✨ Feature/add quantum demo with security fixes

[KPRoche]

Adding or modifying a card/dashboard? Read the Card Development Guide first — it covers required patterns, common pitfalls, and the full file checklist.

New CNCF project card? New cards go in kubestellar/console-marketplace, not this repo. PRs adding new cards here will be redirected.

Use a coding agent. This repo is primarily developed with Claude Code (Opus 4.5/4.6). It knows all codebase patterns (isDemoData, useCardLoadingState, locale strings, DCO). Manual PRs that miss required patterns will be sent back.

📌 Fixes

Fixes #12531 Community review issue regarding SSRF security problem

---

📝 Summary of Changes

This is a fix to the security issue in PR 12531 noted after its merge.

---

Changes Made

Checklist

Please ensure the following before submitting your PR:

• [x ] I used a coding agent (Claude Code, Copilot, Gemini, or Codex) to generate/review this code
• [x ] I have reviewed the project's contribution guidelines
• [ x] New cards target console-marketplace, not this repo
• [ x] isDemoData is wired correctly (cards show Demo badge when using demo data)
• [ x] I have written unit tests for the changes (if applicable)
• [ x] I have tested the changes locally and ensured they work as expected
• [ x] All commits are signed with DCO (git commit -s)

---

Screenshots or Logs (if applicable)

---

👀 Reviewer Notes

Add any special notes for the reviewer here

[netlify]

✅ Deploy Preview for kubestellarconsole ready!

Built without sensitive environment variables

Name	Link
🔨 Latest commit	20ca906
🔍 Latest deploy log	https://app.netlify.com/projects/kubestellarconsole/deploys/69fd1e6fa5db46000826bafd
😎 Deploy Preview	https://deploy-preview-12552.console-deploy-preview.kubestellar.io
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign eeshaansa for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

👋 Hey @KPRoche — thanks for opening this PR!

🤖 This project is developed exclusively using AI coding assistants.

Please do not attempt to code anything for this project manually.
All contributions should be authored using an AI coding tool such as:

• Claude Code (Opus 4.5 / 4.6) — recommended
• GitHub Copilot
• Cursor
• Other AI coding assistants

This ensures consistency in code style, architecture patterns, test coverage,
and commit quality across the entire codebase.

---

This is an automated message.

[Copilot]

Pull request overview

This PR introduces a new Quantum Demo dashboard (frontend + backend proxying) and adds SSRF-focused hardening around quantum proxy configuration and workload detection via /health.

Changes:

• Added Quantum dashboard route/config, sidebar entry, icon, and multiple quantum cards (control panel, status, qubit grid, circuit viewer, histogram) plus supporting hooks/UI components.
• Implemented backend /api/quantum/* proxy routes and /api/result/histogram, and extended /health to report quantum workload availability.
• Added SSRF-related protections (notably exporting IsPrivateHost) and updated UI-UX raw color-count expectations.

