Option<String>,
+}
+
+pub async fn sso_login(State(state): State<AppState>, Query(q): Query<LoginQuery>) -> Response {
+    let cfg = state.sso.snapshot();
+    if !cfg.is_usable() {
+        return redirect("/?sso_error=unavailable");
+    }
+    let idp = match resolve_idp_metadata(&state, &cfg).await {
+        Ok(m) => m,
+        Err(e) => {
+            tracing::warn!(target: "openpxe::saml", "sso_login: metadata unavailable: {e}");
+            return redirect("/?sso_error=metadata");
+        }
+    };
+    let Some(dest) = idp.sso_destination().map(str::to_owned) else {
+        tracing::warn!(target: "openpxe::saml", "sso_login: IdP metadata has no SSO endpoint");
+        return redirect("/?sso_error=metadata");
+    };
+    let sp = sp_params(&state, &cfg);
+    let relay = safe_local_path(q.next.as_deref());
+    match saml::authn_request::build(&sp, &dest, Some(&relay)) {
+        Ok(req) => {
+            state.saml.register_request(&req.id);
+            redirect(&req.location)
+        }
+        Err(e) => {
+            tracing::warn!(target: "openpxe::saml", "sso_login: build AuthnRequest failed: {e}");
+            redirect("/?sso_error=request")
+        }
+    }
+}
+
+// ─── POST /api/sso/acs ──────────────────────────────────────────────────────
+
+#[derive(Debug, Deserialize)]
+pub struct AcsForm {
+    #[serde(rename = "SAMLResponse")]
+    pub saml_response: String,
+    #[serde(rename = "RelayState", default)]
+    pub relay_state: Option<String>,
+}
+
+pub async fn sso_acs(State(state): State<AppState>, Form(form): Form<AcsForm>) -> Response {
+    let cfg = state.sso.snapshot();
+    if !cfg.is_usable() {
+        return redirect("/?sso_error=unavailable");
+    }
+    let xml = match base64::engine::general_purpose::STANDARD.decode(form.saml_response.as_bytes())
+    {
+        Ok(bytes) => String::from_utf8_lossy(&bytes).into_owned(),
+        Err(e) => {
+            tracing::warn!(target: "openpxe::saml", "acs: base64 decode failed: {e}");
+            return redirect("/?sso_error=1");
+        }
+    };
+    let idp = match resolve_idp_metadata(&state, &cfg).await {
+        Ok(m) => m,
+        Err(e) => {
+            tracing::warn!(target: "openpxe::saml", "acs: metadata unavailable: {e}");
+            return redirect("/?sso_error=metadata");
+        }
+    };
+    let sp = sp_params(&state, &cfg);
+
+    // Signature verification + semantic checks are CPU-bound — keep them off
+    // the async executor.
+    let now = OffsetDateTime::now_utc();
+    let skew = Duration::seconds(saml::DEFAULT_CLOCK_SKEW_SECS);
+    let verify = {
+        let xml = xml.clone();
+        let sp = sp.clone();
+        tokio::task::spawn_blocking(move || saml::response::consume(&xml, &sp, &idp, now, skew))
+            .await
+    };
+    let verified = match verify {
+        Ok(Ok(v)) => v,
+        Ok(Err(e)) => {
+            // Never leak which specific check failed to the browser.
+            tracing::warn!(target: "openpxe::saml", "acs: response rejected: {e}");
+            return redirect("/?sso_error=1");
+        }
+        Err(join) => {
+            tracing::error!(target: "openpxe::saml", "acs: verify task panicked: {join}");
+            return redirect("/?sso_error=1");
+        }
+    };
+
+    // Stateful checks the core deliberately left to us.
+    match &verified.in_response_to {
+        Some(id) => {
+            if !state.saml.take_request(id) {
+                tracing::warn!(target: "openpxe::saml", "acs: InResponseTo matches no live request");
+                return redirect("/?sso_error=1");
+            }
+        }
+        None => {
+            if !cfg.allow_idp_initiated {
+                tracing::warn!(target: "openpxe::saml", "acs: IdP-initiated login is disabled");
+                return redirect("/?sso_error=idp_initiated");
+            }
+        }
+    }
+    if !state
+        .saml
+        .record_assertion(&verified.assertion_id, verified.assertion_expiry)
+    {
+        tracing::warn!(target: "openpxe::saml", "acs: assertion replay rejected");
+        return redirect("/?sso_error=1");
+    }
+
+    // Success → mint an operator session keyed to the verified email.
+    let session = state.sessions.create(&verified.principal.email);
+    tracing::info!(
+        target: "openpxe::saml",
+        email = %verified.principal.email,
+        idp_initiated = verified.in_response_to.is_none(),
+        "SAML SSO sign-in"
+    );
+    // safe_local_path already maps None / unsafe values to "/".
+    let relay = safe_local_path(form.relay_state.as_deref());
+    redirect_with_session(&relay, &session)
+}
+
+// ─── GET /api/sso/metadata ──────────────────────────────────────────────────
+
+pub async fn sso_metadata(State(state): State<AppState>) -> Response {
+    let cfg = state.sso.snapshot();
+    let sp = sp_params(&state, &cfg);
+    let xml = saml::metadata::build_sp_metadata(&sp);
+    (
+        StatusCode::OK,
+        [(header::CONTENT_TYPE, "application/samlmetadata+xml")],
+        xml,
+    )
+        .into_response()
+}
+
+// ─── helpers ────────────────────────────────────────────────────────────────
+
+/// Derive runtime SP parameters from config + the advertised public base URL.
+fn sp_params(state: &AppState, cfg: &SsoConfig) -> SpParams {
+    let base = state.public_base_url.trim_end_matches('/');
+    let entity_id = if cfg.entity_id.trim().is_empty() {
+        base.to_owned()
+    } else {
+        cfg.entity_id.trim().to_owned()
+    };
+    SpParams {
+        entity_id,
+        acs_url: format!("{base}/api/sso/acs"),
+    }
+}
+
+/// Resolve the IdP metadata: prefer the metadata URL (fetched + cached) per
+/// the "URL wins" rule, else parse the pasted XML.
+async fn resolve_idp_metadata(state: &AppState, cfg: &SsoConfig) -> Result<IdpMetadata, SamlError> {
+    let url = cfg.metadata_url.trim();
+    if !url.is_empty() {
+        if let Some(md) = state.saml.cached_metadata(url) {
+            return Ok(md);
+        }
+        let body = fetch_metadata(url).await?;
+        let md = IdpMetadata::parse(&body)?;
+        state.saml.cache_metadata(url.to_owned(), md.clone());
+        return Ok(md);
+    }
+    if !cfg.metadata.trim().is_empty() {
+        return IdpMetadata::parse(&cfg.metadata);
+    }
+    Err(SamlError::Metadata("no metadata source configured".into()))
+}
+
+async fn fetch_metadata(url: &str) -> Result<String, SamlError> {
+    let client = reqwest::Client::builder()
+        .timeout(METADATA_FETCH_TIMEOUT)
+        .build()
+        .map_err(|e| SamlError::Metadata(format!("http client: {e}")))?;
+    let resp = client
+        .get(url)
+        .send()
+        .await
+        .map_err(|e| SamlError::Metadata(format!("fetch {url}: {e}")))?;
+    if !resp.status().is_success() {
+        return Err(SamlError::Metadata(format!(
+            "fetch {url}: HTTP {}",
+            resp.status()
+        )));
+    }
+    resp.text()
+        .await
+        .map_err(|e| SamlError::Metadata(format!("read {url}: {e}")))
+}
+
+/// Only permit a same-site path (single leading slash) as a redirect target —
+/// blocks open-redirect / protocol-relative (`//evil.com`) abuse of RelayState.
+fn safe_local_path(p: Option<&str>) -> String {
+    match p {
+        Some(p) if p.starts_with('/') && !p.starts_with("//") => p.to_owned(),
+        _ => "/".to_owned(),
+    }
+}
+
+fn redirect(location: &str) -> Response {
+    Response::builder()
+        .status(StatusCode::FOUND)
+        .header(header::LOCATION, location)
+        .body(Body::empty())
+        .map_or_else(
+            |_| StatusCode::INTERNAL_SERVER_ERROR.into_response(),
+            IntoResponse::into_response,
+        )
+}
+
+fn redirect_with_session(location: &str, session: &str) -> Response {
+    Response::builder()
+        .status(StatusCode::FOUND)
+        .header(header::LOCATION, location)
+        .header(header::SET_COOKIE, auth::session_cookie(session))
+        .body(Body::empty())
+        .map_or_else(
+            |_| StatusCode::INTERNAL_SERVER_ERROR.into_response(),
+            IntoResponse::into_response,
+        )
+}

crates/http-api/src/state.rs

@@ -1,10 +1,11 @@
-use crate::uploads::UploadSessions;
 use crate::auth::SessionStore;
+use crate::saml_routes::SamlRuntime;
+use crate::uploads::UploadSessions;
 use openpxe_core::{
     AdminStore, BootLog, BrandingStore, ClientRegistry, DeploymentQueue, HostBindings, LogBus,
     Metrics, NotifyStore, SettingsStore, SsoStore,
 };
-use openpxe_iso_store::{IsoStore, NfsShareManager, SmbManager, SmbShareManager};
+use openpxe_iso_store::{IsoStore, NfsShareManager, SmbManager, SmbShareManager, UnattendedStore};
 use std::sync::Arc;
 use time::OffsetDateTime;
 
