Skip to content

chore: SBOM support#95

Merged
JanZachmann merged 28 commits intoomnect:mainfrom
JanZachmann:refactor/ux
Feb 11, 2026
Merged

chore: SBOM support#95
JanZachmann merged 28 commits intoomnect:mainfrom
JanZachmann:refactor/ux

Conversation

@JanZachmann
Copy link
Contributor

@JanZachmann JanZachmann commented Feb 11, 2026

Summary

  • Enable SBOM generation via cargo-auditable and npm runtime metadata in Docker image
  • Disable default features for crux_core and crux_macros to minimize binary size

Signed-off-by: Jan Zachmann <50990105+JanZachmann@users.noreply.github.com>
Signed-off-by: Jan Zachmann <50990105+JanZachmann@users.noreply.github.com>
- Switched Model and shared types to camelCase for consistent frontend/WASM communication.
- Introduced ODS DTOs in Core to isolate external WebSocket wire format from internal domain models.
- Replaced netmask dropdown with a subnet mask text field and added CIDR/Subnet conversion utilities.
- Implemented client-side validation for IP and Subnet mask in the network form.
- Unified event handling for ODS updates using raw JSON strings and a specialized parsing macro.
- Updated Playwright tests to match the new camelCase properties and UI changes.

Signed-off-by: Jan Zachmann <50990105+JanZachmann@users.noreply.github.com>
- Moved request and response structs (NetworkConfigRequest, SetPasswordRequest, etc.) to omnect-ui-core.
- Added serde_valid dependency to core for unified validation rules.
- Standardized shared types to use std::net::Ipv4Addr where appropriate.
- Enabled #[serde(rename_all = "camelCase")] on shared types for UI consistency.
- Updated backend services and API handlers to use core types, eliminating duplication.
- Resolved clippy warnings and fixed type conversion issues in core logic.

Signed-off-by: Jan Zachmann <50990105+JanZachmann@users.noreply.github.com>
- Moved vue-router to runtime dependencies.
- Configured Vite to split Vue and Vuetify into separate manual chunks.
- Increased chunkSizeWarningLimit to 1000kB to accommodate modern UI framework sizes.

Signed-off-by: Jan Zachmann <50990105+JanZachmann@users.noreply.github.com>
- Removed technical debt notes and future intent comments.
- Stripped historical context markers (e.g., "was", "previously", "until now").
- Removed high-priority markers like BUG, FIX, REGRESSION, TODO, and CRITICAL from comments and test titles.
- Excised environment-specific build instructions and internal implementation details from docstrings and code comments.
- Standardized comments to focus on current behavior rather than implementation history.

Signed-off-by: Jan Zachmann <50990105+JanZachmann@users.noreply.github.com>
Signed-off-by: Jan Zachmann <50990105+JanZachmann@users.noreply.github.com>
- Optimized horizontal space by reducing excessive margins on main pages.
- Improved Network Settings UX with logical grouping, descriptive icons, and tooltips.
- Enhanced state visualization for DHCP-managed and readonly fields (e.g., MAC address).
- Updated sidebar tabs with real-time adapter status indicators.
- Refactored core types to use String for IP fields to handle hostnames (localhost) robustly.
- Verified all 67 E2E tests pass.

Signed-off-by: Jan Zachmann <50990105+JanZachmann@users.noreply.github.com>
…arts

- Spawned process_pending_rollback as a concurrent background task to avoid blocking the main server loop during the rollback window.
- Updated process_pending_rollback signature to take ownership of the service client, satisfying 'static lifetime requirements for spawned tasks.
- Implemented Clone for MockDeviceServiceClient to support the new signature in unit tests.
- Added unit test to verify the new asynchronous, owned signature of process_pending_rollback.