Reviewed changes

Copilot reviewed 38 out of 38 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
web/src/test/ui-ux-standards.test.ts	Updates expected raw hex color count for new quantum UI usage.
web/src/lib/quantum/pollingContext.ts	Adds quantum polling pause context/helpers (currently incomplete).
web/src/lib/navigationIcons.ts	Adds quantum navigation icon mapping.
web/src/lib/icons.ts	Registers custom Qiskit icon in icon registry.
web/src/lib/demoMode.ts	Adds quantum workload availability tracking + demo-mode forcing hooks.
web/src/index.css	Adds monospace styling for quantum ASCII circuit display.
web/src/hooks/useSidebarConfig.ts	Adds Quantum dashboard to discoverables and reads workload availability from /health.
web/src/hooks/useResultHistogram.ts	New polling hook for result histogram API.
web/src/hooks/useQASMFiles.ts	New hook to list available QASM files (skips when quantum forced to demo).
web/src/hooks/useDrillDown.tsx	Adds quantum-credentials drilldown view type.
web/src/hooks/tests/useResultHistogram.test.ts	Adds unit tests for useResultHistogram.
web/src/config/routes.ts	Adds ROUTES.QUANTUM.
web/src/config/dashboards/quantum.ts	Adds unified dashboard config for Quantum demo.
web/src/config/dashboards/index.ts	Registers quantumDashboardConfig.
web/src/components/ui/Slider.tsx	Adds a reusable slider UI component.
web/src/components/ui/QiskitIcon.tsx	Adds custom Qiskit SVG icon component.
web/src/components/quantum/QuantumWorkloadBanner.tsx	Adds banner indicating quantum workload detected/missing.
web/src/components/quantum/Quantum.tsx	Adds Quantum dashboard page wrapper using DashboardPage.
web/src/components/drilldown/views/quantum/QuantumCredentialsDrillDown.tsx	Adds IBM Quantum credentials drilldown UI.
web/src/components/drilldown/DrillDownModal.tsx	Registers quantum credentials drilldown in modal router.
web/src/components/cards/quantum/QuantumStatus.tsx	Adds quantum status card with adjustable polling interval.
web/src/components/cards/quantum/QuantumQubitGrid.tsx	Adds qubit grid visualization card with polling + mask selection.
web/src/components/cards/quantum/QuantumHistogramCard.tsx	Adds histogram chart card powered by useResultHistogram.
web/src/components/cards/quantum/QuantumControlPanel.tsx	Adds execution control panel card (backends, shots, loop mode, credentials, custom QASM).
web/src/components/cards/quantum/QuantumCircuitViewer.tsx	Adds circuit ASCII viewer card.
web/src/components/cards/quantum/quantum-bundle.ts	Barrel export file (appears unused).
web/src/components/cards/quantum/index.ts	Barrel export for quantum cards.
web/src/components/cards/quantum/CustomQASMModal.tsx	Adds modal to paste/upload custom QASM.
web/src/components/cards/cardRegistry.ts	Integrates quantum card registry (and large-scale registry restructure in this diff).
web/src/components/cards/cardRegistry.quantum.ts	Adds lazy-loaded quantum card registry category and preloaders.
web/src/components/cards/cardMetadata.ts	Adds descriptions for quantum cards.
web/src/App.tsx	Adds /quantum route and lazy-loads Quantum page.
web/netlify/functions/quantum-proxy.mts	Adds Netlify function quantum proxy with SSRF checks + demo responses.
startup-oauth.sh	Sets default QUANTUM_SERVICE_URL for local dev.
pkg/api/server.go	Adds quantum proxy routes to API server.
pkg/api/routes_health.go	Adds quantum workload detection and exposes it via /health.
pkg/api/projects.go	Adds quantum dashboard to kubestellar project preset.
pkg/api/handlers/quantum_proxy.go	Adds backend quantum proxy handler (SSRF validation, header filtering).
pkg/api/handlers/ping.go	Exports IsPrivateHost for reuse (SSRF prevention).

[kubestellar-hive]

🔒 Security Gate Review — PR #12552

Status: CHANGES REQUESTED — 4 security findings (2 HIGH, 2 MEDIUM)

---

HIGH-1: SSRF — No private IP validation in Go quantum proxy

pkg/api/handlers/quantum_proxy.go — NewQuantumProxyHandler() reads QUANTUM_SERVICE_URL from env and proxies to it with zero validation. An attacker who can set this env var (or a misconfiguration) can make the server proxy requests to internal services (cloud metadata, K8s API, etc.).

PR #12557 exists to fix this, but this PR (#12552) would merge without that fix, creating a window of vulnerability.

Fix: Either merge #12557 first, or cherry-pick validateQuantumServiceURL() + IsPrivateHost() into this PR.

---

HIGH-2: SSRF — Netlify function forwards all request headers

web/netlify/functions/quantum-proxy.mts line ~121:

const proxyReq = new Request(targetURL, {
  method: req.method,
  headers: req.headers,  // ← Forwards Cookie, Authorization, etc.
  body: ...
});

This forwards all client headers (including Cookie, Authorization, X-Forwarded-For) to the backend quantum service. If the backend is compromised or the URL is SSRF-ed, sensitive auth tokens are leaked.

Fix: Whitelist safe headers (Accept, Content-Type, User-Agent) — same pattern as the Go handler's safeHeadersToForward.

---

MEDIUM-3: Query string injection in ProxyResultHistogram

pkg/api/handlers/quantum_proxy.go ProxyResultHistogram():

sort := c.Query("sort", "count")
targetURL := h.quantumServiceURL + "/api/result/histogram?sort=" + sort

The sort parameter is concatenated into the URL without encoding. A value like count&admin=true would inject extra query parameters.

Fix: Use url.QueryEscape(sort) or validate against an allowlist (count, state, etc.).

---

MEDIUM-4: Missing fetch timeout in Netlify function

web/netlify/functions/quantum-proxy.mts — the fetch(proxyReq) call has no AbortSignal.timeout(). A slow/hanging backend will keep the Netlify function alive until the platform timeout (26s), consuming resources.

Fix: Add signal: AbortSignal.timeout(15_000) to the fetch call.

---

Minor observations (non-blocking)

• Go error messages leak connection details: fmt.Sprintf("Quantum service unavailable: %v", err) — consider a generic message.
• api.Delete("/quantum/*") routes through ProxyRequest (GET handler) — verify this is intentional.

cc @KPRoche

[kubestellar-prow]

@kubestellar-hive[bot]: changing LGTM is restricted to collaborators

Details

In response to this:

🔒 Security Gate Review — PR #12552

Status: CHANGES REQUESTED — 4 security findings (2 HIGH, 2 MEDIUM)

---

HIGH-1: SSRF — No private IP validation in Go quantum proxy

pkg/api/handlers/quantum_proxy.go — NewQuantumProxyHandler() reads QUANTUM_SERVICE_URL from env and proxies to it with zero validation. An attacker who can set this env var (or a misconfiguration) can make the server proxy requests to internal services (cloud metadata, K8s API, etc.).