@@ -34,9 +35,13 @@ pub struct AppState {
     /// process restart (sessions are tied to UI state, not persisted —
     /// matches Sonarr/Radarr behaviour).
     pub sessions: SessionStore,
-    /// SAML SSO configuration. v0.4.5 stores it; the actual SSO login
-    /// flow ships in a later release.
+    /// SAML SSO configuration (persisted IdP metadata, Entity ID, toggles).
     pub sso: SsoStore,
+    /// v0.5.1: in-memory SAML runtime state — outstanding AuthnRequest IDs
+    /// (for InResponseTo correlation), consumed-assertion replay guard, and
+    /// a cache of fetched IdP metadata. Tied to process lifetime, like
+    /// `sessions`; a restart simply invalidates any in-flight SSO login.
+    pub saml: SamlRuntime,
     /// v0.5.0: webhook / email notification config (Slack/Teams/Discord/
     /// SMTP). Drives the fire-and-forget pings on boot events and powers
     /// the Advanced tab's config + "Send test" button.
@@ -62,6 +67,11 @@ pub struct AppState {
     /// In-process (no subprocess); supports HTTP Range requests on
     /// NFS-sourced ISOs because NFSv3 READ3 takes an explicit offset.
     pub nfs_shares: NfsShareManager,
+    /// v0.5.2: uploaded unattended-install answer files (Kickstart /
+    /// Preseed / Autoinstall / Windows answer files). Served on demand to
+    /// booting clients with per-host hostname/IP/MAC templating; lives in
+    /// its own directory, never the ISO listing or PXE menu.
+    pub unattended: UnattendedStore,
     /// Browser chunked upload state. Multipart uploads still go straight
     /// through `IsoStore`, but the UI uses sessions so large ISO transfers
     /// can show deterministic progress and leave visible partial files.

crates/http-api/tests/full_flow.rs

@@ -96,6 +96,8 @@ async fn build_state() -> (AppState, tempfile::TempDir) {
     let settings = SettingsStore::load_or_default(dir.path());
     let smb_shares = SmbShareManager::new(dir.path(), iso_store.clone());
     let nfs_shares = NfsShareManager::new(dir.path(), iso_store.clone());
+    let unattended = openpxe_iso_store::UnattendedStore::new(dir.path().join("unattended"));
+    unattended.ensure_dir().await.unwrap();
     let log_bus = LogBus::new(64);
     let hosts = HostBindings::load_or_default(dir.path());
     let boot_log = openpxe_core::BootLog::load_or_default(dir.path());
@@ -116,11 +118,13 @@ async fn build_state() -> (AppState, tempfile::TempDir) {
         admin,
         sessions,
         sso,
+        saml: openpxe_http_api::saml_routes::SamlRuntime::default(),
         notify,
         metrics,
         smb: None,
         smb_shares,
         nfs_shares,
+        unattended,
         uploads: openpxe_http_api::uploads::UploadSessions::default(),
         log_bus,
         started_at: time::OffsetDateTime::now_utc(),
@@ -559,7 +563,10 @@ async fn notify_config_round_trips_and_redacts_smtp_password() {
     assert_eq!(v["kind"], "smtp");
     let pw = v["smtp_password"].as_str().unwrap_or("");
     assert_ne!(pw, "s3cret", "raw password must never be returned");
-    assert!(!pw.is_empty(), "a set password should surface as a sentinel");
+    assert!(
+        !pw.is_empty(),
+        "a set password should surface as a sentinel"
+    );
 }
 
 #[tokio::test]
@@ -1484,7 +1491,8 @@ async fn api_docs_lists_known_endpoints() {
         "/api/isos",
         "/api/isos/:id/category",
         "/api/storage/disk",
-        "/api/branding/logo",
+        "/api/branding/logo/:slot",
+        "/api/unattended",
         "/api/boot-log",
         "/metrics",
     ] {
@@ -1505,7 +1513,7 @@ async fn branding_clear_when_no_logo_is_no_content() {
         .oneshot(
             Request::builder()
                 .method("DELETE")
-                .uri("/api/branding/logo")
+                .uri("/api/branding/logo/dark")
                 .body(Body::empty())
                 .unwrap(),
         )
@@ -1551,7 +1559,11 @@ async fn put_json(router: &axum::Router, path: &str, body: &str) -> (StatusCode,
 
