v0.5.0: fix update-check repository URL (inherit workspace repository)

The About-tab "check for updates" returned "repository URL not
configured at build time" because the http-api crate didn't inherit the
workspace `repository` field, leaving CARGO_PKG_REPOSITORY empty. Add
`repository.workspace = true` so the Gitea releases API URL derives
correctly, and strengthen the unit test to assert the URL is present.

Caught by the v0.5.0 container smoke test before publish.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

.claude/settings.json

@@ -0,0 +1,16 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(cargo check *)",
+      "Bash(cargo build *)",
+      "Bash(cargo clippy *)",
+      "Bash(cargo fmt *)",
+      "Bash(cargo tree *)",
+      "Bash(cargo doc *)",
+      "Bash(cargo test --workspace --lib)",
+      "Bash(cargo test --workspace)",
+      "Bash(cargo --version)",
+      "Bash(rustc --version)"
+    ]
+  }
+}

Cargo.toml

@@ -12,7 +12,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.5.4"
+version = "0.5.0"
 edition = "2021"
 rust-version = "1.95"
 license = "MIT OR Apache-2.0"
@@ -36,25 +36,25 @@ tower = "0.5"
 tower-http = { version = "0.6", features = ["fs", "trace", "cors", "limit"] }
 hyper = "1.4"
 reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "stream", "json"] }
+mime = "0.3"
+mime_guess = "2.0"
 
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 toml = "0.8"
-# v0.5.4: layered config (TOML file + env). Pure-Rust, no C deps; keeps the
-# static-musl build OpenSSL-free. Replaces the hand-rolled apply_env mapping.
-figment = { version = "0.10", features = ["toml", "env"] }
 
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
 
 anyhow = "1.0"
-thiserror = "2.0"
+thiserror = "1.0"
 clap = { version = "4.5", features = ["derive", "env"] }
 uuid = { version = "1.10", features = ["v4", "serde"] }
 time = { version = "0.3", features = ["serde", "serde-human-readable", "formatting", "macros"] }
 sha2 = "0.10"
 hex = "0.4"
 bcrypt = "0.15"
+once_cell = "1.19"
 parking_lot = "0.12"
 rust-embed = { version = "8.5", features = ["include-exclude"] }
 
@@ -71,20 +71,6 @@ nfs3_types = "0.5"
 # to match reqwest and stay musl-static-friendly — no OpenSSL.
 lettre = { version = "0.11", default-features = false, features = ["smtp-transport", "tokio1-rustls-tls", "builder", "hostname"] }
 
-# v0.5.1: pure-Rust SAML 2.0 Service Provider. bergshamra does XML-DSig
-# verification + exclusive c14n with RustCrypto (no OpenSSL/xmlsec/libxml2
-# C deps), so the static musl binary stays OpenSSL-free — samael was
-# rejected precisely because it hard-requires OpenSSL. We build the thin
-# SP layer (AuthnRequest, metadata parse, SAMLResponse semantics) on top.
-bergshamra = "0.4"
-roxmltree = "0.21"
-quick-xml = "0.40"
-x509-parser = "0.18"
-# flate2 default backend is miniz_oxide (pure Rust) — do NOT enable the
-# zlib/zlib-ng C backends, which would break the musl-static build.
-flate2 = "1.1"
-base64 = "0.22"
-
 openpxe-core = { path = "crates/core" }
 openpxe-dhcp-proxy = { path = "crates/dhcp-proxy" }
 openpxe-tftp = { path = "crates/tftp" }

crates/core/Cargo.toml

@@ -13,7 +13,6 @@ workspace = true
 serde.workspace = true
 serde_json.workspace = true
 toml.workspace = true
-figment.workspace = true
 thiserror.workspace = true
 anyhow.workspace = true
 tracing.workspace = true
@@ -26,22 +25,5 @@ tokio = { workspace = true, features = ["sync", "rt", "macros", "time"] }
 # for per-ISO boot passwords; just re-exported here.
 bcrypt.workspace = true
 
-# v0.5.1: pure-Rust SAML 2.0 SP. bergshamra = XML-DSig verify + exclusive
-# c14n (no OpenSSL/C). roxmltree/quick-xml parse + build SAML XML;
-# x509-parser pulls the IdP signing cert out of metadata; flate2+base64
-# encode the HTTP-Redirect binding's SAMLRequest.
-bergshamra.workspace = true
-roxmltree.workspace = true
-quick-xml.workspace = true
-x509-parser.workspace = true
-flate2.workspace = true
-base64.workspace = true
-
 [dev-dependencies]
 tempfile = "3.12"
-# v0.5.4: figment's `Jail` (hermetic env/file sandbox) for the config
-# loader tests lives behind the `test` feature.
-figment = { workspace = true, features = ["test"] }
-# v0.5.1: generate a throwaway self-signed signing cert/key so SAML
-# verification tests can produce genuinely signed SAMLResponses.
-rcgen = "0.13"

crates/core/src/branding.rs

@@ -1,23 +1,11 @@
 //! Operator-controlled branding overrides.
 //!
-//! v0.5.2 splits the single brand mark into **three independent slots**,
+//! The browser tab's logo (`/assets/logo.svg`) defaults to the bundled
-//! FleetDM-style:
+//! rainbow-horizon mark. Operators who deploy OpenPXE behind their own
-//!
+//! branding can upload a replacement that lives at
-//! * `light` — shown in the WebUI top-left and on the form-login page
+//! `<work_dir>/branding/logo.<ext>` and is served in preference to the
-//!   when the active theme is light.
+//! bundled SVG when present. Borrowed-from-FleetDM: tenant chrome, same
-//! * `dark` — same surfaces, when the active theme is dark.
+//! product.
-//! * `client` — the raster painted above the iPXE boot menu entries
-//!   (`/branding/pxe-logo`), i.e. what a PXE client sees on the screen.
-//!
-//! Each slot lives at `<work_dir>/branding/logo-<slot>.<ext>` and is
-//! served in preference to the bundled rainbow-horizon mark when present.
-//! Borrowed-from-FleetDM: tenant chrome, same product.
-//!
-//! Legacy continuity: a pre-v0.5.2 single `logo.<ext>` (recorded under
-//! the old `logo_filename`/`logo_mime` keys) is migrated on first load
-//! into both the `dark` and `client` slots — that preserves the previous
-//! behaviour (one mark fed both the dark WebUI and the PXE screen) until
-//! the operator uploads dedicated variants.
 //!
 //! Storage policy mirrors `HostBindings` / `BootLog`: in-memory cache is
 //! authoritative for the current process, disk is the source of truth on
@@ -47,104 +35,27 @@ pub const ALLOWED_LOGO_MIMES: &[&str] = &[
 /// puts a clear bound on memory + serialization cost.
 pub const MAX_LOGO_BYTES: usize = 2 * 1024 * 1024;
 
-/// Which branded surface a logo upload targets.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum LogoSlot {
-    /// WebUI + form-login page, light theme.
-    Light,
-    /// WebUI + form-login page, dark theme.
-    Dark,
-    /// iPXE boot-menu background seen by PXE clients.
-    Client,
-}
-
-impl LogoSlot {
-    #[must_use]
-    pub fn as_str(self) -> &'static str {
-        match self {
-            LogoSlot::Light => "light",
-            LogoSlot::Dark => "dark",
-            LogoSlot::Client => "client",
-        }
-    }
-
-    /// Parse a slot name from the URL path segment. Case-insensitive.
-    #[must_use]
-    pub fn parse(s: &str) -> Option<Self> {
-        match s.trim().to_ascii_lowercase().as_str() {
-            "light" => Some(LogoSlot::Light),
-            "dark" => Some(LogoSlot::Dark),
-            "client" => Some(LogoSlot::Client),
-            _ => None,
-        }
-    }
-}
-
-/// One brand-mark slot: a filename (relative to the branding dir) plus
-/// the MIME we cached at upload time so the HTTP layer can set the
-/// Content-Type without re-sniffing.
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
-struct Slot {
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    filename: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    mime: Option<String>,
-}
-
-impl Slot {
-    fn clear_file(&mut self, dir: &Path) {
-        if let Some(name) = self.filename.take() {
-            let _ = std::fs::remove_file(dir.join(name));
-        }
-        self.mime = None;
-    }
-}
-
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 struct Inner {
-    #[serde(default)]
+    /// File name (relative to the branding dir) for the active logo, if
-    light: Slot,
+    /// any. Always under `<work_dir>/branding/`; never an absolute path
-    #[serde(default)]
+    /// from the operator.
-    dark: Slot,
+    logo_filename: Option<String>,
-    #[serde(default)]
+    /// MIME of the active logo, mirroring `logo_filename`. Cached here
-    client: Slot,
+    /// so the HTTP layer can set Content-Type without re-sniffing.
-    /// Monotonic counter bumped on every set/clear (any slot). Surfaces
+    logo_mime: Option<String>,
-    /// as a cache-bust token (`/assets/logo.svg?r=<rev>`) so the browser
+    /// Monotonic counter bumped on every set/clear. Surfaces as a
-    /// fetches the new bytes the moment the operator swaps a logo — the
+    /// cache-bust token (`/assets/logo.svg?r=<rev>`) so the browser
-    /// app version alone can't do this since it doesn't change on upload.
+    /// fetches the new bytes the moment the operator swaps the logo —
-    /// Persisted so the token stays stable across restarts and keeps
+    /// the app version alone can't do this since it doesn't change on
-    /// climbing across multiple swaps.
+    /// upload. Persisted so the token stays stable across restarts and
+    /// keeps climbing across multiple swaps.
     #[serde(default)]
     rev: u64,
-    // ── Legacy (pre-v0.5.2) single-logo keys ──────────────────────────
-    // Read on load for one-way migration into `dark` + `client`, then
-    // dropped from the persisted form (skip_serializing_if).
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    logo_filename: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    logo_mime: Option<String>,
-}
-
-impl Inner {
-    fn slot(&self, slot: LogoSlot) -> &Slot {
-        match slot {
-            LogoSlot::Light => &self.light,
-            LogoSlot::Dark => &self.dark,
-            LogoSlot::Client => &self.client,
-        }
-    }
-
-    fn slot_mut(&mut self, slot: LogoSlot) -> &mut Slot {
-        match slot {
-            LogoSlot::Light => &mut self.light,
-            LogoSlot::Dark => &mut self.dark,
-            LogoSlot::Client => &mut self.client,
-        }
-    }
 }
 
 /// In-memory + on-disk override registry. Cheap to clone; locks are
-/// brief. The `branding.json` cache lives alongside the active assets
+/// brief. The `branding.json` cache lives alongside the active asset
 /// inside `<work_dir>/branding/`.
 #[derive(Debug, Clone)]
 pub struct BrandingStore {
@@ -156,8 +67,7 @@ pub struct BrandingStore {
 impl BrandingStore {
     /// Load (or initialise empty) from `<work_dir>/branding/`. Tolerates
     /// missing directories, partial state, and corrupt JSON — a bad
-    /// cache should never block PXE for the network. Migrates a legacy
+    /// cache should never block PXE for the network.
-    /// single-logo file into the dark + client slots.
     #[must_use]
     pub fn load_or_default(work_dir: &Path) -> Self {
         let dir = work_dir.join("branding");
@@ -165,7 +75,25 @@ impl BrandingStore {
         let mut inner = Inner::default();
         if let Ok(text) = std::fs::read_to_string(&path) {
             match serde_json::from_str::<Inner>(&text) {
-                Ok(parsed) => inner = parsed,
+                Ok(parsed) => {
+                    // Sanity: if the JSON says we have a logo but the
+                    // file is gone, clear the in-memory pointer so
+                    // /assets/logo.svg falls back to the bundled SVG
+                    // rather than 500ing on a missing file.
+                    if let Some(name) = parsed.logo_filename.as_deref() {
+                        if dir.join(name).is_file() {
+                            inner = parsed;
+                        } else {
+                            tracing::warn!(
+                                target: "openpxe::branding",
+                                file = %name,
+                                "branding.json points at missing file; clearing"
+                            );
+                        }
+                    } else {
+                        inner = parsed;
+                    }
+                }
                 Err(e) => {
                     tracing::warn!(
                         target: "openpxe::branding",
@@ -174,242 +102,102 @@ impl BrandingStore {
                 }
             }
         }
-        let store = Self {
+        Self {
             dir: Arc::new(dir),
             inner: Arc::new(RwLock::new(inner)),
-        };
+        }
-        store.migrate_legacy();
-        store.prune_missing();
-        store
     }
 
-    /// One-way migration: a pre-v0.5.2 `logo.<ext>` becomes the dark +
+    /// Absolute path to the active logo, if one is set and present on
-    /// client slots (the old single mark fed both the dark WebUI and the
+    /// disk. `None` means the HTTP layer should serve the bundled SVG.
-    /// PXE screen). Best-effort; failures leave the legacy file in place
+    #[must_use]
-    /// rather than blocking startup.
+    pub fn logo_path(&self) -> Option<PathBuf> {
-    fn migrate_legacy(&self) {
-        let (legacy_name, legacy_mime) = {
         let g = self.inner.read();
-            (g.logo_filename.clone(), g.logo_mime.clone())
+        g.logo_filename.as_deref().map(|n| self.dir.join(n))
-        };
-        let Some(name) = legacy_name else { return };
-        let src = self.dir.join(&name);
-        if !src.is_file() {
-            // Legacy pointer is stale — just drop it.
-            let mut g = self.inner.write();
-            g.logo_filename = None;
-            g.logo_mime = None;
-            drop(g);
-            self.persist();
-            return;
     }
-        let mime = legacy_mime.unwrap_or_else(|| "image/svg+xml".to_string());
+
-        let ext = ext_for_mime(&mime).unwrap_or("bin");
+    /// MIME of the active logo, if any. The HTTP layer pairs this with
-        if let Ok(bytes) = std::fs::read(&src) {
+    /// the bytes returned by [`Self::logo_path`].
-            // Seed dark + client only when those slots are still empty so
+    #[must_use]
-            // a re-run (or a manual edit) never clobbers operator intent.
+    pub fn logo_mime(&self) -> Option<String> {
-            let needs_dark = self.inner.read().dark.filename.is_none();
+        self.inner.read().logo_mime.clone()
-            let needs_client = self.inner.read().client.filename.is_none();
-            if needs_dark {
-                let _ = self.write_slot(LogoSlot::Dark, &mime, ext, &bytes);
     }
-            if needs_client {
+
-                let _ = self.write_slot(LogoSlot::Client, &mime, ext, &bytes);
+    /// Replace the active logo. Returns the chosen on-disk filename so
+    /// the caller can echo it back in the API response. Old logos are
+    /// removed best-effort.
+    pub fn set_logo(&self, mime: &str, ext: &str, bytes: &[u8]) -> std::io::Result<String> {
+        std::fs::create_dir_all(self.dir.as_path())?;
+        // Single canonical filename per upload — overwriting the old one
+        // (after clearing it) keeps the directory tidy and avoids any
+        // path-traversal concern: the operator never supplies the name.
+        let safe_ext = sanitize_ext(ext);
+        let filename = format!("logo.{safe_ext}");
+        let final_path = self.dir.join(&filename);
+        // Atomic write: tmp -> rename. Guarantees the file is either
+        // entirely the old logo or entirely the new one.
+        let tmp = final_path.with_extension(format!("{safe_ext}.tmp"));
+        std::fs::write(&tmp, bytes)?;
+        std::fs::rename(&tmp, &final_path)?;
+        // Clean up any sibling logo.<otherext> so there's exactly one
+        // canonical file at any time.
+        if let Ok(entries) = std::fs::read_dir(self.dir.as_path()) {
+            for e in entries.flatten() {
+                let p = e.path();
+                let name = p
+                    .file_name()
+                    .and_then(|s| s.to_str())
+                    .unwrap_or("");
+                if name.starts_with("logo.") && name != filename {
+                    let _ = std::fs::remove_file(&p);
                 }
             }
-        let _ = std::fs::remove_file(&src);
+        }
+
         {
             let mut g = self.inner.write();
-            g.logo_filename = None;
+            g.logo_filename = Some(filename.clone());
-            g.logo_mime = None;
+            g.logo_mime = Some(mime.to_string());
+            g.rev = g.rev.wrapping_add(1);
         }
         self.persist();
         tracing::info!(
             target: "openpxe::branding",
-            "migrated legacy single logo into dark + client slots"
+            file = %filename, mime = %mime, size = bytes.len(),
-        );
-    }
-
-    /// Drop in-memory slot pointers whose backing file vanished from disk
-    /// so the HTTP layer falls back to the bundled mark instead of 500ing.
-    fn prune_missing(&self) {
-        let mut changed = false;
-        {
-            let mut g = self.inner.write();
-            for slot in [LogoSlot::Light, LogoSlot::Dark, LogoSlot::Client] {
-                let present = g
-                    .slot(slot)
-                    .filename
-                    .as_deref()
-                    .is_some_and(|n| self.dir.join(n).is_file());
-                if !present && g.slot(slot).filename.is_some() {
-                    g.slot_mut(slot).filename = None;
-                    g.slot_mut(slot).mime = None;
-                    changed = true;
-                }
-            }
-        }
-        if changed {
-            self.persist();
-        }
-    }
-
-    /// Absolute path to the logo for `slot`, if set and present on disk.
-    #[must_use]
-    pub fn slot_path(&self, slot: LogoSlot) -> Option<PathBuf> {
-        let g = self.inner.read();
-        g.slot(slot).filename.as_deref().map(|n| self.dir.join(n))
-    }
-
-    /// MIME of the logo for `slot`, if any.
-    #[must_use]
-    pub fn slot_mime(&self, slot: LogoSlot) -> Option<String> {
-        self.inner.read().slot(slot).mime.clone()
-    }
-
-    /// Resolve the WebUI logo for a theme, with fallback: light falls
-    /// back to dark and vice-versa, so a single uploaded variant still
-    /// shows on both themes. Returns `(path, mime)` or `None` (→ bundled).
-    #[must_use]
-    pub fn web_logo(&self, theme_is_light: bool) -> Option<(PathBuf, String)> {
-        let (primary, secondary) = if theme_is_light {
-            (LogoSlot::Light, LogoSlot::Dark)
-        } else {
-            (LogoSlot::Dark, LogoSlot::Light)
-        };
-        let g = self.inner.read();
-        let chosen = if g.slot(primary).filename.is_some() {
-            primary
-        } else {
-            secondary
-        };
-        let s = g.slot(chosen);
-        s.filename.as_deref().map(|n| {
-            (
-                self.dir.join(n),
-                s.mime
-                    .clone()
-                    .unwrap_or_else(|| "image/svg+xml".to_string()),
-            )
-        })
-    }
-
-    /// Resolve the PXE client logo (no theme fallback — the PXE screen
-    /// has a single mark). Returns `(path, mime)` or `None` (→ default
-    /// composed background).
-    #[must_use]
-    pub fn client_logo(&self) -> Option<(PathBuf, String)> {
-        let g = self.inner.read();
-        let s = &g.client;
-        s.filename.as_deref().map(|n| {
-            (
-                self.dir.join(n),
-                s.mime
-                    .clone()
-                    .unwrap_or_else(|| "application/octet-stream".to_string()),
-            )
-        })
-    }
-
-    /// Replace the logo for `slot`. Returns the chosen on-disk filename so
-    /// the caller can echo it back in the API response.
-    pub fn set_logo(
-        &self,
-        slot: LogoSlot,
-        mime: &str,
-        ext: &str,
-        bytes: &[u8],
-    ) -> std::io::Result<String> {
-        let filename = self.write_slot(slot, mime, ext, bytes)?;
-        self.persist();
-        tracing::info!(
-            target: "openpxe::branding",
-            slot = slot.as_str(), file = %filename, mime = %mime, size = bytes.len(),
             "custom logo installed"
         );
         Ok(filename)
     }
 
-    /// Write the bytes for a slot and update the in-memory pointer + rev,
+    /// Drop the override and return to the bundled SVG.
-    /// without persisting (the caller decides when to flush). Cleans up
+    pub fn clear_logo(&self) -> std::io::Result<()> {
-    /// any sibling `logo-<slot>.*` so there's exactly one file per slot.
+        let removed = {
-    fn write_slot(
+            let mut g = self.inner.write();
-        &self,
+            let removed = g.logo_filename.take();
-        slot: LogoSlot,
+            g.logo_mime = None;
-        mime: &str,
+            g.rev = g.rev.wrapping_add(1);
-        ext: &str,
+            removed
-        bytes: &[u8],
+        };
-    ) -> std::io::Result<String> {
+        if let Some(name) = removed {
-        std::fs::create_dir_all(self.dir.as_path())?;
+            let p = self.dir.join(&name);
-        let safe_ext = sanitize_ext(ext);
-        let stem = format!("logo-{}", slot.as_str());
-        let filename = format!("{stem}.{safe_ext}");
-        let final_path = self.dir.join(&filename);
-        // Atomic write: tmp -> rename.
-        let tmp = final_path.with_extension(format!("{safe_ext}.tmp"));
-        std::fs::write(&tmp, bytes)?;
-        std::fs::rename(&tmp, &final_path)?;
-        // Clean up any sibling `logo-<slot>.<otherext>`.
-        if let Ok(entries) = std::fs::read_dir(self.dir.as_path()) {
-            for e in entries.flatten() {
-                let p = e.path();
-                let name = p.file_name().and_then(|s| s.to_str()).unwrap_or("");
-                if name.starts_with(&format!("{stem}.")) && name != filename {
             let _ = std::fs::remove_file(&p);
-                }
+            tracing::info!(target: "openpxe::branding", file = %name, "custom logo cleared");
-            }
-        }
-        let mut g = self.inner.write();
-        let s = g.slot_mut(slot);
-        s.filename = Some(filename.clone());
-        s.mime = Some(mime.to_string());
-        g.rev = g.rev.wrapping_add(1);
-        Ok(filename)
-    }
-
-    /// Drop the override for `slot` and return to the bundled / default.
-    pub fn clear_logo(&self, slot: LogoSlot) -> std::io::Result<()> {
-        {
-            let mut g = self.inner.write();
-            let dir = self.dir.as_path();
-            g.slot_mut(slot).clear_file(dir);
-            g.rev = g.rev.wrapping_add(1);
         }
         self.persist();
-        tracing::info!(target: "openpxe::branding", slot = slot.as_str(), "custom logo cleared");
         Ok(())
     }
 
-    /// True if a custom logo is configured for `slot`.
+    /// Convenience: true if a custom logo is configured. Surfaces on
+    /// `/api/status` so the WebUI can show "Custom logo: yes" without
+    /// fetching the asset itself.
     #[must_use]
-    pub fn has_logo(&self, slot: LogoSlot) -> bool {
+    pub fn has_logo(&self) -> bool {
-        self.inner.read().slot(slot).filename.is_some()
+        self.inner.read().logo_filename.is_some()
     }
 
-    /// True if either WebUI theme slot has a custom logo — drives the
+    /// Cache-bust token for the logo asset URL. Changes on every
-    /// FleetDM-style full-width brand block (and the `has-custom-logo`
-    /// class) on the sidebar + login page.
-    #[must_use]
-    pub fn has_any_web_logo(&self) -> bool {
-        let g = self.inner.read();
-        g.light.filename.is_some() || g.dark.filename.is_some()
-    }
-
-    /// Presence triple `(light, dark, client)` for the `/api/me` and
-    /// `/api/status` bootstrap payloads.
-    #[must_use]
-    pub fn presence(&self) -> (bool, bool, bool) {
-        let g = self.inner.read();
-        (
-            g.light.filename.is_some(),
-            g.dark.filename.is_some(),
-            g.client.filename.is_some(),
-        )
-    }
-
-    /// Cache-bust token for the logo asset URLs. Changes on every
     /// set/clear so `/assets/logo.svg?r=<rev>` resolves to a fresh URL
-    /// whenever the operator swaps a brand mark. Stable otherwise.
+    /// whenever the operator swaps the brand mark. Stable otherwise.
     #[must_use]
     pub fn logo_rev(&self) -> u64 {
         self.inner.read().rev
@@ -479,87 +267,47 @@ mod tests {
     fn empty_after_load_when_no_branding_dir() {
         let dir = tempdir().unwrap();
         let b = BrandingStore::load_or_default(dir.path());
-        assert!(!b.has_logo(LogoSlot::Light));
+        assert!(!b.has_logo());
-        assert!(!b.has_logo(LogoSlot::Dark));
+        assert!(b.logo_path().is_none());
-        assert!(!b.has_logo(LogoSlot::Client));
+        assert!(b.logo_mime().is_none());
-        assert!(b.web_logo(false).is_none());
-        assert!(b.client_logo().is_none());
-        assert!(!b.has_any_web_logo());
     }
 
     #[test]
     fn set_clear_round_trip_persists() {
         let dir = tempdir().unwrap();
         let b = BrandingStore::load_or_default(dir.path());
-        let name = b
+        let name = b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake").unwrap();
-            .set_logo(LogoSlot::Dark, "image/png", "png", b"\x89PNG\r\n\x1a\nfake")
+        assert_eq!(name, "logo.png");
-            .unwrap();
+        assert!(b.has_logo());
-        assert_eq!(name, "logo-dark.png");
+        assert_eq!(b.logo_mime().as_deref(), Some("image/png"));
-        assert!(b.has_logo(LogoSlot::Dark));
+        let p = b.logo_path().unwrap();
-        assert_eq!(b.slot_mime(LogoSlot::Dark).as_deref(), Some("image/png"));
-        let (p, _) = b.web_logo(false).unwrap();
         assert!(p.is_file());
 
         // Re-open and confirm the override survives a restart.
         drop(b);
         let b2 = BrandingStore::load_or_default(dir.path());
-        assert!(b2.has_logo(LogoSlot::Dark));
+        assert!(b2.has_logo());
-        assert_eq!(b2.slot_mime(LogoSlot::Dark).as_deref(), Some("image/png"));
+        assert_eq!(b2.logo_mime().as_deref(), Some("image/png"));
 
         // Clear; the file goes away and has_logo flips off.
-        b2.clear_logo(LogoSlot::Dark).unwrap();
+        b2.clear_logo().unwrap();
-        assert!(!b2.has_logo(LogoSlot::Dark));
+        assert!(!b2.has_logo());
         assert!(!p.exists());
     }
 
     #[test]
-    fn web_logo_falls_back_across_themes() {
+    fn replacing_logo_removes_old_extension_sibling() {
+        // PNG then SVG; only the SVG should remain on disk.
         let dir = tempdir().unwrap();
         let b = BrandingStore::load_or_default(dir.path());
-        // Only dark uploaded — light theme falls back to it.
+        b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake").unwrap();
-        b.set_logo(LogoSlot::Dark, "image/png", "png", b"dark")
+        b.set_logo("image/svg+xml", "svg", br#"<svg xmlns="http://www.w3.org/2000/svg"/>"#).unwrap();
-            .unwrap();
-        let (p_light, _) = b.web_logo(true).expect("light falls back to dark");
-        assert!(p_light.ends_with("logo-dark.png"));
-        // Upload a distinct light — now light theme uses its own.
-        b.set_logo(LogoSlot::Light, "image/png", "png", b"light")
-            .unwrap();
-        let (p_light2, _) = b.web_logo(true).unwrap();
-        assert!(p_light2.ends_with("logo-light.png"));
-        // Client is independent and still unset.
-        assert!(b.client_logo().is_none());
-    }
-
-    #[test]
-    fn replacing_slot_removes_old_extension_sibling() {
-        let dir = tempdir().unwrap();
-        let b = BrandingStore::load_or_default(dir.path());
-        b.set_logo(
-            LogoSlot::Client,
-            "image/png",
-            "png",
-            b"\x89PNG\r\n\x1a\nfake",
-        )
-        .unwrap();
-        b.set_logo(
-            LogoSlot::Client,
-            "image/svg+xml",
-            "svg",
-            br#"<svg xmlns="http://www.w3.org/2000/svg"/>"#,
-        )
-        .unwrap();
         let entries: Vec<_> = std::fs::read_dir(dir.path().join("branding"))
             .unwrap()
             .filter_map(|e| e.ok().map(|e| e.file_name().to_string_lossy().into_owned()))
             .collect();
-        assert!(
+        assert!(entries.iter().any(|n| n == "logo.svg"), "got {entries:?}");
-            entries.iter().any(|n| n == "logo-client.svg"),
+        assert!(!entries.iter().any(|n| n == "logo.png"), "stale PNG left over: {entries:?}");
-            "got {entries:?}"
-        );
-        assert!(
-            !entries.iter().any(|n| n == "logo-client.png"),
-            "stale PNG left over: {entries:?}"
-        );
     }
 
     #[test]
@@ -567,92 +315,54 @@ mod tests {
         let dir = tempdir().unwrap();
         let b = BrandingStore::load_or_default(dir.path());
         assert_eq!(b.logo_rev(), 0);
-        b.set_logo(LogoSlot::Light, "image/png", "png", b"a")
+        b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake").unwrap();
-            .unwrap();
         assert_eq!(b.logo_rev(), 1);
-        b.set_logo(LogoSlot::Dark, "image/png", "png", b"b")
+        b.set_logo("image/png", "png", b"\x89PNG\r\n\x1a\nfake2").unwrap();
-            .unwrap();
         assert_eq!(b.logo_rev(), 2);
-        b.clear_logo(LogoSlot::Light).unwrap();
+        b.clear_logo().unwrap();
         assert_eq!(b.logo_rev(), 3);
+        // Survives a restart.
         drop(b);
         let b2 = BrandingStore::load_or_default(dir.path());
         assert_eq!(b2.logo_rev(), 3);
     }
 
-    #[test]
-    fn legacy_single_logo_migrates_to_dark_and_client() {
-        // A pre-v0.5.2 branding.json + logo.png migrates on load.
-        let dir = tempdir().unwrap();
-        let brand_dir = dir.path().join("branding");
-        std::fs::create_dir_all(&brand_dir).unwrap();
-        std::fs::write(brand_dir.join("logo.png"), b"\x89PNG\r\n\x1a\nlegacy").unwrap();
-        // Hand-write the old shape (logo_filename/logo_mime, no slots).
-        std::fs::write(
-            brand_dir.join("branding.json"),
-            br#"{"logo_filename":"logo.png","logo_mime":"image/png","rev":4}"#,
-        )
-        .unwrap();
-        let b = BrandingStore::load_or_default(dir.path());
-        assert!(b.has_logo(LogoSlot::Dark), "dark seeded from legacy");
-        assert!(b.has_logo(LogoSlot::Client), "client seeded from legacy");
-        assert!(!b.has_logo(LogoSlot::Light), "light stays empty");
-        // The old logo.png is gone; per-slot files exist.
-        assert!(!brand_dir.join("logo.png").exists());
-        assert!(brand_dir.join("logo-dark.png").is_file());
-        assert!(brand_dir.join("logo-client.png").is_file());
-        // rev carried over from the legacy file and advanced as the two
-        // slots were seeded (each write bumps it), so it never regresses.
-        let migrated_rev = b.logo_rev();
-        assert!(
-            migrated_rev >= 4,
-            "rev should not regress below legacy: {migrated_rev}"
-        );
-        // And the migration is sticky across a restart (no re-migrate, no
-        // further rev churn).
-        drop(b);
-        let b2 = BrandingStore::load_or_default(dir.path());
-        assert!(b2.has_logo(LogoSlot::Dark));
-        assert!(b2.has_logo(LogoSlot::Client));
-        assert!(!b2.has_logo(LogoSlot::Light));
-        assert_eq!(b2.logo_rev(), migrated_rev, "restart must not re-migrate");
-    }
-
     #[test]
     fn sanitize_ext_strips_separators_and_path_chars() {
         assert_eq!(sanitize_ext("svg"), "svg");
+        // Path separators and non-alphanumerics filter out, leaving just
+        // letters. The remaining "etcpasswd" exceeds the 5-char cap so
+        // it collapses to `bin` rather than producing `etcpa`.
         assert_eq!(sanitize_ext("../etc/passwd"), "bin");
+        // Short alphanumeric strip-through stays itself.
         assert_eq!(sanitize_ext("../svg"), "svg");
         assert_eq!(sanitize_ext(""), "bin");
         assert_eq!(sanitize_ext("PNG"), "png");
+        // Anything past five chars is suspicious — collapse to `bin`.
         assert_eq!(sanitize_ext("svgvvvv"), "bin");
     }
 
