mirror of
https://github.com/fabro-sh/fabro.git
synced 2026-10-10 03:30:59 +00:00
## Summary
Removes Fabro's in-process inbound source-IP allowlist entirely.
`[server.ip_allowlist]` and
`[server.integrations.github.webhooks.ip_allowlist]` are gone from
config parsing, resolved settings types, the OpenAPI spec, generated API
clients, and the Settings > Security UI. Existing `settings.toml` files
containing those keys now fail as unknown fields — this is a hard
removal with no migration path.
Network source restrictions should be enforced upstream via a reverse
proxy, firewall, VPN, Tailscale ACLs, Kubernetes ingress, or platform
policy.
### What changed
- **Config/types** (`fabro-config`, `fabro-types`): Removed
`ServerIpAllowlistLayer`, `ServerIpAllowlistOverrideLayer`,
`ServerIpAllowlistSettings`, `ServerIpAllowlistOverrideSettings`,
`IpAllowEntry`, associated resolver functions, GitHub `/meta` hook-range
parsing, and Unix socket trusted-proxy validation. `ipnet` dropped from
`fabro-types`; kept in `fabro-config` for sandbox CIDR validation.
- **Server runtime** (`fabro-server`): Deleted `ip_allowlist.rs`,
removed `IpAllowlistConfig` parameter from `build_router_with_options`
and `RouterOptions`, removed the global allowlist middleware layer, and
removed `GitHubMetaResolver` startup logic. GitHub webhook HMAC
verification is unchanged.
- **OpenAPI + generated clients**: Removed `ServerIpAllowlistSettings`,
`ServerIpAllowlistOverrideSettings`, `IpAllowEntry`,
`LiteralIpAllowEntry`, `GitHubMetaHooksEntry` schemas; removed
`ip_allowlist` from `ServerNamespace` and `IntegrationWebhooksSettings`;
dropped `IpAllowEntry` re-exports from `fabro-api`.
- **Web UI**: Removed IP allowlist row from Settings > Security; updated
nav description and page copy.
- **Docs/changelog**: Security docs explicitly state Fabro provides no
source-IP filtering and direct operators upstream. Changelog entry dated
2026-05-27 documents the breaking removal and annotates the 2026-04-19
entry where the feature was introduced.
### Also in this diff (unrelated to IP allowlisting)
The worker control stream was migrated from reading newline-delimited
JSON on stdin to a reconnecting WebSocket
(`/api/v1/runs/{id}/worker/control-stream`). This adds
`tokio-tungstenite` to `fabro-cli`/`fabro-server`, introduces
`WorkerControlManagerHandle` with backoff reconnection and deduplication
of replayed delivery IDs, and adds `RunPause`/`RunUnpause` message
handling. A new integration test
(`detached_run_cancel_reaches_worker_over_control_websocket`) exercises
the full cancel path over the WebSocket.
### Key decisions
- **Hard removal via `deny_unknown_fields`**: stale config is
immediately visible as a startup error rather than silently ignored.
- **No stub or default pass-through**: `IpAllowlistConfig::default()` is
gone, not left as a no-op wrapper, to avoid keeping the feature shape
alive.
- **Webhook HMAC boundary unchanged**: source-IP filtering on webhook
routes is removed; cryptographic signature verification remains the
security boundary.