PR #12557 exists to fix this, but this PR (#12552) would merge without that fix, creating a window of vulnerability.

Fix: Either merge #12557 first, or cherry-pick validateQuantumServiceURL() + IsPrivateHost() into this PR.

---

HIGH-2: SSRF — Netlify function forwards all request headers

web/netlify/functions/quantum-proxy.mts line ~121:

const proxyReq = new Request(targetURL, {
 method: req.method,
 headers: req.headers,  // ← Forwards Cookie, Authorization, etc.
 body: ...
});

This forwards all client headers (including Cookie, Authorization, X-Forwarded-For) to the backend quantum service. If the backend is compromised or the URL is SSRF-ed, sensitive auth tokens are leaked.

Fix: Whitelist safe headers (Accept, Content-Type, User-Agent) — same pattern as the Go handler's safeHeadersToForward.

---

MEDIUM-3: Query string injection in ProxyResultHistogram

pkg/api/handlers/quantum_proxy.go ProxyResultHistogram():

sort := c.Query("sort", "count")
targetURL := h.quantumServiceURL + "/api/result/histogram?sort=" + sort

The sort parameter is concatenated into the URL without encoding. A value like count&admin=true would inject extra query parameters.

Fix: Use url.QueryEscape(sort) or validate against an allowlist (count, state, etc.).

---

MEDIUM-4: Missing fetch timeout in Netlify function

web/netlify/functions/quantum-proxy.mts — the fetch(proxyReq) call has no AbortSignal.timeout(). A slow/hanging backend will keep the Netlify function alive until the platform timeout (26s), consuming resources.

Fix: Add signal: AbortSignal.timeout(15_000) to the fetch call.

---

Minor observations (non-blocking)

• Go error messages leak connection details: fmt.Sprintf("Quantum service unavailable: %v", err) — consider a generic message.
• api.Delete("/quantum/*") routes through ProxyRequest (GET handler) — verify this is intentional.

cc @KPRoche

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[github-actions]

🔍 Stuck PR Detection

This draft PR has had no activity for ~11 hours.

Current status:

• ⏳ Still in draft mode with no recent commits
• Build/check status may need review

Suggested next steps:

1. Verify the build is passing
2. Address any review comments
3. Mark as ready for review when complete

If you're blocked or need help, please leave a comment explaining the situation.

This is an automated status check from the stuck-detection workflow.

Note

🔒 Integrity filter blocked 2 items

The following items were blocked because they don't meet the GitHub integrity level.

• security: add SSRF protection to quantum proxy handlers #12557 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• ✨ Feature/add quantum demo with security fixes #12552 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

Generated by Stuck Detection Workflow · ● 296K · ◷

[github-actions]

Status Check — Stuck PR Detected

This draft PR has had no activity for over 26 hours and remains in do-not-merge/work-in-progress state.

Current status:

• Draft PR, no recent commits
• Fixes ✨ Feature/quantum rebased : Add Quantum Computing Demo dashboard to console #12531 SSRF security issue

@KPRoche Please either:

1. Mark as ready for review if the work is complete
2. Push any remaining commits to unblock the pipeline
3. Comment with current status if still in progress

This security fix is important — please prioritize moving it forward.

This is an automated stuck-detection check — no action needed if you're actively working on this.

Note

🔒 Integrity filter blocked 2 items

The following items were blocked because they don't meet the GitHub integrity level.

• security: add SSRF protection to quantum proxy handlers #12557 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• ✨ Feature/add quantum demo with security fixes #12552 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

Generated by Stuck Detection Workflow · ● 391.3K · ◷

[github-actions]

Stuck PR Detection — Status Check

This draft PR has had no activity for ~43 hours and is still in draft state.

Current state:

• Status: Draft
• Labels: do-not-merge/work-in-progress, size/XXL
• Last updated: 2026-05-09

@KPRoche — could you please provide a status update?

• Are you still working on this?
• Is there anything blocking progress?
• Do you need a rebase against main?

If you are ready, please mark it as ready for review. If blocked, let us know what's needed!

Note

🔒 Integrity filter blocked 3 items

The following items were blocked because they don't meet the GitHub integrity level.

• security: add SSRF protection to quantum proxy handlers #12557 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• STELLAR personal assistant #12904 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• ✨ Feature/add quantum demo with security fixes #12552 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

Generated by Stuck Detection Workflow · ● 356.9K · ◷