Signed-off-by: Jan Zachmann <50990105+JanZachmann@users.noreply.github.com>
- Updated process_status_response and process_json_response to match on
  crux_http::HttpError::Http and extract the raw response body.
- Enhanced extract_error_message to return raw message bodies on success,
  ensuring detailed context from ODS reaches the UI.
- Consolidated error mapping logic into a shared map_http_error helper.
- Added a simple unit test for build_url in http_helpers.
- Created a new E2E test error-handling.spec.ts to verify the display
  of detailed error messages in the UI snackbar.
- Fixed minor indentation in backend network services.

Signed-off-by: Jan Zachmann <50990105+JanZachmann@users.noreply.github.com>
Implements streaming upload with performance optimizations:
- Align buffer sizes (512KB multipart + write buffer)
- Add periodic flushing (every 5MB or 10s)
- Set file permissions atomically
- Add stream timeout protection (30s/chunk, 600s total)
- Background folder clearing (non-blocking)
- Optimize worker threads for I/O-bound workload

Switch to pure-Rust crypto backends for stable cross-compilation:
- jwt-simple: optimal → pure-rust
- rustls: aws_lc_rs → ring

Remove verbose speed logging from firmware upload.

Signed-off-by: Jan Zachmann <50990105+JanZachmann@users.noreply.github.com>
- Redesigned Update page with dynamic drag-and-drop area and 3-column info grid.
- Implemented auto-upload for firmware files.
- Unified primary action buttons to 'primary flat' style across all functional areas.
- Standardized dialog and secondary actions to 'primary text' or 'outlined' variants.
- Refined Reboot/Factory Reset buttons with compact density and fixed width.
- Updated Playwright E2E tests to match the new update flow and UI labels.
- Fixed backend cargo clippy warnings (manual_clamp and await_holding_lock).

Signed-off-by: Jan Zachmann <50990105+JanZachmann@users.noreply.github.com>
…sults

Show persistent modal dialogs when factory reset completes or firmware
update validation finishes, ensuring the user sees the outcome regardless
of which page they navigate to after reboot.

- Factory reset result: Success (green) or Error (red) dialog with
  error details from the backend
- Update validation: Success for "Succeeded", Warning for "Recovered"
  (rollback to previous version)
- Dismissing a modal sends an ack to the backend (marker file in /tmp/)
  to suppress re-showing on page refresh
- Extract generic MarkerFile service from NetworkConfigService to
  cleanly separate network, factory reset, and update concerns

Signed-off-by: Jan Zachmann <50990105+JanZachmann@users.noreply.github.com>
…tication

After Keycloak redirect, the Core reinitializes with default state
(requires_password_set=false). The Vue watcher for auto-login depended
on a true->false transition that never occurred, leaving the user stuck
on the set-password dialog.

SetPasswordResponse now carries the auth token returned by the backend,
directly setting auth_token and is_authenticated. This eliminates the
fragile watcher-based auto-login and the unnecessary second HTTP
round-trip.

Signed-off-by: Jan Zachmann <50990105+JanZachmann@users.noreply.github.com>
ODS sends factory reset status as numeric values (0=ModeSupported,
1=ModeUnsupported, 2=BackupRestoreError, 3=ConfigurationError) but the
OdsFactoryResetResultStatus enum expected snake_case strings, causing
parse failure at runtime.

Switch to serde_repr for integer deserialization matching the ODS wire
format, and remove the unused OdsFactoryResetResultStatus from typegen
and Shell imports since it is an internal Core deserialization type.

Signed-off-by: Jan Zachmann <50990105+JanZachmann@users.noreply.github.com>
- Fix misleading update spinner texts: show "Installing update..." during
  POST (SWUpdate runs synchronously) and "Rebooting to new firmware" after
- Add countdown timer to reboot (5 min), factory reset (10 min), and update
  overlays with timeout constants defined in Core
- Unify timeout message with actionable cert re-acceptance hint
- Show "Open app in new tab" button on device operation timeout for cert
  re-acceptance (same pattern as network config changes)
- Make OverlaySpinner countdown label a prop ("Timeout in:" for device ops,
  "Automatic rollback in:" for network changes)
- Move overlay spinner sync before device/network state in sync.ts so
  watchers can read countdown value
- Remove dead reconnection_timeout_seconds field from Model

Signed-off-by: Jan Zachmann <50990105+JanZachmann@users.noreply.github.com>
Change reboot and factory reset confirmation buttons from text variant
to flat variant with error color for better visibility and consistency
with the theme's VDangerButton pattern.