 // ─── v0.4.5: Forms auth + SSO ─────────────────────────────────────────────
 
-async fn post_collect(router: &axum::Router, path: &str, body: &str) -> (StatusCode, Vec<u8>, Vec<axum::http::HeaderValue>) {
+async fn post_collect(
+    router: &axum::Router,
+    path: &str,
+    body: &str,
+) -> (StatusCode, Vec<u8>, Vec<axum::http::HeaderValue>) {
     let res = router
         .clone()
         .oneshot(
@@ -1942,6 +1954,7 @@ async fn pxe_background_falls_back_to_default_for_svg_upload() {
     state
         .branding
         .set_logo(
+            openpxe_core::LogoSlot::Client,
             "image/svg+xml",
             "svg",
             br#"<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 8 8"/>"#,
@@ -1962,7 +1975,10 @@ async fn pxe_background_falls_back_to_default_for_svg_upload() {
     let body = axum::body::to_bytes(res.into_body(), usize::MAX)
         .await
         .unwrap();
-    assert!(body.starts_with(b"\x89PNG"), "should serve default PNG for SVG");
+    assert!(
+        body.starts_with(b"\x89PNG"),
+        "should serve default PNG for SVG"
+    );
     let width = u32::from_be_bytes([body[16], body[17], body[18], body[19]]);
     assert_eq!(width, 1024);
 }
@@ -1976,7 +1992,7 @@ async fn pxe_logo_composes_to_1024x768_png() {
     let png = tiny_png();
     state
         .branding
-        .set_logo("image/png", "png", &png)
+        .set_logo(openpxe_core::LogoSlot::Client, "image/png", "png", &png)
         .unwrap();
     let app = build_router(state);
     let res = app
@@ -2019,7 +2035,7 @@ async fn pxe_logo_endpoint_is_public_after_admin_setup() {
     let png = tiny_png();
     state
         .branding
-        .set_logo("image/png", "png", &png)
+        .set_logo(openpxe_core::LogoSlot::Client, "image/png", "png", &png)
         .unwrap();
     let app = build_router(state);
     // Configure an admin so the middleware kicks in.
@@ -2034,3 +2050,508 @@ async fn pxe_logo_endpoint_is_public_after_admin_setup() {
     let (s, _) = get(&app, "/branding/pxe-logo").await;
     assert_eq!(s, StatusCode::OK);
 }
+
+// ─── v0.5.2: unattended files + deployment profiles ─────────────────────────
+
+async fn post_multipart(
+    router: &axum::Router,
+    path: &str,
+    ct: &str,
+    body: Vec<u8>,
+) -> (StatusCode, Vec<u8>) {
+    let res = router
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri(path)
+                .header("content-type", ct)
+                .body(Body::from(body))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    let status = res.status();
+    let body = axum::body::to_bytes(res.into_body(), usize::MAX)
+        .await
+        .unwrap()
+        .to_vec();
+    (status, body)
+}
+
+#[tokio::test]
+async fn unattended_upload_list_serve_and_template() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let ks = b"install\nnetwork --hostname={{HOSTNAME}} --ip={{IP}}\n%packages\n@core\n%end\n";
+    let (ct, body) = multipart_iso_body("rocky.ks", ks);
+    let (s, b) = post_multipart(&app, "/api/unattended", &ct, body).await;
+    assert_eq!(s, StatusCode::CREATED, "{}", String::from_utf8_lossy(&b));
+    let m: serde_json::Value = serde_json::from_slice(&b).unwrap();
+    assert_eq!(m["kind"], "kickstart");
+    let id = m["id"].as_str().unwrap().to_string();
+
+    let (s, b) = get(&app, "/api/unattended").await;
+    assert_eq!(s, StatusCode::OK);
+    let v: serde_json::Value = serde_json::from_slice(&b).unwrap();
+    assert_eq!(v["files"].as_array().unwrap().len(), 1);
+
+    // Public serve substitutes the query tokens.
+    let (s, b) = get(
+        &app,
+        &format!("/unattended/{id}?hostname=node7&ip=10.0.0.7"),
+    )
+    .await;
+    assert_eq!(s, StatusCode::OK);
+    let text = String::from_utf8_lossy(&b);
+    assert!(text.contains("--hostname=node7"), "got: {text}");
+    assert!(text.contains("--ip=10.0.0.7"), "got: {text}");
+    assert!(!text.contains("{{"), "tokens left unrendered: {text}");
+
+    // Delete.
+    let res = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("DELETE")
+                .uri(format!("/api/unattended/{id}"))
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(res.status(), StatusCode::NO_CONTENT);
+    let (_, b) = get(&app, "/api/unattended").await;
+    let v: serde_json::Value = serde_json::from_slice(&b).unwrap();
+    assert_eq!(v["files"].as_array().unwrap().len(), 0);
+}
+
+#[tokio::test]
+async fn unattended_upload_rejects_bad_type() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (ct, body) = multipart_iso_body("evil.sh", b"#!/bin/sh\n");
+    let (s, _) = post_multipart(&app, "/api/unattended", &ct, body).await;
+    assert_eq!(s, StatusCode::BAD_REQUEST);
+}
+
+#[tokio::test]
+async fn host_pin_with_unattended_injects_kickstart_arg() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state.clone());
+    // Upload a Linux ISO → synthesises the `fake-alpine-linux` LinuxKernel entry.
+    let (ct, body) = multipart_iso_body("fake-alpine.iso", &fake_alpine_iso());
+    let (s, _) = post_multipart(&app, "/api/isos", &ct, body).await;
+    assert_eq!(s, StatusCode::CREATED);
+    // Upload a kickstart.
+    let (ct, body) = multipart_iso_body("ks.ks", b"install\n%packages\n@core\n%end\n");
+    let (s, b) = post_multipart(&app, "/api/unattended", &ct, body).await;
+    assert_eq!(s, StatusCode::CREATED);
+    let ks_id = serde_json::from_slice::<serde_json::Value>(&b).unwrap()["id"]
+        .as_str()
+        .unwrap()
+        .to_string();
+    // Pin a MAC to the Linux entry with the unattended profile.
+    let mac = "aa:bb:cc:dd:ee:01";
+    let pin = format!(
+        r#"{{"mac":"{mac}","target":"fake-alpine-linux","label":"lab","auto_hostname":"node7","auto_ip":"10.0.0.7","unattended_file":"{ks_id}"}}"#
+    );
+    let (s, b) = post_json(&app, "/api/hosts", &pin).await;
+    assert_eq!(s, StatusCode::CREATED, "{}", String::from_utf8_lossy(&b));
+    // Boot the entry as that MAC; the kernel line should carry inst.ks=.
+    let (s, b) = get(&app, &format!("/boot/fake-alpine-linux.ipxe?mac={mac}")).await;
+    assert_eq!(s, StatusCode::OK);
+    let script = String::from_utf8_lossy(&b);
+    assert!(
+        script.contains("inst.ks="),
+        "no kickstart arg injected:\n{script}"
+    );
+    assert!(
+        script.contains("hostname=node7"),
+        "hostname not passed:\n{script}"
+    );
+}
+
+#[tokio::test]
+async fn host_pin_rejects_unknown_unattended_file() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state.clone());
+    let (ct, body) = multipart_iso_body("fake-alpine.iso", &fake_alpine_iso());
+    let (s, _) = post_multipart(&app, "/api/isos", &ct, body).await;
+    assert_eq!(s, StatusCode::CREATED);
+    let pin = r#"{"mac":"aa:bb:cc:dd:ee:02","target":"fake-alpine-linux","unattended_file":"does-not-exist"}"#;
+    let (s, _) = post_json(&app, "/api/hosts", pin).await;
+    assert_eq!(s, StatusCode::BAD_REQUEST);
+}
+
+#[tokio::test]
+async fn host_pin_rejects_bad_auto_ip() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state.clone());
+    let (ct, body) = multipart_iso_body("fake-alpine.iso", &fake_alpine_iso());
+    let (s, _) = post_multipart(&app, "/api/isos", &ct, body).await;
+    assert_eq!(s, StatusCode::CREATED);
+    let pin = r#"{"mac":"aa:bb:cc:dd:ee:03","target":"fake-alpine-linux","auto_ip":"not-an-ip"}"#;
+    let (s, _) = post_json(&app, "/api/hosts", pin).await;
+    assert_eq!(s, StatusCode::BAD_REQUEST);
+}
+
+#[tokio::test]
+async fn per_theme_logo_and_favicon_serve() {
+    let (state, _dir) = build_state().await;
+    // Light slot only; dark falls back to it, favicon stays bundled.
+    let png = tiny_png();
+    state
+        .branding
+        .set_logo(openpxe_core::LogoSlot::Light, "image/png", "png", &png)
+        .unwrap();
+    let app = build_router(state);
+    // Light theme → the uploaded PNG.
+    let (s, b) = get(&app, "/assets/logo.svg?theme=light").await;
+    assert_eq!(s, StatusCode::OK);
+    assert!(b.starts_with(b"\x89PNG"), "light slot should serve the PNG");
+    // Dark theme → falls back to the light PNG (only slot set).
+    let (s, b) = get(&app, "/assets/logo.svg?theme=dark").await;
+    assert_eq!(s, StatusCode::OK);
+    assert!(
+        b.starts_with(b"\x89PNG"),
+        "dark should fall back to light PNG"
+    );
+    // Favicon is always the bundled SVG, never the custom raster.
+    let (s, b) = get(&app, "/assets/favicon.svg").await;
+    assert_eq!(s, StatusCode::OK);
+    let txt = String::from_utf8_lossy(&b);
+    assert!(txt.contains("<svg"), "favicon must be the bundled SVG mark");
+}
+
+#[tokio::test]
+async fn branding_slot_rejects_unknown_and_client_svg() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    // Unknown slot name → 400.
+    let (ct, body) = multipart_iso_body("logo.png", &tiny_png());
+    let (s, _) = post_multipart(&app, "/api/branding/logo/sideways", &ct, body).await;
+    assert_eq!(s, StatusCode::BAD_REQUEST);
+    // SVG into the client (PXE) slot → 400 (raster-only).
+    let svg = br#"<svg xmlns="http://www.w3.org/2000/svg"/>"#;
+    let boundary = "----OpenPxeTestBoundary1234";
+    let mut b = Vec::new();
+    b.extend_from_slice(format!("--{boundary}\r\n").as_bytes());
+    b.extend_from_slice(b"Content-Disposition: form-data; name=\"file\"; filename=\"l.svg\"\r\n");
+    b.extend_from_slice(b"Content-Type: image/svg+xml\r\n\r\n");
+    b.extend_from_slice(svg);
+    b.extend_from_slice(format!("\r\n--{boundary}--\r\n").as_bytes());
+    let ct = format!("multipart/form-data; boundary={boundary}");
+    let (s, _) = post_multipart(&app, "/api/branding/logo/client", &ct, b).await;
+    assert_eq!(s, StatusCode::BAD_REQUEST);
+}
+
+// ─── v0.5.1: SAML SSO flow ──────────────────────────────────────────────────
+//
+// The core crate exhaustively tests signature verification + semantic
+// validation (crates/core/src/saml/tests.rs). These integration tests cover
+// the HTTP wiring the core can't: routing, base64 decode, session minting,
+// the InResponseTo / IdP-initiated gating, and assertion-replay rejection.
+
+use base64::Engine as _;
+use openpxe_core::SsoConfig;
+use time::format_description::well_known::Rfc3339;
+use time::{Duration as TimeDuration, OffsetDateTime};
+
+const SP_BASE: &str = "http://127.0.0.1"; // build_state's public_base_url