     #[test]
     fn missing_file_referenced_by_json_resolves_to_empty() {
+        // If the operator nukes the file out from under the JSON cache,
+        // we should silently fall back to no-override rather than
+        // hanging on to a bogus path.
         let dir = tempdir().unwrap();
         let brand_dir = dir.path().join("branding");
         std::fs::create_dir_all(&brand_dir).unwrap();
-        // branding.json claims a dark slot whose file doesn't exist.
+        // Hand-write a branding.json claiming logo.png exists.
+        let inner = Inner {
+            logo_filename: Some("logo.png".into()),
+            logo_mime: Some("image/png".into()),
+            rev: 0,
+        };
         std::fs::write(
             brand_dir.join("branding.json"),
-            br#"{"dark":{"filename":"logo-dark.png","mime":"image/png"},"rev":1}"#,
+            serde_json::to_vec_pretty(&inner).unwrap(),
         )
         .unwrap();
         let b = BrandingStore::load_or_default(dir.path());
-        assert!(
+        assert!(!b.has_logo(), "should fall back when referenced file is missing");
-            !b.has_logo(LogoSlot::Dark),
-            "should fall back when referenced file is missing"
-        );
-    }
-
-    #[test]
-    fn slot_parse_round_trips() {
-        assert_eq!(LogoSlot::parse("light"), Some(LogoSlot::Light));
-        assert_eq!(LogoSlot::parse("DARK"), Some(LogoSlot::Dark));
-        assert_eq!(LogoSlot::parse(" client "), Some(LogoSlot::Client));
-        assert_eq!(LogoSlot::parse("nope"), None);
-        assert_eq!(LogoSlot::Light.as_str(), "light");
     }
 
     #[test]

crates/core/src/config.rs

@@ -1,5 +1,3 @@
-use figment::providers::{Env, Format, Serialized, Toml};
-use figment::Figment;
 use serde::{Deserialize, Serialize};
 use std::net::{IpAddr, Ipv4Addr};
 use std::path::{Path, PathBuf};
@@ -58,9 +56,6 @@ pub enum DhcpMode {
     /// Disabled — rely on an external DHCP server that has been manually
     /// configured with `next-server` / `filename`. OpenPXE only serves TFTP
     /// + HTTP in this mode. Useful for home routers that can be pre-set.
-    // `off`/`none` are accepted as aliases for backward-compat with the old
-    // hand-rolled `apply_env`, which mapped them to Disabled.
-    #[serde(alias = "off", alias = "none")]
     Disabled,
 }
 
@@ -79,11 +74,6 @@ pub struct Paths {
     /// Only used when `settings.windows_enabled = true`. Defaults to
     /// `/var/lib/openpxe/smb` in the container image.
     pub smb_dir: PathBuf,
-    /// v0.5.2: directory holding uploaded unattended-install answer files
-    /// (Kickstart / Preseed / Autoinstall / Windows answer files). Kept
-    /// separate from `iso_dir` so answer files never appear in the ISO
-    /// listing or the PXE menu. Defaults to `/var/lib/openpxe/unattended`.
-    pub unattended_dir: PathBuf,
 }
 
 impl Default for ServerConfig {
@@ -119,7 +109,6 @@ impl Default for Paths {
             ipxe_dir: PathBuf::from("/usr/share/openpxe/ipxe"),
             wimboot_path: None,
             smb_dir: PathBuf::from("/var/lib/openpxe/smb"),
-            unattended_dir: PathBuf::from("/var/lib/openpxe/unattended"),
         }
     }
 }
@@ -134,162 +123,48 @@ impl Config {
         toml::from_str(&text).map_err(|e| crate::Error::Config(e.to_string()))
     }
 
-    /// Load configuration with layered precedence (v0.5.4, via `figment`):
+    /// Apply environment variable overrides. Env var names follow the pattern
-    /// built-in [`Default`] → optional TOML file → `OPENPXE_*` environment
+    /// `OPENPXE_<SECTION>_<FIELD>`, uppercase. Unknown vars are ignored.
-    /// (highest). Replaces the old `from_toml_file` + `apply_env` two-step
+    /// Call this after loading the TOML file so env takes precedence.
-    /// and now covers **every** field automatically (the previous hand-rolled
+    pub fn apply_env(&mut self) {
-    /// mapping silently skipped `unattended_dir`, the bind addresses, etc.).
+        if let Ok(v) = std::env::var("OPENPXE_HTTP_PORT") {
-    ///
+            if let Ok(p) = v.parse() {
-    /// The env layer preserves the historical flat names
+                self.server.http_port = p;
-    /// (`OPENPXE_HTTP_PORT`, `OPENPXE_ISO_DIR`, …) so existing deployments
-    /// (the Unraid template, `entrypoint.sh`) keep working unchanged, and
-    /// additionally accepts the explicit nested form
-    /// `OPENPXE_<SECTION>__<FIELD>` (double underscore).
-    pub fn load(path: Option<&Path>) -> crate::Result<Self> {
-        let mut fig = Figment::from(Serialized::defaults(Config::default()));
-        if let Some(p) = path {
-            if p.exists() {
-                fig = fig.merge(Toml::file(p));
             }
         }
-        fig = fig.merge(env_provider());
+        if let Ok(v) = std::env::var("OPENPXE_TFTP_PORT") {
-        fig.extract()
+            if let Ok(p) = v.parse() {
-            .map_err(|e| crate::Error::Config(e.to_string()))
+                self.server.tftp_port = p;
             }
         }
-
+        if let Ok(v) = std::env::var("OPENPXE_DHCP_PORT") {
-/// The `OPENPXE_*` environment provider. Maps the historical flat variable
+            if let Ok(p) = v.parse() {
-/// names onto the nested [`Config`] fields, and also accepts the explicit
+                self.network.dhcp_port = p;
-/// `OPENPXE_SECTION__FIELD` nested form. Keys that match nothing (e.g.
+            }
-/// `OPENPXE_CONFIG`, `OPENPXE_UID` from the entrypoint) become stray
+        }
-/// top-level keys that `Config` ignores on extract.
+        if let Ok(v) = std::env::var("OPENPXE_PUBLIC_IP") {
-fn env_provider() -> Env {
+            if let Ok(ip) = v.parse() {
-    Env::prefixed("OPENPXE_")
+                self.server.public_ip = Some(ip);
-        .map(|key| {
+            }
-            // Lowercase so the match is robust regardless of how the OS
+        }
-            // reports the var's case.
+        if let Ok(v) = std::env::var("OPENPXE_DHCP_MODE") {
-            let k = key.as_str().to_ascii_lowercase();
+            self.network.dhcp_mode = match v.to_ascii_lowercase().as_str() {
-            let mapped = match k.as_str() {
+                "proxy" => DhcpMode::Proxy,
-                "http_port" => "server.http_port",
+                "disabled" | "off" | "none" => DhcpMode::Disabled,
-                "http_bind" => "server.http_bind",
+                _ => self.network.dhcp_mode,
-                "tftp_port" => "server.tftp_port",
-                "tftp_bind" => "server.tftp_bind",
-                "public_ip" => "server.public_ip",
-                "dhcp_port" => "network.dhcp_port",
-                "dhcp_bind" => "network.dhcp_bind",
-                "dhcp_mode" => "network.dhcp_mode",
-                "pxe_port" => "network.pxe_port",
-                "iso_dir" => "paths.iso_dir",
-                "work_dir" => "paths.work_dir",
-                "ipxe_dir" => "paths.ipxe_dir",
-                "smb_dir" => "paths.smb_dir",
-                "wimboot_path" => "paths.wimboot_path",
-                "unattended_dir" => "paths.unattended_dir",
-                // Unknown: support the explicit nested form
-                // (OPENPXE_SERVER__HTTP_PORT). `replace` is a no-op for the
-                // already-handled flat names above.
-                other => return other.replace("__", ".").into(),
             };
-            mapped.into()
-        })
-        .split(".")
         }
-
+        if let Ok(v) = std::env::var("OPENPXE_ISO_DIR") {
-#[cfg(test)]
+            self.paths.iso_dir = PathBuf::from(v);
-mod tests {
-    // figment's `Jail::expect_with` closure returns `Result<(), figment::Error>`
-    // and `figment::Error` is large; that's the library's API, not ours.
-    #![allow(clippy::result_large_err)]
-    use super::*;
-
-    #[test]
-    fn defaults_load_when_no_file_or_env() {
-        figment::Jail::expect_with(|_jail| {
-            let c = Config::load(None).expect("load defaults");
-            assert_eq!(c.server.http_port, 80);
-            assert_eq!(c.network.dhcp_mode, DhcpMode::Proxy);
-            assert_eq!(c.paths.iso_dir, PathBuf::from("/var/lib/openpxe/isos"));
-            Ok(())
-        });
         }
-
+        if let Ok(v) = std::env::var("OPENPXE_WORK_DIR") {
-    #[test]
+            self.paths.work_dir = PathBuf::from(v);
-    fn legacy_flat_env_vars_still_apply() {
-        figment::Jail::expect_with(|jail| {
-            jail.set_env("OPENPXE_HTTP_PORT", "8123");
-            jail.set_env("OPENPXE_TFTP_PORT", "6900");
-            jail.set_env("OPENPXE_DHCP_PORT", "6767");
-            jail.set_env("OPENPXE_PXE_PORT", "4444");
-            jail.set_env("OPENPXE_PUBLIC_IP", "10.20.30.40");
-            jail.set_env("OPENPXE_DHCP_MODE", "disabled");
-            jail.set_env("OPENPXE_ISO_DIR", "/data/isos");
-            jail.set_env("OPENPXE_WORK_DIR", "/data/work");
-            jail.set_env("OPENPXE_IPXE_DIR", "/data/ipxe");
-            jail.set_env("OPENPXE_SMB_DIR", "/data/smb");
-            // v0.5.4: a field the old apply_env never covered.
-            jail.set_env("OPENPXE_UNATTENDED_DIR", "/data/unattended");
-            let c = Config::load(None).expect("load with env");
-            assert_eq!(c.server.http_port, 8123);
-            assert_eq!(c.server.tftp_port, 6900);
-            assert_eq!(c.network.dhcp_port, 6767);
-            assert_eq!(c.network.pxe_port, 4444);
-            assert_eq!(c.server.public_ip, Some("10.20.30.40".parse().unwrap()));
-            assert_eq!(c.network.dhcp_mode, DhcpMode::Disabled);
-            assert_eq!(c.paths.iso_dir, PathBuf::from("/data/isos"));
-            assert_eq!(c.paths.work_dir, PathBuf::from("/data/work"));
-            assert_eq!(c.paths.ipxe_dir, PathBuf::from("/data/ipxe"));
-            assert_eq!(c.paths.smb_dir, PathBuf::from("/data/smb"));
-            assert_eq!(c.paths.unattended_dir, PathBuf::from("/data/unattended"));
-            Ok(())
-        });
         }
-
+        if let Ok(v) = std::env::var("OPENPXE_IPXE_DIR") {
-    #[test]
+            self.paths.ipxe_dir = PathBuf::from(v);
-    fn dhcp_mode_off_alias_maps_to_disabled() {
+        }
-        figment::Jail::expect_with(|jail| {
+        if let Ok(v) = std::env::var("OPENPXE_SMB_DIR") {
-            jail.set_env("OPENPXE_DHCP_MODE", "off");
+            self.paths.smb_dir = PathBuf::from(v);
-            let c = Config::load(None).unwrap();
-            assert_eq!(c.network.dhcp_mode, DhcpMode::Disabled);
-            Ok(())
-        });
         }
-
-    #[test]
-    fn nested_double_underscore_form_also_works() {
-        figment::Jail::expect_with(|jail| {
-            jail.set_env("OPENPXE_SERVER__HTTP_PORT", "9001");
-            let c = Config::load(None).unwrap();
-            assert_eq!(c.server.http_port, 9001);
-            Ok(())
-        });
-    }
-
-    #[test]
-    fn env_overrides_toml_file() {
-        figment::Jail::expect_with(|jail| {
-            jail.create_file(
-                "openpxe.toml",
-                "[server]\nhttp_port = 8080\n[paths]\niso_dir = \"/from/toml\"\n",
-            )?;
-            jail.set_env("OPENPXE_HTTP_PORT", "8443");
-            let c = Config::load(Some(Path::new("openpxe.toml"))).unwrap();
-            // env wins over TOML…
-            assert_eq!(c.server.http_port, 8443);
-            // …but TOML-only values still apply.
-            assert_eq!(c.paths.iso_dir, PathBuf::from("/from/toml"));
-            Ok(())
-        });
-    }
-
-    #[test]
-    fn unrelated_openpxe_env_vars_are_ignored() {
-        figment::Jail::expect_with(|jail| {
-            // entrypoint.sh sets these; they must not break config load.
-            jail.set_env("OPENPXE_UID", "10001");
-            jail.set_env("OPENPXE_CONFIG", "/etc/openpxe.toml");
-            let c = Config::load(None).expect("stray vars ignored");
-            assert_eq!(c.server.http_port, 80);
-            Ok(())
-        });
     }
 }

crates/core/src/encoding.rs

@@ -1,65 +0,0 @@
-//! Small, dependency-free encoding helpers shared across crates.
-//!
-//! v0.5.4: `pct_encode` and `xml_escape` were duplicated in the SAML
-//! modules and the HTTP layer; they live here now. They're deliberately
-//! hand-rolled rather than pulling in `percent-encoding` / `url`: the
-//! unreserved set below is exactly the RFC 3986 set that iPXE's
-//! `:uristring` modifier and the SAML HTTP-Redirect binding both expect,
-//! and a general-purpose URL crate escapes a different set.
-
-use std::fmt::Write as _;
-
-/// Percent-encode `s` per RFC 3986: the unreserved set
-/// (`A-Z` `a-z` `0-9` `-` `_` `.` `~`) passes through unchanged; every
-/// other byte becomes `%XX` (uppercase hex).
-#[must_use]
-pub fn pct_encode(s: &str) -> String {
-    let mut out = String::with_capacity(s.len());
-    for b in s.bytes() {
-        match b {
-            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => {
-                out.push(b as char);
-            }
-            _ => {
-                let _ = write!(out, "%{b:02X}");
-            }
-        }
-    }
-    out
-}
-
-/// Escape the five XML predefined entities so `s` is safe inside element
-/// text or a double-quoted attribute value.
-#[must_use]
-pub fn xml_escape(s: &str) -> String {
-    let mut out = String::with_capacity(s.len());
-    for c in s.chars() {
-        match c {
-            '&' => out.push_str("&"),
-            '<' => out.push_str("&lt;"),
-            '>' => out.push_str("&gt;"),
-            '"' => out.push_str("&quot;"),
-            '\'' => out.push_str("&apos;"),
-            _ => out.push(c),
-        }
-    }
-    out
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn pct_encode_unreserved_passthrough_else_hex() {
-        assert_eq!(pct_encode("node-7.lab_1~"), "node-7.lab_1~");
-        assert_eq!(pct_encode("aa:bb cc/?&="), "aa%3Abb%20cc%2F%3F%26%3D");
-        assert_eq!(pct_encode(""), "");
-    }
-
-    #[test]
-    fn xml_escape_all_five_entities() {
-        assert_eq!(xml_escape("a&b<c>\"d'e"), "a&amp;b&lt;c&gt;&quot;d&apos;e");
-        assert_eq!(xml_escape("plain text"), "plain text");
-    }
-}

crates/core/src/host_bindings.rs

@@ -21,8 +21,6 @@ use std::path::PathBuf;
 use std::sync::Arc;
 use time::OffsetDateTime;
 
-use crate::profile::DeployProfile;
-
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct HostBinding {
     /// Lowercase, colon-separated MAC (e.g. `aa:bb:cc:dd:ee:ff`). The
@@ -37,11 +35,6 @@ pub struct HostBinding {
     /// `"rack-3 spine"`). Empty if unset.
     #[serde(default)]
     pub label: String,
-    /// v0.5.2: optional unattended-install hints (auto hostname / IP /
-    /// answer-file id). Flattened into the binding JSON so pre-v0.5.2
-    /// `hosts.json` files (which lack these keys) still deserialize.
-    #[serde(default, flatten)]
-    pub profile: DeployProfile,
     #[serde(with = "time::serde::rfc3339")]
     pub created_at: OffsetDateTime,
     #[serde(with = "time::serde::rfc3339")]
@@ -101,31 +94,20 @@ impl HostBindings {
     }
 
     /// Insert or update. Returns the resulting binding (with timestamps).
-    /// The `profile` carries optional unattended-install hints (v0.5.2);
+    pub fn upsert(&self, mac: &str, target: &str, label: &str) -> HostBinding {
-    /// pass `DeployProfile::default()` for a plain pin.
-    pub fn upsert(
-        &self,
-        mac: &str,
-        target: &str,
-        label: &str,
-        profile: DeployProfile,
-    ) -> HostBinding {
         let key = normalize_mac(mac);
         let now = OffsetDateTime::now_utc();
-        let profile = profile.normalized();
         let binding = {
             let mut g = self.inner.write();
             let entry = g.by_mac.entry(key.clone()).or_insert_with(|| HostBinding {
                 mac: key.clone(),
                 target: target.to_string(),
                 label: label.to_string(),
-                profile: profile.clone(),
                 created_at: now,
                 updated_at: now,
             });
             entry.target = target.to_string();
             entry.label = label.to_string();
-            entry.profile = profile.clone();
             entry.updated_at = now;
             entry.clone()
         };
@@ -197,10 +179,6 @@ mod tests {
     use super::*;
     use tempfile::tempdir;
 
-    fn np() -> DeployProfile {
-        DeployProfile::default()
-    }
-
     #[test]
     fn normalize_handles_case_and_dashes() {
         assert_eq!(normalize_mac("AA:BB:CC:DD:EE:FF"), "aa:bb:cc:dd:ee:ff");
@@ -213,12 +191,7 @@ mod tests {
         let dir = tempdir().unwrap();
         let h = HostBindings::load_or_default(dir.path());
         assert!(h.is_empty());
-        h.upsert(
+        h.upsert("AA:BB:CC:00:00:01", "ubuntu-24-04-linux", "rack-3 spine");
-            "AA:BB:CC:00:00:01",
-            "ubuntu-24-04-linux",
-            "rack-3 spine",
-            np(),
-        );
         let found = h.lookup("aa-bb-cc-00-00-01").expect("lookup");
         assert_eq!(found.target, "ubuntu-24-04-linux");
         assert_eq!(found.label, "rack-3 spine");
@@ -229,8 +202,8 @@ mod tests {
     fn upsert_replaces_existing_target() {
         let dir = tempdir().unwrap();
         let h = HostBindings::load_or_default(dir.path());
-        h.upsert("aa:bb:cc:00:00:01", "old-target", "label1", np());
+        h.upsert("aa:bb:cc:00:00:01", "old-target", "label1");
-        h.upsert("aa:bb:cc:00:00:01", "new-target", "label2", np());
+        h.upsert("aa:bb:cc:00:00:01", "new-target", "label2");
         assert_eq!(h.len(), 1);
         let b = h.lookup("aa:bb:cc:00:00:01").unwrap();
         assert_eq!(b.target, "new-target");
@@ -241,7 +214,7 @@ mod tests {
     fn remove_works_and_reports_outcome() {
         let dir = tempdir().unwrap();
         let h = HostBindings::load_or_default(dir.path());
-        h.upsert("aa:bb:cc:00:00:01", "x", "", np());
+        h.upsert("aa:bb:cc:00:00:01", "x", "");
         assert!(h.remove("AA:BB:CC:00:00:01"));
         assert!(!h.remove("aa:bb:cc:00:00:01")); // already gone
         assert!(h.is_empty());
@@ -251,44 +224,11 @@ mod tests {
     fn round_trip_persists_to_disk() {
         let dir = tempdir().unwrap();
         let h = HostBindings::load_or_default(dir.path());
-        h.upsert("aa:bb:cc:00:00:01", "ubuntu-linux", "rack-3", np());
+        h.upsert("aa:bb:cc:00:00:01", "ubuntu-linux", "rack-3");
-        h.upsert("aa:bb:cc:00:00:02", "_local", "tom-laptop", np());
+        h.upsert("aa:bb:cc:00:00:02", "_local", "tom-laptop");
         drop(h);
         let h2 = HostBindings::load_or_default(dir.path());
         assert_eq!(h2.len(), 2);
         assert_eq!(h2.lookup("aa:bb:cc:00:00:02").unwrap().target, "_local");
     }
-
-    #[test]
-    fn profile_round_trips_to_disk() {
-        let dir = tempdir().unwrap();
-        let h = HostBindings::load_or_default(dir.path());
-        let prof = DeployProfile {
-            auto_hostname: Some("node-7".into()),
-            auto_ip: Some("10.0.0.7".into()),
-            unattended_file: Some("ubuntu-ks".into()),
-        };
-        h.upsert("aa:bb:cc:00:00:09", "ubuntu-linux", "lab", prof);
-        drop(h);
-        let h2 = HostBindings::load_or_default(dir.path());
-        let b = h2.lookup("aa:bb:cc:00:00:09").unwrap();
-        assert_eq!(b.profile.auto_hostname.as_deref(), Some("node-7"));
-        assert_eq!(b.profile.auto_ip.as_deref(), Some("10.0.0.7"));
-        assert_eq!(b.profile.unattended_file.as_deref(), Some("ubuntu-ks"));
-    }
-
-    #[test]
-    fn legacy_hosts_json_without_profile_still_loads() {
-        // A pre-v0.5.2 hosts.json has no profile keys at all.
-        let dir = tempdir().unwrap();
-        std::fs::write(
-            dir.path().join("hosts.json"),
-            br#"[{"mac":"aa:bb:cc:00:00:01","target":"_local","label":"old","created_at":"2024-01-01T00:00:00Z","updated_at":"2024-01-01T00:00:00Z"}]"#,
-        )
-        .unwrap();
-        let h = HostBindings::load_or_default(dir.path());
-        let b = h.lookup("aa:bb:cc:00:00:01").unwrap();
-        assert_eq!(b.target, "_local");
-        assert!(b.profile.is_empty());
-    }
 }

crates/core/src/lib.rs

@@ -8,15 +8,12 @@ pub mod boot_log;
 pub mod branding;
 pub mod client;
 pub mod config;
-pub mod encoding;
 pub mod error;
 pub mod host_bindings;
 pub mod log_bus;
 pub mod metrics;
 pub mod notify;
-pub mod profile;
 pub mod queue;
-pub mod saml;
 pub mod settings;
 pub mod sso;
 pub mod wol;
@@ -24,16 +21,14 @@ pub mod wol;
 pub use arch::{ClientArch, FirmwareClass};
 pub use auth::{AdminAccount, AdminPublic, AdminStore};
 pub use boot_log::{BootEvent, BootLog};
-pub use branding::{ext_for_mime, BrandingStore, LogoSlot, ALLOWED_LOGO_MIMES, MAX_LOGO_BYTES};
+pub use branding::{ext_for_mime, BrandingStore, ALLOWED_LOGO_MIMES, MAX_LOGO_BYTES};
 pub use client::{ClientEvent, ClientRegistry, ClientSnapshot};
+pub use sso::{SsoConfig, SsoStore};
 pub use config::{Config, DhcpMode, NetworkConfig, Paths, ServerConfig};
 pub use error::{Error, Result};
 pub use host_bindings::{normalize_mac, HostBinding, HostBindings};
 pub use log_bus::{LogBus, LogBusLayer, LogLine};
 pub use metrics::{HttpRoute, Metrics};
 pub use notify::{NotifyConfig, NotifyKind, NotifyStore};
-pub use profile::DeployProfile;
 pub use queue::{DeploymentQueue, QueueEntry};
-pub use saml::{IdpMetadata, SamlError, SpParams, VerifiedPrincipal, VerifiedResponse};
 pub use settings::{Settings, SettingsStore, TimeoutAction};
-pub use sso::{SsoConfig, SsoStore};

crates/core/src/profile.rs

@@ -1,122 +0,0 @@
-//! Per-host deployment profile.
-//!
-//! v0.5.2: a small, optional bundle of "what should this machine do when
-//! it images" attached to either a pinned host binding ([`crate::HostBinding`])
-//! or a queued device ([`crate::QueueEntry`]). All three fields are
-//! optional and independent:
-//!
-//! * `auto_hostname` — substituted into the served unattended answer file
-//!   (`{{HOSTNAME}}`) so the installer sets the machine name.
-//! * `auto_ip` — substituted as `{{IP}}`. OpenPXE is a DHCP **proxy** and
-//!   does not hand out leases, so this is applied by the installer as a
-//!   static-network directive inside the answer file, not by DHCP.
-//! * `unattended_file` — the id of an uploaded file in the unattended
-//!   store (Kickstart / Preseed / Autoinstall / Windows answer file). When
-//!   set, the boot chain injects the appropriate kernel argument so the
-//!   install runs unattended.
-
-use serde::{Deserialize, Serialize};
-
-/// Optional deployment hints carried on a host pin or a queue entry.
-///
-/// The fields are flattened into `HostBinding` / `QueueEntry` on the wire
-/// (so existing JSON stays compatible via `#[serde(default)]`); this type
-/// is the in-code bundle the boot chain consumes.
-#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
-pub struct DeployProfile {
-    /// Hostname to set on the imaged machine (`{{HOSTNAME}}`). Empty/None
-    /// leaves the installer default.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub auto_hostname: Option<String>,
-    /// Static IPv4/IPv6 the installer should configure (`{{IP}}`). Stored
-    /// as a free-form string — validated lightly at the HTTP layer.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub auto_ip: Option<String>,
-    /// Id of an uploaded file in the unattended store. Empty/None means
-    /// "no unattended install — boot interactively".
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub unattended_file: Option<String>,
-}
-
-/// Cap on the stored hostname / IP strings — generous for any real value
-/// but bounds what an operator can stuff into the JSON.
-pub const MAX_PROFILE_FIELD_LEN: usize = 255;
-
-impl DeployProfile {
-    /// True when nothing is set — lets call sites skip work entirely.
-    #[must_use]
-    pub fn is_empty(&self) -> bool {
-        self.auto_hostname.is_none() && self.auto_ip.is_none() && self.unattended_file.is_none()
-    }
-
-    /// True when an unattended file is selected (drives boot-chain injection).
-    #[must_use]
-    pub fn has_unattended(&self) -> bool {
-        self.unattended_file
-            .as_deref()
-            .is_some_and(|s| !s.trim().is_empty())
-    }
-
-    /// Normalise: trim every field and collapse empty strings to `None`
-    /// so persisted JSON never carries `""` for an unset value.
-    #[must_use]
-    pub fn normalized(mut self) -> Self {
-        fn clean(v: Option<String>) -> Option<String> {
-            v.map(|s| s.trim().to_string())
-                .filter(|s| !s.is_empty())
-                .map(|s| s.chars().take(MAX_PROFILE_FIELD_LEN).collect())
-        }
-        self.auto_hostname = clean(self.auto_hostname);
-        self.auto_ip = clean(self.auto_ip);
-        self.unattended_file = clean(self.unattended_file);
-        self
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn empty_profile_is_empty() {
-        assert!(DeployProfile::default().is_empty());
-        assert!(!DeployProfile::default().has_unattended());
-    }
-
-    #[test]
-    fn normalize_trims_and_nulls_empty() {
-        let p = DeployProfile {
-            auto_hostname: Some("  node-7  ".into()),
-            auto_ip: Some("   ".into()),
-            unattended_file: Some(String::new()),
-        }
-        .normalized();
-        assert_eq!(p.auto_hostname.as_deref(), Some("node-7"));
-        assert_eq!(p.auto_ip, None);
-        assert_eq!(p.unattended_file, None);
-        assert!(!p.is_empty());
-    }
-
-    #[test]
-    fn has_unattended_detects_real_id() {
-        let p = DeployProfile {
-            unattended_file: Some("ubuntu-ks".into()),
-            ..Default::default()
-        };
-        assert!(p.has_unattended());
-    }
-
-    #[test]
-    fn long_field_is_capped() {
-        let long = "a".repeat(1000);
-        let p = DeployProfile {
-            auto_hostname: Some(long),
-            ..Default::default()
-        }
-        .normalized();
-        assert_eq!(
-            p.auto_hostname.as_deref().map(str::len),
-            Some(MAX_PROFILE_FIELD_LEN)
-        );
-    }
-}

crates/core/src/queue.rs

@@ -21,7 +21,6 @@ use time::OffsetDateTime;
 use tokio::sync::Notify;
 use uuid::Uuid;
 
-use crate::profile::DeployProfile;
 use crate::ClientArch;
 
 /// Per-client queue state visible to the WebUI.
@@ -38,11 +37,6 @@ pub struct QueueEntry {
     #[serde(with = "time::serde::rfc3339")]
     pub last_poll_at: OffsetDateTime,
     pub assigned_target: Option<String>,
-    /// v0.5.2: optional per-device deployment profile set via the queue
-    /// "Profile" button (auto hostname / IP / unattended file). Flattened
-    /// so the JSON stays flat alongside the other queue fields.
-    #[serde(default, flatten)]
-    pub profile: DeployProfile,
 }
 
 #[derive(Debug)]
@@ -55,7 +49,6 @@ struct QueueEntryInner {
     joined_at: OffsetDateTime,
     last_poll_at: OffsetDateTime,
     assigned_target: Option<String>,
-    profile: DeployProfile,
     /// Broadcast primitive that wakes the long-poll as soon as an
     /// assignment lands — no polling on our side, no sleep-loops.
     notify: Arc<Notify>,
@@ -72,7 +65,6 @@ impl QueueEntryInner {
             joined_at: self.joined_at,
             last_poll_at: self.last_poll_at,
             assigned_target: self.assigned_target.clone(),
-            profile: self.profile.clone(),
         }
     }
 }
@@ -118,7 +110,6 @@ impl DeploymentQueue {
             joined_at: now,
             last_poll_at: now,
             assigned_target: None,
-            profile: DeployProfile::default(),
             notify: Arc::new(Notify::new()),
         };
         let snap = inner.snapshot();
@@ -142,29 +133,6 @@ impl DeploymentQueue {
         Some(g.snapshot())
     }
 
-    /// Operator sets (or clears) the deployment profile for a queued
-    /// device via the WebUI "Profile" button. Returns the updated
-    /// snapshot, or `None` if the entry has since been released.
-    pub fn set_profile(&self, entry_id: &str, profile: DeployProfile) -> Option<QueueEntry> {
-        let mut guard = self.inner.write();
-        let g = guard.get_mut(entry_id)?;
-        g.profile = profile.normalized();
-        Some(g.snapshot())
-    }
-
-    /// Look up the deployment profile for a queued MAC, if any. Used by
-    /// the boot chain to inject an unattended file / template the
-    /// hostname + IP when an assigned device chains to its target.
-    #[must_use]
-    pub fn profile_for_mac(&self, mac: &str) -> Option<DeployProfile> {
-        let guard = self.inner.read();
-        guard
-            .values()
-            .find(|g| g.mac == mac)
-            .map(|g| g.profile.clone())
-            .filter(|p| !p.is_empty())
-    }
-
     /// Operator assigns an ISO entry (boot_entry id) to one or more clients.
     /// Returns the number of queue entries that were updated. Entries not in the
     /// queue are silently skipped.