Signed-off-by: Jan Zachmann <50990105+JanZachmann@users.noreply.github.com>
The dummy pnpm script on PATH preempts corepack entirely, making
this environment variable a no-op.

Signed-off-by: $(git config user.name) <$(git config user.email)>
Rust major: reqwest 0.12→0.13 (rustls-tls→rustls), mockall 0.13→0.14
Rust minor/patch: actix-web, uuid, tokio, rustls, log, anyhow, etc.
UI major: @vueuse/core 13→14
UI minor/patch: vue, vuetify, axios, vite, biome, playwright, etc.

Fix jwt-simple 0.12.14 minimum key length enforcement in token tests.

Signed-off-by: Jan Zachmann <50990105+JanZachmann@users.noreply.github.com>
- Standardize sub-section headers to text-subtitle-2 text-medium-emphasis
- Remove decorative prepend-inner icons from form fields
- Switch DHCP-managed fields to plain variant for read-only appearance
- Move MAC address to status bar as inline label matching Mode style
- Change form layout to horizontal rows per section
- Use text variant for secondary Discard button
- Remove redundant (current connection) chip
- Add UX Guidelines section to project-context.md
- Update e2e tests to match new DOM structure

Signed-off-by: Jan Zachmann <50990105+JanZachmann@users.noreply.github.com>
App.vue's global useMessageWatchers (flush: 'pre') cleared successMessage
before UpdatePassword's page-level watcher could react. Replace with
flush: 'sync' watchers that fire inline during the reactive assignment.

Signed-off-by: Jan Zachmann <50990105+JanZachmann@users.noreply.github.com>
Auth form errors were presented inconsistently: API errors (wrong
password) showed as toasts via the global useMessageWatchers, while
client-side validation errors (password mismatch) showed inline.

- Add `inlineErrors` route meta to suppress toast on auth pages
- Add `suppressErrorToast` option to useMessageWatchers composable
- Use flush:sync watchers in Login.vue and SetPassword.vue to capture
  errors before the global handler clears them
- Fix unauth_post/auth_post_basic macros losing HTTP response body text
  by using map_http_error instead of Display formatting on HttpError
- Add e2e tests for all auth error scenarios (inline display, no toast)

Signed-off-by: Jan Zachmann <50990105+JanZachmann@users.noreply.github.com>
Signed-off-by: Jan Zachmann <50990105+JanZachmann@users.noreply.github.com>
Use architecture-specific cache IDs for cargo registry and build
caches to prevent race conditions when building linux/amd64 and
linux/arm64 images in parallel. This fixes "File exists (os error 17)"
errors during cargo package extraction.

Signed-off-by: Jan Zachmann <50990105+JanZachmann@users.noreply.github.com>
…data

Use cargo auditable build to embed Rust dependency metadata in the
binary, allowing Syft to extract runtime Cargo deps directly from
the image. Add stripped package.json (runtime deps only) and bun.lock
to the final image at /sbom/npm/ for JavaScript dependency discovery.

Signed-off-by: Jan Zachmann <50990105+JanZachmann@users.noreply.github.com>
Signed-off-by: Jan Zachmann <50990105+JanZachmann@users.noreply.github.com>
@JanZachmann JanZachmann changed the title refactor: UX overhaul with Crux Core migration and SBOM support chore: SBOM support Feb 11, 2026
Signed-off-by: Buell <50990105+JanZachmann@users.noreply.github.com>
@JanZachmann JanZachmann merged commit c7718b7 into omnect:main Feb 11, 2026
1 of 2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

Comments