+const SP_ACS: &str = "http://127.0.0.1/api/sso/acs";
+const IDP_ENTITY: &str = "https://idp.test/realms/fleet";
+const IDP_SSO: &str = "https://idp.test/realms/fleet/protocol/saml";
+
+struct TestIdp {
+    cert_b64: String,
+    key_pem: String,
+}
+
+fn make_idp() -> TestIdp {
+    let ck = rcgen::generate_simple_self_signed(vec!["idp.test".to_string()]).unwrap();
+    let der = ck.cert.der().as_ref().to_vec();
+    TestIdp {
+        cert_b64: base64::engine::general_purpose::STANDARD.encode(der),
+        key_pem: ck.key_pair.serialize_pem(),
+    }
+}
+
+fn idp_metadata_xml(cert_b64: &str) -> String {
+    format!(
+        r#"<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" entityID="{IDP_ENTITY}">
+  <md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+    <md:KeyDescriptor use="signing"><ds:KeyInfo><ds:X509Data><ds:X509Certificate>{cert_b64}</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor>
+    <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="{IDP_SSO}"/>
+  </md:IDPSSODescriptor>
+</md:EntityDescriptor>"#
+    )
+}
+
+/// Build + sign a SAMLResponse with the test IdP key. `in_response_to: None`
+/// makes it an unsolicited (IdP-initiated) response.
+fn signed_response(idp: &TestIdp, in_response_to: Option<&str>) -> String {
+    let now = OffsetDateTime::now_utc().replace_nanosecond(0).unwrap();
+    let fmt = |t: OffsetDateTime| t.format(&Rfc3339).unwrap();
+    let irt = in_response_to
+        .map(|v| format!(r#" InResponseTo="{v}""#))
+        .unwrap_or_default();
+    let template = format!(
+        r##"<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_resp1" Version="2.0" IssueInstant="{now}" Destination="{SP_ACS}"{irt}>
+  <saml:Issuer>{IDP_ENTITY}</saml:Issuer>
+  <samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>
+  <saml:Assertion ID="_assertion1" Version="2.0" IssueInstant="{now}">
+    <saml:Issuer>{IDP_ENTITY}</saml:Issuer>
+    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+      <ds:SignedInfo>
+        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+        <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256"/>
+        <ds:Reference URI="#_assertion1">
+          <ds:Transforms>
+            <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
+            <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+          </ds:Transforms>
+          <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
+          <ds:DigestValue></ds:DigestValue>
+        </ds:Reference>
+      </ds:SignedInfo>
+      <ds:SignatureValue></ds:SignatureValue>
+    </ds:Signature>
+    <saml:Subject>
+      <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">[email protected]</saml:NameID>
+      <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
+        <saml:SubjectConfirmationData Recipient="{SP_ACS}" NotOnOrAfter="{noa}"{irt}/>
+      </saml:SubjectConfirmation>
+    </saml:Subject>
+    <saml:Conditions NotBefore="{nb}" NotOnOrAfter="{noa}">
+      <saml:AudienceRestriction><saml:Audience>{SP_BASE}</saml:Audience></saml:AudienceRestriction>
+    </saml:Conditions>
+    <saml:AuthnStatement AuthnInstant="{now}" SessionIndex="sess-1">
+      <saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef></saml:AuthnContext>
+    </saml:AuthnStatement>
+  </saml:Assertion>
+</samlp:Response>"##,
+        now = fmt(now),
+        nb = fmt(now - TimeDuration::minutes(5)),
+        noa = fmt(now + TimeDuration::hours(1)),
+    );
+    let key = bergshamra::keys::loader::load_pem_auto(idp.key_pem.as_bytes(), None).unwrap();
+    let mut km = bergshamra::keys::KeysManager::new();
+    km.add_key(key);
+    let ctx = bergshamra::DsigContext::new(km);
+    bergshamra::sign(&ctx, &template).unwrap()
+}
+
+fn urlencode(s: &str) -> String {
+    let mut out = String::with_capacity(s.len() * 3);
+    for b in s.bytes() {
+        match b {
+            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => {
+                out.push(b as char);
+            }
+            _ => {
+                out.push('%');
+                out.push(
+                    char::from_digit((b >> 4) as u32, 16)
+                        .unwrap()
+                        .to_ascii_uppercase(),
+                );
+                out.push(
+                    char::from_digit((b & 0xf) as u32, 16)
+                        .unwrap()
+                        .to_ascii_uppercase(),
+                );
+            }
+        }
+    }
+    out
+}
+
+fn configure_sso(state: &AppState, metadata: String, allow_idp_initiated: bool) {
+    state
+        .sso
+        .replace(SsoConfig {
+            enabled: true,
+            idp_name: "Test IdP".into(),
+            idp_logo_url: String::new(),
+            metadata,
+            metadata_url: String::new(),
+            entity_id: String::new(),
+            allow_idp_initiated,
+        })
+        .unwrap();
+}
+
+async fn post_acs(router: &axum::Router, signed_xml: &str) -> axum::response::Response {
+    let b64 = base64::engine::general_purpose::STANDARD.encode(signed_xml.as_bytes());
+    let body = format!("SAMLResponse={}", urlencode(&b64));
+    router
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri("/api/sso/acs")
+                .header("content-type", "application/x-www-form-urlencoded")
+                .body(Body::from(body))
+                .unwrap(),
+        )
+        .await
+        .unwrap()
+}
+
+fn has_session_cookie(resp: &axum::response::Response) -> bool {
+    resp.headers().get_all(header::SET_COOKIE).iter().any(|v| {
+        let s = v.to_str().unwrap_or("");
+        s.starts_with("openpxe_session=")
+            && !s.contains("openpxe_session=;")
+            && !s.contains("Max-Age=0")
+    })
+}
+
+fn location(resp: &axum::response::Response) -> String {
+    resp.headers()
+        .get(header::LOCATION)
+        .and_then(|v| v.to_str().ok())
+        .unwrap_or("")
+        .to_owned()
+}
+
+#[tokio::test]
+async fn sso_login_redirects_to_idp() {
+    let (state, _dir) = build_state().await;
+    let idp = make_idp();
+    configure_sso(&state, idp_metadata_xml(&idp.cert_b64), false);
+    let app = build_router(state);
+    let resp = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .uri("/api/sso/login")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), StatusCode::FOUND);
+    let loc = location(&resp);
+    assert!(loc.starts_with(IDP_SSO), "redirect to IdP, got {loc}");
+    assert!(
+        loc.contains("SAMLRequest="),
+        "carries SAMLRequest, got {loc}"
+    );
+}
+
+#[tokio::test]
+async fn sso_login_unavailable_when_disabled() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state); // SSO never configured
+    let resp = app
+        .oneshot(
+            Request::builder()
+                .uri("/api/sso/login")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), StatusCode::FOUND);
+    assert!(location(&resp).contains("sso_error"));
+}
+
+#[tokio::test]
+async fn sso_metadata_is_served() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (status, body) = get(&app, "/api/sso/metadata").await;
+    assert_eq!(status, StatusCode::OK);
+    let xml = String::from_utf8(body).unwrap();
+    assert!(xml.contains("SPSSODescriptor"));
+    assert!(xml.contains(SP_ACS));
+    assert!(xml.contains(SP_BASE));
+}
+
+#[tokio::test]
+async fn acs_idp_initiated_mints_session() {
+    let (state, _dir) = build_state().await;
+    let idp = make_idp();
+    configure_sso(&state, idp_metadata_xml(&idp.cert_b64), true);
+    let app = build_router(state);
+    let signed = signed_response(&idp, None);
+    let resp = post_acs(&app, &signed).await;
+    assert_eq!(resp.status(), StatusCode::FOUND);
+    assert_eq!(location(&resp), "/");
+    assert!(
+        has_session_cookie(&resp),
+        "ACS must set an operator session cookie"
+    );
+}
+
+#[tokio::test]
+async fn acs_idp_initiated_blocked_when_disabled() {
+    let (state, _dir) = build_state().await;
+    let idp = make_idp();
+    configure_sso(&state, idp_metadata_xml(&idp.cert_b64), false); // gate OFF
+    let app = build_router(state);
+    let signed = signed_response(&idp, None);
+    let resp = post_acs(&app, &signed).await;
+    assert_eq!(resp.status(), StatusCode::FOUND);
+    assert!(location(&resp).contains("sso_error"));
+    assert!(
+        !has_session_cookie(&resp),
+        "no session when IdP-initiated is disabled"
+    );
+}
+
+#[tokio::test]
+async fn acs_sp_initiated_without_known_request_is_rejected() {
+    let (state, _dir) = build_state().await;
+    let idp = make_idp();
+    configure_sso(&state, idp_metadata_xml(&idp.cert_b64), true);
+    let app = build_router(state);
+    // A valid signature but an InResponseTo we never issued => reject.
+    let signed = signed_response(&idp, Some("_never-issued"));
+    let resp = post_acs(&app, &signed).await;
+    assert_eq!(resp.status(), StatusCode::FOUND);
+    assert!(location(&resp).contains("sso_error"));
+    assert!(!has_session_cookie(&resp));
+}
+
+#[tokio::test]
+async fn acs_replayed_assertion_is_rejected() {
+    let (state, _dir) = build_state().await;
+    let idp = make_idp();
+    configure_sso(&state, idp_metadata_xml(&idp.cert_b64), true);
+    let app = build_router(state);
+    let signed = signed_response(&idp, None);
+    // First use succeeds…
+    let first = post_acs(&app, &signed).await;
+    assert!(has_session_cookie(&first));
+    // …replaying the identical assertion is rejected.
+    let second = post_acs(&app, &signed).await;
+    assert_eq!(second.status(), StatusCode::FOUND);
+    assert!(location(&second).contains("sso_error"));
+    assert!(!has_session_cookie(&second));
+}
+
+#[tokio::test]
+async fn acs_garbage_is_rejected_without_500() {
+    let (state, _dir) = build_state().await;
+    let idp = make_idp();
+    configure_sso(&state, idp_metadata_xml(&idp.cert_b64), true);
+    let app = build_router(state);
+    let body = "SAMLResponse=not%20valid%20base64%21%21";
+    let resp = app
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri("/api/sso/acs")
+                .header("content-type", "application/x-www-form-urlencoded")
+                .body(Body::from(body))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), StatusCode::FOUND);
+    assert!(location(&resp).contains("sso_error"));
+    assert!(!has_session_cookie(&resp));
+}