crates/core/src/saml/authn_request.rs

@@ -1,159 +0,0 @@
-//! AuthnRequest construction + HTTP-Redirect binding encoding.
-//!
-//! For SP-initiated login we build an `<AuthnRequest>`, then encode it for the
-//! HTTP-Redirect binding: raw DEFLATE (RFC 1951) → base64 → percent-encode,
-//! appended as the `SAMLRequest` query parameter. AuthnRequests are sent
-//! unsigned in this release (the IdP must not require client signatures).
-
-use std::io::Write as _;
-
-use base64::Engine;
-use flate2::write::DeflateEncoder;
-use flate2::Compression;
-use time::format_description::well_known::Rfc3339;
-use time::OffsetDateTime;
-
-use super::{SamlError, SpParams};
-use crate::encoding::{pct_encode, xml_escape};
-
-const NS_PROTOCOL: &str = "urn:oasis:names:tc:SAML:2.0:protocol";
-const NS_ASSERTION: &str = "urn:oasis:names:tc:SAML:2.0:assertion";
-const NAMEID_EMAIL: &str = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress";
-const BINDING_POST: &str = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST";
-
-/// A built AuthnRequest, ready to redirect the browser to the IdP.
-#[derive(Debug, Clone)]
-pub struct AuthnRequest {
-    /// The request `ID` — the caller records this so the matching response's
-    /// `InResponseTo` can be correlated (replay/CSRF protection).
-    pub id: String,
-    /// The full IdP URL to 302 the browser to (includes `SAMLRequest` and,
-    /// when supplied, `RelayState`).
-    pub location: String,
-}
-
-/// Build an AuthnRequest targeting `idp_sso_url` and encode it for the
-/// HTTP-Redirect binding. `relay_state`, if given, round-trips back to us via
-/// the response (we use it to send the operator to their intended page).
-pub fn build(
-    sp: &SpParams,
-    idp_sso_url: &str,
-    relay_state: Option<&str>,
-) -> Result<AuthnRequest, SamlError> {
-    let id = format!("_{}", uuid::Uuid::new_v4().simple());
-    let issue_instant = OffsetDateTime::now_utc()
-        .replace_nanosecond(0)
-        .unwrap_or_else(|_| OffsetDateTime::now_utc())
-        .format(&Rfc3339)
-        .map_err(|e| SamlError::Timestamp(e.to_string()))?;
-
-    let xml = format!(
-        r#"<samlp:AuthnRequest xmlns:samlp="{NS_PROTOCOL}" xmlns:saml="{NS_ASSERTION}" ID="{id}" Version="2.0" IssueInstant="{instant}" Destination="{dest}" ProtocolBinding="{BINDING_POST}" AssertionConsumerServiceURL="{acs}"><saml:Issuer>{issuer}</saml:Issuer><samlp:NameIDPolicy Format="{NAMEID_EMAIL}" AllowCreate="true"/></samlp:AuthnRequest>"#,
-        instant = issue_instant,
-        dest = xml_escape(idp_sso_url),
-        acs = xml_escape(&sp.acs_url),
-        issuer = xml_escape(&sp.entity_id),
-    );
-
-    let encoded = deflate_base64(&xml)?;
-
-    let sep = if idp_sso_url.contains('?') { '&' } else { '?' };
-    let mut location = format!("{idp_sso_url}{sep}SAMLRequest={}", pct_encode(&encoded));
-    if let Some(rs) = relay_state {
-        location.push_str("&RelayState=");
-        location.push_str(&pct_encode(rs));
-    }
-
-    Ok(AuthnRequest { id, location })
-}
-
-/// Raw-DEFLATE then base64 — the HTTP-Redirect binding's `SAMLRequest` payload.
-fn deflate_base64(xml: &str) -> Result<String, SamlError> {
-    let mut enc = DeflateEncoder::new(Vec::new(), Compression::default());
-    enc.write_all(xml.as_bytes())
-        .and_then(|()| enc.try_finish())
-        .map_err(|e| SamlError::Xml(format!("deflate: {e}")))?;
-    let compressed = enc
-        .finish()
-        .map_err(|e| SamlError::Xml(format!("deflate: {e}")))?;
-    Ok(base64::engine::general_purpose::STANDARD.encode(compressed))
-}
-
-// `pct_encode` + `xml_escape` now live in `openpxe_core::encoding` (v0.5.4)
-// — imported above.
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use flate2::read::DeflateDecoder;
-    use std::io::Read;
-
-    fn sp() -> SpParams {
-        SpParams {
-            entity_id: "https://pxe.example.com".into(),
-            acs_url: "https://pxe.example.com/api/sso/acs".into(),
-        }
-    }
-
-    fn pct_decode(s: &str) -> Vec<u8> {
-        let bytes = s.as_bytes();
-        let mut out = Vec::with_capacity(bytes.len());
-        let mut i = 0;
-        while i < bytes.len() {
-            if bytes[i] == b'%' && i + 2 < bytes.len() {
-                let hi = (bytes[i + 1] as char).to_digit(16).unwrap();
-                let lo = (bytes[i + 2] as char).to_digit(16).unwrap();
-                out.push((hi * 16 + lo) as u8);
-                i += 3;
-            } else {
-                out.push(bytes[i]);
-                i += 1;
-            }
-        }
-        out
-    }
-
-    #[test]
-    fn id_is_ncname_and_location_has_request() {
-        let req = build(&sp(), "https://idp.example.com/sso", Some("/dashboard")).unwrap();
-        assert!(req.id.starts_with('_'));
-        assert!(req
-            .location
-            .starts_with("https://idp.example.com/sso?SAMLRequest="));
-        assert!(req.location.contains("&RelayState=%2Fdashboard"));
-    }
-
-    #[test]
-    fn redirect_payload_round_trips_to_our_authn_request() {
-        let req = build(&sp(), "https://idp.example.com/sso", None).unwrap();
-        // Pull SAMLRequest value out of the query string.
-        let q = req.location.split("SAMLRequest=").nth(1).unwrap();
-        let val = q.split('&').next().unwrap();
-        let compressed = base64::engine::general_purpose::STANDARD
-            .decode(pct_decode(val))
-            .unwrap();
-        let mut inflate = DeflateDecoder::new(&compressed[..]);
-        let mut xml = String::new();
-        inflate.read_to_string(&mut xml).unwrap();
-
-        let doc = roxmltree::Document::parse(&xml).unwrap();
-        let root = doc.root_element();
-        assert_eq!(root.tag_name().name(), "AuthnRequest");
-        assert_eq!(root.attribute("ID").unwrap(), req.id);
-        assert_eq!(
-            root.attribute("AssertionConsumerServiceURL").unwrap(),
-            "https://pxe.example.com/api/sso/acs"
-        );
-        let issuer = root
-            .descendants()
-            .find(|n| n.tag_name().name() == "Issuer")
-            .unwrap();
-        assert_eq!(issuer.text().unwrap(), "https://pxe.example.com");
-    }
-
-    #[test]
-    fn existing_query_uses_ampersand_separator() {
-        let req = build(&sp(), "https://idp.example.com/sso?foo=bar", None).unwrap();
-        assert!(req.location.contains("?foo=bar&SAMLRequest="));
-    }
-}

crates/core/src/saml/metadata.rs

@@ -1,228 +0,0 @@
-//! IdP metadata parsing + SP metadata generation.
-//!
-//! We parse only what the SP flow needs: the IdP Entity ID, its
-//! `SingleSignOnService` endpoints (HTTP-Redirect / HTTP-POST), and the
-//! X.509 signing certificate(s). Everything else in the document is ignored.
-
-use base64::Engine;
-
-use super::{SamlError, SpParams};
-use crate::encoding::xml_escape;
-
-/// SAML 2.0 binding URIs.
-pub const BINDING_REDIRECT: &str = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect";
-pub const BINDING_POST: &str = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST";
-
-/// The subset of an IdP's `EntityDescriptor` the SP flow consumes.
-#[derive(Debug, Clone)]
-pub struct IdpMetadata {
-    /// The IdP's Entity ID — we require incoming assertions to be issued by it.
-    pub entity_id: String,
-    /// SSO endpoint for the HTTP-Redirect binding (where we send AuthnRequests).
-    pub sso_redirect_url: Option<String>,
-    /// SSO endpoint for the HTTP-POST binding (fallback target).
-    pub sso_post_url: Option<String>,
-    /// DER-encoded X.509 signing certificate(s). More than one appears during
-    /// key rotation; verification tries each.
-    pub signing_certs_der: Vec<Vec<u8>>,
-}
-
-impl IdpMetadata {
-    /// Parse an IdP `EntityDescriptor` document.
-    ///
-    /// Robust to namespace-prefix variation (matches on local element names),
-    /// since IdPs disagree on prefixes (`md:`, `ns0:`, default, …).
-    pub fn parse(xml: &str) -> Result<Self, SamlError> {
-        let doc = roxmltree::Document::parse(xml).map_err(|e| SamlError::Xml(e.to_string()))?;
-        let root = doc.root_element();
-
-        // The signing IDP descriptor. Some metadata wraps multiple
-        // descriptors (AA, SP) in one document; we want IDPSSODescriptor.
-        let idp_desc = root
-            .descendants()
-            .find(|n| n.is_element() && n.tag_name().name() == "IDPSSODescriptor")
-            .ok_or_else(|| SamlError::Metadata("IDPSSODescriptor".into()))?;
-
-        // Entity ID lives on the EntityDescriptor (root, or an ancestor of the
-        // IDPSSODescriptor when several are nested).
-        let entity_id = idp_desc
-            .ancestors()
-            .find_map(|n| {
-                if n.tag_name().name() == "EntityDescriptor" {
-                    n.attribute("entityID")
-                } else {
-                    None
-                }
-            })
-            .or_else(|| root.attribute("entityID"))
-            .map(str::to_owned)
-            .ok_or_else(|| SamlError::Metadata("entityID".into()))?;
-
-        let mut sso_redirect_url = None;
-        let mut sso_post_url = None;
-        for sso in idp_desc
-            .children()
-            .filter(|n| n.is_element() && n.tag_name().name() == "SingleSignOnService")
-        {
-            let binding = sso.attribute("Binding").unwrap_or("");
-            let location = sso.attribute("Location").map(str::to_owned);
-            match binding {
-                BINDING_REDIRECT if sso_redirect_url.is_none() => sso_redirect_url = location,
-                BINDING_POST if sso_post_url.is_none() => sso_post_url = location,
-                _ => {}
-            }
-        }
-
-        // Signing certs: KeyDescriptor with use="signing" or no use attribute
-        // (a bare KeyDescriptor is valid for both signing and encryption).
-        let mut signing_certs_der = Vec::new();
-        for kd in idp_desc
-            .children()
-            .filter(|n| n.is_element() && n.tag_name().name() == "KeyDescriptor")
-        {
-            match kd.attribute("use") {
-                Some("signing") | None => {}
-                Some(_) => continue, // encryption-only key — skip
-            }
-            for cert_node in kd
-                .descendants()
-                .filter(|n| n.is_element() && n.tag_name().name() == "X509Certificate")
-            {
-                let b64: String = node_text(&cert_node)
-                    .chars()
-                    .filter(|c| !c.is_whitespace())
-                    .collect();
-                if b64.is_empty() {
-                    continue;
-                }
-                let der = base64::engine::general_purpose::STANDARD
-                    .decode(b64.as_bytes())
-                    .map_err(|e| SamlError::Base64(e.to_string()))?;
-                signing_certs_der.push(der);
-            }
-        }
-
-        if signing_certs_der.is_empty() {
-            return Err(SamlError::NoSigningCert);
-        }
-
-        Ok(Self {
-            entity_id,
-            sso_redirect_url,
-            sso_post_url,
-            signing_certs_der,
-        })
-    }
-
-    /// Preferred SSO destination for an outbound AuthnRequest: HTTP-Redirect
-    /// if advertised, otherwise HTTP-POST.
-    pub fn sso_destination(&self) -> Option<&str> {
-        self.sso_redirect_url
-            .as_deref()
-            .or(self.sso_post_url.as_deref())
-    }
-}
-
-/// Build our SP `EntityDescriptor` XML so an IdP admin can import OpenPXE as a
-/// relying party. Advertises the ACS URL (HTTP-POST binding) and an emailAddress
-/// NameID format — matching what the response path expects.
-pub fn build_sp_metadata(sp: &SpParams) -> String {
-    let entity = xml_escape(&sp.entity_id);
-    let acs = xml_escape(&sp.acs_url);
-    format!(
-        r#"<?xml version="1.0" encoding="UTF-8"?>
-<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="{entity}">
-  <SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
-    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
-    <AssertionConsumerService Binding="{BINDING_POST}" Location="{acs}" index="0" isDefault="true"/>
-  </SPSSODescriptor>
-</EntityDescriptor>
-"#
-    )
-}
-
-/// Collect the concatenated text of an element's direct text children.
-fn node_text(n: &roxmltree::Node<'_, '_>) -> String {
-    n.children()
-        .filter(roxmltree::Node::is_text)
-        .filter_map(|c| c.text())
-        .collect()
-}
-
-// `xml_escape` now lives in `openpxe_core::encoding` (v0.5.4) — imported above.
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    // A trimmed-down Keycloak-style IdP descriptor (cert body is a stand-in;
-    // signing tests build real certs in the parent module's tests).
-    const SAMPLE: &str = r#"<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
-        xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
-        entityID="https://idp.example.com/realms/fleet">
-      <md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
-        <md:KeyDescriptor use="signing">
-          <ds:KeyInfo><ds:X509Data><ds:X509Certificate>
-            QUJDREVG
-          </ds:X509Certificate></ds:X509Data></ds:KeyInfo>
-        </md:KeyDescriptor>
-        <md:KeyDescriptor use="encryption">
-          <ds:KeyInfo><ds:X509Data><ds:X509Certificate>WlpaWg==</ds:X509Certificate></ds:X509Data></ds:KeyInfo>
-        </md:KeyDescriptor>
-        <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
-            Location="https://idp.example.com/realms/fleet/protocol/saml"/>
-        <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
-            Location="https://idp.example.com/realms/fleet/protocol/saml"/>
-      </md:IDPSSODescriptor>
-    </md:EntityDescriptor>"#;
-
-    #[test]
-    fn parses_entity_sso_and_signing_cert() {
-        let m = IdpMetadata::parse(SAMPLE).unwrap();
-        assert_eq!(m.entity_id, "https://idp.example.com/realms/fleet");
-        assert_eq!(
-            m.sso_redirect_url.as_deref(),
-            Some("https://idp.example.com/realms/fleet/protocol/saml")
-        );
-        assert!(m.sso_post_url.is_some());
-        // Only the signing KeyDescriptor's cert is collected (ABCDEF), not the
-        // encryption one (ZZZZ).
-        assert_eq!(m.signing_certs_der.len(), 1);
-        assert_eq!(m.signing_certs_der[0], b"ABCDEF");
-    }
-
-    #[test]
-    fn missing_signing_cert_is_rejected() {
-        let xml = r#"<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="x">
-            <IDPSSODescriptor>
-              <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://x/sso"/>
-            </IDPSSODescriptor></EntityDescriptor>"#;
-        assert!(matches!(
-            IdpMetadata::parse(xml),
-            Err(SamlError::NoSigningCert)
-        ));
-    }
-
-    #[test]
-    fn missing_idp_descriptor_is_rejected() {
-        let xml = r#"<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="x"></EntityDescriptor>"#;
-        assert!(matches!(
-            IdpMetadata::parse(xml),
-            Err(SamlError::Metadata(_))
-        ));
-    }
-
-    #[test]
-    fn sp_metadata_contains_entity_and_acs() {
-        let sp = SpParams {
-            entity_id: "https://pxe.example.com".into(),
-            acs_url: "https://pxe.example.com/api/sso/acs".into(),
-        };
-        let xml = build_sp_metadata(&sp);
-        assert!(xml.contains(r#"entityID="https://pxe.example.com""#));
-        assert!(xml.contains("https://pxe.example.com/api/sso/acs"));
-        assert!(xml.contains(BINDING_POST));
-        // Must be well-formed.
-        roxmltree::Document::parse(&xml).unwrap();
-    }
-}

crates/core/src/saml/mod.rs

@@ -1,92 +0,0 @@
-//! Pure-Rust SAML 2.0 Service Provider (v0.5.1).
-//!
-//! This module implements the SP half of a SAML Web-Browser-SSO profile:
-//!
-//! * [`metadata`] — parse the IdP's `EntityDescriptor` (SSO URLs + signing
-//!   certificates) and build *our* SP metadata for the IdP admin to import.
-//! * [`authn_request`] — build an `AuthnRequest` and encode it for the
-//!   HTTP-Redirect binding.
-//! * [`response`] — decode a `SAMLResponse`, **verify its XML signature**
-//!   against the IdP's pinned certificate (via the pure-Rust `bergshamra`
-//!   crate — no OpenSSL/libxml2/xmlsec, so the static musl binary stays
-//!   C-free), then enforce the SP-side semantic checks (Status, Destination,
-//!   Audience, time bounds) that are where SAML SPs actually get attacked.
-//!
-//! Stateful checks (replay of assertion IDs, correlating `InResponseTo`
-//! against requests *we* issued, gating IdP-initiated login) live in the
-//! HTTP layer — [`response::consume`] is deliberately stateless and returns
-//! the IDs the caller needs to perform them.
-//!
-//! Access model: any assertion the IdP authenticates and we cryptographically
-//! verify yields an operator [`VerifiedPrincipal`]. OpenPXE is single-tier —
-//! there is no per-user role table — and the local admin account remains a
-//! guaranteed fallback owner regardless of SSO state.
-
-pub mod authn_request;
-pub mod metadata;
-pub mod response;
-
-pub use authn_request::AuthnRequest;
-pub use metadata::IdpMetadata;
-pub use response::{VerifiedPrincipal, VerifiedResponse};
-
-use thiserror::Error;
-
-/// Default clock-skew tolerance applied to assertion time bounds. SAML IdPs
-/// and SPs rarely have perfectly synced clocks; 60s matches common practice
-/// (Shibboleth/FleetDM defaults are in this ballpark).
-pub const DEFAULT_CLOCK_SKEW_SECS: i64 = 60;
-
-/// Runtime SP parameters, derived from [`crate::SsoConfig`] + the advertised
-/// public base URL by the HTTP layer.
-#[derive(Debug, Clone)]
-pub struct SpParams {
-    /// Our SP Entity ID (the `<Issuer>` we send and the `Audience` we require
-    /// in responses). Defaults to the public base URL when the operator left
-    /// the Entity ID field blank.
-    pub entity_id: String,
-    /// The Assertion Consumer Service URL the IdP POSTs the response to —
-    /// `<public_base_url>/api/sso/acs`.
-    pub acs_url: String,
-}
-
-/// Everything that can go wrong consuming a SAML response. Kept coarse on
-/// purpose: the HTTP layer logs the detail and shows the operator a generic
-/// "SSO sign-in failed" — we never leak which specific check tripped to the
-/// browser, since that aids an attacker probing the SP.
-#[derive(Debug, Error)]
-pub enum SamlError {
-    #[error("SAML XML parse error: {0}")]
-    Xml(String),
-    #[error("IdP metadata is missing a required element: {0}")]
-    Metadata(String),
-    #[error("no usable IdP signing certificate in metadata")]
-    NoSigningCert,
-    #[error("signature verification failed: {0}")]
-    Signature(String),
-    #[error("the signature does not cover the assertion we read")]
-    SignatureScope,
-    #[error("SAML response status was not Success: {0}")]
-    Status(String),
-    #[error("response is missing a required element: {0}")]
-    MissingElement(String),
-    #[error("encrypted assertions are not supported in this release")]
-    EncryptedAssertionUnsupported,
-    #[error("expected exactly one assertion, found {0}")]
-    AssertionCount(usize),
-    #[error("issuer mismatch: response was not issued by the configured IdP")]
-    IssuerMismatch,
-    #[error("audience mismatch: assertion is not addressed to this service provider")]
-    AudienceMismatch,
-    #[error("response destination does not match our ACS URL")]
-    DestinationMismatch,
-    #[error("assertion is expired or not yet valid")]
-    TimeBounds,
-    #[error("invalid SAML timestamp: {0}")]
-    Timestamp(String),
-    #[error("base64 decode failed: {0}")]
-    Base64(String),
-}
-
-#[cfg(test)]
-mod tests;

crates/core/src/saml/response.rs

@@ -1,294 +0,0 @@
-//! SAMLResponse consumption: signature verification + SP-side validation.
-//!
-//! [`consume`] is intentionally **stateless** — it verifies the XML signature
-//! against the IdP's pinned certificate(s) and enforces every check that can
-//! be made from the response alone (Status, Destination, Issuer, Audience,
-//! time bounds, signature scope). It then returns the `assertion_id` and
-//! `in_response_to` so the HTTP layer can perform the *stateful* checks it
-//! owns: replay rejection, correlating the request we issued, and gating
-//! IdP-initiated login.
-
-use roxmltree::{Document, Node};
-use time::format_description::well_known::Rfc3339;
-use time::{Duration, OffsetDateTime};
-
-use super::metadata::IdpMetadata;
-use super::{SamlError, SpParams};
-
-const STATUS_SUCCESS: &str = "urn:oasis:names:tc:SAML:2.0:status:Success";
-
-/// The verified subject of a SAML assertion. OpenPXE is single-tier, so this
-/// is all an operator session needs.
-#[derive(Debug, Clone)]
-pub struct VerifiedPrincipal {
-    /// The `<NameID>` value (an email, per our requested NameID format).
-    pub name_id: String,
-    /// Email used as the session identity. Equals `name_id` for the
-    /// emailAddress NameID format.
-    pub email: String,
-    /// Human-readable display name, if the IdP sent one as an attribute.
-    pub display_name: Option<String>,
-}
-
-/// Result of a successful [`consume`]. The IDs/expiry feed the HTTP layer's
-/// stateful checks.
-#[derive(Debug, Clone)]
-pub struct VerifiedResponse {
-    pub principal: VerifiedPrincipal,
-    /// `InResponseTo` from the response, if present. `None` = unsolicited
-    /// (IdP-initiated) — the HTTP layer only accepts that when the operator
-    /// enabled it.
-    pub in_response_to: Option<String>,
-    /// The assertion's `ID` — used by the caller as the replay-guard key.
-    pub assertion_id: String,
-    /// The assertion's expiry (`Conditions/@NotOnOrAfter`) — the replay
-    /// guard can drop the consumed ID after this instant.
-    pub assertion_expiry: OffsetDateTime,
-    /// `AuthnStatement/@SessionIndex`, if present (useful for future SLO).
-    pub session_index: Option<String>,
-}
-
-/// Verify and validate a decoded `SAMLResponse` XML document.
-pub fn consume(
-    xml: &str,
-    sp: &SpParams,
-    idp: &IdpMetadata,
-    now: OffsetDateTime,
-    clock_skew: Duration,
-) -> Result<VerifiedResponse, SamlError> {
-    // 1. Cryptographically verify the signature against the pinned IdP cert(s).
-    //    `trusted_keys_only` ignores any cert embedded in the document's
-    //    KeyInfo, so an attacker can't substitute their own key.
-    let verified_uris = verify_signature(xml, &idp.signing_certs_der)?;
-
-    // 2. Parse for semantic validation.
-    let doc = Document::parse(xml).map_err(|e| SamlError::Xml(e.to_string()))?;
-    let root = doc.root_element();
-    if root.tag_name().name() != "Response" {
-        return Err(SamlError::MissingElement("Response".into()));
-    }
-    let response_id = root.attribute("ID").map(str::to_owned);
-    let in_response_to = root.attribute("InResponseTo").map(str::to_owned);
-
-    // 3. Status must be Success.
-    let status_value = root
-        .descendants()
-        .find(|n| n.is_element() && n.tag_name().name() == "StatusCode")
-        .and_then(|sc| sc.attribute("Value"))
-        .unwrap_or("");
-    if status_value != STATUS_SUCCESS && !status_value.ends_with(":Success") {
-        return Err(SamlError::Status(status_value.to_owned()));
-    }
-
-    // 4. Destination (if the IdP set one) must be our ACS.
-    if let Some(dest) = root.attribute("Destination") {
-        if !urls_equal(dest, &sp.acs_url) {
-            return Err(SamlError::DestinationMismatch);
-        }
-    }
-
-    // 5. Exactly one (unencrypted) Assertion.
-    if root
-        .descendants()
-        .any(|n| n.is_element() && n.tag_name().name() == "EncryptedAssertion")
-    {
-        return Err(SamlError::EncryptedAssertionUnsupported);
-    }
-    let assertions: Vec<Node<'_, '_>> = root
-        .children()
-        .filter(|c| c.is_element() && c.tag_name().name() == "Assertion")
-        .collect();
-    if assertions.len() != 1 {
-        return Err(SamlError::AssertionCount(assertions.len()));
-    }
-    let assertion = assertions[0];
-    let assertion_id = assertion
-        .attribute("ID")
-        .map(str::to_owned)
-        .ok_or_else(|| SamlError::MissingElement("Assertion/@ID".into()))?;
-
-    // 6. The signature must actually cover the assertion we're about to trust:
-    //    either the assertion itself, the enclosing response, or the whole
-    //    document. (bergshamra's strict_verification already constrains where
-    //    the signed element may sit; this ties it to *our* assertion.)
-    let covers_assertion = verified_uris.iter().any(|u| {
-        u.is_empty()
-            || u == &format!("#{assertion_id}")
-            || response_id
-                .as_ref()
-                .is_some_and(|rid| u == &format!("#{rid}"))
-    });
-    if !covers_assertion {
-        return Err(SamlError::SignatureScope);
-    }
-
-    // 7. Issuer must be the configured IdP.
-    let issuer = first_child(assertion, "Issuer")
-        .map(text_of)
-        .unwrap_or_default();
-    if !idp.entity_id.is_empty() && issuer != idp.entity_id {
-        return Err(SamlError::IssuerMismatch);
-    }
-
-    // 8. Subject → NameID + SubjectConfirmationData time/recipient checks.
-    let subject = first_child(assertion, "Subject")
-        .ok_or_else(|| SamlError::MissingElement("Subject".into()))?;
-    let name_id = first_child(subject, "NameID")
-        .map(text_of)
-        .filter(|s| !s.is_empty())
-        .ok_or_else(|| SamlError::MissingElement("NameID".into()))?;
-    if let Some(scd) = subject
-        .descendants()
-        .find(|n| n.is_element() && n.tag_name().name() == "SubjectConfirmationData")
-    {
-        if let Some(recipient) = scd.attribute("Recipient") {
-            if !urls_equal(recipient, &sp.acs_url) {
-                return Err(SamlError::DestinationMismatch);
-            }
-        }
-        if let Some(noa) = scd.attribute("NotOnOrAfter") {
-            let noa = parse_instant(noa)?;
-            if now >= noa + clock_skew {
-                return Err(SamlError::TimeBounds);
-            }
-        }
-    }
-
-    // 9. Conditions: time window + audience.
-    let conditions = first_child(assertion, "Conditions");
-    if let Some(cond) = conditions {
-        if let Some(nb) = cond.attribute("NotBefore") {
-            let nb = parse_instant(nb)?;
-            if now < nb - clock_skew {
-                return Err(SamlError::TimeBounds);
-            }
-        }
-    }
-    let assertion_expiry = conditions
-        .and_then(|c| c.attribute("NotOnOrAfter"))
-        .map(parse_instant)
-        .transpose()?
-        .ok_or_else(|| SamlError::MissingElement("Conditions/@NotOnOrAfter".into()))?;
-    if now >= assertion_expiry + clock_skew {
-        return Err(SamlError::TimeBounds);
-    }
-
-    let audience_ok = conditions.is_some_and(|c| {
-        c.descendants()
-            .filter(|n| n.is_element() && n.tag_name().name() == "Audience")
-            .any(|a| text_of(a) == sp.entity_id)
-    });
-    if !audience_ok {
-        return Err(SamlError::AudienceMismatch);
-    }
-
-    // 10. Optional: SessionIndex + display-name attribute.
-    let session_index = assertion
-        .descendants()
-        .find(|n| n.is_element() && n.tag_name().name() == "AuthnStatement")
-        .and_then(|a| a.attribute("SessionIndex"))
-        .map(str::to_owned);
-
-    let display_name = extract_display_name(assertion);
-
-    Ok(VerifiedResponse {
-        principal: VerifiedPrincipal {
-            email: name_id.clone(),
-            name_id,
-            display_name,
-        },
-        in_response_to,
-        assertion_id,
-        assertion_expiry,
-        session_index,
-    })
-}
-
-/// Verify the document's XML-DSig against each pinned IdP cert in turn
-/// (handles key rotation), returning the verified `<Reference>` URIs.
-fn verify_signature(xml: &str, certs_der: &[Vec<u8>]) -> Result<Vec<String>, SamlError> {
-    let mut last_err = String::from("no signing certificate matched");
-    for der in certs_der {
-        let key = match bergshamra::keys::loader::load_x509_cert_der(der) {
-            Ok(k) => k,
-            Err(e) => {
-                last_err = e.to_string();
-                continue;
-            }
-        };
-        let mut km = bergshamra::keys::KeysManager::new();
-        km.add_key(key);
-        // trusted_keys_only: only ever trust the pinned IdP key, never an
-        // inline KeyInfo cert. strict_verification: XSW positional defense.
-        let ctx = bergshamra::DsigContext::new(km)
-            .with_trusted_keys_only(true)
-            .with_strict_verification(true);
-        match bergshamra::verify(&ctx, xml) {
-            Ok(bergshamra::VerifyResult::Valid { references, .. }) => {
-                return Ok(references.into_iter().map(|r| r.uri).collect());
-            }
-            Ok(bergshamra::VerifyResult::Invalid { reason }) => last_err = reason,
-            Err(e) => last_err = e.to_string(),
-        }
-    }
-    Err(SamlError::Signature(last_err))
-}
-
-/// Pull a display name from the assertion's attribute statement, trying the
-/// common attribute names IdPs use (FleetDM checks the same set).
-fn extract_display_name(assertion: Node<'_, '_>) -> Option<String> {
-    const WANTED: &[&str] = &[
-        "name",
-        "displayname",
-        "cn",
-        "urn:oid:2.5.4.3",
-        "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
-    ];
-    for attr in assertion
-        .descendants()
-        .filter(|n| n.is_element() && n.tag_name().name() == "Attribute")
-    {
-        let key = attr
-            .attribute("Name")
-            .or_else(|| attr.attribute("FriendlyName"))
-            .unwrap_or("")
-            .to_ascii_lowercase();
-        if WANTED.contains(&key.as_str()) {
-            if let Some(val) = attr
-                .descendants()
-                .find(|n| n.is_element() && n.tag_name().name() == "AttributeValue")
-            {
-                let v = text_of(val);
-                if !v.is_empty() {
-                    return Some(v);
-                }
-            }
-        }
-    }
-    None
-}
-
-fn first_child<'a, 'i>(n: Node<'a, 'i>, local: &str) -> Option<Node<'a, 'i>> {
-    n.children()
-        .find(|c| c.is_element() && c.tag_name().name() == local)
-}
-
-fn text_of(n: Node<'_, '_>) -> String {
-    n.children()
-        .filter(Node::is_text)
-        .filter_map(|c| c.text())
-        .collect::<String>()
-        .trim()
-        .to_owned()
-}
-
-/// Parse an `xs:dateTime` (e.g. `2026-05-31T12:00:00.000Z`).
-fn parse_instant(s: &str) -> Result<OffsetDateTime, SamlError> {
-    OffsetDateTime::parse(s.trim(), &Rfc3339).map_err(|e| SamlError::Timestamp(format!("{s}: {e}")))
-}
-
-/// Compare two URLs for SAML endpoint-matching purposes: exact, or differing
-/// only by a single trailing slash.
-fn urls_equal(a: &str, b: &str) -> bool {
-    a == b || a.trim_end_matches('/') == b.trim_end_matches('/')
-}

