Security to-do list: the Security page, and critical items on the dashboard #59

Merged

jcoffey-dev merged 2 commits from feature/security-todo into main

2026-09-29 04:19:54 +00:00

jcoffey-dev commented

2026-09-29 04:08:33 +00:00

Owner

The console side of the security to-do list (spec approved 2026-09-26, inbuxa-drafts/specs/security-score.md). Needs inbuxa-server #114 (inbuxa:SecurityAcceptance); on a server without it, the page works without Accept.

Settings › Security › Security (was Hardening; same URL) is now:

A to-do list: what isn't as it should be, most serious first (Critical, Important, Good practice). Each item says what's wrong and why it matters, and has one action:
- Fix: one field, back to its default. The change is shown before the click ("Allow plain text authentication: on → off"), and the toast after it has Undo for 10 seconds.
- Review: opens the setting, with the expressions side by side where that matters.
- Go to the switch: for legacy protocols.
Explain appears where the local model is available. A counts line ("3 to do, 1 of them critical") shows only when there's something to do. There's no score and no "all good" banner.
Accepted: Accept the risk… asks why (required) and stores the acceptance on the server, so every administrator sees it, with who and when. Put back on the list removes it. If the value changes after acceptance, the item returns, marked Accepted earlier for a different value.
Passed checks (n): folded. A check that couldn't run (no permission, DNS unreachable) is listed as not checked with why, never as a to-do item.
Legacy mail protocols: the existing switch and impact panel, moved in unchanged.

The 18 checks (features/security/checks.ts), as the spec lists them:

plain-text IMAP;
the relaying rule, domains that relay for anyone, and sign-in for sending;
certificates expiring within 7 days (critical) or 30 days;
automatic bans, anonymous HTTP rate limits, and OAuth self-registration;
password rules and hashing;
invalid certificates accepted on outgoing mail;
DMARC checks switched off for port 25;
open Prometheus metrics;
missing MX/SPF/DKIM/DMARC records in public DNS, and DMARC p=none (per domain);
legacy protocols;
MTA-STS not enforced.

Defaults come from the server's schema. Expressions are compared whatever their stored shape. Fixes never write a secret, a DNS record or a listener. DNS answers are kept for a minute, so a Fix doesn't ask again.

Dashboard (SS-27): "1 critical security item" in the status line, only while a critical item isn't accepted, linking to the page. It runs a light load: only the critical checks, no DNS.

Also:

Only for those who may read the server's security settings, so not tenant administrators.
The ports table's rows now say Switched on the Security page.
use-toast gains an optional duration.

Checked:

Unit tests for every spec acceptance case that runs without a server (1–8, and 9's matching). 532 tests pass in total.
Typecheck and lint are clean.
In Chrome against a local server built from #114:
- with plain-text IMAP on, the page showed "3 to do, 1 of them critical" (IMAP, legacy protocols, MTA-STS) and 15 passed checks;
- Fix wrote false and the list dropped to 2; Undo wrote true back;
- accepting MTA-STS with a note moved it under Accepted, with the note, name and time;
- the dashboard showed "One thing needs a look: 1 critical security item", and the link opened the page.

Not in this PR:

Help-panel texts for each check.
The docs still call the page Hardening; a docs PR follows once this merges.

English only: about 70 new strings, most of them the check sentences.

The console side of the security to-do list (spec approved 2026-09-26, `inbuxa-drafts/specs/security-score.md`). **Needs inbuxa-server #114** (`inbuxa:SecurityAcceptance`); on a server without it, the page works without Accept. **Settings › Security › Security** (was *Hardening*; same URL) is now: 1. **A to-do list:** what isn't as it should be, most serious first (Critical, Important, Good practice). Each item says what's wrong and why it matters, and has one action: - **Fix**: one field, back to its default. The change is shown before the click ("Allow plain text authentication: on → off"), and the toast after it has **Undo** for 10 seconds. - **Review**: opens the setting, with the expressions side by side where that matters. - **Go to the switch**: for legacy protocols. **Explain** appears where the local model is available. A counts line ("3 to do, 1 of them critical") shows only when there's something to do. There's no score and no "all good" banner. 2. **Accepted:** *Accept the risk…* asks why (required) and stores the acceptance on the server, so every administrator sees it, with who and when. *Put back on the list* removes it. If the value changes after acceptance, the item returns, marked *Accepted earlier for a different value*. 3. **Passed checks (n):** folded. A check that couldn't run (no permission, DNS unreachable) is listed as *not checked* with why, never as a to-do item. 4. **Legacy mail protocols:** the existing switch and impact panel, moved in unchanged. **The 18 checks** (`features/security/checks.ts`), as the spec lists them: - plain-text IMAP; - the relaying rule, domains that relay for anyone, and sign-in for sending; - certificates expiring within 7 days (critical) or 30 days; - automatic bans, anonymous HTTP rate limits, and OAuth self-registration; - password rules and hashing; - invalid certificates accepted on outgoing mail; - DMARC checks switched off for port 25; - open Prometheus metrics; - missing MX/SPF/DKIM/DMARC records in public DNS, and DMARC `p=none` (per domain); - legacy protocols; - MTA-STS not enforced. Defaults come from the server's schema. Expressions are compared whatever their stored shape. Fixes never write a secret, a DNS record or a listener. DNS answers are kept for a minute, so a Fix doesn't ask again. **Dashboard (SS-27):** "1 critical security item" in the status line, only while a critical item isn't accepted, linking to the page. It runs a light load: only the critical checks, no DNS. **Also:** - Only for those who may read the server's security settings, so not tenant administrators. - The ports table's rows now say *Switched on the Security page*. - `use-toast` gains an optional `duration`. **Checked:** - Unit tests for every spec acceptance case that runs without a server (1–8, and 9's matching). 532 tests pass in total. - Typecheck and lint are clean. - In Chrome against a local server built from #114: - with plain-text IMAP on, the page showed "3 to do, 1 of them critical" (IMAP, legacy protocols, MTA-STS) and 15 passed checks; - Fix wrote `false` and the list dropped to 2; Undo wrote `true` back; - accepting MTA-STS with a note moved it under Accepted, with the note, name and time; - the dashboard showed "One thing needs a look: 1 critical security item", and the link opened the page. **Not in this PR:** - Help-panel texts for each check. - The docs still call the page *Hardening*; a docs PR follows once this merges. English only: about 70 new strings, most of them the check sentences.

jcoffey-dev added 1 commit 2026-09-29 04:08:33 +00:00