crates/iso-store/src/lib.rs

@@ -23,6 +23,7 @@ pub mod pxe_logo;
 pub mod smb;
 pub mod smb_share;
 pub mod store;
+pub mod unattended;
 pub mod windows;
 
 pub use entry::{BootEntry, BootKind, KernelArgs};
@@ -40,7 +41,10 @@ pub use smb_share::{SmbAddRequest, SmbShare, SmbShareError, SmbShareManager, Smb
 // Range requests because NFSv3 READ3 takes an explicit offset.
 pub use nfs_share::{NfsAddRequest, NfsShare, NfsShareError, NfsShareManager, NfsStream};
 pub use store::{
-    generate_boot_entries_for, slugify_str, IsoCategory, IsoMeta, IsoSource, IsoStore,
-    UploadHandle,
+    generate_boot_entries_for, slugify_str, IsoCategory, IsoMeta, IsoSource, IsoStore, UploadHandle,
+};
+pub use unattended::{
+    classify as classify_unattended, render_template, UnattendedKind, UnattendedMeta,
+    UnattendedStore, MAX_UNATTENDED_BYTES,
 };
 pub use windows::{WimPatcher, WinPatchState};

crates/iso-store/src/unattended.rs

@@ -0,0 +1,412 @@
+//! Unattended-install answer-file store (v0.5.2).
+//!
+//! Operators upload the answer file their installer expects — a RHEL/
+//! Fedora **Kickstart**, a Debian **Preseed**, an Ubuntu **Autoinstall**
+//! cloud-init user-data, or a Windows **answer file** (`autounattend.xml`)
+//! — and OpenPXE serves it on demand to the booting machine. Files live
+//! in their own directory (`<unattended_dir>/`), deliberately *not* under
+//! `iso_dir`, so they never appear in the ISO listing or the PXE menu.
+//!
+//! Storage mirrors [`crate::store::IsoStore`]: in-memory map authoritative
+//! for the process, sidecar `*.meta.json` on disk is the source of truth on
+//! restart. The raw answer file sits beside it as `<id>.file`.
+//!
+//! Templating is applied at *serve* time, not store time — see
+//! [`render_template`]. The stored bytes are exactly what the operator
+//! uploaded; per-host hostname/IP/MAC values are substituted into a copy
+//! when the file is fetched for a specific client.
+
+use crate::store::slugify_str;
+use openpxe_core::{Error, Result};
+use parking_lot::RwLock;
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use std::path::PathBuf;
+use std::sync::Arc;
+use time::OffsetDateTime;
+
+/// Disk + memory cap for one answer file. Kickstarts/preseeds/cloud-init
+/// configs are a few KB; 1 MiB is a comfortable ceiling that still bounds
+/// abuse.
+pub const MAX_UNATTENDED_BYTES: usize = 1024 * 1024;
+
+/// Which installer the answer file targets. Drives the kernel-argument
+/// injection in the boot chain.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum UnattendedKind {
+    /// RHEL / Fedora / CentOS / AlmaLinux / Rocky — `inst.ks=<url>`.
+    Kickstart,
+    /// Debian / older Ubuntu — `auto=true priority=critical url=<url>`.
+    Preseed,
+    /// Ubuntu 20.04+ Subiquity autoinstall — cloud-init NoCloud:
+    /// `autoinstall ds=nocloud-net;s=<url>/`.
+    Autoinstall,
+    /// Windows Setup answer file (`autounattend.xml`). Served, not
+    /// auto-injected (Windows reads it from media/USB, not a kernel arg).
+    AnswerFile,
+    /// Couldn't classify — stored + served, no auto-injection.
+    #[default]
+    Unknown,
+}
+
+impl UnattendedKind {
+    #[must_use]
+    pub fn label(self) -> &'static str {
+        match self {
+            UnattendedKind::Kickstart => "Kickstart",
+            UnattendedKind::Preseed => "Preseed",
+            UnattendedKind::Autoinstall => "Autoinstall",
+            UnattendedKind::AnswerFile => "Answer file",
+            UnattendedKind::Unknown => "Unknown",
+        }
+    }
+}
+
+/// Lowercase file extension (no dot), or `None` if there isn't one.
+fn ext_lower(filename: &str) -> Option<String> {
+    std::path::Path::new(filename)
+        .extension()
+        .and_then(|e| e.to_str())
+        .map(str::to_ascii_lowercase)
+}
+
+/// Classify an upload from its filename + a peek at its content. Best
+/// effort: extension first, then a content sniff to disambiguate the
+/// `.cfg` case (both Kickstart and Preseed use it).
+#[must_use]
+pub fn classify(filename: &str, content: &[u8]) -> UnattendedKind {
+    let lower_name = filename.to_ascii_lowercase();
+    let ext = ext_lower(filename);
+    let text = String::from_utf8_lossy(&content[..content.len().min(8192)]);
+    let looks_preseed = text.contains("d-i ") || text.contains("preseed/");
+    let looks_kickstart = text.contains("%packages")
+        || text.contains("\nlang ")
+        || text.contains("\nkeyboard ")
+        || text.contains("bootloader --")
+        || text.starts_with("install");
+    let looks_cloud_init = text.contains("autoinstall")
+        || text.contains("#cloud-config")
+        || text.contains("version: 1");
+
+    match ext.as_deref() {
+        Some("ks") => return UnattendedKind::Kickstart,
+        Some("seed") => return UnattendedKind::Preseed,
+        Some("xml") => return UnattendedKind::AnswerFile,
+        Some("yaml" | "yml") => return UnattendedKind::Autoinstall,
+        Some("cfg") => {
+            return if looks_kickstart && !looks_preseed {
+                UnattendedKind::Kickstart
+            } else {
+                UnattendedKind::Preseed
+            };
+        }
+        _ => {}
+    }
+    if lower_name == "user-data" {
+        return UnattendedKind::Autoinstall;
+    }
+    // No recognised extension — fall back to content sniffing.
+    if looks_cloud_init {
+        UnattendedKind::Autoinstall
+    } else if looks_kickstart {
+        UnattendedKind::Kickstart
+    } else if looks_preseed {
+        UnattendedKind::Preseed
+    } else {
+        UnattendedKind::Unknown
+    }
+}
+
+/// True if the filename carries an extension we accept for upload. We
+/// also accept the bare `user-data` name (cloud-init NoCloud convention).
+#[must_use]
+pub fn is_accepted_filename(filename: &str) -> bool {
+    if filename.trim().eq_ignore_ascii_case("user-data") {
+        return true;
+    }
+    matches!(
+        ext_lower(filename).as_deref(),
+        Some("ks" | "cfg" | "seed" | "yaml" | "yml" | "xml")
+    )
+}
+
+/// Sidecar metadata for a stored answer file.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct UnattendedMeta {
+    /// URL-safe slug, unique within the store.
+    pub id: String,
+    /// Original upload filename, shown in the UI.
+    pub filename: String,
+    pub kind: UnattendedKind,
+    pub size_bytes: u64,
+    #[serde(with = "time::serde::rfc3339")]
+    pub uploaded_at: OffsetDateTime,
+}
+
+#[derive(Debug, Default)]
+struct Inner {
+    files: HashMap<String, UnattendedMeta>,
+}
+
+/// In-memory + on-disk answer-file registry. Cheap to clone.
+#[derive(Debug, Clone)]
+pub struct UnattendedStore {
+    dir: Arc<PathBuf>,
+    inner: Arc<RwLock<Inner>>,
+}
+
+impl UnattendedStore {
+    #[must_use]
+    pub fn new(dir: PathBuf) -> Self {
+        Self {
+            dir: Arc::new(dir),
+            inner: Arc::new(RwLock::new(Inner::default())),
+        }
+    }
+
+    pub async fn ensure_dir(&self) -> Result<()> {
+        tokio::fs::create_dir_all(self.dir.as_path()).await?;
+        Ok(())
+    }
+
+    /// Scan the directory on startup, loading every `*.meta.json` sidecar.
+    pub async fn load_from_disk(&self) -> Result<()> {
+        self.ensure_dir().await?;
+        let mut entries = tokio::fs::read_dir(self.dir.as_path()).await?;
+        while let Some(e) = entries.next_entry().await? {
+            let p = e.path();
+            let is_meta = p
+                .file_name()
+                .and_then(|s| s.to_str())
+                .is_some_and(|n| n.ends_with(".meta.json"));
+            if !is_meta {
+                continue;
+            }
+            if let Ok(text) = tokio::fs::read_to_string(&p).await {
+                if let Ok(meta) = serde_json::from_str::<UnattendedMeta>(&text) {
+                    self.inner.write().files.insert(meta.id.clone(), meta);
+                }
+            }
+        }
+        Ok(())
+    }
+
+    fn data_path(&self, id: &str) -> PathBuf {
+        self.dir.join(format!("{id}.file"))
+    }
+
+    fn meta_path(&self, id: &str) -> PathBuf {
+        self.dir.join(format!("{id}.meta.json"))
+    }
+
+    /// Mint a unique slug from the upload filename's stem.
+    fn unique_id(&self, filename: &str) -> String {
+        let stem = filename.rsplit_once('.').map_or(filename, |(s, _)| s);
+        let base = {
+            let s = slugify_str(stem);
+            if s.is_empty() {
+                "unattended".to_string()
+            } else {
+                s
+            }
+        };
+        let g = self.inner.read();
+        if !g.files.contains_key(&base) {
+            return base;
+        }
+        for n in 1.. {
+            let candidate = format!("{base}-{n}");
+            if !g.files.contains_key(&candidate) {
+                return candidate;
+            }
+        }
+        unreachable!("u64 ids exhausted")
+    }
+
+    /// Store an uploaded answer file. Validates type + size, classifies,
+    /// writes the bytes + a sidecar, and returns the new metadata.
+    pub async fn add(&self, filename: &str, bytes: &[u8]) -> Result<UnattendedMeta> {
+        if !is_accepted_filename(filename) {
+            return Err(Error::Invalid(format!(
+                "unsupported answer-file type '{filename}'. Accepted: .ks, .cfg, .seed, .yaml, .yml, .xml, user-data"
+            )));
+        }
+        if bytes.len() > MAX_UNATTENDED_BYTES {
+            return Err(Error::Invalid(format!(
+                "answer file too large ({} bytes, max {MAX_UNATTENDED_BYTES})",
+                bytes.len()
+            )));
+        }
+        self.ensure_dir().await?;
+        let kind = classify(filename, bytes);
+        let id = self.unique_id(filename);
+        let meta = UnattendedMeta {
+            id: id.clone(),
+            filename: filename.to_string(),
+            kind,
+            size_bytes: bytes.len() as u64,
+            uploaded_at: OffsetDateTime::now_utc(),
+        };
+        // Atomic data write: tmp -> rename.
+        let data = self.data_path(&id);
+        let tmp = data.with_extension("file.tmp");
+        tokio::fs::write(&tmp, bytes).await?;
+        tokio::fs::rename(&tmp, &data).await?;
+        let meta_text = serde_json::to_string_pretty(&meta).map_err(|e| Error::Other(e.into()))?;
+        tokio::fs::write(self.meta_path(&id), meta_text).await?;
+        self.inner.write().files.insert(id.clone(), meta.clone());
+        tracing::info!(
+            target: "openpxe::unattended",
+            id = %id, file = %filename, kind = ?kind, size = bytes.len(),
+            "unattended answer file stored"
+        );
+        Ok(meta)
+    }
+
+    #[must_use]
+    pub fn list(&self) -> Vec<UnattendedMeta> {
+        let g = self.inner.read();
+        let mut v: Vec<_> = g.files.values().cloned().collect();
+        v.sort_by_key(|m| std::cmp::Reverse(m.uploaded_at));
+        v
+    }
+
+    #[must_use]
+    pub fn get(&self, id: &str) -> Option<UnattendedMeta> {
+        self.inner.read().files.get(id).cloned()
+    }
+
+    /// Read the raw stored bytes for `id`.
+    pub async fn read(&self, id: &str) -> Result<Vec<u8>> {
+        if !self.inner.read().files.contains_key(id) {
+            return Err(Error::NotFound(format!("no unattended file '{id}'")));
+        }
+        let bytes = tokio::fs::read(self.data_path(id)).await?;
+        Ok(bytes)
+    }
+
+    /// Remove a file + its sidecar. Returns true if something was removed.
+    pub async fn remove(&self, id: &str) -> bool {
+        let existed = self.inner.write().files.remove(id).is_some();
+        if existed {
+            let _ = tokio::fs::remove_file(self.data_path(id)).await;
+            let _ = tokio::fs::remove_file(self.meta_path(id)).await;
+        }
+        existed
+    }
+
+    #[must_use]
+    pub fn len(&self) -> usize {
+        self.inner.read().files.len()
+    }
+
+    #[must_use]
+    pub fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+}
+
+/// Substitute the per-host template tokens into an answer file at serve
+/// time. Recognised tokens (case-sensitive, double-brace): `{{HOSTNAME}}`,
+/// `{{IP}}`, `{{MAC}}`. Unset values render as an empty string so a
+/// half-filled profile never leaves a literal `{{IP}}` in the file.
+#[must_use]
+pub fn render_template(
+    content: &str,
+    mac: Option<&str>,
+    hostname: Option<&str>,
+    ip: Option<&str>,
+) -> String {
+    content
+        .replace("{{HOSTNAME}}", hostname.unwrap_or(""))
+        .replace("{{IP}}", ip.unwrap_or(""))
+        .replace("{{MAC}}", mac.unwrap_or(""))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::tempdir;
+
+    #[test]
+    fn classify_by_extension() {
+        assert_eq!(
+            classify(" subiquity.yaml", b""),
+            UnattendedKind::Autoinstall
+        );
+        assert_eq!(classify("ks.ks", b""), UnattendedKind::Kickstart);
+        assert_eq!(classify("preseed.seed", b""), UnattendedKind::Preseed);
+        assert_eq!(
+            classify("autounattend.xml", b"<xml/>"),
+            UnattendedKind::AnswerFile
+        );
+        assert_eq!(classify("user-data", b""), UnattendedKind::Autoinstall);
+    }
+
+    #[test]
+    fn classify_cfg_by_content() {
+        assert_eq!(
+            classify("answer.cfg", b"d-i debian-installer/locale string en_US"),
+            UnattendedKind::Preseed
+        );
+        assert_eq!(
+            classify("answer.cfg", b"install\n%packages\n@core\n%end\n"),
+            UnattendedKind::Kickstart
+        );
+    }
+
+    #[test]
+    fn accepted_filenames() {
+        assert!(is_accepted_filename("a.ks"));
+        assert!(is_accepted_filename("USER-DATA".to_lowercase().as_str()));
+        assert!(is_accepted_filename("autounattend.XML"));
+        assert!(!is_accepted_filename("evil.sh"));
+        assert!(!is_accepted_filename("image.iso"));
+    }
+
+    #[test]
+    fn template_substitutes_and_blanks_unset() {
+        let body = "ip={{IP}} host={{HOSTNAME}} mac={{MAC}}";
+        let out = render_template(body, Some("aa:bb"), Some("node1"), None);
+        assert_eq!(out, "ip= host=node1 mac=aa:bb");
+    }
+
+    #[tokio::test]
+    async fn add_list_read_remove_round_trip() {
+        let dir = tempdir().unwrap();
+        let s = UnattendedStore::new(dir.path().join("unattended"));
+        let meta = s
+            .add("rocky.ks", b"install\n%packages\n@core\n%end\n")
+            .await
+            .unwrap();
+        assert_eq!(meta.kind, UnattendedKind::Kickstart);
+        assert_eq!(s.len(), 1);
+        let got = s.read(&meta.id).await.unwrap();
+        assert!(got.starts_with(b"install"));
+        // Survives a reload.
+        let s2 = UnattendedStore::new(dir.path().join("unattended"));
+        s2.load_from_disk().await.unwrap();
+        assert!(s2.get(&meta.id).is_some());
+        assert!(s2.remove(&meta.id).await);
+        assert!(s2.get(&meta.id).is_none());
+    }
+
+    #[tokio::test]
+    async fn rejects_bad_type_and_oversize() {
+        let dir = tempdir().unwrap();
+        let s = UnattendedStore::new(dir.path().join("unattended"));
+        assert!(s.add("evil.sh", b"#!/bin/sh").await.is_err());
+        let big = vec![b'x'; MAX_UNATTENDED_BYTES + 1];
+        assert!(s.add("big.ks", &big).await.is_err());
+    }
+
+    #[tokio::test]
+    async fn ids_are_unique() {
+        let dir = tempdir().unwrap();
+        let s = UnattendedStore::new(dir.path().join("unattended"));
+        let a = s.add("ks.ks", b"install").await.unwrap();
+        let b = s.add("ks.ks", b"install").await.unwrap();
+        assert_ne!(a.id, b.id);
+    }
+}