crates/core/src/saml/tests.rs

@@ -1,287 +0,0 @@
-//! End-to-end SAML SP tests.
-//!
-//! We mint a throwaway self-signed cert/key with `rcgen`, sign a SAML Response
-//! template with `bergshamra::sign` (the same engine that verifies it), and
-//! drive [`response::consume`] through the accept path and every reject path.
-//! This proves both the signature wiring and the SP-semantic checks.
-
-use time::format_description::well_known::Rfc3339;
-use time::{Duration, OffsetDateTime};
-
-use super::metadata::IdpMetadata;
-use super::{response, SamlError, SpParams};
-
-const SP_ENTITY: &str = "https://pxe.example.com";
-const ACS: &str = "https://pxe.example.com/api/sso/acs";
-const IDP_ENTITY: &str = "https://idp.example.com/realms/fleet";
-const EMAIL: &str = "[email protected]";
-
-struct TestIdp {
-    cert_der: Vec<u8>,
-    key_pem: String,
-}
-
-fn test_idp() -> TestIdp {
-    let ck = rcgen::generate_simple_self_signed(vec!["idp.example.com".to_string()]).unwrap();
-    TestIdp {
-        cert_der: ck.cert.der().as_ref().to_vec(),
-        key_pem: ck.key_pair.serialize_pem(),
-    }
-}
-
-fn fmt(t: OffsetDateTime) -> String {
-    t.replace_nanosecond(0).unwrap().format(&Rfc3339).unwrap()
-}
-
-/// Knobs for building a response template — defaults are a valid response.
-struct Resp {
-    issuer: String,
-    audience: String,
-    status: String,
-    not_before: OffsetDateTime,
-    not_on_or_after: OffsetDateTime,
-    in_response_to: Option<String>,
-    recipient: String,
-}
-
-impl Default for Resp {
-    fn default() -> Self {
-        let now = OffsetDateTime::now_utc();
-        Self {
-            issuer: IDP_ENTITY.into(),
-            audience: SP_ENTITY.into(),
-            status: "urn:oasis:names:tc:SAML:2.0:status:Success".into(),
-            not_before: now - Duration::minutes(5),
-            not_on_or_after: now + Duration::hours(1),
-            in_response_to: Some("_req-abc".into()),
-            recipient: ACS.into(),
-        }
-    }
-}
-
-impl Resp {
-    /// The unsigned template (a `<ds:Signature>` with empty values).
-    fn template(&self) -> String {
-        let now = fmt(OffsetDateTime::now_utc());
-        let irt = self
-            .in_response_to
-            .as_ref()
-            .map(|v| format!(r#" InResponseTo="{v}""#))
-            .unwrap_or_default();
-        format!(
-            r##"<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_resp1" Version="2.0" IssueInstant="{now}" Destination="{ACS}"{irt}>
-  <saml:Issuer>{issuer}</saml:Issuer>
-  <samlp:Status><samlp:StatusCode Value="{status}"/></samlp:Status>
-  <saml:Assertion ID="_assertion1" Version="2.0" IssueInstant="{now}">
-    <saml:Issuer>{issuer}</saml:Issuer>
-    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
-      <ds:SignedInfo>
-        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
-        <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256"/>
-        <ds:Reference URI="#_assertion1">
-          <ds:Transforms>
-            <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
-            <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
-          </ds:Transforms>
-          <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
-          <ds:DigestValue></ds:DigestValue>
-        </ds:Reference>
-      </ds:SignedInfo>
-      <ds:SignatureValue></ds:SignatureValue>
-    </ds:Signature>
-    <saml:Subject>
-      <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">{EMAIL}</saml:NameID>
-      <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
-        <saml:SubjectConfirmationData Recipient="{recipient}" NotOnOrAfter="{noa}"{irt}/>
-      </saml:SubjectConfirmation>
-    </saml:Subject>
-    <saml:Conditions NotBefore="{nb}" NotOnOrAfter="{noa}">
-      <saml:AudienceRestriction><saml:Audience>{audience}</saml:Audience></saml:AudienceRestriction>
-    </saml:Conditions>
-    <saml:AuthnStatement AuthnInstant="{now}" SessionIndex="sess-123">
-      <saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef></saml:AuthnContext>
-    </saml:AuthnStatement>
-    <saml:AttributeStatement>
-      <saml:Attribute Name="displayName"><saml:AttributeValue>Miles Ward</saml:AttributeValue></saml:Attribute>
-    </saml:AttributeStatement>
-  </saml:Assertion>
-</samlp:Response>"##,
-            issuer = self.issuer,
-            status = self.status,
-            audience = self.audience,
-            recipient = self.recipient,
-            nb = fmt(self.not_before),
-            noa = fmt(self.not_on_or_after),
-        )
-    }
-}
-
-fn sign(template: &str, key_pem: &str) -> String {
-    let key = bergshamra::keys::loader::load_pem_auto(key_pem.as_bytes(), None)
-        .expect("load test signing key");
-    let mut km = bergshamra::keys::KeysManager::new();
-    km.add_key(key);
-    let ctx = bergshamra::DsigContext::new(km);
-    bergshamra::sign(&ctx, template).expect("sign test response")
-}
-
-fn sp() -> SpParams {
-    SpParams {
-        entity_id: SP_ENTITY.into(),
-        acs_url: ACS.into(),
-    }
-}
-
-fn idp(cert_der: Vec<u8>) -> IdpMetadata {
-    IdpMetadata {
-        entity_id: IDP_ENTITY.into(),
-        sso_redirect_url: None,
-        sso_post_url: None,
-        signing_certs_der: vec![cert_der],
-    }
-}
-
-fn consume(xml: &str, cert_der: Vec<u8>) -> Result<response::VerifiedResponse, SamlError> {
-    response::consume(
-        xml,
-        &sp(),
-        &idp(cert_der),
-        OffsetDateTime::now_utc(),
-        Duration::seconds(60),
-    )
-}
-
-#[test]
-fn good_response_yields_principal() {
-    let t = test_idp();
-    let signed = sign(&Resp::default().template(), &t.key_pem);
-    let out = consume(&signed, t.cert_der).expect("valid response should verify");
-    assert_eq!(out.principal.email, EMAIL);
-    assert_eq!(out.principal.name_id, EMAIL);
-    assert_eq!(out.principal.display_name.as_deref(), Some("Miles Ward"));
-    assert_eq!(out.in_response_to.as_deref(), Some("_req-abc"));
-    assert_eq!(out.assertion_id, "_assertion1");
-    assert_eq!(out.session_index.as_deref(), Some("sess-123"));
-}
-
-#[test]
-fn tampered_assertion_is_rejected() {
-    let t = test_idp();
-    let signed = sign(&Resp::default().template(), &t.key_pem);
-    // Flip the subject email after signing — breaks the digest.
-    let tampered = signed.replace(EMAIL, "[email protected]");
-    assert_ne!(signed, tampered);
-    assert!(matches!(
-        consume(&tampered, t.cert_der),
-        Err(SamlError::Signature(_) | SamlError::SignatureScope)
-    ));
-}
-
-#[test]
-fn unsigned_response_is_rejected() {
-    let t = test_idp();
-    // Feed the *unsigned* template (empty SignatureValue) straight in.
-    let unsigned = Resp::default().template();
-    assert!(matches!(
-        consume(&unsigned, t.cert_der),
-        Err(SamlError::Signature(_))
-    ));
-}
-
-#[test]
-fn wrong_signing_key_is_rejected() {
-    let signer = test_idp();
-    let other = test_idp(); // different keypair pinned as the "IdP" cert
-    let signed = sign(&Resp::default().template(), &signer.key_pem);
-    assert!(matches!(
-        consume(&signed, other.cert_der),
-        Err(SamlError::Signature(_))
-    ));
-}
-
-#[test]
-fn wrong_audience_is_rejected() {
-    let t = test_idp();
-    let r = Resp {
-        audience: "https://someone-else.example".into(),
-        ..Resp::default()
-    };
-    let signed = sign(&r.template(), &t.key_pem);
-    assert!(matches!(
-        consume(&signed, t.cert_der),
-        Err(SamlError::AudienceMismatch)
-    ));
-}
-
-#[test]
-fn expired_assertion_is_rejected() {
-    let t = test_idp();
-    let now = OffsetDateTime::now_utc();
-    let r = Resp {
-        not_before: now - Duration::hours(2),
-        not_on_or_after: now - Duration::hours(1),
-        ..Resp::default()
-    };
-    let signed = sign(&r.template(), &t.key_pem);
-    assert!(matches!(
-        consume(&signed, t.cert_der),
-        Err(SamlError::TimeBounds)
-    ));
-}
-
-#[test]
-fn future_assertion_is_rejected() {
-    let t = test_idp();
-    let now = OffsetDateTime::now_utc();
-    let r = Resp {
-        not_before: now + Duration::hours(1),
-        not_on_or_after: now + Duration::hours(2),
-        ..Resp::default()
-    };
-    let signed = sign(&r.template(), &t.key_pem);
-    assert!(matches!(
-        consume(&signed, t.cert_der),
-        Err(SamlError::TimeBounds)
-    ));
-}
-
-#[test]
-fn wrong_issuer_is_rejected() {
-    let t = test_idp();
-    let r = Resp {
-        issuer: "https://evil-idp.example".into(),
-        ..Resp::default()
-    };
-    let signed = sign(&r.template(), &t.key_pem);
-    assert!(matches!(
-        consume(&signed, t.cert_der),
-        Err(SamlError::IssuerMismatch)
-    ));
-}
-
-#[test]
-fn non_success_status_is_rejected() {
-    let t = test_idp();
-    let r = Resp {
-        status: "urn:oasis:names:tc:SAML:2.0:status:Requester".into(),
-        ..Resp::default()
-    };
-    let signed = sign(&r.template(), &t.key_pem);
-    assert!(matches!(
-        consume(&signed, t.cert_der),
-        Err(SamlError::Status(_))
-    ));
-}
-
-#[test]
-fn idp_initiated_has_no_in_response_to() {
-    // No InResponseTo => the HTTP layer must gate it behind allow_idp_initiated.
-    let t = test_idp();
-    let r = Resp {
-        in_response_to: None,
-        ..Resp::default()
-    };
-    let signed = sign(&r.template(), &t.key_pem);
-    let out = consume(&signed, t.cert_der).expect("unsolicited but otherwise valid");
-    assert!(out.in_response_to.is_none());
-}

crates/core/src/sso.rs

@@ -1,17 +1,16 @@
-//! SAML SSO configuration — FleetDM-shaped.
+//! SAML SSO configuration — FleetDM-shaped, storage-only for v0.4.5.
 //!
 //! The operator pastes their IdP's metadata XML (or its URL) and a
-//! human-readable label. As of v0.5.1 the SAML login flow is wired
+//! human-readable label; v0.4.5 just persists it. The actual SAML
-//! end-to-end (see [`crate::saml`]): SP-initiated AuthnRequest, the ACS
+//! response-validation / JIT-provisioning flow lands in a later release
-//! endpoint, pure-Rust signature verification, and operator-session
+//! — for now we cover the "configurable" half so an operator can teach
-//! minting. This module owns only the persisted *configuration*.
+//! OpenPXE about their IdP today and flip the switch on next upgrade.
 //!
 //! Shape borrowed from <https://github.com/fleetdm/fleet>'s app-config
-//! SSO block, minus the user-RBAC fields (OpenPXE is single-tier: any
+//! SSO block, minus the user-RBAC fields (OpenPXE is single-tier: you
-//! IdP-authenticated user the SP cryptographically verifies gets an
+//! have access or you don't). Entity ID is omitted from the operator
-//! operator session; there is no per-user role table). Entity ID is
+//! UI per the v0.4.5 brief — it defaults to the advertised public base
-//! exposed (FleetDM-style) but defaults to the advertised public base
+//! URL when SAML wiring lands, which is what most IdPs expect anyway.
-//! URL when blank, which is what most IdPs expect anyway.
 
 use parking_lot::RwLock;
 use serde::{Deserialize, Serialize};
@@ -48,18 +47,6 @@ pub struct SsoConfig {
     /// future SAML flow; not validated here beyond a basic length cap.
     #[serde(default)]
     pub metadata_url: String,
-    /// SP Entity ID advertised to the IdP — mirrors FleetDM's "Entity ID".
-    /// Must exactly match the SP/Relying-Party entry configured on the IdP.
-    /// Empty falls back to the advertised public base URL at runtime, which
-    /// is what most IdPs expect. Length-capped at [`MAX_URL_LEN`].
-    #[serde(default)]
-    pub entity_id: String,
-    /// Allow IdP-initiated login — an unsolicited `<Response>` POSTed to the
-    /// ACS with no `InResponseTo`. Mirrors FleetDM's "Allow SSO login
-    /// initiated by identity provider". Default off; SP-initiated (the
-    /// "Sign in with X" button) is always allowed regardless.
-    #[serde(default)]
-    pub allow_idp_initiated: bool,
 }
 
 impl SsoConfig {
@@ -69,7 +56,8 @@ impl SsoConfig {
     /// surface a yellow "configured but not live yet" hint.
     #[must_use]
     pub fn is_usable(&self) -> bool {
-        self.enabled && (!self.metadata.trim().is_empty() || !self.metadata_url.trim().is_empty())
+        self.enabled
+            && (!self.metadata.trim().is_empty() || !self.metadata_url.trim().is_empty())
     }
 }
 
@@ -120,12 +108,6 @@ impl SsoStore {
         cfg.idp_logo_url = cfg.idp_logo_url.trim().to_string();
         cfg.metadata = cfg.metadata.trim().to_string();
         cfg.metadata_url = cfg.metadata_url.trim().to_string();
-        cfg.entity_id = cfg.entity_id.trim().to_string();
-        if cfg.entity_id.len() > MAX_URL_LEN {
-            return Err(Error::Invalid(format!(
-                "entity_id exceeds {MAX_URL_LEN}-char cap"
-            )));
-        }
         if cfg.metadata.len() > MAX_METADATA_BYTES {
             return Err(Error::Invalid(format!(
                 "metadata XML exceeds {MAX_METADATA_BYTES}-byte cap"
@@ -235,8 +217,6 @@ mod tests {
             metadata: String::new(),
             metadata_url: "https://idp.example.com/metadata".into(),
             idp_logo_url: String::new(),
-            entity_id: String::new(),
-            allow_idp_initiated: false,
         })
         .unwrap();
         drop(s);
@@ -259,8 +239,6 @@ mod tests {
             metadata: xml.into(),
             metadata_url: String::new(),
             idp_logo_url: String::new(),
-            entity_id: String::new(),
-            allow_idp_initiated: false,
         })
         .unwrap();
         assert!(s.snapshot().is_usable());
@@ -276,8 +254,6 @@ mod tests {
             metadata: String::new(),
             metadata_url: String::new(),
             idp_logo_url: String::new(),
-            entity_id: String::new(),
-            allow_idp_initiated: false,
         });
         assert!(matches!(r, Err(Error::Invalid(_))));
         // …and a disabled blank config is fine.
@@ -294,8 +270,6 @@ mod tests {
             metadata: String::new(),
             metadata_url: "ftp://idp.example.com/metadata".into(),
             idp_logo_url: String::new(),
-            entity_id: String::new(),
-            allow_idp_initiated: false,
         });
         assert!(matches!(r, Err(Error::Invalid(_))));
     }
@@ -313,8 +287,6 @@ mod tests {
             metadata: String::new(),
             metadata_url: String::new(),
             idp_logo_url: "data:image/png;base64,...".into(),
-            entity_id: String::new(),
-            allow_idp_initiated: false,
         });
         assert!(matches!(r, Err(Error::Invalid(_))));
         // Real HTTPS URL is fine.
@@ -324,51 +296,9 @@ mod tests {
             metadata: String::new(),
             metadata_url: String::new(),
             idp_logo_url: "https://idp.example.com/logo.png".into(),
-            entity_id: String::new(),
-            allow_idp_initiated: false,
         })
         .unwrap();
-        assert_eq!(
+        assert_eq!(s.snapshot().idp_logo_url, "https://idp.example.com/logo.png");
-            s.snapshot().idp_logo_url,
-            "https://idp.example.com/logo.png"
-        );
-    }
-
-    #[test]
-    fn entity_id_and_idp_initiated_round_trip() {
-        // v0.5.1: SP Entity ID + IdP-initiated toggle persist across reload.
-        let dir = tempdir().unwrap();
-        let s = SsoStore::load_or_default(dir.path());
-        s.replace(SsoConfig {
-            enabled: true,
-            idp_name: "Keycloak".into(),
-            metadata: String::new(),
-            metadata_url: "https://idp.example.com/metadata".into(),
-            idp_logo_url: String::new(),
-            entity_id: "https://pxe.example.com".into(),
-            allow_idp_initiated: true,
-        })
-        .unwrap();
-        drop(s);
-        let cfg = SsoStore::load_or_default(dir.path()).snapshot();
-        assert_eq!(cfg.entity_id, "https://pxe.example.com");
-        assert!(cfg.allow_idp_initiated);
-    }
-
-    #[test]
-    fn entity_id_cap_enforced() {
-        let dir = tempdir().unwrap();
-        let s = SsoStore::load_or_default(dir.path());
-        let r = s.replace(SsoConfig {
-            enabled: false,
-            idp_name: String::new(),
-            metadata: String::new(),
-            metadata_url: String::new(),
-            idp_logo_url: String::new(),
-            entity_id: "x".repeat(MAX_URL_LEN + 1),
-            allow_idp_initiated: false,
-        });
-        assert!(matches!(r, Err(Error::Invalid(_))));
     }
 
     #[test]
@@ -382,8 +312,6 @@ mod tests {
             metadata: oversize,
             metadata_url: String::new(),
             idp_logo_url: String::new(),
-            entity_id: String::new(),
-            allow_idp_initiated: false,
         });
         assert!(matches!(r, Err(Error::Invalid(_))));
     }

crates/http-api/Cargo.toml

@@ -33,6 +33,8 @@ thiserror.workspace = true
 anyhow.workspace = true
 bytes.workspace = true
 futures.workspace = true
+mime.workspace = true
+mime_guess.workspace = true
 uuid.workspace = true
 # v0.4.5 Forms auth: lock-free session store and cookie helpers.
 parking_lot.workspace = true
@@ -42,8 +44,6 @@ parking_lot.workspace = true
 # OpenSSL-free.
 reqwest.workspace = true
 lettre.workspace = true
-# v0.5.1: decode the base64 SAMLResponse at the ACS endpoint.
-base64.workspace = true
 
 [dev-dependencies]
 tokio = { workspace = true, features = ["macros", "rt", "rt-multi-thread", "time"] }
@@ -54,14 +54,3 @@ time = { workspace = true }
 # v0.4.61: integration tests need to generate real PNG bytes for the
 # `/branding/pxe-logo` compositor; hand-rolled CRCs are too fragile.
 image = { version = "0.25", default-features = false, features = ["png"] }
-# v0.5.1: the SAML ACS integration tests mint a throwaway IdP keypair
-# (rcgen) and sign a SAMLResponse with bergshamra so the happy-path,
-# replay, and IdP-initiated-gating flows exercise real signatures.
-rcgen = "0.13"
-bergshamra = { workspace = true }
-# v0.5.4: snapshot the generated iPXE menu so any unintended drift (a
-# dropped line, reordered item) is caught and reviewed, not silently shipped.
-insta = "1.40"
-# v0.5.4: stand up a mock HTTP server to exercise the SAML metadata-URL
-# fetch path (previously untested because it did a real network GET).
-wiremock = "0.6"

crates/http-api/src/app.rs

@@ -14,7 +14,6 @@
 //! | `/api/*`         | JSON/HTML API for the web UI                          |
 
 use crate::auth as auth_api;
-use crate::error::AppError;
 use crate::ipxe_script::{
     render_entry, render_family_menu, render_local_hdd, render_menu, render_nic_info,
     render_queue_entry, render_shell, render_tools_menu, render_util,
@@ -32,15 +31,12 @@ use axum::{
     Json, Router,
 };
 use openpxe_core::{
-    encoding::pct_encode, ext_for_mime, wol, BootEvent, ClientEvent, DeployProfile, Error,
+    ext_for_mime, wol, BootEvent, ClientEvent, Error, NotifyConfig, Settings, SsoConfig,
-    LogoSlot, NotifyConfig, Settings, SsoConfig, ALLOWED_LOGO_MIMES, MAX_LOGO_BYTES,
+    ALLOWED_LOGO_MIMES, MAX_LOGO_BYTES,
 };
 use openpxe_ipxe_assets::asset_bytes;
-use openpxe_iso_store::{
+use openpxe_iso_store::{IsoCategory, IsoMeta, IsoSource, NfsAddRequest, SmbAddRequest};
-    render_template, IsoCategory, IsoMeta, IsoSource, NfsAddRequest, SmbAddRequest, SmbState,
+use serde::Deserialize;
-    UnattendedKind, UnattendedMeta,
-};
-use serde::{Deserialize, Serialize};
 use serde_json::json;
 use std::net::SocketAddr;
 use std::time::Duration;
@@ -53,14 +49,7 @@ pub fn build_router(state: AppState) -> Router {
         .route("/", get(index))
         .route("/assets/app.js", get(ui_js))
         .route("/assets/app.css", get(ui_css))
-        // v0.5.2: theme-aware brand mark. `?theme=light|dark` selects the
-        // operator's per-theme logo slot (falling back across themes, then
-        // to the bundled mark). The WebUI swaps `?theme=` on theme toggle.
         .route("/assets/logo.svg", get(ui_logo))
-        // v0.5.2: favicon is pinned to the *bundled* OpenPXE mark for
-        // continuity — it never follows the operator's custom branding, so
-        // the browser-tab icon stays recognisably "OpenPXE".
-        .route("/assets/favicon.svg", get(ui_favicon))
         .route("/assets/loader.svg", get(ui_loader))
         // v0.4.6: PXE menu logo — the raster form of the operator's
         // uploaded mark, served so iPXE's `console --picture` can
@@ -72,16 +61,6 @@ pub fn build_router(state: AppState) -> Router {
         // iPXE script endpoints.
         .route("/boot.ipxe", get(boot_top_menu))
         .route("/boot/:filename", get(boot_sub))
-        // v0.5.2: unattended answer-file *serving* — public (like /iso),
-        // because the booting installer fetches these with no session.
-        // `/unattended/:id` serves a Kickstart/Preseed with `{{HOSTNAME}}`
-        // / `{{IP}}` / `{{MAC}}` substituted from the query string. The
-        // 3-segment form is the cloud-init NoCloud seed dir for Ubuntu
-        // autoinstall (`…/<ctx>/user-data` + `/meta-data`), where `<ctx>`
-        // base64url-encodes the per-host hostname/ip/mac. Management
-        // (upload/list/delete) lives under the gated `/api/unattended`.
-        .route("/unattended/:id", get(serve_unattended))
-        .route("/unattended/:id/:ctx/:sub", get(serve_unattended_seed))
         // Bundled binaries and raw ISO access.
         .route("/ipxe/:name", get(ipxe_binary))
         .route("/iso/:filename", get(iso_raw))
@@ -116,21 +95,12 @@ pub fn build_router(state: AppState) -> Router {
         // volume — surfaced as a small card on the Storage tab so the
         // operator knows when they're about to run out of room.
         .route("/api/storage/disk", get(api_storage_disk))
-        // v0.4.4: operator-controlled WebUI branding overrides (custom
+        // v0.4.4: operator-controlled WebUI branding overrides
-        // logo). v0.5.2: split into three slots — `light` / `dark` /
+        // (custom logo). Multipart upload to POST; DELETE clears.
-        // `client`. Multipart upload to POST; DELETE clears one slot.
         .route(
-            "/api/branding/logo/:slot",
+            "/api/branding/logo",
             post(api_branding_upload).delete(api_branding_clear),
         )
-        // v0.5.2: unattended-install answer-file management (gated).
-        // Multipart upload, list, delete. Serving is the public
-        // `/unattended/*` routes above.
-        .route(
-            "/api/unattended",
-            get(api_unattended_list).post(api_unattended_upload),
-        )
-        .route("/api/unattended/:id", delete(api_unattended_delete))
         // v0.4.4: self-rendered API reference, served as JSON so the UI
         // can format it consistently with the rest of the chrome. Lives
         // under the Settings tab — operators chasing an integration get
@@ -146,16 +116,14 @@ pub fn build_router(state: AppState) -> Router {
         .route("/api/login", post(auth_api::api_login))
         .route("/api/logout", post(auth_api::api_logout))
         .route("/api/me", get(auth_api::api_me))
-        .route("/api/me/credentials", put(auth_api::api_update_credentials))
+        .route(
-        // SAML SSO configuration (FleetDM-shaped). Gated behind auth — the
+            "/api/me/credentials",
-        // operator pastes their IdP metadata, Entity ID, and toggles here.
+            put(auth_api::api_update_credentials),
+        )
+        // v0.4.5: SAML SSO configuration (FleetDM-shaped, storage-only).
+        // The actual sign-in flow lands in a later release; this just
+        // gives operators a place to paste their IdP metadata today.
         .route("/api/sso", get(api_sso_get).put(api_sso_put))
-        // v0.5.1: SAML SP login flow (pre-auth — see the require_auth
-        // allowlist). /login redirects to the IdP, /acs consumes the signed
-        // response + mints a session, /metadata serves our SP descriptor.
-        .route("/api/sso/login", get(crate::saml_routes::sso_login))
-        .route("/api/sso/acs", post(crate::saml_routes::sso_acs))
-        .route("/api/sso/metadata", get(crate::saml_routes::sso_metadata))
         .route("/api/clients", get(api_list_clients))
         .route("/api/status", get(api_status))
         .route("/api/settings", get(api_get_settings).put(api_put_settings))
@@ -163,9 +131,6 @@ pub fn build_router(state: AppState) -> Router {
         .route("/api/queue/join", get(api_queue_join))
         .route("/api/queue/poll/:entry_id", get(api_queue_poll))
         .route("/api/queue/assign", post(api_queue_assign))
-        // v0.5.2: per-device deployment profile (auto hostname / IP /
-        // unattended file) set from the queue "Profile" button.
-        .route("/api/queue/:entry_id/profile", put(api_queue_set_profile))
         .route("/api/queue/:entry_id", delete(api_queue_release))
         // v0.4.65: SMB share manager (userspace via smbclient). The
         // kernel-mount NFS routes that v0.4.64 shipped are gone — they
@@ -173,19 +138,13 @@ pub fn build_router(state: AppState) -> Router {
         // modules (Unraid), and no container-side configuration could
         // load a host kernel module. `smbclient` speaks SMB over a
         // plain TCP socket in userspace, works in every container.
-        .route(
+        .route("/api/smb-shares", get(api_smb_shares_list).post(api_smb_shares_add))
-            "/api/smb-shares",
-            get(api_smb_shares_list).post(api_smb_shares_add),
-        )
         .route("/api/smb-shares/:id", delete(api_smb_shares_remove))
         .route("/api/smb-shares/:id/scan", post(api_smb_shares_scan))
         // v0.4.67: NFSv3 share manager (pure-Rust in-process client).
         // Ships alongside SMB. Routes are parallel so the UI can
         // reuse the same form/error/hint rendering for both.
-        .route(
+        .route("/api/nfs-shares", get(api_nfs_shares_list).post(api_nfs_shares_add))
-            "/api/nfs-shares",
-            get(api_nfs_shares_list).post(api_nfs_shares_add),
-        )
         .route("/api/nfs-shares/:id", delete(api_nfs_shares_remove))
         .route("/api/nfs-shares/:id/scan", post(api_nfs_shares_scan))
         // Phase 4: Network info (read-only) + DNS edit.
@@ -242,12 +201,14 @@ async fn api_sso_get(State(state): State<AppState>) -> Json<SsoConfig> {
     Json(state.sso.snapshot())
 }
 
-async fn api_sso_put(
+async fn api_sso_put(State(state): State<AppState>, Json(body): Json<SsoConfig>) -> Response {
-    State(state): State<AppState>,
+    match state.sso.replace(body) {
-    Json(body): Json<SsoConfig>,
+        Ok(cfg) => (StatusCode::OK, Json(cfg)).into_response(),
-) -> Result<Json<SsoConfig>, AppError> {
+        Err(Error::Invalid(msg)) => {
-    // v0.5.4: `?` + AppError centralizes Invalid→400 / _→500.
+            (StatusCode::BAD_REQUEST, msg).into_response()
-    Ok(Json(state.sso.replace(body)?))
+        }
+        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
+    }
 }
 
 // ─── UI ────────────────────────────────────────────────────────────────────
@@ -264,7 +225,7 @@ async fn index(State(state): State<AppState>) -> Response {
         &state.public_base_url,
         env!("CARGO_PKG_VERSION"),
         state.branding.logo_rev(),
-        state.branding.has_any_web_logo(),
+        state.branding.has_logo(),
     );
     (
         [
@@ -290,7 +251,8 @@ async fn index(State(state): State<AppState>) -> Response {
 /// with the `?v=<version>` query string in index.html, the practical
 /// upper bound on caching across an upgrade is "until the operator
 /// reloads".
-const ASSET_CACHE_CONTROL: HeaderValue = HeaderValue::from_static("no-cache, must-revalidate");
+const ASSET_CACHE_CONTROL: HeaderValue =
+    HeaderValue::from_static("no-cache, must-revalidate");
 
 async fn ui_js() -> Response {
     (
@@ -317,28 +279,23 @@ async fn ui_css() -> Response {
         .into_response()
 }
 
-#[derive(Debug, Deserialize)]
+async fn ui_logo(State(state): State<AppState>) -> Response {
-struct LogoQuery {
-    /// `light` or `dark` — which theme variant the page is currently
-    /// showing. Anything else (or absent) resolves to the dark slot,
-    /// which matches the default theme.
-    #[serde(default)]
-    theme: Option<String>,
-}
-
-async fn ui_logo(State(state): State<AppState>, Query(q): Query<LogoQuery>) -> Response {
     // Custom override first; fall back to the bundled rainbow-horizon
     // SVG. We resolve the override on each request rather than caching
     // because operators may upload/clear from the Settings tab while the
     // server is live, and we want them to see their change immediately
-    // without bouncing the binary. The theme query selects the per-theme
+    // without bouncing the binary.
-    // slot, with cross-theme + bundled fallback handled in BrandingStore.
+    if let Some(path) = state.branding.logo_path() {
-    let theme_is_light = q.theme.as_deref() == Some("light");
+        let mime = state
-    if let Some((path, mime)) = state.branding.web_logo(theme_is_light) {
+            .branding
+            .logo_mime()
+            .unwrap_or_else(|| "image/svg+xml".to_string());
         match tokio::fs::read(&path).await {
             Ok(bytes) => {
-                let ct = HeaderValue::from_str(&mime)
+                let ct = match HeaderValue::from_str(&mime) {
-                    .unwrap_or_else(|_| HeaderValue::from_static("application/octet-stream"));
+                    Ok(v) => v,
+                    Err(_) => HeaderValue::from_static("application/octet-stream"),
+                };
                 return (
                     [
                         (header::CONTENT_TYPE, ct),
@@ -359,17 +316,6 @@ async fn ui_logo(State(state): State<AppState>, Query(q): Query<LogoQuery>) -> R
             }
         }
     }
-    bundled_logo_response()
-}
-
-/// Favicon — always the bundled OpenPXE mark, decoupled from operator
-/// branding (v0.5.2) so the browser-tab icon stays "OpenPXE" for
-/// continuity regardless of any uploaded light/dark logo.
-async fn ui_favicon() -> Response {
-    bundled_logo_response()
-}
-
-fn bundled_logo_response() -> Response {
     (
         [
             (
@@ -400,8 +346,10 @@ async fn ui_pxe_logo(State(state): State<AppState>) -> Response {
     // Resolve the operator's raster upload, if any and if it's a format
     // iPXE/our compositor can consume. SVG (or a missing/unreadable
     // file) yields `None`, which composes the default background.
-    let raster: Option<Vec<u8>> = match state.branding.client_logo() {
+    let raster: Option<Vec<u8>> = match (state.branding.logo_path(), state.branding.logo_mime()) {
-        Some((path, mime)) if mime != "image/svg+xml" => tokio::fs::read(&path).await.ok(),
+        (Some(path), Some(mime)) if mime != "image/svg+xml" => {
+            tokio::fs::read(&path).await.ok()
+        }
         _ => None,
     };
 
@@ -691,26 +639,7 @@ async fn boot_sub(
                             "PXE boot started",
                             &format!("{who} started booting {} ({}).", iso.filename, entry.title),
                         );
-                        // v0.5.2: if this MAC has a deployment profile with
+                        return text_plain(render_entry(entry, &settings, base));
-                        // an unattended answer file selected (via a host
-                        // pin or queue Profile), inject the right kernel
-                        // arg so the install runs unattended.
-                        let unattended_args = mac_normalized.as_deref().and_then(|m| {
-                            resolve_profile(&state, m).and_then(|p| {
-                                p.unattended_file
-                                    .as_deref()
-                                    .and_then(|fid| state.unattended.get(fid))
-                                    .and_then(|meta| {
-                                        build_unattended_args(base, &meta, Some(m), &p)
-                                    })
-                            })
-                        });
-                        return text_plain(render_entry(
-                            entry,
-                            &settings,
-                            base,
-                            unattended_args.as_deref(),
-                        ));
                     }
                 }
             }
@@ -764,7 +693,9 @@ async fn iso_raw(
             };
             match stream_file_range(&path, headers.get(header::RANGE)).await {
                 Ok(r) => r,
-                Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
+                Err(e) => {
+                    (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response()
+                }
             }
         }
         IsoSource::Smb {
@@ -779,10 +710,7 @@ async fn iso_raw(
             if headers.get(header::RANGE).is_some() {
                 return Response::builder()
                     .status(StatusCode::RANGE_NOT_SATISFIABLE)
-                    .header(
+                    .header(header::CONTENT_RANGE, format!("bytes */{}", meta.size_bytes))
-                        header::CONTENT_RANGE,
-                        format!("bytes */{}", meta.size_bytes),
-                    )
                     .body(Body::empty())
                     .unwrap();
             }
@@ -1122,16 +1050,8 @@ async fn api_storage_disk(State(state): State<AppState>) -> Json<serde_json::Val
 
 async fn api_branding_upload(
     State(state): State<AppState>,
-    AxumPath(slot): AxumPath<String>,
     mut multipart: Multipart,
 ) -> Response {
-    let Some(slot) = LogoSlot::parse(&slot) else {
-        return (
-            StatusCode::BAD_REQUEST,
-            "unknown logo slot; expected light, dark, or client",
-        )
-            .into_response();
-    };
     while let Ok(Some(field)) = multipart.next_field().await {
         let name = field.name().unwrap_or("").to_string();
         if name != "file" && name != "logo" {
@@ -1152,7 +1072,9 @@ async fn api_branding_upload(
         // hitting disk. Logos are tiny by definition.
         let bytes = match field.bytes().await {
             Ok(b) => b,
-            Err(e) => return (StatusCode::BAD_REQUEST, format!("read body: {e}")).into_response(),
+            Err(e) => {
+                return (StatusCode::BAD_REQUEST, format!("read body: {e}")).into_response()
+            }
         };
         if bytes.len() > MAX_LOGO_BYTES {
             return (
@@ -1168,21 +1090,11 @@ async fn api_branding_upload(
         let Some(ext) = ext_for_mime(&mime) else {
             return (StatusCode::BAD_REQUEST, "unsupported MIME").into_response();
         };
-        // The PXE "client" logo is rasterized for the boot screen; an SVG
+        match state.branding.set_logo(&mime, ext, &bytes) {
-        // there can't be composited, so steer operators to a raster.
-        if slot == LogoSlot::Client && mime == "image/svg+xml" {
-            return (
-                StatusCode::BAD_REQUEST,
-                "the client (PXE) logo must be a raster image (PNG/JPEG/WebP/GIF); SVG can't be painted on the boot screen",
-            )
-                .into_response();
-        }
-        match state.branding.set_logo(slot, &mime, ext, &bytes) {
             Ok(filename) => {
                 return (
                     StatusCode::OK,
                     Json(json!({
-                        "slot": slot.as_str(),
                         "filename": filename,
                         "mime": mime,
                         "size_bytes": bytes.len(),
@@ -1190,225 +1102,19 @@ async fn api_branding_upload(
                 )
                     .into_response()
             }
-            Err(e) => return (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
+            Err(e) => {
+                return (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response()
+            }
         }
     }
     (StatusCode::BAD_REQUEST, "no 'file' part").into_response()
 }
 
