Sensors: read-only tokens, live stream, Prometheus, status sensors, widgets, embeds

- sensors:read tokens open the sensor endpoints (here and on managed machines through the hub) and nothing else; full tokens are never accepted from a URL - /api/sensors/stream: a shaped query that keeps answering, over SSE - /metrics: Prometheus text format - services, updates, ZFS and SMART as background status sensors - widget library over the sensor API; custom widgets on the dashboard - /embed/widget: one live widget in its own bundle, the only frameable path - Dashboard tab is now Monitors Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-19 07:37:10 -07:00
parent 468f45251d
commit b05a053920
20 changed files with 950 additions and 56 deletions
@@ -84,6 +84,7 @@ func New(cfg *config.Config, sessions *auth.Sessions, mgr *term.Manager, col *me
 	if s.user == "" {
 		s.user = "?"
 	}
+	s.sensors.Add(newStatusSensors(s))
 	// The saved dashboard layout carries the sampling interval; apply it on boot.
 	var raw json.RawMessage
 	st.View(func(x *store.State) { raw = x.Dashboard })
@@ -111,11 +112,18 @@ func New(cfg *config.Config, sessions *auth.Sessions, mgr *term.Manager, col *me
 	m.HandleFunc("GET /api/terminals/{id}/attach", s.auth(s.attach))
 	m.HandleFunc("GET /api/metrics", s.auth(s.metricsLatest))
 	m.HandleFunc("GET /api/metrics/history", s.auth(s.metricsHistory))
-	m.HandleFunc("GET /api/sensors", s.auth(s.sensorCatalog))
-	m.HandleFunc("GET /api/sensors/query", s.auth(s.sensorQuery))
-	m.HandleFunc("POST /api/sensors/query", s.auth(s.sensorQuery))
-	m.HandleFunc("GET /api/sensors/{id}", s.auth(s.sensorOne))
-	m.HandleFunc("GET /api/sensors/{id}/history", s.auth(s.sensorHistory))
+	m.HandleFunc("GET /api/sensors", s.sensorAuth(s.sensorCatalog))
+	m.HandleFunc("GET /api/sensors/query", s.sensorAuth(s.sensorQuery))
+	m.HandleFunc("POST /api/sensors/query", s.sensorAuth(s.sensorQuery))
+	m.HandleFunc("GET /api/sensors/stream", s.sensorAuth(s.sensorStream))
+	m.HandleFunc("GET /api/sensors/prometheus", s.sensorAuth(s.sensorProm))
+	m.HandleFunc("GET /metrics", s.sensorAuth(s.sensorProm))
+	m.HandleFunc("GET /api/sensors/{id}", s.sensorAuth(s.sensorOne))
+	m.HandleFunc("GET /api/sensors/{id}/history", s.sensorAuth(s.sensorHistory))
+	m.HandleFunc("GET /api/nodes/{name}/sensors", s.sensorAuth(s.proxyNodeSensors))
+	m.HandleFunc("GET /api/nodes/{name}/sensors/{rest...}", s.sensorAuth(s.proxyNodeSensors))
+	m.HandleFunc("POST /api/nodes/{name}/sensors/query", s.sensorAuth(s.proxyNodeSensors))
+	m.HandleFunc("POST /api/tokens/read", s.auth(s.issueReadToken))
 	m.HandleFunc("GET /api/services", s.auth(s.listServices))
 	m.HandleFunc("GET /api/services/{unit}", s.auth(s.showService))
 	m.HandleFunc("GET /api/services/{unit}/file", s.auth(s.serviceFile))
@@ -179,8 +187,12 @@ func New(cfg *config.Config, sessions *auth.Sessions, mgr *term.Manager, col *me
 func (s *Server) Handler() http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		h := w.Header()
-		h.Set("X-Frame-Options", "DENY")
-		h.Set("Content-Security-Policy", "frame-ancestors 'none'")
+		// The console must never be framed. An embedded widget exists to be: it is a page
+		// that can only read sensors, and only with a read-only token in its URL.