crates/openpxe/src/main.rs

@@ -99,6 +99,16 @@ async fn main() -> anyhow::Result<()> {
 
     let iso_store = IsoStore::new(config.paths.iso_dir.clone());
     iso_store.load_from_disk().await?;
+    // v0.5.2: unattended answer-file store (Kickstart/Preseed/Autoinstall/
+    // Windows answer files). Separate directory from the ISO store.
+    let unattended =
+        openpxe_iso_store::UnattendedStore::new(config.paths.unattended_dir.clone());
+    if let Err(e) = unattended.load_from_disk().await {
+        tracing::warn!(
+            target: "openpxe::unattended",
+            "could not load unattended files on startup: {e}"
+        );
+    }
     let clients = ClientRegistry::new();
     let queue = DeploymentQueue::new();
     let settings = SettingsStore::load_or_default(&config.paths.work_dir);
@@ -168,11 +178,13 @@ async fn main() -> anyhow::Result<()> {
         admin: admin.clone(),
         sessions: sessions.clone(),
         sso: sso.clone(),
+        saml: openpxe_http_api::saml_routes::SamlRuntime::default(),
         notify: notify.clone(),
         metrics: metrics.clone(),
         smb: Some(smb.clone()),
         smb_shares: smb_shares.clone(),
         nfs_shares: nfs_shares.clone(),
+        unattended: unattended.clone(),
         uploads: openpxe_http_api::uploads::UploadSessions::default(),
         log_bus: log_bus.clone(),
         started_at: time::OffsetDateTime::now_utc(),

crates/webui/src/app.css

@@ -304,6 +304,14 @@ button.ghost { background: transparent; color: var(--fg); border: 1px solid var(
 button.ghost:hover { background: var(--bg-panel-2); color: var(--fg); }
 button.danger { background: transparent; color: var(--err); border: 1px solid color-mix(in srgb, var(--err) 35%, transparent); }
 button.danger:hover { background: color-mix(in srgb, var(--err) 14%, transparent); color: var(--err); }
+/* v0.5.3: unified spacing for a card's primary action button(s). Any
+   button that sits as a direct child of a card body (Save, Bind, Add,
+   Launch, …) gets the same gap above it so it never butts against the
+   form. Inline buttons inside table rows / toolbars / logo slots /
+   modal action bars are nested deeper, so the `>` keeps them untouched.
+   Adjacent action buttons on one row (e.g. Save + Send test) share the
+   margin and stay aligned. */
+.card .body > button { margin-top: 16px; }
 