-async fn api_branding_clear(
+async fn api_branding_clear(State(state): State<AppState>) -> Response {
-    State(state): State<AppState>,
+    match state.branding.clear_logo() {
-    AxumPath(slot): AxumPath<String>,
+        Ok(()) => StatusCode::NO_CONTENT.into_response(),
-) -> Result<Response, AppError> {
+        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{e}")).into_response(),
-    let Some(slot) = LogoSlot::parse(&slot) else {
-        return Ok((StatusCode::BAD_REQUEST, "unknown logo slot").into_response());
-    };
-    state.branding.clear_logo(slot)?;
-    Ok(StatusCode::NO_CONTENT.into_response())
     }
-
-// ─── Unattended answer files (v0.5.2) ──────────────────────────────────────
-//
-// Management (list/upload/delete) is gated behind the auth middleware.
-// *Serving* the files to the booting installer is the public
-// `/unattended/*` route pair below — the installer has no session.
-
-async fn api_unattended_list(State(state): State<AppState>) -> Json<serde_json::Value> {
-    Json(json!({ "files": state.unattended.list() }))
-}
-
-async fn api_unattended_upload(
-    State(state): State<AppState>,
-    mut multipart: Multipart,
-) -> Result<Response, AppError> {
-    // v0.5.4: the answer-file add() maps Invalid→400 / _→500 via `?`+AppError.
-    // The multipart-shape 400s (missing field/filename) stay explicit.
-    while let Ok(Some(field)) = multipart.next_field().await {
-        let name = field.name().unwrap_or("").to_string();
-        if name != "file" && name != "unattended" {
-            continue;
-        }
-        let filename = field.file_name().map(str::to_string).unwrap_or_default();
-        if filename.trim().is_empty() {
-            return Ok((StatusCode::BAD_REQUEST, "missing filename on upload").into_response());
-        }
-        let bytes = match field.bytes().await {
-            Ok(b) => b,
-            Err(e) => {
-                return Ok((StatusCode::BAD_REQUEST, format!("read body: {e}")).into_response())
-            }
-        };
-        let meta = state.unattended.add(&filename, &bytes).await?;
-        return Ok((StatusCode::CREATED, Json(meta)).into_response());
-    }
-    Ok((StatusCode::BAD_REQUEST, "no 'file' part").into_response())
-}
-
-async fn api_unattended_delete(
-    State(state): State<AppState>,
-    AxumPath(id): AxumPath<String>,
-) -> StatusCode {
-    if state.unattended.remove(&id).await {
-        StatusCode::NO_CONTENT
-    } else {
-        StatusCode::NOT_FOUND
-    }
-}
-
-#[derive(Debug, Deserialize)]
-struct UnattendedServeQuery {
-    #[serde(default)]
-    mac: Option<String>,
-    #[serde(default)]
-    hostname: Option<String>,
-    #[serde(default)]
-    ip: Option<String>,
-}
-
-/// Public: serve a Kickstart/Preseed/answer file with `{{HOSTNAME}}` /
-/// `{{IP}}` / `{{MAC}}` substituted from the query string. Returns
-/// `text/plain` so installers (anaconda, debian-installer, Windows setup
-/// fetching over HTTP) read it verbatim.
-async fn serve_unattended(
-    State(state): State<AppState>,
-    AxumPath(id): AxumPath<String>,
-    Query(q): Query<UnattendedServeQuery>,
-) -> Response {
-    let Ok(bytes) = state.unattended.read(&id).await else {
-        return (StatusCode::NOT_FOUND, "no such unattended file").into_response();
-    };
-    let content = String::from_utf8_lossy(&bytes);
-    let rendered = render_template(
-        &content,
-        q.mac.as_deref(),
-        q.hostname.as_deref(),
-        q.ip.as_deref(),
-    );
-    text_plain(rendered)
-}
-
-/// Public: cloud-init NoCloud seed directory for Ubuntu autoinstall. The
-/// kernel arg points iPXE/cloud-init at `…/<id>/<ctx>/`; cloud-init then
-/// fetches `user-data`, `meta-data`, (and `vendor-data`). `<ctx>`
-/// base64url-encodes the per-host hostname/ip/mac so they survive the
-/// seedfrom URL (which can't carry a query string).
-async fn serve_unattended_seed(
-    State(state): State<AppState>,
-    AxumPath((id, ctx, sub)): AxumPath<(String, String, String)>,
-) -> Response {
-    let (mac, hostname, ip) = decode_seed_ctx(&ctx);
-    match sub.as_str() {
-        "user-data" => {
-            let Ok(bytes) = state.unattended.read(&id).await else {
-                return (StatusCode::NOT_FOUND, "no such unattended file").into_response();
-            };
-            let content = String::from_utf8_lossy(&bytes);
-            let rendered =
-                render_template(&content, mac.as_deref(), hostname.as_deref(), ip.as_deref());
-            text_plain(rendered)
-        }
-        "meta-data" => {
-            let host_line = hostname
-                .as_deref()
-                .map(|h| format!("local-hostname: {h}\n"))
-                .unwrap_or_default();
-            text_plain(format!("instance-id: openpxe-{id}\n{host_line}"))
-        }
-        // cloud-init probes vendor-data too; an empty 200 keeps it quiet.
-        "vendor-data" => text_plain(String::new()),
-        _ => (StatusCode::NOT_FOUND, "unknown seed resource").into_response(),
-    }
-}
-
-/// Resolve the deployment profile for a booting MAC: a host pin wins, else
-/// a queued device's Profile. `None` when neither carries one.
-fn resolve_profile(state: &AppState, mac: &str) -> Option<DeployProfile> {
-    if let Some(b) = state.hosts.lookup(mac) {
-        if !b.profile.is_empty() {
-            return Some(b.profile);
-        }
-    }
-    state.queue.profile_for_mac(mac)
-}
-
-/// Build the per-host unattended kernel arguments for a Linux entry.
-/// Returns `None` for Windows answer files / unclassified uploads (no
-/// kernel cmdline injection applies).
-fn build_unattended_args(
-    base: &str,
-    meta: &UnattendedMeta,
-    mac: Option<&str>,
-    profile: &DeployProfile,
-) -> Option<String> {
-    let base = base.trim_end_matches('/');
-    let id = &meta.id;
-    let host = profile.auto_hostname.as_deref();
-    let ip = profile.auto_ip.as_deref();
-    let query = build_query(&[("mac", mac), ("hostname", host), ("ip", ip)]);
-    match meta.kind {
-        UnattendedKind::Kickstart => Some(format!("inst.ks={base}/unattended/{id}{query}")),
-        UnattendedKind::Preseed => {
-            let mut s = format!("auto=true priority=critical url={base}/unattended/{id}{query}");
-            if let Some(h) = host {
-                s.push_str(" hostname=");
-                s.push_str(h);
-            }
-            Some(s)
-        }
-        UnattendedKind::Autoinstall => {
-            let ctx = encode_seed_ctx(mac, host, ip);
-            Some(format!(
-                "autoinstall ds=nocloud-net;s={base}/unattended/{id}/{ctx}/"
-            ))
-        }
-        UnattendedKind::AnswerFile | UnattendedKind::Unknown => None,
-    }
-}
-
-/// Build a `?k=v&…` query string from present key/value pairs, percent-
-/// encoding the values. Empty when nothing is present.
-fn build_query(pairs: &[(&str, Option<&str>)]) -> String {
-    use std::fmt::Write as _;
-    let mut out = String::new();
-    for (k, v) in pairs {
-        if let Some(val) = v {
-            out.push(if out.is_empty() { '?' } else { '&' });
-            let _ = write!(out, "{k}={}", pct_encode(val));
-        }
-    }
-    out
-}
-
-// `pct_encode` lives in `openpxe_core::encoding` (v0.5.4) — imported above.
-
-/// Encode `(hostname, ip, mac)` into a single base64url path segment for
-/// the cloud-init seed directory. Empty values become empty fields.
-fn encode_seed_ctx(mac: Option<&str>, hostname: Option<&str>, ip: Option<&str>) -> String {
-    use base64::Engine as _;
-    let raw = format!(
-        "{}\n{}\n{}",
-        hostname.unwrap_or(""),
-        ip.unwrap_or(""),
-        mac.unwrap_or("")
-    );
-    base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(raw.as_bytes())
-}
-
-/// Inverse of [`encode_seed_ctx`]; returns `(mac, hostname, ip)`. A bad
-/// or empty segment yields all-`None` so the seed still serves (just
-/// without per-host substitution).
-fn decode_seed_ctx(ctx: &str) -> (Option<String>, Option<String>, Option<String>) {
-    use base64::Engine as _;
-    let Ok(bytes) = base64::engine::general_purpose::URL_SAFE_NO_PAD.decode(ctx.as_bytes()) else {
-        return (None, None, None);
-    };
-    let s = String::from_utf8_lossy(&bytes).into_owned();
-    let mut it = s.splitn(3, '\n');
-    let clean = |v: Option<&str>| v.map(str::to_string).filter(|x| !x.is_empty());
-    let hostname = clean(it.next());
-    let ip = clean(it.next());
-    let mac = clean(it.next());
-    (mac, hostname, ip)
 }
 
 // ─── API reference (Settings → bottom) ────────────────────────────────────
@@ -1506,12 +1212,12 @@ async fn api_docs() -> Json<serde_json::Value> {
                      "summary": "Current runtime settings (Windows toggle, timeout, dns hint, …)."},
                     {"method": "PUT", "path": "/api/settings",
                      "summary": "Replace runtime settings. Guards against enabling Windows when wimboot isn't bundled."},
-                    {"method": "POST", "path": "/api/branding/logo/:slot",
+                    {"method": "POST", "path": "/api/branding/logo",
-                     "summary": "Upload a custom logo for a slot (light | dark | client). Multipart 'file', PNG/SVG/JPEG/WebP/GIF up to 2 MB. The client slot is raster-only."},
+                     "summary": "Upload a custom WebUI logo (multipart 'file', PNG/SVG/JPEG/WebP/GIF up to 2 MB)."},
-                    {"method": "DELETE", "path": "/api/branding/logo/:slot",
+                    {"method": "DELETE", "path": "/api/branding/logo",
-                     "summary": "Remove the custom logo for a slot and revert to the bundled mark."},
+                     "summary": "Remove the custom logo and revert to the bundled mark."},
                     {"method": "GET", "path": "/branding/pxe-logo",
-                     "summary": "Raster form of the operator's 'client' logo for the iPXE menu's `console --picture`. Default background when unset/SVG."},
+                     "summary": "Raster form of the operator's logo for the iPXE menu's `console --picture`. SVG uploads 404 here."},
                     {"method": "GET", "path": "/api/sso",
                      "summary": "Current SAML SSO configuration."},
                     {"method": "PUT", "path": "/api/sso",
@@ -1542,28 +1248,13 @@ async fn api_docs() -> Json<serde_json::Value> {
                      "summary": "Free / used / total bytes for the volume hosting the ISO directory."},
                 ],
             },
-            {
-                "name": "Unattended answer files",
-                "endpoints": [
-                    {"method": "GET", "path": "/api/unattended",
-                     "summary": "List uploaded answer files (Kickstart / Preseed / Autoinstall / Windows answer file)."},
-                    {"method": "POST", "path": "/api/unattended",
-                     "summary": "Upload an answer file (multipart 'file', .ks/.cfg/.seed/.yaml/.yml/.xml/user-data, up to 1 MB)."},
-                    {"method": "DELETE", "path": "/api/unattended/:id",
-                     "summary": "Delete an uploaded answer file."},
-                    {"method": "GET", "path": "/unattended/:id",
-                     "summary": "Public: serve an answer file with {{HOSTNAME}}/{{IP}}/{{MAC}} substituted from the query string."},
-                ],
-            },
             {
                 "name": "Queued Deployment",
                 "endpoints": [
                     {"method": "GET", "path": "/api/queue",
-                     "summary": "List queue entries (waiting + assigned, with any deployment profile)."},
+                     "summary": "List queue entries (waiting + assigned)."},
                     {"method": "POST", "path": "/api/queue/assign",
                      "summary": "Assign a target image to queued clients. Body: { target, entry_ids }."},
-                    {"method": "PUT", "path": "/api/queue/:entry_id/profile",
-                     "summary": "Set a queued device's deployment profile. Body: { auto_hostname?, auto_ip?, unattended_file? }."},
                     {"method": "DELETE", "path": "/api/queue/:entry_id",
                      "summary": "Release a queue entry without assigning."},
                 ],
@@ -1574,7 +1265,7 @@ async fn api_docs() -> Json<serde_json::Value> {
                     {"method": "GET", "path": "/api/hosts",
                      "summary": "List per-MAC boot bindings."},
                     {"method": "POST", "path": "/api/hosts",
-                     "summary": "Pin a MAC to a boot target. Body: { mac, target, label, auto_hostname?, auto_ip?, unattended_file? }."},
+                     "summary": "Pin a MAC to a boot target. Body: { mac, target, label }."},
                     {"method": "DELETE", "path": "/api/hosts/:mac",
                      "summary": "Remove a binding."},
                     {"method": "POST", "path": "/api/hosts/:mac/wol",
@@ -1932,49 +1623,7 @@ async fn api_list_clients(State(state): State<AppState>) -> Json<serde_json::Val
     Json(json!({ "clients": state.clients.list() }))
 }
 
-/// Per-theme branding presence, nested under [`StatusResponse::branding`].
+async fn api_status(State(state): State<AppState>) -> Json<serde_json::Value> {
-#[derive(Serialize)]
-struct BrandingStatus {
-    light: bool,
-    dark: bool,
-    client: bool,
-    rev: u64,
-}
-
-/// Dashboard status payload. v0.5.4: this replaced a 25-key hand-built
-/// `json!` blob — the typed struct makes the contract with the WebUI
-/// compile-checked. Field names ARE the JSON keys; do not rename without
-/// updating `crates/webui/src/app.js` (a `full_flow` test guards the set).
-/// `settings` / `smb` / `started_at` embed their own `Serialize` impls so
-/// the wire shape is byte-identical to the previous `json!` output.
-#[derive(Serialize)]
-struct StatusResponse {
-    version: &'static str,
-    public_base_url: String,
-    iso_count: usize,
-    client_count: usize,
-    queue_count: usize,
-    imaging_count: usize,
-    waiting_count: usize,
-    ipxe_assets: Vec<String>,
-    settings: Settings,
-    smb: Option<SmbState>,
-    smb_share_count: usize,
-    smb_share_reachable: usize,
-    nfs_share_count: usize,
-    nfs_share_reachable: usize,
-    host_bindings: usize,
-    custom_logo: bool,
-    branding: BrandingStatus,
-    unattended_count: usize,
-    uptime_secs: i64,
-    started_at: time::OffsetDateTime,
-    nic_name: String,
-    subnet_mask: String,
-    gateway: String,
-}
-
-async fn api_status(State(state): State<AppState>) -> Json<StatusResponse> {
     let smb = state.smb.as_ref().map(|s| s.snapshot());
     // v0.4.65+v0.4.67: external storage shares — SMB (userspace
     // smbclient) and NFS (in-process nfs3_client). Dashboard tile
@@ -2007,39 +1656,32 @@ async fn api_status(State(state): State<AppState>) -> Json<StatusResponse> {
     state.metrics.record_http(openpxe_core::HttpRoute::Api);
     let now = time::OffsetDateTime::now_utc();
     let uptime_secs = (now - state.started_at).whole_seconds().max(0);
-    Json(StatusResponse {
+    Json(json!({
-        version: env!("CARGO_PKG_VERSION"),
+        "version": env!("CARGO_PKG_VERSION"),
-        public_base_url: state.public_base_url.clone(),
+        "public_base_url": state.public_base_url,
-        iso_count: isos.len(),
+        "iso_count": isos.len(),
-        client_count: clients.len(),
+        "client_count": clients.len(),
-        queue_count: queue_entries.len(),
+        "queue_count": queue_entries.len(),
-        imaging_count: imaging,
+        "imaging_count": imaging,
-        waiting_count: waiting,
+        "waiting_count": waiting,
-        ipxe_assets: openpxe_ipxe_assets::list_assets(),
+        "ipxe_assets": openpxe_ipxe_assets::list_assets(),
-        settings: state.settings.snapshot(),
+        "settings": state.settings.snapshot(),
-        smb,
+        "smb": smb,
-        smb_share_count: smb_shares.len(),
+        "smb_share_count": smb_shares.len(),
-        smb_share_reachable: smb_reachable,
+        "smb_share_reachable": smb_reachable,
-        // v0.4.67: NFSv3 share counts. The dashboard tile sums these with
+        // v0.4.67: NFSv3 share counts. The dashboard tile sums these
-        // the SMB counts above ("N shares reachable") so the top-line
+        // with the SMB counts above ("N shares reachable") so the
-        // metric works regardless of protocol mix.
+        // top-line metric works regardless of protocol mix.
-        nfs_share_count: nfs_shares.len(),
+        "nfs_share_count": nfs_shares.len(),
-        nfs_share_reachable: nfs_reachable,
+        "nfs_share_reachable": nfs_reachable,
-        host_bindings: state.hosts.len(),
+        "host_bindings": state.hosts.len(),
-        custom_logo: state.branding.has_any_web_logo(),
+        "custom_logo": state.branding.has_logo(),
-        branding: BrandingStatus {
+        "uptime_secs": uptime_secs,
-            light: state.branding.has_logo(LogoSlot::Light),
+        "started_at": state.started_at,
-            dark: state.branding.has_logo(LogoSlot::Dark),
+        "nic_name": state.nic_name,
-            client: state.branding.has_logo(LogoSlot::Client),
+        "subnet_mask": state.subnet_mask,
-            rev: state.branding.logo_rev(),
+        "gateway": state.gateway,
-        },
+    }))
-        unattended_count: state.unattended.len(),
-        uptime_secs,
-        started_at: state.started_at,
-        nic_name: state.nic_name.clone(),
-        subnet_mask: state.subnet_mask.clone(),
-        gateway: state.gateway.clone(),
-    })
 }
 
 async fn api_get_settings(State(state): State<AppState>) -> Json<Settings> {
@@ -2180,15 +1822,10 @@ async fn api_queue_poll(
                 entry_id=%entry_id, mac=%g.mac, target=%target,
                 "queue assignment delivered"
             );
-            // Carry `?mac=` so the per-entry handler can resolve this
-            // device's deployment profile (auto hostname/IP + unattended
-            // file) and inject the unattended kernel args, mirroring the
-            // pinned-host path.
-            let qmac = g.mac.clone();
             text_plain(format!(
                 "#!ipxe\n\
                  echo Queue assignment received: {target}\n\
-                 chain {base}/boot/{target}.ipxe?mac={qmac} || chain {base}/api/queue/poll/{entry_id}\n"
+                 chain {base}/boot/{target}.ipxe || chain {base}/api/queue/poll/{entry_id}\n"
             ))
         }
         Some(g) => {
@@ -2241,21 +1878,6 @@ async fn api_queue_assign(
     Json(json!({ "ok": true, "assigned": n, "target": body.target }))
 }
 
-async fn api_queue_set_profile(
-    State(state): State<AppState>,
-    AxumPath(entry_id): AxumPath<String>,
-    Json(body): Json<DeployProfile>,
-) -> Response {
-    let profile = body.normalized();
-    if let Err(msg) = validate_profile(&state, &profile) {
-        return (StatusCode::BAD_REQUEST, msg).into_response();
-    }
-    match state.queue.set_profile(&entry_id, profile) {
-        Some(entry) => (StatusCode::OK, Json(entry)).into_response(),
-        None => (StatusCode::NOT_FOUND, "no such queue entry").into_response(),
-    }
-}
-
 async fn api_queue_release(
     State(state): State<AppState>,
     AxumPath(entry_id): AxumPath<String>,
@@ -2394,11 +2016,6 @@ struct HostsUpsertBody {
     target: String,
     #[serde(default)]
     label: String,
-    /// v0.5.2: optional unattended-install profile. Flattened so the
-    /// front-end posts `auto_hostname` / `auto_ip` / `unattended_file`
-    /// at the top level alongside mac/target/label.
-    #[serde(default, flatten)]
-    profile: DeployProfile,
 }
 
 async fn api_hosts_upsert(
@@ -2426,32 +2043,10 @@ async fn api_hosts_upsert(
         )
             .into_response();
     }
-    let profile = body.profile.normalized();
+    let binding = state.hosts.upsert(mac, target, body.label.trim());
-    if let Err(msg) = validate_profile(&state, &profile) {
-        return (StatusCode::BAD_REQUEST, msg).into_response();
-    }
-    let binding = state.hosts.upsert(mac, target, body.label.trim(), profile);
     (StatusCode::CREATED, Json(binding)).into_response()
 }
 
-/// Shared validation for a deployment profile (host pin + queue profile):
-/// the referenced unattended file must exist, and a supplied IP must
-/// parse. Hostname is free-form (installers vary), so we only length-cap
-/// it (done in `DeployProfile::normalized`).
-fn validate_profile(state: &AppState, profile: &DeployProfile) -> Result<(), String> {
-    if let Some(id) = profile.unattended_file.as_deref() {
-        if state.unattended.get(id).is_none() {
-            return Err(format!("unknown unattended file: {id}"));
-        }
-    }
-    if let Some(ip) = profile.auto_ip.as_deref() {
-        if ip.parse::<std::net::IpAddr>().is_err() {
-            return Err(format!("auto_ip is not a valid IP address: {ip}"));
-        }
-    }
-    Ok(())
-}
-
 async fn api_hosts_remove(
     State(state): State<AppState>,
     AxumPath(mac): AxumPath<String>,
@@ -2469,7 +2064,10 @@ async fn api_hosts_remove(
 /// common "same VLAN as OpenPXE" case with zero network config. We only
 /// wake MACs that are actually bound — keeps this from being an open
 /// "spray packets at any MAC" endpoint.
-async fn api_hosts_wol(State(state): State<AppState>, AxumPath(mac): AxumPath<String>) -> Response {
+async fn api_hosts_wol(
+    State(state): State<AppState>,
+    AxumPath(mac): AxumPath<String>,
+) -> Response {
     if state.hosts.lookup(&mac).is_none() {
         return (
             StatusCode::NOT_FOUND,
@@ -2499,7 +2097,8 @@ async fn api_hosts_wol(State(state): State<AppState>, AxumPath(mac): AxumPath<St
     // The send is a blocking std UDP call; push it off the async
     // executor.
     let mac_owned = mac.clone();
-    let result = tokio::task::spawn_blocking(move || wol::wake(&mac_owned, &broadcasts)).await;
+    let result =
+        tokio::task::spawn_blocking(move || wol::wake(&mac_owned, &broadcasts)).await;
     match result {
         Ok(Ok(n)) => {
             // Fire-and-forget notification — nice "someone woke a box"
@@ -2512,11 +2111,7 @@ async fn api_hosts_wol(State(state): State<AppState>, AxumPath(mac): AxumPath<St
             Json(json!({ "ok": true, "broadcasts": n })).into_response()
         }
         Ok(Err(e)) => (StatusCode::BAD_REQUEST, format!("{e}")).into_response(),
-        Err(e) => (
+        Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, format!("wol task failed: {e}")).into_response(),
-            StatusCode::INTERNAL_SERVER_ERROR,
-            format!("wol task failed: {e}"),
-        )
-            .into_response(),
     }
 }
 
@@ -2527,7 +2122,10 @@ async fn api_notify_get(State(state): State<AppState>) -> Json<NotifyConfig> {
     Json(state.notify.snapshot().redacted())
 }
 
-async fn api_notify_put(State(state): State<AppState>, Json(cfg): Json<NotifyConfig>) -> Response {
+async fn api_notify_put(
+    State(state): State<AppState>,
+    Json(cfg): Json<NotifyConfig>,
+) -> Response {
     match state.notify.replace(cfg) {
         Ok(saved) => (StatusCode::OK, Json(saved.redacted())).into_response(),
         Err(e) => (StatusCode::BAD_REQUEST, format!("{e}")).into_response(),
@@ -2593,7 +2191,10 @@ async fn api_updates_check() -> Response {
                 .and_then(|v| v.as_str())
                 .unwrap_or("")
                 .to_string();
-            let update_available = version_is_newer(latest_tag.trim_start_matches('v'), current);
+            let update_available = version_is_newer(
+                latest_tag.trim_start_matches('v'),
+                current,
+            );
             Json(json!({
                 "current": current,
                 "latest": latest_tag,
@@ -2640,11 +2241,7 @@ fn gitea_releases_api_url() -> Option<String> {
 fn version_is_newer(latest: &str, current: &str) -> bool {
     fn parts(v: &str) -> Vec<u64> {
         v.split('.')
-            .map(|p| {
+            .map(|p| p.chars().take_while(char::is_ascii_digit).collect::<String>())
-                p.chars()
-                    .take_while(char::is_ascii_digit)
-                    .collect::<String>()
-            })
             .map(|s| s.parse::<u64>().unwrap_or(0))
             .collect()
     }
@@ -2734,107 +2331,6 @@ async fn api_metrics(State(state): State<AppState>) -> Response {
 mod tests {
     use super::*;
 
-    fn meta(kind: UnattendedKind) -> UnattendedMeta {
-        UnattendedMeta {
-            id: "ks1".into(),
-            filename: "f".into(),
-            kind,
-            size_bytes: 0,
-            uploaded_at: time::OffsetDateTime::UNIX_EPOCH,
-        }
-    }
-
-    #[test]
-    fn unattended_kickstart_arg_carries_query() {
-        let p = DeployProfile {
-            auto_hostname: Some("node7".into()),
-            auto_ip: Some("10.0.0.7".into()),
-            unattended_file: Some("ks1".into()),
-        };
-        let a = build_unattended_args(
-            "http://h",
-            &meta(UnattendedKind::Kickstart),
-            Some("aa:bb:cc:dd:ee:ff"),
-            &p,
-        )
-        .unwrap();
-        assert!(a.starts_with("inst.ks=http://h/unattended/ks1?"), "{a}");
-        assert!(a.contains("hostname=node7"), "{a}");
-        assert!(a.contains("ip=10.0.0.7"), "{a}");
-        // MAC colons are percent-encoded.
-        assert!(a.contains("mac=aa%3Abb%3Acc%3Add%3Aee%3Aff"), "{a}");
-    }
-
-    #[test]
-    fn unattended_preseed_appends_hostname_kernel_arg() {
-        let p = DeployProfile {
-            auto_hostname: Some("deb1".into()),
-            ..Default::default()
-        };
-        let a =
-            build_unattended_args("http://h/", &meta(UnattendedKind::Preseed), None, &p).unwrap();
-        assert!(
-            a.starts_with("auto=true priority=critical url=http://h/unattended/ks1"),
-            "{a}"
-        );
-        assert!(a.ends_with(" hostname=deb1"), "{a}");
-    }
-
-    #[test]
-    fn unattended_autoinstall_uses_nocloud_seed_dir() {
-        let p = DeployProfile {
-            auto_hostname: Some("u1".into()),
-            auto_ip: Some("10.1.1.5".into()),
-            unattended_file: Some("ks1".into()),
-        };
-        let a = build_unattended_args(
-            "http://h",
-            &meta(UnattendedKind::Autoinstall),
-            Some("aa:bb"),
-            &p,
-        )
-        .unwrap();
-        assert!(
-            a.starts_with("autoinstall ds=nocloud-net;s=http://h/unattended/ks1/"),
-            "{a}"
-        );
-        assert!(a.ends_with('/'), "seed URL must end with '/': {a}");
-        // The ctx segment round-trips back to the per-host values.
-        let ctx = a.trim_end_matches('/').rsplit('/').next().unwrap();
-        let (mac, host, ip) = decode_seed_ctx(ctx);
-        assert_eq!(mac.as_deref(), Some("aa:bb"));
-        assert_eq!(host.as_deref(), Some("u1"));
-        assert_eq!(ip.as_deref(), Some("10.1.1.5"));
-    }
-
-    #[test]
-    fn windows_answer_file_is_not_injected() {
-        let p = DeployProfile {
-            unattended_file: Some("ks1".into()),
-            ..Default::default()
-        };
-        assert!(
-            build_unattended_args("http://h", &meta(UnattendedKind::AnswerFile), None, &p)
-                .is_none()
-        );
-    }
-
-    #[test]
-    fn seed_ctx_empty_segment_decodes_to_none() {
-        let ctx = encode_seed_ctx(None, None, None);
-        let (m, h, i) = decode_seed_ctx(&ctx);
-        assert!(m.is_none() && h.is_none() && i.is_none());
-        // Garbage decodes safely to all-None.
-        let (m2, h2, i2) = decode_seed_ctx("!!!not-base64!!!");
-        assert!(m2.is_none() && h2.is_none() && i2.is_none());
-    }
-
-    #[test]
-    fn pct_encode_escapes_reserved() {
-        assert_eq!(pct_encode("aa:bb cc"), "aa%3Abb%20cc");
-        assert_eq!(pct_encode("node-7.lab_1~"), "node-7.lab_1~");
-    }
-
     #[test]
     fn version_newer_detects_updates() {
         assert!(version_is_newer("0.5.1", "0.5.0"));

crates/http-api/src/auth.rs

@@ -140,16 +140,9 @@ fn cookie_attrs(value: &str, max_age: Option<i64>) -> String {
     // never overflow i64, but clippy's `cast_possible_wrap` lint wants
     // us to be explicit. `cast_signed` is the documented form.
     let lifetime = max_age.unwrap_or_else(|| SESSION_TTL.as_secs().cast_signed());
-    format!("{SESSION_COOKIE}={value}; Path=/; HttpOnly; SameSite=Lax; Max-Age={lifetime}")
+    format!(
-}
+        "{SESSION_COOKIE}={value}; Path=/; HttpOnly; SameSite=Lax; Max-Age={lifetime}"
-
+    )
-/// Build the `Set-Cookie` header value that establishes a fresh operator
-/// session with the default 24h TTL. Exposed so the SAML ACS handler can
-/// attach an operator session to its post-login redirect, exactly as the
-/// Forms-login path does via [`login_response`].
-#[must_use]
-pub fn session_cookie(session: &str) -> String {
-    cookie_attrs(session, None)
 }
 
 fn parse_cookie(headers: &axum::http::HeaderMap) -> Option<String> {
@@ -176,18 +169,9 @@ fn is_public_path(path: &str) -> bool {
         return true;
     }
     // Auth surface and iPXE long-poll endpoints (no cookie available).
-    // The SAML SP endpoints are pre-auth by nature — the operator hasn't a
-    // session yet when they start (or arrive from) the IdP. `/api/sso`
-    // (the config GET/PUT, no trailing slash) stays gated.
     matches!(
         path,
-        "/api/setup"
+        "/api/setup" | "/api/login" | "/api/logout" | "/api/me"
-            | "/api/login"
-            | "/api/logout"
-            | "/api/me"
-            | "/api/sso/login"
-            | "/api/sso/acs"
-            | "/api/sso/metadata"
     ) || path.starts_with("/api/queue/join")
         || path.starts_with("/api/queue/poll/")
 }
@@ -238,7 +222,10 @@ pub struct SetupBody {
 /// guards against a leaked WebUI being re-bootstrapped by an attacker
 /// who's seen the deployment URL. After bootstrap, the new session
 /// cookie is set so the operator goes straight to the dashboard.
-pub async fn api_setup(State(state): State<AppState>, Json(body): Json<SetupBody>) -> Response {
+pub async fn api_setup(
+    State(state): State<AppState>,
+    Json(body): Json<SetupBody>,
+) -> Response {
     if state.admin.is_configured() {
         return (
             StatusCode::CONFLICT,
@@ -293,7 +280,10 @@ pub async fn api_login(State(state): State<AppState>, Json(body): Json<LoginBody
     login_response(StatusCode::OK, &pub_, &session)
 }
 