+		if !strings.HasPrefix(r.URL.Path, "/embed/") {
+			h.Set("X-Frame-Options", "DENY")
+			h.Set("Content-Security-Policy", "frame-ancestors 'none'")
+		}
 		h.Set("X-Content-Type-Options", "nosniff")
 		h.Set("Referrer-Policy", "no-referrer")
 		s.mux.ServeHTTP(w, r)
@@ -221,7 +233,9 @@ func (s *Server) auth(next http.HandlerFunc) http.HandlerFunc {
 			var hashes []string
 			s.cfg.View(func(c *config.Config) {
 				for _, t := range c.Tokens {
-					hashes = append(hashes, t.Hash)
+					if t.Scope == "" { // a scoped token is not a key to the machine
+						hashes = append(hashes, t.Hash)
+					}
 				}
 			})
 			if auth.TokenMatches(strings.TrimPrefix(h, "Bearer "), hashes) {
@@ -233,6 +247,84 @@ func (s *Server) auth(next http.HandlerFunc) http.HandlerFunc {
 	}
 }

+// sensorAuth guards the read-only sensor endpoints: a session, any token in the
+// Authorization header, or a sensors:read token as ?token= — an iframe or a browser
+// EventSource can't send headers, and a token that can only read fan speeds is one we
+// can afford to see in a URL. Full-control tokens are never accepted from the URL.
+func (s *Server) sensorAuth(next http.HandlerFunc) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if c, err := r.Cookie(cookieName); err == nil && s.sessions.Valid(c.Value) {
+			next(w, r)
+			return
+		}
+		presented, fromURL := strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer "), false
+		if presented == "" {
+			presented, fromURL = r.URL.Query().Get("token"), true
+		}
+		if presented != "" {
+			var hashes []string
+			s.cfg.View(func(c *config.Config) {
+				for _, t := range c.Tokens {
+					if t.Scope == config.ScopeSensorsRead || (t.Scope == "" && !fromURL) {
+						hashes = append(hashes, t.Hash)
+					}
+				}
+			})
+			if auth.TokenMatches(presented, hashes) {
+				next(w, r)
+				return
+			}
+		}
+		jsonErr(w, 401, "unauthenticated")
+	}
+}
+
+// proxyNodeSensors lets a sensors:read token reach a managed machine's sensors through
+// this hub. The hub authenticates to the node as itself; the caller's token stops here.
+func (s *Server) proxyNodeSensors(w http.ResponseWriter, r *http.Request) {
+	if q := r.URL.Query(); q.Has("token") {
+		q.Del("token")
+		r.URL.RawQuery = q.Encode()
+	}
+	s.proxyNode(w, r)
+}
+
+// issueReadToken makes a sensors:read token for a dashboard. Shown once, stored hashed.
+func (s *Server) issueReadToken(w http.ResponseWriter, r *http.Request) {
+	var body struct {
+		Name string `json:"name"`
+	}
+	if err := json.NewDecoder(io.LimitReader(r.Body, 4096)).Decode(&body); err != nil || strings.TrimSpace(body.Name) == "" {
+		jsonErr(w, 400, "name required")
+		return
+	}
+	name := strings.TrimSpace(body.Name)
+	tok, hash, err := auth.NewToken()
+	if err != nil {
+		jsonErr(w, 500, "token error")
+		return
+	}
+	clash := false
+	if err := s.cfg.Update(func(c *config.Config) {
+		for _, t := range c.Tokens {
+			if t.Name == name {
+				clash = true
+				return
+			}
+		}
+		c.Tokens = append(c.Tokens, config.Token{Name: name, Hash: hash, Created: time.Now(), Scope: config.ScopeSensorsRead})
+	}); err != nil {
+		jsonErr(w, 500, err.Error())
+		return
+	}
+	if clash {
+		jsonErr(w, 409, "a token with that name exists; revoke it first")
+		return
+	}
+	log.Printf("read-only sensor token %q created (from %s)", name, clientIP(r))
+	jsonOK(w, 200, map[string]string{"token": tok, "name": name, "scope": config.ScopeSensorsRead})
+}
+
 // ---- API tokens: how a hub authenticates to this node ----

 // issueToken trades the password for a long-lived token, named by the caller (a hub).
@@ -283,7 +375,7 @@ func (s *Server) listTokens(w http.ResponseWriter, _ *http.Request) {
 	var out []map[string]any
 	s.cfg.View(func(c *config.Config) {
 		for _, t := range c.Tokens {
-			out = append(out, map[string]any{"name": t.Name, "created": t.Created})
+			out = append(out, map[string]any{"name": t.Name, "created": t.Created, "scope": t.Scope})
 		}
 	})
 	if out == nil {
@@ -621,27 +713,114 @@ func (s *Server) sensorHistory(w http.ResponseWriter, r *http.Request) {
 	jsonOK(w, 200, h)
 }

+// sensorProm is every numeric sensor in the Prometheus text format.