 label.field {
   display: grid; gap: 4px; margin-bottom: 14px;
@@ -797,3 +805,110 @@ tr.unbootable td:first-child { border-left: 3px solid var(--warn); }
 .logo-preview .info { flex: 1; min-width: 0; }
 .logo-preview .info .name { color: var(--fg); font-weight: 600; }
 .logo-preview .info .meta { color: var(--fg-dim); font-size: 12px; margin-top: 2px; }
+
+/* v0.5.1: collapsible "Advanced" disclosure at the bottom of Settings
+   (the former Advanced sidebar tab). A quiet, full-width toggle that
+   expands to reveal the notification + API-reference cards. */
+.advanced-disclosure { width: 100%; }
+.advanced-summary {
+  list-style: none;
+  cursor: pointer;
+  user-select: none;
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  padding: 10px 14px;
+  color: var(--fg-dim);
+  font-size: 13px;
+  font-weight: 600;
+  background: var(--bg-panel-2);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+}
+.advanced-summary:hover { color: var(--fg); }
+.advanced-summary::-webkit-details-marker { display: none; }
+.advanced-summary::before {
+  content: "▸";
+  font-size: 11px;
+  transition: transform 0.15s ease;
+}
+.advanced-disclosure[open] .advanced-summary::before { transform: rotate(90deg); }
+
+/* v0.5.1: protocol tag on a unified Remote-shares row (SMB / NFS). */
+.proto-badge {
+  display: inline-block;
+  font-size: 10px;
+  font-weight: 700;
+  letter-spacing: 0.04em;
+  padding: 1px 6px;
+  margin-right: 8px;
+  border-radius: 4px;
+  vertical-align: middle;
+  background: var(--bg-panel-2);
+  border: 1px solid var(--border);
+  color: var(--fg-dim);
+}
+
+/* ── v0.5.2: three-slot branding (light / dark / client) ─────────── */
+.logo-slots {
+  display: grid;
+  grid-template-columns: repeat(3, 1fr);
+  gap: 12px;
+}
+@media (max-width: 720px) { .logo-slots { grid-template-columns: 1fr; } }
+.logo-slot {
+  display: flex; flex-direction: column; gap: 8px;
+  padding: 12px;
+  background: var(--bg-panel-2);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+}
+.logo-slot-head { display: flex; align-items: center; justify-content: space-between; gap: 8px; }
+.logo-slot-head .name { color: var(--fg); font-weight: 600; font-size: 13px; }
+.logo-slot .swatch {
+  height: 64px;
+  display: flex; align-items: center; justify-content: center;
+  background: var(--bg); border: 1px solid var(--border);
+  border-radius: var(--radius);
+}
+.logo-slot .swatch img { max-width: 90%; max-height: 52px; object-fit: contain; }
+.logo-slot-hint { color: var(--fg-dim); font-size: 11.5px; }
+
+/* ── v0.5.2: login local/SSO separation ─────────────────────────── */
+.auth-card .auth-divider {
+  display: flex; align-items: center; text-align: center;
+  color: var(--fg-dimmer); font-size: 11px; text-transform: uppercase;
+  letter-spacing: 0.08em;
+  margin: 16px 0 12px;
+}
+.auth-card .auth-divider::before,
+.auth-card .auth-divider::after {
+  content: ""; flex: 1; height: 1px; background: var(--border-soft);
+}
+.auth-card .auth-divider span { padding: 0 10px; }
+.auth-card .sso-block .sso-btn { margin-top: 0; }
+.auth-card .sso-btn {
+  display: flex; align-items: center; justify-content: center; gap: 8px;
+}
+.auth-card .sso-btn .sso-logo { width: 16px; height: 16px; object-fit: contain; flex: none; }
+
+/* ── v0.5.2: modal (queue Profile editor) ───────────────────────── */
+.modal-overlay {
+  position: fixed; inset: 0; z-index: 200;
+  display: flex; align-items: center; justify-content: center;
+  background: rgba(0, 0, 0, 0.55);
+  padding: 24px;
+}
+.modal-box {
+  width: 100%; max-width: 520px;
+  background: var(--bg-panel);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-lg);
+  box-shadow: var(--shadow-card);
+  padding: 22px;
+}
+.modal-box h2 { margin: 0 0 14px; font-size: 16px; font-weight: 600; color: var(--fg); }
+.modal-actions {
+  display: flex; justify-content: flex-end; gap: 10px; margin-top: 18px;
+}
+.modal-actions .submit { width: auto; padding: 8px 18px; }

crates/webui/src/index.html

@@ -13,7 +13,10 @@
        on the asset handlers, the practical caching window is one
        version. -->
   <link rel="stylesheet" href="/assets/app.css?v={{ASSET_VERSION}}" />
-  <link rel="icon" type="image/svg+xml" href="/assets/logo.svg?v={{ASSET_VERSION}}&r={{LOGO_REV}}" />
+  <!-- v0.5.2: favicon is pinned to the bundled OpenPXE mark (its own
+       endpoint, decoupled from operator branding) for tab-icon
+       continuity regardless of any uploaded light/dark/client logo. -->
+  <link rel="icon" type="image/svg+xml" href="/assets/favicon.svg?v={{ASSET_VERSION}}" />
   <!-- Theme is read from localStorage *before* paint to avoid the
        dark→light flash on every navigation. Falls back to the OS
        preference and finally to dark. -->
@@ -53,7 +56,6 @@
       </a>
       <a data-view="terminal">Terminal</a>
       <a data-view="settings">Settings</a>
-      <a data-view="advanced">Advanced</a>
       <a data-view="about">About</a>
     </nav>
     <div class="footer">

deploy/docker/Dockerfile

@@ -60,35 +60,41 @@ COPY deploy/ipxe/local/ deploy/ipxe/local/
 RUN mkdir -p assets/ipxe && bash scripts/build-ipxe.sh /src/assets/ipxe
 
 ########## build openpxe ##########
-FROM rust:${RUST_VERSION}-bookworm AS build
-WORKDIR /src
-
-# v0.4.5: build a fully static musl binary (matches Bootimus v0.1.70's
-# move). The resulting `/openpxe` has no glibc dependency at all, which:
-#   - Lets the runtime stage be any Linux distro (we still ship Debian
-#     slim for the `samba` / `wimtools` / `nfs-common` shellouts, but a
-#     scratch/distroless variant becomes a one-line swap).
-#   - Cuts a class of "GLIBC_2.39 not found" surprises when running on
-#     older RHEL/Rocky hosts that don't match Debian 12's libc version.
-#   - Sidesteps cross-compilation snags (the binary is its own world).
+# v0.5.2: cross-compile the Rust binary NATIVELY — no QEMU.
 #
-# x86_64-unknown-linux-musl is fully static by default (no extra
-# RUSTFLAGS needed). musl-tools provides the linker.
+# This stage is pinned to $BUILDPLATFORM (the builder's native arch — arm64
+# on an Apple-Silicon Mac, amd64 in x86 CI), exactly like `ipxe-build`. The
+# Rust compiler therefore runs at full native speed and emits an
+# x86_64-unknown-linux-musl binary via `cargo-zigbuild`, which uses `zig cc`
+# as the cross-linker (it bundles the musl sysroot for every target, so
+# there's no fiddly cross-gcc toolchain to assemble).
+#
+# Why this replaced the old `FROM rust ... --platform=linux/amd64` build:
+# that ran the *entire* compiler under QEMU x86_64 emulation on the arm64
+# host. It was ~15x slower (a single crate took >20 min) and the emulated
+# gcc/linker intermittently SIGSEGV'd or hung mid-link. Cross-compiling
+# sidesteps emulation entirely — the build is minutes, not half an hour,
+# and is deterministic.
+#
+# The output is still a fully static musl binary with no glibc dependency,
+# so the runtime stage stays free to be any Linux distro.
+FROM --platform=$BUILDPLATFORM rust:${RUST_VERSION}-bookworm AS build
+WORKDIR /src
+# zig (via the `ziglang` pip package — cargo-zigbuild auto-discovers it as
+# `python3 -m ziglang`) supplies the x86_64 musl sysroot + linker.
+# cargo-zigbuild is the thin cargo wrapper that wires zig in as the linker.
 RUN apt-get update \
- && apt-get install -y --no-install-recommends musl-tools \
+ && apt-get install -y --no-install-recommends python3 python3-pip \
  && rm -rf /var/lib/apt/lists/* \
- && rustup target add x86_64-unknown-linux-musl
+ && rustup target add x86_64-unknown-linux-musl \
+ && pip3 install --no-cache-dir --break-system-packages ziglang \
+ && cargo install --locked cargo-zigbuild
 
-# Copy the whole workspace in one go. We used to do a two-pass "cache-prime
-# with stubs, then real build" dance for dep-compile reuse; that turned out
-# to silently serve stale stub binaries when cargo's fingerprint didn't
-# notice the source swap. A single build is ~1.5 min longer on cold cache
-# but guarantees the binary reflects the sources we copied.
 # Do not copy rust-toolchain.toml into the image. The local workspace pins
 # developer tooling, but inside Docker we intentionally use the Rust version
 # selected by the base image. Copying rust-toolchain.toml with
 # `channel = "stable"` makes rustup download a second full toolchain during
-# `cargo build`, which is slow and can exhaust small Colima/CI disks.
+# the build, which is slow and can exhaust small Colima/CI disks.
 COPY Cargo.toml Cargo.lock ./
 COPY crates/ crates/
 # Baseline binaries (BIOS / i386 / wimboot), then overlay the
@@ -100,13 +106,11 @@ COPY --from=fetch /src/assets/ipxe /src/assets/ipxe
 COPY --from=ipxe-build /src/assets/ipxe/snponly.efi /src/assets/ipxe/snponly.efi
 COPY --from=ipxe-build /src/assets/ipxe/ipxe.efi /src/assets/ipxe/ipxe.efi
 
-# Cache cargo registry + target across builds. The mtime touch is
-# belt-and-suspenders: cargo occasionally misses mtime-only changes on
-# networked FS; this forces a fingerprint check.
+# Cache cargo registry + target across builds. `cargo zigbuild` runs the
+# native rustc (fast) and links for x86_64-musl with zig — no emulation.
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
     --mount=type=cache,target=/src/target,sharing=locked \
-    find crates -name '*.rs' -exec touch {} + && \
-    cargo build --release --target x86_64-unknown-linux-musl --bin openpxe && \
+    cargo zigbuild --release --target x86_64-unknown-linux-musl --bin openpxe && \
     cp target/x86_64-unknown-linux-musl/release/openpxe /openpxe && \
     ls -l /openpxe
 