-pub async fn api_logout(State(state): State<AppState>, headers: axum::http::HeaderMap) -> Response {
+pub async fn api_logout(
+    State(state): State<AppState>,
+    headers: axum::http::HeaderMap,
+) -> Response {
     if let Some(t) = parse_cookie(&headers) {
         state.sessions.revoke(&t);
     }
@@ -317,7 +307,7 @@ pub async fn api_me(State(state): State<AppState>, headers: axum::http::HeaderMa
     // screens can render the FleetDM-style full-width custom logo (and
     // cache-bust it) without an extra round trip. `/api/me` is public,
     // and the logo asset is public, so this leaks nothing sensitive.
-    let has_custom_logo = state.branding.has_any_web_logo();
+    let has_custom_logo = state.branding.has_logo();
     let logo_rev = state.branding.logo_rev();
     if !state.admin.is_configured() {
         return (
@@ -459,14 +449,8 @@ mod tests {
     fn public_path_allowlist() {
         // PXE + chrome paths bypass auth.
         for p in [
-            "/",
+            "/", "/assets/app.js", "/boot.ipxe", "/boot/fake.ipxe",
-            "/assets/app.js",
+            "/iso/fake.iso", "/ipxe/snponly.efi", "/healthz", "/readyz",
-            "/boot.ipxe",
-            "/boot/fake.ipxe",
-            "/iso/fake.iso",
-            "/ipxe/snponly.efi",
-            "/healthz",
-            "/readyz",
             "/metrics",
             // v0.4.6: iPXE fetches this for `console --picture` before
             // it can possibly have a session cookie.
@@ -478,10 +462,6 @@ mod tests {
         for p in ["/api/setup", "/api/login", "/api/logout", "/api/me"] {
             assert!(is_public_path(p), "expected {p} to be public");
         }
-        // v0.5.1: SAML SP endpoints are pre-auth (no session yet).
-        for p in ["/api/sso/login", "/api/sso/acs", "/api/sso/metadata"] {
-            assert!(is_public_path(p), "expected {p} to be public");
-        }
         // iPXE long-poll endpoints are public (no cookie available).
         assert!(is_public_path("/api/queue/join"));
         assert!(is_public_path("/api/queue/poll/abc"));
@@ -503,7 +483,8 @@ mod tests {
         let mut h = axum::http::HeaderMap::new();
         h.insert(
             header::COOKIE,
-            HeaderValue::from_str(&format!("foo=bar; {SESSION_COOKIE}=abc123; baz=qux")).unwrap(),
+            HeaderValue::from_str(&format!("foo=bar; {SESSION_COOKIE}=abc123; baz=qux"))
+                .unwrap(),
         );
         assert_eq!(parse_cookie(&h).as_deref(), Some("abc123"));
         // Different name → None.

crates/http-api/src/error.rs

@@ -1,92 +0,0 @@
-//! Uniform HTTP error mapping for the API layer (v0.5.4).
-//!
-//! Before this, ~40 handlers in `app.rs` hand-wrote
-//! `match … { Err(e) => (StatusCode::…, format!("{e}")).into_response() }`,
-//! and the `openpxe_core::Error` → status mapping drifted between them
-//! (e.g. `Invalid` → 400 in most places, 404 in one). [`AppError`] wraps
-//! `openpxe_core::Error` so a handler can return `Result<T, AppError>` and
-//! `?` its way out, getting one consistent status + body. The body stays
-//! plain-text (matching the previous `(StatusCode, String)` responses) so
-//! existing clients and tests see no shape change; 5xx detail is logged
-//! and returned verbatim exactly as before.
-//!
-//! Handlers with *intentional* domain-specific statuses (e.g. a duplicate
-//! share → 409, a still-open chunked upload → 409) keep their explicit
-//! returns — `AppError` is for the common case, not a straitjacket.
-
-use axum::http::StatusCode;
-use axum::response::{IntoResponse, Response};
-use openpxe_core::Error as CoreError;
-
-/// Newtype over [`openpxe_core::Error`] with a uniform [`IntoResponse`].
-#[derive(Debug)]
-pub struct AppError(pub CoreError);
-
-impl From<CoreError> for AppError {
-    fn from(e: CoreError) -> Self {
-        AppError(e)
-    }
-}
-
-impl From<std::io::Error> for AppError {
-    fn from(e: std::io::Error) -> Self {
-        AppError(CoreError::Io(e))
-    }
-}
-
-impl AppError {
-    /// The HTTP status this error maps to. Public so handlers (and tests)
-    /// can reason about the mapping in one place.
-    #[must_use]
-    pub fn status(&self) -> StatusCode {
-        match self.0 {
-            CoreError::NotFound(_) => StatusCode::NOT_FOUND,
-            CoreError::Invalid(_) => StatusCode::BAD_REQUEST,
-            CoreError::Config(_) | CoreError::Io(_) | CoreError::Other(_) => {
-                StatusCode::INTERNAL_SERVER_ERROR
-            }
-        }
-    }
-}
-
-impl IntoResponse for AppError {
-    fn into_response(self) -> Response {
-        let status = self.status();
-        // Match the prior hand-written responses: the 4xx arms returned the
-        // bare inner message (not the `Display` prefix), so a UI showing
-        // `await r.text()` reads "metadata too long", not "invalid input:
-        // metadata too long". 5xx keeps the full `Display` string.
-        let body = match &self.0 {
-            CoreError::Invalid(m) | CoreError::NotFound(m) => m.clone(),
-            other => other.to_string(),
-        };
-        if status.is_server_error() {
-            // Log the full detail server-side; the body still carries it
-            // (unchanged from the prior `format!("{e}")` behaviour), but the
-            // log line is what an operator greps for.
-            tracing::error!(target: "openpxe::http", error = %self.0, "request failed");
-        }
-        (status, body).into_response()
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn status_mapping_is_consistent() {
-        assert_eq!(
-            AppError(CoreError::NotFound("x".into())).status(),
-            StatusCode::NOT_FOUND
-        );
-        assert_eq!(
-            AppError(CoreError::Invalid("x".into())).status(),
-            StatusCode::BAD_REQUEST
-        );
-        assert_eq!(
-            AppError(CoreError::Config("x".into())).status(),
-            StatusCode::INTERNAL_SERVER_ERROR
-        );
-    }
-}

crates/http-api/src/ipxe_script.rs

@@ -460,21 +460,8 @@ pub fn render_queue_entry(base_url: &str) -> String {
 }
 
 /// Per-entry boot script (same as Phase 1, with extra_kernel_args appended).
-///
-/// `unattended_args` (v0.5.2) carries the per-host unattended-install
-/// kernel arguments (`inst.ks=…`, `auto=true … url=…`, or
-/// `autoinstall ds=nocloud-net;s=…`) when the requesting MAC has a
-/// deployment profile with an answer file selected. It's appended to the
-/// Linux kernel command line after the operator's global extra args, and
-/// ignored for Windows (wimboot) / sanboot entries which don't take a
-/// kernel cmdline.
 #[must_use]
-pub fn render_entry(
+pub fn render_entry(entry: &BootEntry, settings: &Settings, base_url: &str) -> String {
-    entry: &BootEntry,
-    settings: &Settings,
-    base_url: &str,
-    unattended_args: Option<&str>,
-) -> String {
     let mut s = String::new();
     let base = base_url.trim_end_matches('/');
     let _ = writeln!(s, "#!ipxe");
@@ -490,12 +477,6 @@ pub fn render_entry(
                 cmdline.push(' ');
                 cmdline.push_str(settings.extra_kernel_args.trim());
             }
-            if let Some(extra) = unattended_args {
-                if !extra.trim().is_empty() {
-                    cmdline.push(' ');
-                    cmdline.push_str(extra.trim());
-                }
-            }
             let _ = writeln!(s, "kernel {base}/{kernel_url} {cmdline}");
             for u in initrd_urls {
                 let _ = writeln!(s, "initrd {base}/{u}");
@@ -693,22 +674,6 @@ mod password_tests {
         assert!(s.contains("arm64 UEFI"), "{s}");
     }
 
-    // v0.5.4: a full snapshot of the rendered top menu. The fragment
-    // `assert!`s above check specific invariants; this catches *any* other
-    // drift (a reordered item, a dropped line, changed spacing) so it's
-    // reviewed deliberately. The OpenPXE version is filtered out so the
-    // snapshot doesn't churn on every release bump.
-    #[test]
-    fn render_menu_snapshot() {
-        // Normalize the compile-time version so the snapshot doesn't churn
-        // on every release bump (no insta `filters` feature needed).
-        let rendered = render_menu(&[], &Settings::default(), "http://10.0.0.5").replace(
-            concat!("OpenPXE v", env!("CARGO_PKG_VERSION")),
-            "OpenPXE vX.Y.Z",
-        );
-        insta::assert_snapshot!(rendered);
-    }
-
     #[test]
     fn generated_scripts_do_not_emit_bare_or_trailing_fallbacks() {
         let settings = Settings::default();

crates/http-api/src/lib.rs

@@ -15,12 +15,10 @@
 
 pub mod app;
 pub mod auth;
-pub mod error;
 pub mod ipxe_script;
 pub mod iso_fs;
 pub mod log_stream;
 pub mod notify;
-pub mod saml_routes;
 pub mod state;
 pub mod terminal;
 pub mod uploads;

crates/http-api/src/saml_routes.rs

@@ -1,370 +0,0 @@
-//! SAML 2.0 Service Provider HTTP endpoints (v0.5.1).
-//!
-//! * `GET  /api/sso/login`    — SP-initiated: build an AuthnRequest, record its
-//!   ID, and 302 the browser to the IdP.
-//! * `POST /api/sso/acs`      — Assertion Consumer Service: verify + validate
-//!   the IdP's `SAMLResponse`, perform the stateful checks (InResponseTo
-//!   correlation, IdP-initiated gating, assertion replay), mint an operator
-//!   session, and 302 to the dashboard. (Mirrors FleetDM's `/sso/callback`.)
-//! * `GET  /api/sso/metadata` — serve our SP metadata XML for IdP import.
-//!
-//! Stateless crypto + semantic validation live in `openpxe_core::saml`; this
-//! module owns only the HTTP glue and the in-memory state the SP needs.
-
-use std::collections::HashMap;
-use std::sync::Arc;
-use std::time::{Duration as StdDuration, Instant};
-
-use axum::{
-    body::Body,
-    extract::{Form, Query, State},
-    http::{header, StatusCode},
-    response::{IntoResponse, Response},
-};
-use base64::Engine;
-use parking_lot::Mutex;
-use serde::Deserialize;
-use time::{Duration, OffsetDateTime};
-
-use openpxe_core::saml::{self, metadata::IdpMetadata, SamlError, SpParams};
-use openpxe_core::SsoConfig;
-
-use crate::auth;
-use crate::state::AppState;
-
-/// Outstanding AuthnRequest IDs live at most this long before a matching
-/// response is considered stale (covers a slow human at the IdP login form).
-const REQUEST_TTL: StdDuration = StdDuration::from_mins(10);
-/// How long we fetch-cache IdP metadata loaded from a URL.
-const METADATA_FETCH_TIMEOUT: StdDuration = StdDuration::from_secs(10);
-
-/// In-memory SAML runtime state. Cheap to clone (Arc-shared).
-#[derive(Clone, Default)]
-pub struct SamlRuntime {
-    /// request_id → issued_at. Correlates a response's `InResponseTo` to a
-    /// request *we* actually sent (replay / CSRF defense for SP-initiated).
-    outstanding: Arc<Mutex<HashMap<String, Instant>>>,
-    /// assertion_id → expiry. A consumed assertion may not be replayed.
-    consumed: Arc<Mutex<HashMap<String, Instant>>>,
-    /// Cache of IdP metadata fetched from a URL: (url, parsed).
-    metadata_cache: Arc<Mutex<Option<(String, IdpMetadata)>>>,
-}
-
-impl SamlRuntime {
-    /// Record an AuthnRequest we just sent.
-    pub fn register_request(&self, id: &str) {
-        let mut g = self.outstanding.lock();
-        prune(&mut g);
-        g.insert(id.to_owned(), Instant::now());
-    }
-
-    /// Consume an outstanding request ID, returning `true` if it was present
-    /// and still fresh. A miss means the response doesn't correlate to any
-    /// live request we issued.
-    pub fn take_request(&self, id: &str) -> bool {
-        let mut g = self.outstanding.lock();
-        prune(&mut g);
-        g.remove(id).is_some()
-    }
-
-    /// Record a consumed assertion. Returns `false` if it was already
-    /// consumed (a replay) — in which case the caller must reject.
-    pub fn record_assertion(&self, id: &str, expiry: OffsetDateTime) -> bool {
-        let mut g = self.consumed.lock();
-        prune(&mut g);
-        if g.contains_key(id) {
-            return false;
-        }
-        let ttl = (expiry - OffsetDateTime::now_utc())
-            .max(Duration::ZERO)
-            .unsigned_abs();
-        g.insert(id.to_owned(), Instant::now() + ttl);
-        true
-    }
-
-    fn cached_metadata(&self, url: &str) -> Option<IdpMetadata> {
-        let g = self.metadata_cache.lock();
-        match &*g {
-            Some((cached_url, md)) if cached_url == url => Some(md.clone()),
-            _ => None,
-        }
-    }
-
-    fn cache_metadata(&self, url: String, md: IdpMetadata) {
-        *self.metadata_cache.lock() = Some((url, md));
-    }
-}
-
-/// Drop expired entries so neither map grows unbounded.
-fn prune(map: &mut HashMap<String, Instant>) {
-    let now = Instant::now();
-    // For the request map this over-prunes (entries store issued_at, not
-    // expiry), so cap by REQUEST_TTL; the consumed map stores absolute
-    // expiry instants. Using saturating logic keeps both correct: request
-    // entries older than REQUEST_TTL go, consumed entries past expiry go.
-    map.retain(|_, &mut t| now.saturating_duration_since(t) < REQUEST_TTL || t > now);
-}
-
-// ─── GET /api/sso/login ───────────────────────────────────────────────────
-
-#[derive(Debug, Deserialize)]
-pub struct LoginQuery {
-    /// Optional local path to return to after login (becomes RelayState).
-    #[serde(default)]
-    pub next: Option<String>,
-}
-
-pub async fn sso_login(State(state): State<AppState>, Query(q): Query<LoginQuery>) -> Response {
-    let cfg = state.sso.snapshot();
-    if !cfg.is_usable() {
-        return redirect("/?sso_error=unavailable");
-    }
-    let idp = match resolve_idp_metadata(&state, &cfg).await {
-        Ok(m) => m,
-        Err(e) => {
-            tracing::warn!(target: "openpxe::saml", "sso_login: metadata unavailable: {e}");
-            return redirect("/?sso_error=metadata");
-        }
-    };
-    let Some(dest) = idp.sso_destination().map(str::to_owned) else {
-        tracing::warn!(target: "openpxe::saml", "sso_login: IdP metadata has no SSO endpoint");
-        return redirect("/?sso_error=metadata");
-    };
-    let sp = sp_params(&state, &cfg);
-    let relay = safe_local_path(q.next.as_deref());
-    match saml::authn_request::build(&sp, &dest, Some(&relay)) {
-        Ok(req) => {
-            state.saml.register_request(&req.id);
-            redirect(&req.location)
-        }
-        Err(e) => {
-            tracing::warn!(target: "openpxe::saml", "sso_login: build AuthnRequest failed: {e}");
-            redirect("/?sso_error=request")
-        }
-    }
-}
-
-// ─── POST /api/sso/acs ──────────────────────────────────────────────────────
-
-#[derive(Debug, Deserialize)]
-pub struct AcsForm {
-    #[serde(rename = "SAMLResponse")]
-    pub saml_response: String,
-    #[serde(rename = "RelayState", default)]
-    pub relay_state: Option<String>,
-}
-
-pub async fn sso_acs(State(state): State<AppState>, Form(form): Form<AcsForm>) -> Response {
-    let cfg = state.sso.snapshot();
-    if !cfg.is_usable() {
-        return redirect("/?sso_error=unavailable");
-    }
-    let xml = match base64::engine::general_purpose::STANDARD.decode(form.saml_response.as_bytes())
-    {
-        Ok(bytes) => String::from_utf8_lossy(&bytes).into_owned(),
-        Err(e) => {
-            tracing::warn!(target: "openpxe::saml", "acs: base64 decode failed: {e}");
-            return redirect("/?sso_error=1");
-        }
-    };
-    let idp = match resolve_idp_metadata(&state, &cfg).await {
-        Ok(m) => m,
-        Err(e) => {
-            tracing::warn!(target: "openpxe::saml", "acs: metadata unavailable: {e}");
-            return redirect("/?sso_error=metadata");
-        }
-    };
-    let sp = sp_params(&state, &cfg);
-
-    // Signature verification + semantic checks are CPU-bound — keep them off
-    // the async executor.
-    let now = OffsetDateTime::now_utc();
-    let skew = Duration::seconds(saml::DEFAULT_CLOCK_SKEW_SECS);
-    let verify = {
-        let xml = xml.clone();
-        let sp = sp.clone();
-        tokio::task::spawn_blocking(move || saml::response::consume(&xml, &sp, &idp, now, skew))
-            .await
-    };
-    let verified = match verify {
-        Ok(Ok(v)) => v,
-        Ok(Err(e)) => {
-            // Never leak which specific check failed to the browser.
-            tracing::warn!(target: "openpxe::saml", "acs: response rejected: {e}");
-            return redirect("/?sso_error=1");
-        }
-        Err(join) => {
-            tracing::error!(target: "openpxe::saml", "acs: verify task panicked: {join}");
-            return redirect("/?sso_error=1");
-        }
-    };
-
-    // Stateful checks the core deliberately left to us.
-    match &verified.in_response_to {
-        Some(id) => {
-            if !state.saml.take_request(id) {
-                tracing::warn!(target: "openpxe::saml", "acs: InResponseTo matches no live request");
-                return redirect("/?sso_error=1");
-            }
-        }
-        None => {
-            if !cfg.allow_idp_initiated {
-                tracing::warn!(target: "openpxe::saml", "acs: IdP-initiated login is disabled");
-                return redirect("/?sso_error=idp_initiated");
-            }
-        }
-    }
-    if !state
-        .saml
-        .record_assertion(&verified.assertion_id, verified.assertion_expiry)
-    {
-        tracing::warn!(target: "openpxe::saml", "acs: assertion replay rejected");
-        return redirect("/?sso_error=1");
-    }
-
-    // Success → mint an operator session keyed to the verified email.
-    let session = state.sessions.create(&verified.principal.email);
-    tracing::info!(
-        target: "openpxe::saml",
-        email = %verified.principal.email,
-        idp_initiated = verified.in_response_to.is_none(),
-        "SAML SSO sign-in"
-    );
-    // safe_local_path already maps None / unsafe values to "/".
-    let relay = safe_local_path(form.relay_state.as_deref());
-    redirect_with_session(&relay, &session)
-}
-
-// ─── GET /api/sso/metadata ──────────────────────────────────────────────────
-
-pub async fn sso_metadata(State(state): State<AppState>) -> Response {
-    let cfg = state.sso.snapshot();
-    let sp = sp_params(&state, &cfg);
-    let xml = saml::metadata::build_sp_metadata(&sp);
-    (
-        StatusCode::OK,
-        [(header::CONTENT_TYPE, "application/samlmetadata+xml")],
-        xml,
-    )
-        .into_response()
-}
-
-// ─── helpers ────────────────────────────────────────────────────────────────
-
-/// Derive runtime SP parameters from config + the advertised public base URL.
-fn sp_params(state: &AppState, cfg: &SsoConfig) -> SpParams {
-    let base = state.public_base_url.trim_end_matches('/');
-    let entity_id = if cfg.entity_id.trim().is_empty() {
-        base.to_owned()
-    } else {
-        cfg.entity_id.trim().to_owned()
-    };
-    SpParams {
-        entity_id,
-        acs_url: format!("{base}/api/sso/acs"),
-    }
-}
-
-/// Resolve the IdP metadata: prefer the metadata URL (fetched + cached) per
-/// the "URL wins" rule, else parse the pasted XML.
-async fn resolve_idp_metadata(state: &AppState, cfg: &SsoConfig) -> Result<IdpMetadata, SamlError> {
-    let url = cfg.metadata_url.trim();
-    if !url.is_empty() {
-        if let Some(md) = state.saml.cached_metadata(url) {
-            return Ok(md);
-        }
-        let body = fetch_metadata(url).await?;
-        let md = IdpMetadata::parse(&body)?;
-        state.saml.cache_metadata(url.to_owned(), md.clone());
-        return Ok(md);
-    }
-    if !cfg.metadata.trim().is_empty() {
-        return IdpMetadata::parse(&cfg.metadata);
-    }
-    Err(SamlError::Metadata("no metadata source configured".into()))
-}
-
-async fn fetch_metadata(url: &str) -> Result<String, SamlError> {
-    let client = reqwest::Client::builder()
-        .timeout(METADATA_FETCH_TIMEOUT)
-        .build()
-        .map_err(|e| SamlError::Metadata(format!("http client: {e}")))?;
-    let resp = client
-        .get(url)
-        .send()
-        .await
-        .map_err(|e| SamlError::Metadata(format!("fetch {url}: {e}")))?;
-    if !resp.status().is_success() {
-        return Err(SamlError::Metadata(format!(
-            "fetch {url}: HTTP {}",
-            resp.status()
-        )));
-    }
-    resp.text()
-        .await
-        .map_err(|e| SamlError::Metadata(format!("read {url}: {e}")))
-}
-
-/// Only permit a same-site path (single leading slash) as a redirect target —
-/// blocks open-redirect / protocol-relative (`//evil.com`) abuse of RelayState.
-fn safe_local_path(p: Option<&str>) -> String {
-    match p {
-        Some(p) if p.starts_with('/') && !p.starts_with("//") => p.to_owned(),
-        _ => "/".to_owned(),
-    }
-}
-
-fn redirect(location: &str) -> Response {
-    Response::builder()
-        .status(StatusCode::FOUND)
-        .header(header::LOCATION, location)
-        .body(Body::empty())
-        .map_or_else(
-            |_| StatusCode::INTERNAL_SERVER_ERROR.into_response(),
-            IntoResponse::into_response,
-        )
-}
-
-fn redirect_with_session(location: &str, session: &str) -> Response {
-    Response::builder()
-        .status(StatusCode::FOUND)
-        .header(header::LOCATION, location)
-        .header(header::SET_COOKIE, auth::session_cookie(session))
-        .body(Body::empty())
-        .map_or_else(
-            |_| StatusCode::INTERNAL_SERVER_ERROR.into_response(),
-            IntoResponse::into_response,
-        )
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use wiremock::matchers::method;
-    use wiremock::{Mock, MockServer, ResponseTemplate};
-
-    // v0.5.4: exercise the SAML metadata-URL fetch against a mock server —
-    // previously this path did a real network GET and had no coverage.
-    #[tokio::test]
-    async fn fetch_metadata_returns_body_on_200() {
-        let server = MockServer::start().await;
-        let xml = "<EntityDescriptor>idp</EntityDescriptor>";
-        Mock::given(method("GET"))
-            .respond_with(ResponseTemplate::new(200).set_body_string(xml))
-            .mount(&server)
-            .await;
-        let got = fetch_metadata(&server.uri()).await.expect("fetch ok");
-        assert_eq!(got, xml);
-    }
-
-    #[tokio::test]
-    async fn fetch_metadata_errors_on_non_2xx() {
-        let server = MockServer::start().await;
-        Mock::given(method("GET"))
-            .respond_with(ResponseTemplate::new(503))
-            .mount(&server)
-            .await;
-        let err = fetch_metadata(&server.uri()).await.unwrap_err();
-        assert!(matches!(err, SamlError::Metadata(_)), "got {err:?}");
-    }
-}

crates/http-api/src/snapshots/openpxe_http_api__ipxe_script__password_tests__render_menu_snapshot.snap

@@ -1,36 +0,0 @@
----
-source: crates/http-api/src/ipxe_script.rs
-expression: rendered
----
-#!ipxe
-# OpenPXE top-level menu - auto-generated, do not edit
-set base-url http://10.0.0.5
-set esc:hex 1b
-set cls ${esc:string}[2J
-console --picture http://10.0.0.5/branding/pxe-logo --top 290 || console
-set arch-label ${buildarch} ${platform}
-iseq ${buildarch} i386   && iseq ${platform} pcbios && set arch-label x86 BIOS         || iseq ${buildarch} x86_64 && iseq ${platform} efi    && set arch-label x86_64 UEFI      || iseq ${buildarch} arm64  && iseq ${platform} efi    && set arch-label arm64 UEFI       || true
-:menu
-menu OpenPXE - network boot menu
-item --gap
-item --gap -- ------------------------- Default -------------------------
-item local            Boot from Local HDD
-item --gap -- ----------------------- Installers -----------------------
-item --gap -- (no Linux ISOs uploaded)
-item --gap -- (Windows support disabled in Settings)
-item --gap -- -------------------------- Tools --------------------------
-item tools            Tools  >
-item --gap -- ---------------------- Queued Deployment ---------------------
-item queue            Queued Deployment  (join queue)
-item --gap
-item --key x exit     Exit iPXE
-item --gap
-item --gap --                 OpenPXE vX.Y.Z  -  ${arch-label}
-choose --default queue --timeout 600000 target || goto menu
-iseq ${target} local   && chain http://10.0.0.5/boot/_local.ipxe        || goto menu
-iseq ${target} linux   && chain http://10.0.0.5/boot/_linux_menu.ipxe   || goto menu
-iseq ${target} windows && chain http://10.0.0.5/boot/_windows_menu.ipxe || goto menu
-iseq ${target} tools   && chain http://10.0.0.5/boot/_tools_menu.ipxe   || goto menu
-iseq ${target} queue   && chain http://10.0.0.5/boot/_queue.ipxe         || goto menu
-iseq ${target} exit    && exit                                 || goto menu
-goto menu

crates/http-api/src/state.rs

@@ -1,11 +1,10 @@
-use crate::auth::SessionStore;
-use crate::saml_routes::SamlRuntime;
 use crate::uploads::UploadSessions;
+use crate::auth::SessionStore;
 use openpxe_core::{
     AdminStore, BootLog, BrandingStore, ClientRegistry, DeploymentQueue, HostBindings, LogBus,
     Metrics, NotifyStore, SettingsStore, SsoStore,
 };
-use openpxe_iso_store::{IsoStore, NfsShareManager, SmbManager, SmbShareManager, UnattendedStore};
+use openpxe_iso_store::{IsoStore, NfsShareManager, SmbManager, SmbShareManager};
 use std::sync::Arc;
 use time::OffsetDateTime;
 
@@ -35,13 +34,9 @@ pub struct AppState {
     /// process restart (sessions are tied to UI state, not persisted —
     /// matches Sonarr/Radarr behaviour).
     pub sessions: SessionStore,
-    /// SAML SSO configuration (persisted IdP metadata, Entity ID, toggles).
+    /// SAML SSO configuration. v0.4.5 stores it; the actual SSO login
+    /// flow ships in a later release.
     pub sso: SsoStore,
-    /// v0.5.1: in-memory SAML runtime state — outstanding AuthnRequest IDs
-    /// (for InResponseTo correlation), consumed-assertion replay guard, and
-    /// a cache of fetched IdP metadata. Tied to process lifetime, like
-    /// `sessions`; a restart simply invalidates any in-flight SSO login.
-    pub saml: SamlRuntime,
     /// v0.5.0: webhook / email notification config (Slack/Teams/Discord/
     /// SMTP). Drives the fire-and-forget pings on boot events and powers
     /// the Advanced tab's config + "Send test" button.
@@ -67,11 +62,6 @@ pub struct AppState {
     /// In-process (no subprocess); supports HTTP Range requests on
     /// NFS-sourced ISOs because NFSv3 READ3 takes an explicit offset.
     pub nfs_shares: NfsShareManager,
-    /// v0.5.2: uploaded unattended-install answer files (Kickstart /
-    /// Preseed / Autoinstall / Windows answer files). Served on demand to
-    /// booting clients with per-host hostname/IP/MAC templating; lives in
-    /// its own directory, never the ISO listing or PXE menu.
-    pub unattended: UnattendedStore,
     /// Browser chunked upload state. Multipart uploads still go straight
     /// through `IsoStore`, but the UI uses sessions so large ISO transfers
     /// can show deterministic progress and leave visible partial files.

crates/http-api/src/uploads.rs

@@ -9,7 +9,6 @@
 use bytes::Bytes;
 use openpxe_core::{Error, Result};
 use openpxe_iso_store::{IsoMeta, IsoStore, UploadHandle};
-use parking_lot::RwLock;
 use serde::Serialize;
 use std::collections::HashMap;
 use std::sync::Arc;
@@ -20,11 +19,7 @@ const DEFAULT_CHUNK_SIZE: u64 = 8 * 1024 * 1024;
 
 #[derive(Clone, Default)]
 pub struct UploadSessions {
-    // v0.5.4: the registry is a sync `parking_lot::RwLock` — it's only ever
+    inner: Arc<Mutex<HashMap<String, Arc<Mutex<UploadSession>>>>>,
-    // briefly read/inserted/removed to look up a session, never held across
-    // an `.await`. The per-session lock below stays a `tokio::sync::Mutex`
-    // because `write_chunk` / `finish` are awaited while it's held.
-    inner: Arc<RwLock<HashMap<String, Arc<Mutex<UploadSession>>>>>,
 }
 
 struct UploadSession {
@@ -72,7 +67,8 @@ impl UploadSessions {
         };
 
         self.inner
-            .write()
+            .lock()
+            .await
             .insert(upload_id.clone(), Arc::new(Mutex::new(session)));
 
         Ok(UploadStarted {
@@ -92,7 +88,7 @@ impl UploadSessions {
         chunk: Bytes,
         complete: bool,
     ) -> Result<UploadAppend> {
-        let Some(session_lock) = self.inner.read().get(upload_id).cloned() else {
+        let Some(session_lock) = self.inner.lock().await.get(upload_id).cloned() else {
             return Err(Error::Invalid(format!("no such upload '{upload_id}'")));
         };
 
@@ -123,7 +119,7 @@ impl UploadSessions {
         if let Err(e) = handle.write_chunk(&chunk).await {
             let handle = session.handle.take();
             drop(session);
-            self.inner.write().remove(upload_id);
+            self.inner.lock().await.remove(upload_id);
             if let Some(handle) = handle {
                 let _ = handle.abort().await;
             }
@@ -160,11 +156,11 @@ impl UploadSessions {
         let meta = match handle.finish(store).await {
             Ok(meta) => meta,
             Err(e) => {
-                self.inner.write().remove(upload_id);
+                self.inner.lock().await.remove(upload_id);
                 return Err(e);
             }
         };
-        self.inner.write().remove(upload_id);
+        self.inner.lock().await.remove(upload_id);
         Ok(UploadAppend::Complete {
             offset: new_offset,
             iso: Box::new(meta),
@@ -172,7 +168,7 @@ impl UploadSessions {
     }
 
     pub async fn abort(&self, upload_id: &str) -> Result<()> {
-        let Some(session_lock) = self.inner.write().remove(upload_id) else {
+        let Some(session_lock) = self.inner.lock().await.remove(upload_id) else {
             return Err(Error::Invalid(format!("no such upload '{upload_id}'")));
         };
         let mut session = session_lock.lock().await;

crates/http-api/tests/full_flow.rs

@@ -96,8 +96,6 @@ async fn build_state() -> (AppState, tempfile::TempDir) {
     let settings = SettingsStore::load_or_default(dir.path());
     let smb_shares = SmbShareManager::new(dir.path(), iso_store.clone());
     let nfs_shares = NfsShareManager::new(dir.path(), iso_store.clone());
-    let unattended = openpxe_iso_store::UnattendedStore::new(dir.path().join("unattended"));
-    unattended.ensure_dir().await.unwrap();
     let log_bus = LogBus::new(64);
     let hosts = HostBindings::load_or_default(dir.path());
     let boot_log = openpxe_core::BootLog::load_or_default(dir.path());
@@ -118,13 +116,11 @@ async fn build_state() -> (AppState, tempfile::TempDir) {
         admin,
         sessions,
         sso,
-        saml: openpxe_http_api::saml_routes::SamlRuntime::default(),
         notify,
         metrics,
         smb: None,
         smb_shares,
         nfs_shares,
-        unattended,
         uploads: openpxe_http_api::uploads::UploadSessions::default(),
         log_bus,
         started_at: time::OffsetDateTime::now_utc(),
@@ -563,10 +559,7 @@ async fn notify_config_round_trips_and_redacts_smtp_password() {
     assert_eq!(v["kind"], "smtp");
     let pw = v["smtp_password"].as_str().unwrap_or("");
     assert_ne!(pw, "s3cret", "raw password must never be returned");
-    assert!(
+    assert!(!pw.is_empty(), "a set password should surface as a sentinel");
-        !pw.is_empty(),
-        "a set password should surface as a sentinel"
-    );
 }
 
 #[tokio::test]
@@ -1491,8 +1484,7 @@ async fn api_docs_lists_known_endpoints() {
         "/api/isos",
         "/api/isos/:id/category",
         "/api/storage/disk",
-        "/api/branding/logo/:slot",
+        "/api/branding/logo",
-        "/api/unattended",
         "/api/boot-log",
         "/metrics",
     ] {
@@ -1513,7 +1505,7 @@ async fn branding_clear_when_no_logo_is_no_content() {
         .oneshot(
             Request::builder()
                 .method("DELETE")
-                .uri("/api/branding/logo/dark")
+                .uri("/api/branding/logo")
                 .body(Body::empty())
                 .unwrap(),
         )
@@ -1536,60 +1528,6 @@ async fn status_exposes_custom_logo_flag() {
     );
 }
 