+func (s *Server) sensorProm(w http.ResponseWriter, _ *http.Request) {
+	w.Header().Set("Content-Type", "text/plain; version=0.0.4; charset=utf-8")
+	sensors.WriteProm(w, s.sensors.All())
+}
+
+// queryOf reads a shaped query from a request: the POST body, or on a GET either ?q= (the
+// JSON shape, URL-encoded — a browser EventSource can only GET) or the flat form, where
+// every other parameter is a key and its selector.
+func queryOf(w http.ResponseWriter, r *http.Request) (q json.RawMessage, full bool, err error) {
+	params := r.URL.Query()
+	full = params.Get("full") == "1"
+	if r.Method == http.MethodPost {
+		b, err := io.ReadAll(http.MaxBytesReader(w, r.Body, 64<<10))
+		if err != nil {
+			return nil, full, errors.New("query larger than 64 KiB")
+		}
+		return b, full, nil
+	}
+	if raw := params.Get("q"); raw != "" {
+		return json.RawMessage(raw), full, nil
+	}
+	flat := map[string]string{}
+	for k, v := range params {
+		if !reservedParam[k] && len(v) > 0 {
+			flat[k] = v[0]
+		}
+	}
+	q, _ = json.Marshal(flat)
+	return q, full, nil
+}
+
+var reservedParam = map[string]bool{"full": true, "token": true, "q": true, "every": true}
+
+// sensorStream is a shaped query that keeps answering: the same object, pushed as a
+// server-sent event after every sample. ?every=<ms> spaces the events out for a consumer
+// that doesn't want them at the sampling rate.
+func (s *Server) sensorStream(w http.ResponseWriter, r *http.Request) {
+	q, full, err := queryOf(w, r)
+	if err == nil {
+		_, err = sensors.Shape(s.sensors.All(), q, full) // refuse a bad query before the stream starts
+	}
+	if err != nil {
+		jsonErr(w, 400, err.Error())
+		return
+	}
+	tick, cancel, ok := s.sensors.Subscribe()
+	fl, canFlush := w.(http.Flusher)
+	if !ok || !canFlush {
+		jsonErr(w, 501, "streaming isn't available here")
+		return
+	}
+	defer cancel()
+	every := time.Duration(0)
+	if ms, err := strconv.Atoi(r.URL.Query().Get("every")); err == nil && ms > 0 {
+		every = time.Duration(ms) * time.Millisecond
+	}
+	h := w.Header()
+	h.Set("Content-Type", "text/event-stream")
+	h.Set("Cache-Control", "no-store")
+	h.Set("X-Accel-Buffering", "no") // nginx (NPM) would otherwise hold events back
+	send := func() bool {
+		out, _ := sensors.Shape(s.sensors.All(), q, full)
+		b, err := json.Marshal(out)
+		if err != nil {
+			return false
+		}
+		if _, err := fmt.Fprintf(w, "data: %s\n\n", b); err != nil {
+			return false
+		}
+		fl.Flush()
+		return true
+	}
+	if !send() {
+		return
+	}
+	last := time.Now()
+	keepalive := time.NewTicker(25 * time.Second)
+	defer keepalive.Stop()
+	for {
+		select {
+		case <-r.Context().Done():
+			return
+		case <-keepalive.C:
+			if _, err := io.WriteString(w, ": keepalive\n\n"); err != nil {
+				return
+			}
+			fl.Flush()
+		case <-tick:
+			if every > 0 && time.Since(last) < every-5*time.Millisecond {
+				continue
+			}
+			last = time.Now()
+			if !send() {
+				return
+			}
+		}
+	}
+}
+
 // sensorQuery answers a shaped query. POST sends the shape as the body; GET builds a
 // flat one from the query string (?cpu=cpu.usage&fans=fan.*). ?full=1 returns whole
 // sensors instead of bare values.
 func (s *Server) sensorQuery(w http.ResponseWriter, r *http.Request) {
-	full := r.URL.Query().Get("full") == "1"
-	var q json.RawMessage
-	if r.Method == http.MethodPost {
-		b, err := io.ReadAll(http.MaxBytesReader(w, r.Body, 64<<10))
-		if err != nil {
-			jsonErr(w, 413, "query larger than 64 KiB")
-			return
-		}
-		q = b
-	} else {
-		flat := map[string]string{}
-		for k, v := range r.URL.Query() {
-			if k != "full" && len(v) > 0 {
-				flat[k] = v[0]
-			}
-		}
-		q, _ = json.Marshal(flat)
+	q, full, err := queryOf(w, r)
+	if err != nil {
+		jsonErr(w, 413, err.Error())
+		return
 	}
 	out, err := sensors.Shape(s.sensors.All(), q, full)
 	if err != nil {