docs/superpowers/specs/2026-05-31-saml-sso-and-ui-design.md

@@ -0,0 +1,199 @@
+# OpenPXE v0.5.1 — SAML SSO wiring + Settings/Storage UI consolidation
+
+**Date:** 2026-05-31
+**Author:** Miles Ward (with Claude)
+**Status:** Approved design → implementation
+
+## Summary
+
+Three workstreams for v0.5.1:
+
+1. **Wire SAML 2.0 SSO** end-to-end (currently config is persisted but no runtime
+   sign-in exists). Pure-Rust implementation that preserves the static-musl /
+   no-OpenSSL architecture, mirroring how FleetDM exposes and handles SAML.
+2. **Fold the Advanced sidebar tab into Settings** as a collapsible section.
+3. **Merge the Storage tab's SMB and NFS cards** into one "Remote shares" card
+   with a protocol dropdown.
+
+Then bump `0.5.0 → 0.5.1`, build the static musl image, push `:0.5.1` + `:latest`
+to Gitea, create the release, and scrub registry credentials.
+
+## Decisions (locked with the user)
+
+- **Crypto:** pure-Rust via `bergshamra` (XML-DSig + exclusive c14n, RustCrypto-based,
+  `#![forbid(unsafe_code)]`, ~99% xmlsec interop). `samael` is rejected — it
+  hard-requires OpenSSL/`xmlsec`/`libxml2` C deps, which would break the static
+  musl binary and the project's pure-Rust / no-OpenSSL architecture.
+- **Access model:** any SAML assertion the IdP successfully authenticates and that
+  we cryptographically verify mints a full operator session. No user table, no
+  roles, no domain allowlist. The local admin account remains a guaranteed
+  fallback owner regardless of SSO state.
+- **Flows:** SP-initiated (the "Sign in with <IdP>" button) is always on.
+  IdP-initiated is supported but gated behind an `allow_idp_initiated` toggle
+  (default off), mirroring FleetDM's "Allow SSO login initiated by identity
+  provider."
+
+## Scope boundaries (v0.5.1)
+
+In scope: SP-initiated + (gated) IdP-initiated login, signature verification on the
+SAML Response/Assertion, full SP-side semantic validation, SP metadata endpoint,
+login-page button wiring.
+
+Out of scope (note for later releases): EncryptedAssertion (assertions must be
+unencrypted), signed AuthnRequests (sent unsigned; Keycloak "client signature
+required" must be off), Single Logout (SLO), multi-user accounts / RBAC / JIT role
+mapping.
+
+---
+
+## Workstream 1 — SAML SP wiring (pure-Rust)
+
+### New dependencies (workspace)
+
+- `bergshamra` — XML-DSig verification + exclusive c14n (pure Rust).
+- `roxmltree` (read/navigate) and/or `quick-xml` (build/serialize) — parse IdP
+  metadata + SAMLResponse, build AuthnRequest and SP metadata.
+- `x509-parser` — extract the IdP signing certificate / public key from metadata.
+- `flate2` — raw DEFLATE for the HTTP-Redirect binding.
+- `base64` — encode/decode SAMLRequest/SAMLResponse.
+
+All pure-Rust → the `x86_64-unknown-linux-musl` static build stays OpenSSL-free.
+Exact `bergshamra` function signatures (`verify`, `DsigContext`, `KeysManager`,
+`Key`, `VerifiedReference`, `VerifyResult`) will be pinned against the installed
+crate source during implementation.
+
+### Module boundaries
+
+Pure protocol logic lives in `openpxe-core` (no axum dependency, unit-testable);
+HTTP wiring lives in `openpxe-http-api`.
+
+- `crates/core/src/saml/mod.rs` — public surface + shared types
+  (`VerifiedPrincipal { email, display_name, name_id, session_index }`, `SamlError`).
+- `crates/core/src/saml/metadata.rs` — parse IdP `EntityDescriptor`: IdP EntityID,
+  `SingleSignOnService` locations + bindings, and one or more X.509 signing
+  certificates. Also build **our** SP metadata XML.
+- `crates/core/src/saml/authn_request.rs` — build an AuthnRequest, return both the
+  request ID (to track) and the encoded HTTP-Redirect query value
+  (deflate → base64 → URL-encode).
+- `crates/core/src/saml/response.rs` — decode `SAMLResponse` (base64 → XML),
+  **verify the signature via bergshamra** against the IdP cert, then enforce SP
+  semantics, returning `VerifiedPrincipal` or a typed `SamlError`.
+
+### SP-side validation (response.rs)
+
+After a cryptographically valid signature over the Response and/or the Assertion:
+
+1. `Status` is `Success`.
+2. `Destination` (if present) equals our ACS URL.
+3. `Conditions/AudienceRestriction/Audience` equals our SP EntityID.
+4. `NotBefore` / `NotOnOrAfter` within bounds (allow small clock skew, e.g. ±60s).
+5. `InResponseTo` matches an outstanding request we issued (SP-initiated). Absent
+   for IdP-initiated, which is only accepted when `allow_idp_initiated` is true.
+6. Assertion-ID replay guard: reject a previously consumed assertion ID.
+7. NameID is the email (`nameid-format:emailAddress`). Display name read from
+   common attributes (`name`, `displayname`, `cn`, `urn:oid:2.5.4.3`).
+
+XML Signature Wrapping (XSW) defenses come from bergshamra (duplicate-ID rejection,
+strict positional verification); enable its strict verification options. We
+additionally confirm the verified `Reference` covers the element we read claims from.
+
+### State (in `openpxe-http-api`)
+
+Two small TTL-pruned in-memory stores (parking_lot `Mutex<HashMap<...>>`):
+
+- **Outstanding requests:** `request_id → issued_at`, TTL ≈ 5 min, for `InResponseTo`.
+- **Consumed assertions:** `assertion_id → expires_at`, TTL = assertion validity,
+  for replay protection.
+
+(In-memory is acceptable: a single-container app; a restart simply invalidates
+in-flight logins.)
+
+### Routes (all pre-auth; added to the public allowlist in the auth middleware)
+
+- `GET /api/sso/login` → build AuthnRequest, record its ID, 302 to the IdP SSO URL
+  (HTTP-Redirect binding) with `SAMLRequest` + `RelayState`.
+- `POST /api/sso/acs` → consume `SAMLResponse` (form-encoded). Verify + validate.
+  On success: `SessionStore::create(email)`, set the `openpxe_session` cookie
+  (same attributes as forms login), 302 to the dashboard. On failure: 302 back to
+  the login page with an error indicator. (Mirrors FleetDM's `/sso/callback`.)
+- `GET /api/sso/metadata` → serve our SP `EntityDescriptor` XML for IdP import.
+
+### Config changes (`crates/core/src/sso.rs`)
+
+Add to `SsoConfig` (preserve existing fields + validation):
+
+- `entity_id: String` — SP Entity ID (mirrors FleetDM's "Entity ID"); defaults to
+  the configured public base URL. The ACS URL is derived as
+  `<public_base_url>/api/sso/acs`.
+- `allow_idp_initiated: bool` — default `false`.
+
+`GET /api/sso` returns the new fields; `PUT /api/sso` validates and persists them.
+
+### Login page (`crates/webui/src/app.js`)
+
+Replace the "configured · runtime pending" message: the existing
+"Sign in with <IdP>" button navigates to `GET /api/sso/login`. Render the IdP logo
+(if `idp_logo_url` set) and use `idp_name` as the label. Keep the existing
+FleetDM-style login layout.
+
+### Testing
+
+- `core/saml` unit tests using a self-signed test keypair we control:
+  - Parse representative Keycloak IdP metadata → correct SSO URL + cert.
+  - Build an AuthnRequest → well-formed, deflate/base64 round-trips, ID recorded.
+  - A correctly signed Response → `VerifiedPrincipal { email, .. }`.
+  - Reject: tampered signature, expired (`NotOnOrAfter`), wrong audience,
+    replayed assertion ID, unsigned response, `Status != Success`.
+- `http-api` integration test: `GET /api/sso/login` returns a 302 with a
+  `SAMLRequest` query param; a crafted signed `SAMLResponse` POSTed to
+  `/api/sso/acs` (signed with the test key) sets an `openpxe_session` cookie.
+
+---
+
+## Workstream 2 — Advanced tab → Settings
+
+- Remove the `Advanced` sidebar entry (`crates/webui/src/index.html`) and its
+  `advanced` view route in `app.js`.
+- In the Settings view, append a **collapsible "Advanced" disclosure**
+  (default-collapsed) at the bottom containing the existing **Webhook
+  Notifications** card and the **API reference** block (moved out of the removed
+  Advanced view).
+- No backend changes; `/api/notify*` and `/api/docs` endpoints are unchanged.
+
+---
+
+## Workstream 3 — Storage: merge SMB + NFS → "Remote shares"
+
+- Replace the separate "SMB shares" and "NFS shares" cards with a single
+  **"Remote shares"** card:
+  - One add-form with a **protocol dropdown (SMB / NFS)**. Selecting the protocol
+    swaps the fields: SMB → server, share, guest checkbox, username, password;
+    NFS → server, export path.
+  - One unified table with a leading **Protocol** column (SMB/NFS badge), then
+    server/share-or-export, auth, ISO count, reachability, and Re-scan / Remove
+    actions.
+- **No backend changes.** The form dispatches to the existing
+  `POST /api/smb-shares` or `POST /api/nfs-shares`; the table merges
+  `GET /api/smb-shares` + `GET /api/nfs-shares`, tagging each row with its
+  protocol. Re-scan/Remove call the existing per-protocol endpoints.
+- Leaves the card pattern open for a future "Config files" card.
+
+---
+
+## Release
+
+1. Bump workspace version `0.5.0 → 0.5.1` (`Cargo.toml`).
+2. `cargo fmt`, `cargo clippy`, `cargo test` (all crates) green.
+3. Build the static musl binary + Docker image; verify SAML deps compile clean
+   under musl (no OpenSSL/C linkage).
+4. Push `openpxe:0.5.1` + `openpxe:latest` to Gitea via the established
+   temp-DOCKER_CONFIG pipeline; scrub credentials (logout + verify no token traces).
+5. Create the Gitea release `v0.5.1` with notes.
+
+## Risks
+
+- `bergshamra` is pre-1.0 and unaudited. Mitigation: pin the version, enable strict
+  verification, keep the local-admin fallback, and own the SP-semantic checks
+  carefully (audience/Conditions/replay/InResponseTo — where SP vulns usually live).
+- SAML is security-sensitive; negative tests (tamper/expiry/audience/replay/unsigned)
+  are part of the definition of done, not optional.