-/// v0.5.4 guard: the typed `StatusResponse` must keep every key the WebUI
-/// (`crates/webui/src/app.js`) reads off `/api/status`. If a refactor drops
-/// or renames one, the dashboard silently breaks — this catches it.
-#[tokio::test]
-async fn status_contract_has_all_ui_keys() {
-    let (state, _dir) = build_state().await;
-    let app = build_router(state);
-    let (s, body) = get(&app, "/api/status").await;
-    assert_eq!(s, StatusCode::OK);
-    let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
-    for key in [
-        "version",
-        "public_base_url",
-        "iso_count",
-        "client_count",
-        "queue_count",
-        "imaging_count",
-        "waiting_count",
-        "ipxe_assets",
-        "settings",
-        "smb_share_count",
-        "smb_share_reachable",
-        "nfs_share_count",
-        "nfs_share_reachable",
-        "host_bindings",
-        "custom_logo",
-        "branding",
-        "unattended_count",
-        "uptime_secs",
-        "started_at",
-        "nic_name",
-        "subnet_mask",
-        "gateway",
-    ] {
-        assert!(
-            v.get(key).is_some(),
-            "/api/status missing UI key '{key}': {v}"
-        );
-    }
-    // Nested branding presence the Settings tab reads.
-    for key in ["light", "dark", "client", "rev"] {
-        assert!(
-            v["branding"].get(key).is_some(),
-            "/api/status branding missing '{key}': {v}"
-        );
-    }
-    // started_at must remain an RFC3339 string (the UI does fmtUptime on
-    // uptime_secs but renders started_at as text), not a serialized struct.
-    assert!(
-        v["started_at"].is_string(),
-        "started_at should serialize as a string: {v}"
-    );
-}
-
 async fn put_json(router: &axum::Router, path: &str, body: &str) -> (StatusCode, Vec<u8>) {
     let res = router
         .clone()
@@ -1613,11 +1551,7 @@ async fn put_json(router: &axum::Router, path: &str, body: &str) -> (StatusCode,
 
 // ─── v0.4.5: Forms auth + SSO ─────────────────────────────────────────────
 
-async fn post_collect(
+async fn post_collect(router: &axum::Router, path: &str, body: &str) -> (StatusCode, Vec<u8>, Vec<axum::http::HeaderValue>) {
-    router: &axum::Router,
-    path: &str,
-    body: &str,
-) -> (StatusCode, Vec<u8>, Vec<axum::http::HeaderValue>) {
     let res = router
         .clone()
         .oneshot(
@@ -2008,7 +1942,6 @@ async fn pxe_background_falls_back_to_default_for_svg_upload() {
     state
         .branding
         .set_logo(
-            openpxe_core::LogoSlot::Client,
             "image/svg+xml",
             "svg",
             br#"<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 8 8"/>"#,
@@ -2029,10 +1962,7 @@ async fn pxe_background_falls_back_to_default_for_svg_upload() {
     let body = axum::body::to_bytes(res.into_body(), usize::MAX)
         .await
         .unwrap();
-    assert!(
+    assert!(body.starts_with(b"\x89PNG"), "should serve default PNG for SVG");
-        body.starts_with(b"\x89PNG"),
-        "should serve default PNG for SVG"
-    );
     let width = u32::from_be_bytes([body[16], body[17], body[18], body[19]]);
     assert_eq!(width, 1024);
 }
@@ -2046,7 +1976,7 @@ async fn pxe_logo_composes_to_1024x768_png() {
     let png = tiny_png();
     state
         .branding
-        .set_logo(openpxe_core::LogoSlot::Client, "image/png", "png", &png)
+        .set_logo("image/png", "png", &png)
         .unwrap();
     let app = build_router(state);
     let res = app
@@ -2089,7 +2019,7 @@ async fn pxe_logo_endpoint_is_public_after_admin_setup() {
     let png = tiny_png();
     state
         .branding
-        .set_logo(openpxe_core::LogoSlot::Client, "image/png", "png", &png)
+        .set_logo("image/png", "png", &png)
         .unwrap();
     let app = build_router(state);
     // Configure an admin so the middleware kicks in.
@@ -2104,508 +2034,3 @@ async fn pxe_logo_endpoint_is_public_after_admin_setup() {
     let (s, _) = get(&app, "/branding/pxe-logo").await;
     assert_eq!(s, StatusCode::OK);
 }
-
-// ─── v0.5.2: unattended files + deployment profiles ─────────────────────────
-
-async fn post_multipart(
-    router: &axum::Router,
-    path: &str,
-    ct: &str,
-    body: Vec<u8>,
-) -> (StatusCode, Vec<u8>) {
-    let res = router
-        .clone()
-        .oneshot(
-            Request::builder()
-                .method("POST")
-                .uri(path)
-                .header("content-type", ct)
-                .body(Body::from(body))
-                .unwrap(),
-        )
-        .await
-        .unwrap();
-    let status = res.status();
-    let body = axum::body::to_bytes(res.into_body(), usize::MAX)
-        .await
-        .unwrap()
-        .to_vec();
-    (status, body)
-}
-
-#[tokio::test]
-async fn unattended_upload_list_serve_and_template() {
-    let (state, _dir) = build_state().await;
-    let app = build_router(state);
-    let ks = b"install\nnetwork --hostname={{HOSTNAME}} --ip={{IP}}\n%packages\n@core\n%end\n";
-    let (ct, body) = multipart_iso_body("rocky.ks", ks);
-    let (s, b) = post_multipart(&app, "/api/unattended", &ct, body).await;
-    assert_eq!(s, StatusCode::CREATED, "{}", String::from_utf8_lossy(&b));
-    let m: serde_json::Value = serde_json::from_slice(&b).unwrap();
-    assert_eq!(m["kind"], "kickstart");
-    let id = m["id"].as_str().unwrap().to_string();
-
-    let (s, b) = get(&app, "/api/unattended").await;
-    assert_eq!(s, StatusCode::OK);
-    let v: serde_json::Value = serde_json::from_slice(&b).unwrap();
-    assert_eq!(v["files"].as_array().unwrap().len(), 1);
-
-    // Public serve substitutes the query tokens.
-    let (s, b) = get(
-        &app,
-        &format!("/unattended/{id}?hostname=node7&ip=10.0.0.7"),
-    )
-    .await;
-    assert_eq!(s, StatusCode::OK);
-    let text = String::from_utf8_lossy(&b);
-    assert!(text.contains("--hostname=node7"), "got: {text}");
-    assert!(text.contains("--ip=10.0.0.7"), "got: {text}");
-    assert!(!text.contains("{{"), "tokens left unrendered: {text}");
-
-    // Delete.
-    let res = app
-        .clone()
-        .oneshot(
-            Request::builder()
-                .method("DELETE")
-                .uri(format!("/api/unattended/{id}"))
-                .body(Body::empty())
-                .unwrap(),
-        )
-        .await
-        .unwrap();
-    assert_eq!(res.status(), StatusCode::NO_CONTENT);
-    let (_, b) = get(&app, "/api/unattended").await;
-    let v: serde_json::Value = serde_json::from_slice(&b).unwrap();
-    assert_eq!(v["files"].as_array().unwrap().len(), 0);
-}
-
-#[tokio::test]
-async fn unattended_upload_rejects_bad_type() {
-    let (state, _dir) = build_state().await;
-    let app = build_router(state);
-    let (ct, body) = multipart_iso_body("evil.sh", b"#!/bin/sh\n");
-    let (s, _) = post_multipart(&app, "/api/unattended", &ct, body).await;
-    assert_eq!(s, StatusCode::BAD_REQUEST);
-}
-
-#[tokio::test]
-async fn host_pin_with_unattended_injects_kickstart_arg() {
-    let (state, _dir) = build_state().await;
-    let app = build_router(state.clone());
-    // Upload a Linux ISO → synthesises the `fake-alpine-linux` LinuxKernel entry.
-    let (ct, body) = multipart_iso_body("fake-alpine.iso", &fake_alpine_iso());
-    let (s, _) = post_multipart(&app, "/api/isos", &ct, body).await;
-    assert_eq!(s, StatusCode::CREATED);
-    // Upload a kickstart.
-    let (ct, body) = multipart_iso_body("ks.ks", b"install\n%packages\n@core\n%end\n");
-    let (s, b) = post_multipart(&app, "/api/unattended", &ct, body).await;
-    assert_eq!(s, StatusCode::CREATED);
-    let ks_id = serde_json::from_slice::<serde_json::Value>(&b).unwrap()["id"]
-        .as_str()
-        .unwrap()
-        .to_string();
-    // Pin a MAC to the Linux entry with the unattended profile.
-    let mac = "aa:bb:cc:dd:ee:01";
-    let pin = format!(
-        r#"{{"mac":"{mac}","target":"fake-alpine-linux","label":"lab","auto_hostname":"node7","auto_ip":"10.0.0.7","unattended_file":"{ks_id}"}}"#
-    );
-    let (s, b) = post_json(&app, "/api/hosts", &pin).await;
-    assert_eq!(s, StatusCode::CREATED, "{}", String::from_utf8_lossy(&b));
-    // Boot the entry as that MAC; the kernel line should carry inst.ks=.
-    let (s, b) = get(&app, &format!("/boot/fake-alpine-linux.ipxe?mac={mac}")).await;
-    assert_eq!(s, StatusCode::OK);
-    let script = String::from_utf8_lossy(&b);
-    assert!(
-        script.contains("inst.ks="),
-        "no kickstart arg injected:\n{script}"
-    );
-    assert!(
-        script.contains("hostname=node7"),
-        "hostname not passed:\n{script}"
-    );
-}
-
-#[tokio::test]
-async fn host_pin_rejects_unknown_unattended_file() {
-    let (state, _dir) = build_state().await;
-    let app = build_router(state.clone());
-    let (ct, body) = multipart_iso_body("fake-alpine.iso", &fake_alpine_iso());
-    let (s, _) = post_multipart(&app, "/api/isos", &ct, body).await;
-    assert_eq!(s, StatusCode::CREATED);
-    let pin = r#"{"mac":"aa:bb:cc:dd:ee:02","target":"fake-alpine-linux","unattended_file":"does-not-exist"}"#;
-    let (s, _) = post_json(&app, "/api/hosts", pin).await;
-    assert_eq!(s, StatusCode::BAD_REQUEST);
-}
-
-#[tokio::test]
-async fn host_pin_rejects_bad_auto_ip() {
-    let (state, _dir) = build_state().await;
-    let app = build_router(state.clone());
-    let (ct, body) = multipart_iso_body("fake-alpine.iso", &fake_alpine_iso());
-    let (s, _) = post_multipart(&app, "/api/isos", &ct, body).await;
-    assert_eq!(s, StatusCode::CREATED);
-    let pin = r#"{"mac":"aa:bb:cc:dd:ee:03","target":"fake-alpine-linux","auto_ip":"not-an-ip"}"#;
-    let (s, _) = post_json(&app, "/api/hosts", pin).await;
-    assert_eq!(s, StatusCode::BAD_REQUEST);
-}
-
-#[tokio::test]
-async fn per_theme_logo_and_favicon_serve() {
-    let (state, _dir) = build_state().await;
-    // Light slot only; dark falls back to it, favicon stays bundled.
-    let png = tiny_png();
-    state
-        .branding
-        .set_logo(openpxe_core::LogoSlot::Light, "image/png", "png", &png)
-        .unwrap();
-    let app = build_router(state);
-    // Light theme → the uploaded PNG.
-    let (s, b) = get(&app, "/assets/logo.svg?theme=light").await;
-    assert_eq!(s, StatusCode::OK);
-    assert!(b.starts_with(b"\x89PNG"), "light slot should serve the PNG");
-    // Dark theme → falls back to the light PNG (only slot set).
-    let (s, b) = get(&app, "/assets/logo.svg?theme=dark").await;
-    assert_eq!(s, StatusCode::OK);
-    assert!(
-        b.starts_with(b"\x89PNG"),
-        "dark should fall back to light PNG"
-    );
-    // Favicon is always the bundled SVG, never the custom raster.
-    let (s, b) = get(&app, "/assets/favicon.svg").await;
-    assert_eq!(s, StatusCode::OK);
-    let txt = String::from_utf8_lossy(&b);
-    assert!(txt.contains("<svg"), "favicon must be the bundled SVG mark");
-}
-
-#[tokio::test]
-async fn branding_slot_rejects_unknown_and_client_svg() {
-    let (state, _dir) = build_state().await;
-    let app = build_router(state);
-    // Unknown slot name → 400.
-    let (ct, body) = multipart_iso_body("logo.png", &tiny_png());
-    let (s, _) = post_multipart(&app, "/api/branding/logo/sideways", &ct, body).await;
-    assert_eq!(s, StatusCode::BAD_REQUEST);
-    // SVG into the client (PXE) slot → 400 (raster-only).
-    let svg = br#"<svg xmlns="http://www.w3.org/2000/svg"/>"#;
-    let boundary = "----OpenPxeTestBoundary1234";
-    let mut b = Vec::new();
-    b.extend_from_slice(format!("--{boundary}\r\n").as_bytes());
-    b.extend_from_slice(b"Content-Disposition: form-data; name=\"file\"; filename=\"l.svg\"\r\n");
-    b.extend_from_slice(b"Content-Type: image/svg+xml\r\n\r\n");
-    b.extend_from_slice(svg);
-    b.extend_from_slice(format!("\r\n--{boundary}--\r\n").as_bytes());
-    let ct = format!("multipart/form-data; boundary={boundary}");
-    let (s, _) = post_multipart(&app, "/api/branding/logo/client", &ct, b).await;
-    assert_eq!(s, StatusCode::BAD_REQUEST);
-}
-
-// ─── v0.5.1: SAML SSO flow ──────────────────────────────────────────────────
-//
-// The core crate exhaustively tests signature verification + semantic
-// validation (crates/core/src/saml/tests.rs). These integration tests cover
-// the HTTP wiring the core can't: routing, base64 decode, session minting,
-// the InResponseTo / IdP-initiated gating, and assertion-replay rejection.
-
-use base64::Engine as _;
-use openpxe_core::SsoConfig;
-use time::format_description::well_known::Rfc3339;
-use time::{Duration as TimeDuration, OffsetDateTime};
-
-const SP_BASE: &str = "http://127.0.0.1"; // build_state's public_base_url
-const SP_ACS: &str = "http://127.0.0.1/api/sso/acs";
-const IDP_ENTITY: &str = "https://idp.test/realms/fleet";
-const IDP_SSO: &str = "https://idp.test/realms/fleet/protocol/saml";
-
-struct TestIdp {
-    cert_b64: String,
-    key_pem: String,
-}
-
-fn make_idp() -> TestIdp {
-    let ck = rcgen::generate_simple_self_signed(vec!["idp.test".to_string()]).unwrap();
-    let der = ck.cert.der().as_ref().to_vec();
-    TestIdp {
-        cert_b64: base64::engine::general_purpose::STANDARD.encode(der),
-        key_pem: ck.key_pair.serialize_pem(),
-    }
-}
-
-fn idp_metadata_xml(cert_b64: &str) -> String {
-    format!(
-        r#"<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" entityID="{IDP_ENTITY}">
-  <md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
-    <md:KeyDescriptor use="signing"><ds:KeyInfo><ds:X509Data><ds:X509Certificate>{cert_b64}</ds:X509Certificate></ds:X509Data></ds:KeyInfo></md:KeyDescriptor>
-    <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="{IDP_SSO}"/>
-  </md:IDPSSODescriptor>
-</md:EntityDescriptor>"#
-    )
-}
-
-/// Build + sign a SAMLResponse with the test IdP key. `in_response_to: None`
-/// makes it an unsolicited (IdP-initiated) response.
-fn signed_response(idp: &TestIdp, in_response_to: Option<&str>) -> String {
-    let now = OffsetDateTime::now_utc().replace_nanosecond(0).unwrap();
-    let fmt = |t: OffsetDateTime| t.format(&Rfc3339).unwrap();
-    let irt = in_response_to
-        .map(|v| format!(r#" InResponseTo="{v}""#))
-        .unwrap_or_default();
-    let template = format!(
-        r##"<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_resp1" Version="2.0" IssueInstant="{now}" Destination="{SP_ACS}"{irt}>
-  <saml:Issuer>{IDP_ENTITY}</saml:Issuer>
-  <samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>
-  <saml:Assertion ID="_assertion1" Version="2.0" IssueInstant="{now}">
-    <saml:Issuer>{IDP_ENTITY}</saml:Issuer>
-    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
-      <ds:SignedInfo>
-        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
-        <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256"/>
-        <ds:Reference URI="#_assertion1">
-          <ds:Transforms>
-            <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
-            <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
-          </ds:Transforms>
-          <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
-          <ds:DigestValue></ds:DigestValue>
-        </ds:Reference>
-      </ds:SignedInfo>
-      <ds:SignatureValue></ds:SignatureValue>
-    </ds:Signature>
-    <saml:Subject>
-      <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">[email protected]</saml:NameID>
-      <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
-        <saml:SubjectConfirmationData Recipient="{SP_ACS}" NotOnOrAfter="{noa}"{irt}/>
-      </saml:SubjectConfirmation>
-    </saml:Subject>
-    <saml:Conditions NotBefore="{nb}" NotOnOrAfter="{noa}">
-      <saml:AudienceRestriction><saml:Audience>{SP_BASE}</saml:Audience></saml:AudienceRestriction>
-    </saml:Conditions>
-    <saml:AuthnStatement AuthnInstant="{now}" SessionIndex="sess-1">
-      <saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef></saml:AuthnContext>
-    </saml:AuthnStatement>
-  </saml:Assertion>
-</samlp:Response>"##,
-        now = fmt(now),
-        nb = fmt(now - TimeDuration::minutes(5)),
-        noa = fmt(now + TimeDuration::hours(1)),
-    );
-    let key = bergshamra::keys::loader::load_pem_auto(idp.key_pem.as_bytes(), None).unwrap();
-    let mut km = bergshamra::keys::KeysManager::new();
-    km.add_key(key);
-    let ctx = bergshamra::DsigContext::new(km);
-    bergshamra::sign(&ctx, &template).unwrap()
-}
-
-fn urlencode(s: &str) -> String {
-    let mut out = String::with_capacity(s.len() * 3);
-    for b in s.bytes() {
-        match b {
-            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => {
-                out.push(b as char);
-            }
-            _ => {
-                out.push('%');
-                out.push(
-                    char::from_digit((b >> 4) as u32, 16)
-                        .unwrap()
-                        .to_ascii_uppercase(),
-                );
-                out.push(
-                    char::from_digit((b & 0xf) as u32, 16)
-                        .unwrap()
-                        .to_ascii_uppercase(),
-                );
-            }
-        }
-    }
-    out
-}
-
-fn configure_sso(state: &AppState, metadata: String, allow_idp_initiated: bool) {
-    state
-        .sso
-        .replace(SsoConfig {
-            enabled: true,
-            idp_name: "Test IdP".into(),
-            idp_logo_url: String::new(),
-            metadata,
-            metadata_url: String::new(),
-            entity_id: String::new(),
-            allow_idp_initiated,
-        })
-        .unwrap();
-}
-
-async fn post_acs(router: &axum::Router, signed_xml: &str) -> axum::response::Response {
-    let b64 = base64::engine::general_purpose::STANDARD.encode(signed_xml.as_bytes());
-    let body = format!("SAMLResponse={}", urlencode(&b64));
-    router
-        .clone()
-        .oneshot(
-            Request::builder()
-                .method("POST")
-                .uri("/api/sso/acs")
-                .header("content-type", "application/x-www-form-urlencoded")
-                .body(Body::from(body))
-                .unwrap(),
-        )
-        .await
-        .unwrap()
-}
-
-fn has_session_cookie(resp: &axum::response::Response) -> bool {
-    resp.headers().get_all(header::SET_COOKIE).iter().any(|v| {
-        let s = v.to_str().unwrap_or("");
-        s.starts_with("openpxe_session=")
-            && !s.contains("openpxe_session=;")
-            && !s.contains("Max-Age=0")
-    })
-}
-
-fn location(resp: &axum::response::Response) -> String {
-    resp.headers()
-        .get(header::LOCATION)
-        .and_then(|v| v.to_str().ok())
-        .unwrap_or("")
-        .to_owned()
-}
-
-#[tokio::test]
-async fn sso_login_redirects_to_idp() {
-    let (state, _dir) = build_state().await;
-    let idp = make_idp();
-    configure_sso(&state, idp_metadata_xml(&idp.cert_b64), false);
-    let app = build_router(state);
-    let resp = app
-        .clone()
-        .oneshot(
-            Request::builder()
-                .uri("/api/sso/login")
-                .body(Body::empty())
-                .unwrap(),
-        )
-        .await
-        .unwrap();
-    assert_eq!(resp.status(), StatusCode::FOUND);
-    let loc = location(&resp);
-    assert!(loc.starts_with(IDP_SSO), "redirect to IdP, got {loc}");
-    assert!(
-        loc.contains("SAMLRequest="),
-        "carries SAMLRequest, got {loc}"
-    );
-}
-
-#[tokio::test]
-async fn sso_login_unavailable_when_disabled() {
-    let (state, _dir) = build_state().await;
-    let app = build_router(state); // SSO never configured
-    let resp = app
-        .oneshot(
-            Request::builder()
-                .uri("/api/sso/login")
-                .body(Body::empty())
-                .unwrap(),
-        )
-        .await
-        .unwrap();
-    assert_eq!(resp.status(), StatusCode::FOUND);
-    assert!(location(&resp).contains("sso_error"));
-}
-
-#[tokio::test]
-async fn sso_metadata_is_served() {
-    let (state, _dir) = build_state().await;
-    let app = build_router(state);
-    let (status, body) = get(&app, "/api/sso/metadata").await;
-    assert_eq!(status, StatusCode::OK);
-    let xml = String::from_utf8(body).unwrap();
-    assert!(xml.contains("SPSSODescriptor"));
-    assert!(xml.contains(SP_ACS));
-    assert!(xml.contains(SP_BASE));
-}
-
-#[tokio::test]
-async fn acs_idp_initiated_mints_session() {
-    let (state, _dir) = build_state().await;
-    let idp = make_idp();
-    configure_sso(&state, idp_metadata_xml(&idp.cert_b64), true);
-    let app = build_router(state);
-    let signed = signed_response(&idp, None);
-    let resp = post_acs(&app, &signed).await;
-    assert_eq!(resp.status(), StatusCode::FOUND);
-    assert_eq!(location(&resp), "/");
-    assert!(
-        has_session_cookie(&resp),
-        "ACS must set an operator session cookie"
-    );
-}
-
-#[tokio::test]
-async fn acs_idp_initiated_blocked_when_disabled() {
-    let (state, _dir) = build_state().await;
-    let idp = make_idp();
-    configure_sso(&state, idp_metadata_xml(&idp.cert_b64), false); // gate OFF
-    let app = build_router(state);
-    let signed = signed_response(&idp, None);
-    let resp = post_acs(&app, &signed).await;
-    assert_eq!(resp.status(), StatusCode::FOUND);
-    assert!(location(&resp).contains("sso_error"));
-    assert!(
-        !has_session_cookie(&resp),
-        "no session when IdP-initiated is disabled"
-    );
-}
-
-#[tokio::test]
-async fn acs_sp_initiated_without_known_request_is_rejected() {
-    let (state, _dir) = build_state().await;
-    let idp = make_idp();
-    configure_sso(&state, idp_metadata_xml(&idp.cert_b64), true);
-    let app = build_router(state);
-    // A valid signature but an InResponseTo we never issued => reject.
-    let signed = signed_response(&idp, Some("_never-issued"));
-    let resp = post_acs(&app, &signed).await;
-    assert_eq!(resp.status(), StatusCode::FOUND);
-    assert!(location(&resp).contains("sso_error"));
-    assert!(!has_session_cookie(&resp));
-}
-
-#[tokio::test]
-async fn acs_replayed_assertion_is_rejected() {
-    let (state, _dir) = build_state().await;
-    let idp = make_idp();
-    configure_sso(&state, idp_metadata_xml(&idp.cert_b64), true);
-    let app = build_router(state);
-    let signed = signed_response(&idp, None);
-    // First use succeeds…
-    let first = post_acs(&app, &signed).await;
-    assert!(has_session_cookie(&first));
-    // …replaying the identical assertion is rejected.
-    let second = post_acs(&app, &signed).await;
-    assert_eq!(second.status(), StatusCode::FOUND);
-    assert!(location(&second).contains("sso_error"));
-    assert!(!has_session_cookie(&second));
-}
-
-#[tokio::test]
-async fn acs_garbage_is_rejected_without_500() {
-    let (state, _dir) = build_state().await;
-    let idp = make_idp();
-    configure_sso(&state, idp_metadata_xml(&idp.cert_b64), true);
-    let app = build_router(state);
-    let body = "SAMLResponse=not%20valid%20base64%21%21";
-    let resp = app
-        .oneshot(
-            Request::builder()
-                .method("POST")
-                .uri("/api/sso/acs")
-                .header("content-type", "application/x-www-form-urlencoded")
-                .body(Body::from(body))
-                .unwrap(),
-        )
-        .await
-        .unwrap();
-    assert_eq!(resp.status(), StatusCode::FOUND);
-    assert!(location(&resp).contains("sso_error"));
-    assert!(!has_session_cookie(&resp));
-}

crates/iso-store/src/lib.rs

@@ -23,7 +23,6 @@ pub mod pxe_logo;
 pub mod smb;
 pub mod smb_share;
 pub mod store;
-pub mod unattended;
 pub mod windows;
 
 pub use entry::{BootEntry, BootKind, KernelArgs};
@@ -41,10 +40,7 @@ pub use smb_share::{SmbAddRequest, SmbShare, SmbShareError, SmbShareManager, Smb
 // Range requests because NFSv3 READ3 takes an explicit offset.
 pub use nfs_share::{NfsAddRequest, NfsShare, NfsShareError, NfsShareManager, NfsStream};
 pub use store::{
-    generate_boot_entries_for, slugify_str, IsoCategory, IsoMeta, IsoSource, IsoStore, UploadHandle,
+    generate_boot_entries_for, slugify_str, IsoCategory, IsoMeta, IsoSource, IsoStore,
-};
+    UploadHandle,
-pub use unattended::{
-    classify as classify_unattended, render_template, UnattendedKind, UnattendedMeta,
-    UnattendedStore, MAX_UNATTENDED_BYTES,
 };
 pub use windows::{WimPatcher, WinPatchState};

crates/iso-store/src/unattended.rs

@@ -1,412 +0,0 @@
-//! Unattended-install answer-file store (v0.5.2).
-//!
-//! Operators upload the answer file their installer expects — a RHEL/
-//! Fedora **Kickstart**, a Debian **Preseed**, an Ubuntu **Autoinstall**
-//! cloud-init user-data, or a Windows **answer file** (`autounattend.xml`)
-//! — and OpenPXE serves it on demand to the booting machine. Files live
-//! in their own directory (`<unattended_dir>/`), deliberately *not* under
-//! `iso_dir`, so they never appear in the ISO listing or the PXE menu.
-//!
-//! Storage mirrors [`crate::store::IsoStore`]: in-memory map authoritative
-//! for the process, sidecar `*.meta.json` on disk is the source of truth on
-//! restart. The raw answer file sits beside it as `<id>.file`.
-//!
-//! Templating is applied at *serve* time, not store time — see
-//! [`render_template`]. The stored bytes are exactly what the operator
-//! uploaded; per-host hostname/IP/MAC values are substituted into a copy
-//! when the file is fetched for a specific client.
-
-use crate::store::slugify_str;
-use openpxe_core::{Error, Result};
-use parking_lot::RwLock;
-use serde::{Deserialize, Serialize};
-use std::collections::HashMap;
-use std::path::PathBuf;
-use std::sync::Arc;
-use time::OffsetDateTime;
-
-/// Disk + memory cap for one answer file. Kickstarts/preseeds/cloud-init
-/// configs are a few KB; 1 MiB is a comfortable ceiling that still bounds
-/// abuse.
-pub const MAX_UNATTENDED_BYTES: usize = 1024 * 1024;
-
-/// Which installer the answer file targets. Drives the kernel-argument
-/// injection in the boot chain.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum UnattendedKind {
-    /// RHEL / Fedora / CentOS / AlmaLinux / Rocky — `inst.ks=<url>`.
-    Kickstart,
-    /// Debian / older Ubuntu — `auto=true priority=critical url=<url>`.
-    Preseed,
-    /// Ubuntu 20.04+ Subiquity autoinstall — cloud-init NoCloud:
-    /// `autoinstall ds=nocloud-net;s=<url>/`.
-    Autoinstall,
-    /// Windows Setup answer file (`autounattend.xml`). Served, not
-    /// auto-injected (Windows reads it from media/USB, not a kernel arg).
-    AnswerFile,
-    /// Couldn't classify — stored + served, no auto-injection.
-    #[default]
-    Unknown,
-}
-
-impl UnattendedKind {
-    #[must_use]
-    pub fn label(self) -> &'static str {
-        match self {
-            UnattendedKind::Kickstart => "Kickstart",
-            UnattendedKind::Preseed => "Preseed",
-            UnattendedKind::Autoinstall => "Autoinstall",
-            UnattendedKind::AnswerFile => "Answer file",
-            UnattendedKind::Unknown => "Unknown",
-        }
-    }
-}
-
-/// Lowercase file extension (no dot), or `None` if there isn't one.
-fn ext_lower(filename: &str) -> Option<String> {
-    std::path::Path::new(filename)
-        .extension()
-        .and_then(|e| e.to_str())
-        .map(str::to_ascii_lowercase)
-}
-
-/// Classify an upload from its filename + a peek at its content. Best
-/// effort: extension first, then a content sniff to disambiguate the
-/// `.cfg` case (both Kickstart and Preseed use it).
-#[must_use]
-pub fn classify(filename: &str, content: &[u8]) -> UnattendedKind {
-    let lower_name = filename.to_ascii_lowercase();
-    let ext = ext_lower(filename);
-    let text = String::from_utf8_lossy(&content[..content.len().min(8192)]);
-    let looks_preseed = text.contains("d-i ") || text.contains("preseed/");
-    let looks_kickstart = text.contains("%packages")
-        || text.contains("\nlang ")
-        || text.contains("\nkeyboard ")
-        || text.contains("bootloader --")
-        || text.starts_with("install");
-    let looks_cloud_init = text.contains("autoinstall")
-        || text.contains("#cloud-config")
-        || text.contains("version: 1");
-
-    match ext.as_deref() {
-        Some("ks") => return UnattendedKind::Kickstart,
-        Some("seed") => return UnattendedKind::Preseed,
-        Some("xml") => return UnattendedKind::AnswerFile,
-        Some("yaml" | "yml") => return UnattendedKind::Autoinstall,
-        Some("cfg") => {
-            return if looks_kickstart && !looks_preseed {
-                UnattendedKind::Kickstart
-            } else {
-                UnattendedKind::Preseed
-            };
-        }
-        _ => {}
-    }
-    if lower_name == "user-data" {
-        return UnattendedKind::Autoinstall;
-    }
-    // No recognised extension — fall back to content sniffing.
-    if looks_cloud_init {
-        UnattendedKind::Autoinstall
-    } else if looks_kickstart {
-        UnattendedKind::Kickstart
-    } else if looks_preseed {
-        UnattendedKind::Preseed
-    } else {
-        UnattendedKind::Unknown
-    }
-}
-
-/// True if the filename carries an extension we accept for upload. We
-/// also accept the bare `user-data` name (cloud-init NoCloud convention).
-#[must_use]
-pub fn is_accepted_filename(filename: &str) -> bool {
-    if filename.trim().eq_ignore_ascii_case("user-data") {
-        return true;
-    }
-    matches!(
-        ext_lower(filename).as_deref(),
-        Some("ks" | "cfg" | "seed" | "yaml" | "yml" | "xml")
-    )
-}
-
-/// Sidecar metadata for a stored answer file.
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct UnattendedMeta {
-    /// URL-safe slug, unique within the store.
-    pub id: String,
-    /// Original upload filename, shown in the UI.
-    pub filename: String,
-    pub kind: UnattendedKind,
-    pub size_bytes: u64,
-    #[serde(with = "time::serde::rfc3339")]
-    pub uploaded_at: OffsetDateTime,
-}
-
-#[derive(Debug, Default)]
-struct Inner {
-    files: HashMap<String, UnattendedMeta>,
-}
-
-/// In-memory + on-disk answer-file registry. Cheap to clone.
-#[derive(Debug, Clone)]
-pub struct UnattendedStore {
-    dir: Arc<PathBuf>,
-    inner: Arc<RwLock<Inner>>,
-}
-
-impl UnattendedStore {
-    #[must_use]
-    pub fn new(dir: PathBuf) -> Self {
-        Self {
-            dir: Arc::new(dir),
-            inner: Arc::new(RwLock::new(Inner::default())),
-        }
-    }
-
-    pub async fn ensure_dir(&self) -> Result<()> {
-        tokio::fs::create_dir_all(self.dir.as_path()).await?;
-        Ok(())
-    }
-
-    /// Scan the directory on startup, loading every `*.meta.json` sidecar.
-    pub async fn load_from_disk(&self) -> Result<()> {
-        self.ensure_dir().await?;
-        let mut entries = tokio::fs::read_dir(self.dir.as_path()).await?;
-        while let Some(e) = entries.next_entry().await? {
-            let p = e.path();
-            let is_meta = p
-                .file_name()
-                .and_then(|s| s.to_str())
-                .is_some_and(|n| n.ends_with(".meta.json"));
-            if !is_meta {
-                continue;
-            }
-            if let Ok(text) = tokio::fs::read_to_string(&p).await {
-                if let Ok(meta) = serde_json::from_str::<UnattendedMeta>(&text) {
-                    self.inner.write().files.insert(meta.id.clone(), meta);
-                }
-            }
-        }
-        Ok(())
-    }
-
-    fn data_path(&self, id: &str) -> PathBuf {
-        self.dir.join(format!("{id}.file"))
-    }
-
-    fn meta_path(&self, id: &str) -> PathBuf {
-        self.dir.join(format!("{id}.meta.json"))
-    }
-
-    /// Mint a unique slug from the upload filename's stem.
-    fn unique_id(&self, filename: &str) -> String {
-        let stem = filename.rsplit_once('.').map_or(filename, |(s, _)| s);
-        let base = {
-            let s = slugify_str(stem);
-            if s.is_empty() {
-                "unattended".to_string()
-            } else {
-                s
-            }
-        };
-        let g = self.inner.read();
-        if !g.files.contains_key(&base) {
-            return base;
-        }
-        for n in 1.. {
-            let candidate = format!("{base}-{n}");
-            if !g.files.contains_key(&candidate) {
-                return candidate;
-            }
-        }
-        unreachable!("u64 ids exhausted")
-    }
-
-    /// Store an uploaded answer file. Validates type + size, classifies,
-    /// writes the bytes + a sidecar, and returns the new metadata.
-    pub async fn add(&self, filename: &str, bytes: &[u8]) -> Result<UnattendedMeta> {
-        if !is_accepted_filename(filename) {
-            return Err(Error::Invalid(format!(
-                "unsupported answer-file type '{filename}'. Accepted: .ks, .cfg, .seed, .yaml, .yml, .xml, user-data"
-            )));
-        }
-        if bytes.len() > MAX_UNATTENDED_BYTES {
-            return Err(Error::Invalid(format!(
-                "answer file too large ({} bytes, max {MAX_UNATTENDED_BYTES})",
-                bytes.len()
-            )));
-        }
-        self.ensure_dir().await?;
-        let kind = classify(filename, bytes);
-        let id = self.unique_id(filename);
-        let meta = UnattendedMeta {
-            id: id.clone(),
-            filename: filename.to_string(),
-            kind,
-            size_bytes: bytes.len() as u64,
-            uploaded_at: OffsetDateTime::now_utc(),
-        };
-        // Atomic data write: tmp -> rename.
-        let data = self.data_path(&id);
-        let tmp = data.with_extension("file.tmp");
-        tokio::fs::write(&tmp, bytes).await?;
-        tokio::fs::rename(&tmp, &data).await?;
-        let meta_text = serde_json::to_string_pretty(&meta).map_err(|e| Error::Other(e.into()))?;
-        tokio::fs::write(self.meta_path(&id), meta_text).await?;
-        self.inner.write().files.insert(id.clone(), meta.clone());
-        tracing::info!(
-            target: "openpxe::unattended",
-            id = %id, file = %filename, kind = ?kind, size = bytes.len(),
-            "unattended answer file stored"
-        );
-        Ok(meta)
-    }
-
-    #[must_use]
-    pub fn list(&self) -> Vec<UnattendedMeta> {
-        let g = self.inner.read();
-        let mut v: Vec<_> = g.files.values().cloned().collect();
-        v.sort_by_key(|m| std::cmp::Reverse(m.uploaded_at));
-        v
-    }
-
-    #[must_use]
-    pub fn get(&self, id: &str) -> Option<UnattendedMeta> {
-        self.inner.read().files.get(id).cloned()
-    }
-
-    /// Read the raw stored bytes for `id`.
-    pub async fn read(&self, id: &str) -> Result<Vec<u8>> {
-        if !self.inner.read().files.contains_key(id) {
-            return Err(Error::NotFound(format!("no unattended file '{id}'")));
-        }
-        let bytes = tokio::fs::read(self.data_path(id)).await?;
-        Ok(bytes)
-    }
-
-    /// Remove a file + its sidecar. Returns true if something was removed.
-    pub async fn remove(&self, id: &str) -> bool {
-        let existed = self.inner.write().files.remove(id).is_some();
-        if existed {
-            let _ = tokio::fs::remove_file(self.data_path(id)).await;
-            let _ = tokio::fs::remove_file(self.meta_path(id)).await;
-        }
-        existed
-    }
-
-    #[must_use]
-    pub fn len(&self) -> usize {
-        self.inner.read().files.len()
-    }
-
-    #[must_use]
-    pub fn is_empty(&self) -> bool {
-        self.len() == 0
-    }
-}
-
-/// Substitute the per-host template tokens into an answer file at serve
-/// time. Recognised tokens (case-sensitive, double-brace): `{{HOSTNAME}}`,
-/// `{{IP}}`, `{{MAC}}`. Unset values render as an empty string so a
-/// half-filled profile never leaves a literal `{{IP}}` in the file.
-#[must_use]
-pub fn render_template(
-    content: &str,
-    mac: Option<&str>,
-    hostname: Option<&str>,
-    ip: Option<&str>,
-) -> String {
-    content
-        .replace("{{HOSTNAME}}", hostname.unwrap_or(""))
-        .replace("{{IP}}", ip.unwrap_or(""))
-        .replace("{{MAC}}", mac.unwrap_or(""))
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use tempfile::tempdir;
-
-    #[test]
-    fn classify_by_extension() {
-        assert_eq!(
-            classify(" subiquity.yaml", b""),
-            UnattendedKind::Autoinstall
-        );
-        assert_eq!(classify("ks.ks", b""), UnattendedKind::Kickstart);
-        assert_eq!(classify("preseed.seed", b""), UnattendedKind::Preseed);
-        assert_eq!(
-            classify("autounattend.xml", b"<xml/>"),
-            UnattendedKind::AnswerFile
-        );
-        assert_eq!(classify("user-data", b""), UnattendedKind::Autoinstall);
-    }
-
-    #[test]
-    fn classify_cfg_by_content() {
-        assert_eq!(
-            classify("answer.cfg", b"d-i debian-installer/locale string en_US"),
-            UnattendedKind::Preseed
-        );
-        assert_eq!(
-            classify("answer.cfg", b"install\n%packages\n@core\n%end\n"),
-            UnattendedKind::Kickstart
-        );
-    }
-
-    #[test]
-    fn accepted_filenames() {
-        assert!(is_accepted_filename("a.ks"));
-        assert!(is_accepted_filename("USER-DATA".to_lowercase().as_str()));
-        assert!(is_accepted_filename("autounattend.XML"));
-        assert!(!is_accepted_filename("evil.sh"));
-        assert!(!is_accepted_filename("image.iso"));
-    }
-
-    #[test]
-    fn template_substitutes_and_blanks_unset() {
-        let body = "ip={{IP}} host={{HOSTNAME}} mac={{MAC}}";
-        let out = render_template(body, Some("aa:bb"), Some("node1"), None);
-        assert_eq!(out, "ip= host=node1 mac=aa:bb");
-    }
-
-    #[tokio::test]
-    async fn add_list_read_remove_round_trip() {
-        let dir = tempdir().unwrap();
-        let s = UnattendedStore::new(dir.path().join("unattended"));
-        let meta = s
-            .add("rocky.ks", b"install\n%packages\n@core\n%end\n")
-            .await
-            .unwrap();
-        assert_eq!(meta.kind, UnattendedKind::Kickstart);
-        assert_eq!(s.len(), 1);
-        let got = s.read(&meta.id).await.unwrap();
-        assert!(got.starts_with(b"install"));
-        // Survives a reload.
-        let s2 = UnattendedStore::new(dir.path().join("unattended"));
-        s2.load_from_disk().await.unwrap();
-        assert!(s2.get(&meta.id).is_some());
-        assert!(s2.remove(&meta.id).await);
-        assert!(s2.get(&meta.id).is_none());
-    }
-
-    #[tokio::test]
-    async fn rejects_bad_type_and_oversize() {
-        let dir = tempdir().unwrap();
-        let s = UnattendedStore::new(dir.path().join("unattended"));
-        assert!(s.add("evil.sh", b"#!/bin/sh").await.is_err());
-        let big = vec![b'x'; MAX_UNATTENDED_BYTES + 1];
-        assert!(s.add("big.ks", &big).await.is_err());
-    }
-
-    #[tokio::test]
-    async fn ids_are_unique() {
-        let dir = tempdir().unwrap();
-        let s = UnattendedStore::new(dir.path().join("unattended"));
-        let a = s.add("ks.ks", b"install").await.unwrap();
-        let b = s.add("ks.ks", b"install").await.unwrap();
-        assert_ne!(a.id, b.id);
-    }
-}

crates/openpxe/src/main.rs

@@ -59,10 +59,11 @@ async fn main() -> anyhow::Result<()> {
     init_tracing(log_bus.clone());
 
     let cli = Cli::parse();
-    // v0.5.4: layered load via figment — defaults → optional TOML → env.
+    let mut config = match &cli.config {
-    // The OPENPXE_* env layer keeps the historical flat names (see
+        Some(p) if p.exists() => Config::from_toml_file(p)?,
-    // `Config::load`), so existing deployments are unaffected.
+        _ => Config::default(),
-    let config = Config::load(cli.config.as_deref())?;
+    };
+    config.apply_env();
 
     // Dispatch subcommands before bringing up the server.
     if let Some(cmd) = cli.command {
@@ -98,16 +99,6 @@ async fn main() -> anyhow::Result<()> {
 
     let iso_store = IsoStore::new(config.paths.iso_dir.clone());
     iso_store.load_from_disk().await?;
-    // v0.5.2: unattended answer-file store (Kickstart/Preseed/Autoinstall/
-    // Windows answer files). Separate directory from the ISO store.
-    let unattended =
-        openpxe_iso_store::UnattendedStore::new(config.paths.unattended_dir.clone());
-    if let Err(e) = unattended.load_from_disk().await {
-        tracing::warn!(
-            target: "openpxe::unattended",
-            "could not load unattended files on startup: {e}"
-        );
-    }
     let clients = ClientRegistry::new();
     let queue = DeploymentQueue::new();
     let settings = SettingsStore::load_or_default(&config.paths.work_dir);
@@ -177,13 +168,11 @@ async fn main() -> anyhow::Result<()> {
         admin: admin.clone(),
         sessions: sessions.clone(),
         sso: sso.clone(),
-        saml: openpxe_http_api::saml_routes::SamlRuntime::default(),
         notify: notify.clone(),
         metrics: metrics.clone(),
         smb: Some(smb.clone()),
         smb_shares: smb_shares.clone(),
         nfs_shares: nfs_shares.clone(),
-        unattended: unattended.clone(),
         uploads: openpxe_http_api::uploads::UploadSessions::default(),
         log_bus: log_bus.clone(),
         started_at: time::OffsetDateTime::now_utc(),

crates/webui/src/app.css

@@ -304,14 +304,6 @@ button.ghost { background: transparent; color: var(--fg); border: 1px solid var(
 button.ghost:hover { background: var(--bg-panel-2); color: var(--fg); }
 button.danger { background: transparent; color: var(--err); border: 1px solid color-mix(in srgb, var(--err) 35%, transparent); }
 button.danger:hover { background: color-mix(in srgb, var(--err) 14%, transparent); color: var(--err); }
-/* v0.5.3: unified spacing for a card's primary action button(s). Any
-   button that sits as a direct child of a card body (Save, Bind, Add,
-   Launch, …) gets the same gap above it so it never butts against the
-   form. Inline buttons inside table rows / toolbars / logo slots /
-   modal action bars are nested deeper, so the `>` keeps them untouched.
-   Adjacent action buttons on one row (e.g. Save + Send test) share the
-   margin and stay aligned. */
-.card .body > button { margin-top: 16px; }
 
 label.field {
   display: grid; gap: 4px; margin-bottom: 14px;
@@ -805,110 +797,3 @@ tr.unbootable td:first-child { border-left: 3px solid var(--warn); }
 .logo-preview .info { flex: 1; min-width: 0; }
 .logo-preview .info .name { color: var(--fg); font-weight: 600; }
 .logo-preview .info .meta { color: var(--fg-dim); font-size: 12px; margin-top: 2px; }
-
-/* v0.5.1: collapsible "Advanced" disclosure at the bottom of Settings
-   (the former Advanced sidebar tab). A quiet, full-width toggle that
-   expands to reveal the notification + API-reference cards. */
-.advanced-disclosure { width: 100%; }
-.advanced-summary {
-  list-style: none;
-  cursor: pointer;
-  user-select: none;
-  display: flex;
-  align-items: center;
-  gap: 8px;
-  padding: 10px 14px;
-  color: var(--fg-dim);
-  font-size: 13px;
-  font-weight: 600;
-  background: var(--bg-panel-2);
-  border: 1px solid var(--border);
-  border-radius: var(--radius);
-}
-.advanced-summary:hover { color: var(--fg); }
-.advanced-summary::-webkit-details-marker { display: none; }
-.advanced-summary::before {
-  content: "▸";
-  font-size: 11px;
-  transition: transform 0.15s ease;
-}
-.advanced-disclosure[open] .advanced-summary::before { transform: rotate(90deg); }
-
-/* v0.5.1: protocol tag on a unified Remote-shares row (SMB / NFS). */
-.proto-badge {
-  display: inline-block;
-  font-size: 10px;
-  font-weight: 700;
-  letter-spacing: 0.04em;
-  padding: 1px 6px;
-  margin-right: 8px;
-  border-radius: 4px;
-  vertical-align: middle;
-  background: var(--bg-panel-2);
-  border: 1px solid var(--border);
-  color: var(--fg-dim);
-}
-
-/* ── v0.5.2: three-slot branding (light / dark / client) ─────────── */
-.logo-slots {
-  display: grid;
-  grid-template-columns: repeat(3, 1fr);
-  gap: 12px;
-}
-@media (max-width: 720px) { .logo-slots { grid-template-columns: 1fr; } }
-.logo-slot {
-  display: flex; flex-direction: column; gap: 8px;
-  padding: 12px;
-  background: var(--bg-panel-2);
-  border: 1px solid var(--border);
-  border-radius: var(--radius);
-}
-.logo-slot-head { display: flex; align-items: center; justify-content: space-between; gap: 8px; }
-.logo-slot-head .name { color: var(--fg); font-weight: 600; font-size: 13px; }
-.logo-slot .swatch {
-  height: 64px;
-  display: flex; align-items: center; justify-content: center;
-  background: var(--bg); border: 1px solid var(--border);
-  border-radius: var(--radius);
-}
-.logo-slot .swatch img { max-width: 90%; max-height: 52px; object-fit: contain; }
-.logo-slot-hint { color: var(--fg-dim); font-size: 11.5px; }
-
-/* ── v0.5.2: login local/SSO separation ─────────────────────────── */
-.auth-card .auth-divider {
-  display: flex; align-items: center; text-align: center;
-  color: var(--fg-dimmer); font-size: 11px; text-transform: uppercase;
-  letter-spacing: 0.08em;
-  margin: 16px 0 12px;
-}
-.auth-card .auth-divider::before,
-.auth-card .auth-divider::after {
-  content: ""; flex: 1; height: 1px; background: var(--border-soft);
-}
-.auth-card .auth-divider span { padding: 0 10px; }
-.auth-card .sso-block .sso-btn { margin-top: 0; }
-.auth-card .sso-btn {
-  display: flex; align-items: center; justify-content: center; gap: 8px;
-}
-.auth-card .sso-btn .sso-logo { width: 16px; height: 16px; object-fit: contain; flex: none; }
-
-/* ── v0.5.2: modal (queue Profile editor) ───────────────────────── */
-.modal-overlay {
-  position: fixed; inset: 0; z-index: 200;
-  display: flex; align-items: center; justify-content: center;
-  background: rgba(0, 0, 0, 0.55);
-  padding: 24px;
-}
-.modal-box {
-  width: 100%; max-width: 520px;
-  background: var(--bg-panel);
-  border: 1px solid var(--border);
-  border-radius: var(--radius-lg);
-  box-shadow: var(--shadow-card);
-  padding: 22px;
-}
-.modal-box h2 { margin: 0 0 14px; font-size: 16px; font-weight: 600; color: var(--fg); }
-.modal-actions {
-  display: flex; justify-content: flex-end; gap: 10px; margin-top: 18px;
-}
-.modal-actions .submit { width: auto; padding: 8px 18px; }

crates/webui/src/index.html

@@ -13,10 +13,7 @@
        on the asset handlers, the practical caching window is one
        version. -->
   <link rel="stylesheet" href="/assets/app.css?v={{ASSET_VERSION}}" />
-  <!-- v0.5.2: favicon is pinned to the bundled OpenPXE mark (its own
+  <link rel="icon" type="image/svg+xml" href="/assets/logo.svg?v={{ASSET_VERSION}}&r={{LOGO_REV}}" />
-       endpoint, decoupled from operator branding) for tab-icon
-       continuity regardless of any uploaded light/dark/client logo. -->
-  <link rel="icon" type="image/svg+xml" href="/assets/favicon.svg?v={{ASSET_VERSION}}" />
   <!-- Theme is read from localStorage *before* paint to avoid the
        dark→light flash on every navigation. Falls back to the OS
        preference and finally to dark. -->
@@ -56,6 +53,7 @@
       </a>
       <a data-view="terminal">Terminal</a>
       <a data-view="settings">Settings</a>
+      <a data-view="advanced">Advanced</a>
       <a data-view="about">About</a>
     </nav>
     <div class="footer">

deploy/docker/Dockerfile

@@ -60,41 +60,35 @@ COPY deploy/ipxe/local/ deploy/ipxe/local/
 RUN mkdir -p assets/ipxe && bash scripts/build-ipxe.sh /src/assets/ipxe
 
 ########## build openpxe ##########
-# v0.5.2: cross-compile the Rust binary NATIVELY — no QEMU.
+FROM rust:${RUST_VERSION}-bookworm AS build
-#
-# This stage is pinned to $BUILDPLATFORM (the builder's native arch — arm64
-# on an Apple-Silicon Mac, amd64 in x86 CI), exactly like `ipxe-build`. The
-# Rust compiler therefore runs at full native speed and emits an
-# x86_64-unknown-linux-musl binary via `cargo-zigbuild`, which uses `zig cc`
-# as the cross-linker (it bundles the musl sysroot for every target, so
-# there's no fiddly cross-gcc toolchain to assemble).
-#
-# Why this replaced the old `FROM rust ... --platform=linux/amd64` build:
-# that ran the *entire* compiler under QEMU x86_64 emulation on the arm64
-# host. It was ~15x slower (a single crate took >20 min) and the emulated
-# gcc/linker intermittently SIGSEGV'd or hung mid-link. Cross-compiling
-# sidesteps emulation entirely — the build is minutes, not half an hour,
-# and is deterministic.
-#
-# The output is still a fully static musl binary with no glibc dependency,
-# so the runtime stage stays free to be any Linux distro.
-FROM --platform=$BUILDPLATFORM rust:${RUST_VERSION}-bookworm AS build
 WORKDIR /src
-# zig (via the `ziglang` pip package — cargo-zigbuild auto-discovers it as
-# `python3 -m ziglang`) supplies the x86_64 musl sysroot + linker.
-# cargo-zigbuild is the thin cargo wrapper that wires zig in as the linker.
-RUN apt-get update \
- && apt-get install -y --no-install-recommends python3 python3-pip \
- && rm -rf /var/lib/apt/lists/* \
- && rustup target add x86_64-unknown-linux-musl \
- && pip3 install --no-cache-dir --break-system-packages ziglang \
- && cargo install --locked cargo-zigbuild
 
+# v0.4.5: build a fully static musl binary (matches Bootimus v0.1.70's
+# move). The resulting `/openpxe` has no glibc dependency at all, which:
+#   - Lets the runtime stage be any Linux distro (we still ship Debian
+#     slim for the `samba` / `wimtools` / `nfs-common` shellouts, but a
+#     scratch/distroless variant becomes a one-line swap).
+#   - Cuts a class of "GLIBC_2.39 not found" surprises when running on
+#     older RHEL/Rocky hosts that don't match Debian 12's libc version.
+#   - Sidesteps cross-compilation snags (the binary is its own world).
+#
+# x86_64-unknown-linux-musl is fully static by default (no extra
+# RUSTFLAGS needed). musl-tools provides the linker.
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends musl-tools \
+ && rm -rf /var/lib/apt/lists/* \
+ && rustup target add x86_64-unknown-linux-musl
+
+# Copy the whole workspace in one go. We used to do a two-pass "cache-prime
+# with stubs, then real build" dance for dep-compile reuse; that turned out
+# to silently serve stale stub binaries when cargo's fingerprint didn't
+# notice the source swap. A single build is ~1.5 min longer on cold cache
+# but guarantees the binary reflects the sources we copied.
 # Do not copy rust-toolchain.toml into the image. The local workspace pins
 # developer tooling, but inside Docker we intentionally use the Rust version
 # selected by the base image. Copying rust-toolchain.toml with
 # `channel = "stable"` makes rustup download a second full toolchain during
-# the build, which is slow and can exhaust small Colima/CI disks.
+# `cargo build`, which is slow and can exhaust small Colima/CI disks.
 COPY Cargo.toml Cargo.lock ./
 COPY crates/ crates/
 # Baseline binaries (BIOS / i386 / wimboot), then overlay the
@@ -106,11 +100,13 @@ COPY --from=fetch /src/assets/ipxe /src/assets/ipxe
 COPY --from=ipxe-build /src/assets/ipxe/snponly.efi /src/assets/ipxe/snponly.efi
 COPY --from=ipxe-build /src/assets/ipxe/ipxe.efi /src/assets/ipxe/ipxe.efi
 
-# Cache cargo registry + target across builds. `cargo zigbuild` runs the
+# Cache cargo registry + target across builds. The mtime touch is
-# native rustc (fast) and links for x86_64-musl with zig — no emulation.
+# belt-and-suspenders: cargo occasionally misses mtime-only changes on
+# networked FS; this forces a fingerprint check.
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
     --mount=type=cache,target=/src/target,sharing=locked \
-    cargo zigbuild --release --target x86_64-unknown-linux-musl --bin openpxe && \
+    find crates -name '*.rs' -exec touch {} + && \
+    cargo build --release --target x86_64-unknown-linux-musl --bin openpxe && \
     cp target/x86_64-unknown-linux-musl/release/openpxe /openpxe && \
     ls -l /openpxe
 

docs/superpowers/specs/2026-05-31-saml-sso-and-ui-design.md

@@ -1,199 +0,0 @@
-# OpenPXE v0.5.1 — SAML SSO wiring + Settings/Storage UI consolidation
-
-**Date:** 2026-05-31
-**Author:** Miles Ward (with Claude)
-**Status:** Approved design → implementation
-
-## Summary
-
-Three workstreams for v0.5.1:
-
-1. **Wire SAML 2.0 SSO** end-to-end (currently config is persisted but no runtime
-   sign-in exists). Pure-Rust implementation that preserves the static-musl /
-   no-OpenSSL architecture, mirroring how FleetDM exposes and handles SAML.
-2. **Fold the Advanced sidebar tab into Settings** as a collapsible section.
-3. **Merge the Storage tab's SMB and NFS cards** into one "Remote shares" card
-   with a protocol dropdown.
-
-Then bump `0.5.0 → 0.5.1`, build the static musl image, push `:0.5.1` + `:latest`
-to Gitea, create the release, and scrub registry credentials.
-
-## Decisions (locked with the user)
-
-- **Crypto:** pure-Rust via `bergshamra` (XML-DSig + exclusive c14n, RustCrypto-based,
-  `#![forbid(unsafe_code)]`, ~99% xmlsec interop). `samael` is rejected — it
-  hard-requires OpenSSL/`xmlsec`/`libxml2` C deps, which would break the static
-  musl binary and the project's pure-Rust / no-OpenSSL architecture.
-- **Access model:** any SAML assertion the IdP successfully authenticates and that
-  we cryptographically verify mints a full operator session. No user table, no
-  roles, no domain allowlist. The local admin account remains a guaranteed
-  fallback owner regardless of SSO state.
-- **Flows:** SP-initiated (the "Sign in with <IdP>" button) is always on.
-  IdP-initiated is supported but gated behind an `allow_idp_initiated` toggle
-  (default off), mirroring FleetDM's "Allow SSO login initiated by identity
-  provider."
-
-## Scope boundaries (v0.5.1)
-
-In scope: SP-initiated + (gated) IdP-initiated login, signature verification on the
-SAML Response/Assertion, full SP-side semantic validation, SP metadata endpoint,
-login-page button wiring.
-
-Out of scope (note for later releases): EncryptedAssertion (assertions must be
-unencrypted), signed AuthnRequests (sent unsigned; Keycloak "client signature
-required" must be off), Single Logout (SLO), multi-user accounts / RBAC / JIT role
-mapping.
-
----
-
-## Workstream 1 — SAML SP wiring (pure-Rust)
-
-### New dependencies (workspace)
-
-- `bergshamra` — XML-DSig verification + exclusive c14n (pure Rust).
-- `roxmltree` (read/navigate) and/or `quick-xml` (build/serialize) — parse IdP
-  metadata + SAMLResponse, build AuthnRequest and SP metadata.
-- `x509-parser` — extract the IdP signing certificate / public key from metadata.
-- `flate2` — raw DEFLATE for the HTTP-Redirect binding.
-- `base64` — encode/decode SAMLRequest/SAMLResponse.
-
-All pure-Rust → the `x86_64-unknown-linux-musl` static build stays OpenSSL-free.
-Exact `bergshamra` function signatures (`verify`, `DsigContext`, `KeysManager`,
-`Key`, `VerifiedReference`, `VerifyResult`) will be pinned against the installed
-crate source during implementation.
-
-### Module boundaries
-
-Pure protocol logic lives in `openpxe-core` (no axum dependency, unit-testable);
-HTTP wiring lives in `openpxe-http-api`.
-
-- `crates/core/src/saml/mod.rs` — public surface + shared types
-  (`VerifiedPrincipal { email, display_name, name_id, session_index }`, `SamlError`).
-- `crates/core/src/saml/metadata.rs` — parse IdP `EntityDescriptor`: IdP EntityID,
-  `SingleSignOnService` locations + bindings, and one or more X.509 signing
-  certificates. Also build **our** SP metadata XML.
-- `crates/core/src/saml/authn_request.rs` — build an AuthnRequest, return both the
-  request ID (to track) and the encoded HTTP-Redirect query value
-  (deflate → base64 → URL-encode).
-- `crates/core/src/saml/response.rs` — decode `SAMLResponse` (base64 → XML),
-  **verify the signature via bergshamra** against the IdP cert, then enforce SP
-  semantics, returning `VerifiedPrincipal` or a typed `SamlError`.
-
-### SP-side validation (response.rs)
-
-After a cryptographically valid signature over the Response and/or the Assertion:
-
-1. `Status` is `Success`.
-2. `Destination` (if present) equals our ACS URL.
-3. `Conditions/AudienceRestriction/Audience` equals our SP EntityID.
-4. `NotBefore` / `NotOnOrAfter` within bounds (allow small clock skew, e.g. ±60s).
-5. `InResponseTo` matches an outstanding request we issued (SP-initiated). Absent
-   for IdP-initiated, which is only accepted when `allow_idp_initiated` is true.
-6. Assertion-ID replay guard: reject a previously consumed assertion ID.
-7. NameID is the email (`nameid-format:emailAddress`). Display name read from
-   common attributes (`name`, `displayname`, `cn`, `urn:oid:2.5.4.3`).
-
-XML Signature Wrapping (XSW) defenses come from bergshamra (duplicate-ID rejection,
-strict positional verification); enable its strict verification options. We
-additionally confirm the verified `Reference` covers the element we read claims from.
-
-### State (in `openpxe-http-api`)
-
-Two small TTL-pruned in-memory stores (parking_lot `Mutex<HashMap<...>>`):
-
-- **Outstanding requests:** `request_id → issued_at`, TTL ≈ 5 min, for `InResponseTo`.
-- **Consumed assertions:** `assertion_id → expires_at`, TTL = assertion validity,
-  for replay protection.
-
-(In-memory is acceptable: a single-container app; a restart simply invalidates
-in-flight logins.)
-
-### Routes (all pre-auth; added to the public allowlist in the auth middleware)
-
-- `GET /api/sso/login` → build AuthnRequest, record its ID, 302 to the IdP SSO URL
-  (HTTP-Redirect binding) with `SAMLRequest` + `RelayState`.
-- `POST /api/sso/acs` → consume `SAMLResponse` (form-encoded). Verify + validate.
-  On success: `SessionStore::create(email)`, set the `openpxe_session` cookie
-  (same attributes as forms login), 302 to the dashboard. On failure: 302 back to
-  the login page with an error indicator. (Mirrors FleetDM's `/sso/callback`.)
-- `GET /api/sso/metadata` → serve our SP `EntityDescriptor` XML for IdP import.
-
-### Config changes (`crates/core/src/sso.rs`)
-
-Add to `SsoConfig` (preserve existing fields + validation):
-
-- `entity_id: String` — SP Entity ID (mirrors FleetDM's "Entity ID"); defaults to
-  the configured public base URL. The ACS URL is derived as
-  `<public_base_url>/api/sso/acs`.
-- `allow_idp_initiated: bool` — default `false`.
-
-`GET /api/sso` returns the new fields; `PUT /api/sso` validates and persists them.
-
-### Login page (`crates/webui/src/app.js`)
-
-Replace the "configured · runtime pending" message: the existing
-"Sign in with <IdP>" button navigates to `GET /api/sso/login`. Render the IdP logo
-(if `idp_logo_url` set) and use `idp_name` as the label. Keep the existing
-FleetDM-style login layout.
-
-### Testing
-
-- `core/saml` unit tests using a self-signed test keypair we control:
-  - Parse representative Keycloak IdP metadata → correct SSO URL + cert.
-  - Build an AuthnRequest → well-formed, deflate/base64 round-trips, ID recorded.
-  - A correctly signed Response → `VerifiedPrincipal { email, .. }`.
-  - Reject: tampered signature, expired (`NotOnOrAfter`), wrong audience,
-    replayed assertion ID, unsigned response, `Status != Success`.
-- `http-api` integration test: `GET /api/sso/login` returns a 302 with a
-  `SAMLRequest` query param; a crafted signed `SAMLResponse` POSTed to
-  `/api/sso/acs` (signed with the test key) sets an `openpxe_session` cookie.
-
----
-
-## Workstream 2 — Advanced tab → Settings
-
-- Remove the `Advanced` sidebar entry (`crates/webui/src/index.html`) and its
-  `advanced` view route in `app.js`.
-- In the Settings view, append a **collapsible "Advanced" disclosure**
-  (default-collapsed) at the bottom containing the existing **Webhook
-  Notifications** card and the **API reference** block (moved out of the removed
-  Advanced view).
-- No backend changes; `/api/notify*` and `/api/docs` endpoints are unchanged.
-
----
-
-## Workstream 3 — Storage: merge SMB + NFS → "Remote shares"
-
-- Replace the separate "SMB shares" and "NFS shares" cards with a single
-  **"Remote shares"** card:
-  - One add-form with a **protocol dropdown (SMB / NFS)**. Selecting the protocol
-    swaps the fields: SMB → server, share, guest checkbox, username, password;
-    NFS → server, export path.
-  - One unified table with a leading **Protocol** column (SMB/NFS badge), then
-    server/share-or-export, auth, ISO count, reachability, and Re-scan / Remove
-    actions.
-- **No backend changes.** The form dispatches to the existing
-  `POST /api/smb-shares` or `POST /api/nfs-shares`; the table merges
-  `GET /api/smb-shares` + `GET /api/nfs-shares`, tagging each row with its
-  protocol. Re-scan/Remove call the existing per-protocol endpoints.
-- Leaves the card pattern open for a future "Config files" card.
-
----
-
-## Release
-
-1. Bump workspace version `0.5.0 → 0.5.1` (`Cargo.toml`).
-2. `cargo fmt`, `cargo clippy`, `cargo test` (all crates) green.
-3. Build the static musl binary + Docker image; verify SAML deps compile clean
-   under musl (no OpenSSL/C linkage).
-4. Push `openpxe:0.5.1` + `openpxe:latest` to Gitea via the established
-   temp-DOCKER_CONFIG pipeline; scrub credentials (logout + verify no token traces).
-5. Create the Gitea release `v0.5.1` with notes.
-
-## Risks
-
-- `bergshamra` is pre-1.0 and unaudited. Mitigation: pin the version, enable strict
-  verification, keep the local-admin fallback, and own the SP-semantic checks
-  carefully (audience/Conditions/replay/InResponseTo — where SP vulns usually live).
-- SAML is security-sensitive; negative tests (tamper/expiry/audience/replay/unsigned)
-  are part of the definition of done, not optional.