### Fabro Details
<details>
<summary>Ran 9 stages in 59m 53s for $27.24</summary>
| Stage | Duration | Cost | Retries |
|---|---|---|---|
| start | 0s | – | 0 |
| toolchain | 1s | – | 0 |
| preflight_compile | 2m 15s | – | 0 |
| preflight_lint | 2m 22s | – | 0 |
| implement | 33m 54s | $22.81 | 0 |
| simplify_opus | 5m 55s | $0.75 | 0 |
| simplify_gpt | 3m 35s | $2.81 | 0 |
| verify | 8m 34s | – | 0 |
| fixup | 2m 24s | $0.87 | 0 |
| **Total** | **59m 53s** | **$27.24** | **0** |
</details>
<details>
<summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14
edges)</summary>
```dot
digraph ImplementPlan {
graph [
goal="Implement and simplify",
model_stylesheet="
* { model: claude-opus-4-7; }
"
]
rankdir=LR
start [shape=Mdiamond, label="Start"]
exit [shape=Msquare, label="Exit"]
toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0]
preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0]
preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0]
fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3]
implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"]
simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"]
simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"]
verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"]
fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3]
start -> toolchain
toolchain -> preflight_compile [condition="outcome=succeeded"]
toolchain -> exit
preflight_compile -> preflight_lint [condition="outcome=succeeded"]
preflight_compile -> exit
preflight_lint -> implement [condition="outcome=succeeded"]
preflight_lint -> fix_lints
fix_lints -> preflight_lint
implement -> simplify_opus -> simplify_gpt -> verify
verify -> exit [condition="outcome=succeeded"]
verify -> fixup
fixup -> verify
}
```
</details>
⚒️ Generated with [Fabro](https://fabro.sh)
---------
Co-authored-by: Fabro <noreply@fabro.sh>
207 lines
5.9 KiB
TypeScript
207 lines
5.9 KiB
TypeScript
import {
|
|
BoltIcon,
|
|
ChartBarSquareIcon,
|
|
CircleStackIcon,
|
|
CodeBracketIcon,
|
|
Cog6ToothIcon,
|
|
CpuChipIcon,
|
|
CubeTransparentIcon,
|
|
KeyIcon,
|
|
PuzzlePieceIcon,
|
|
ShieldCheckIcon,
|
|
} from "@heroicons/react/24/outline";
|
|
import { Fragment } from "react";
|
|
import { Link, Outlet, useLocation, useMatches } from "react-router";
|
|
|
|
export function meta({}: any) {
|
|
return [{ title: "Settings — Fabro" }];
|
|
}
|
|
|
|
export const handle = { hideHeader: true };
|
|
|
|
export type NavItem = {
|
|
name: string;
|
|
href: string;
|
|
icon: typeof Cog6ToothIcon;
|
|
description: string;
|
|
match: (pathname: string) => boolean;
|
|
};
|
|
|
|
export type NavSection = {
|
|
key: string;
|
|
label?: string;
|
|
items: NavItem[];
|
|
};
|
|
|
|
export const navSections: NavSection[] = [
|
|
{
|
|
key: "general",
|
|
label: "General",
|
|
items: [
|
|
{
|
|
name: "Models",
|
|
href: "/settings/models",
|
|
icon: CpuChipIcon,
|
|
description: "LLM providers and credentials.",
|
|
match: (p) => p.startsWith("/settings/models"),
|
|
},
|
|
{
|
|
name: "Integrations",
|
|
href: "/settings/integrations",
|
|
icon: PuzzlePieceIcon,
|
|
description: "Slack, GitHub, and other services.",
|
|
match: (p) => p.startsWith("/settings/integrations"),
|
|
},
|
|
{
|
|
name: "Sandboxes",
|
|
href: "/settings/sandboxes",
|
|
icon: CubeTransparentIcon,
|
|
description: "Where workflow stages execute.",
|
|
match: (p) => p.startsWith("/settings/sandboxes"),
|
|
},
|
|
{
|
|
name: "Security",
|
|
href: "/settings/security",
|
|
icon: ShieldCheckIcon,
|
|
description: "Authentication methods and access.",
|
|
match: (p) => p.startsWith("/settings/security"),
|
|
},
|
|
{
|
|
name: "Variables",
|
|
href: "/settings/variables",
|
|
icon: CodeBracketIcon,
|
|
description: "Non-sensitive values for run config interpolation.",
|
|
match: (p) => p.startsWith("/settings/variables"),
|
|
},
|
|
{
|
|
name: "Secrets",
|
|
href: "/settings/secrets",
|
|
icon: KeyIcon,
|
|
description: "Write-only values for workflow runs.",
|
|
match: (p) => p.startsWith("/settings/secrets"),
|
|
},
|
|
],
|
|
},
|
|
{
|
|
key: "administration",
|
|
label: "Administration",
|
|
items: [
|
|
{
|
|
name: "Server",
|
|
href: "/settings/server",
|
|
icon: Cog6ToothIcon,
|
|
description: "URLs, listen address, scheduler.",
|
|
match: (p) => p.startsWith("/settings/server"),
|
|
},
|
|
{
|
|
name: "Storage",
|
|
href: "/settings/storage",
|
|
icon: CircleStackIcon,
|
|
description: "Database, runs, and artifacts.",
|
|
match: (p) => p.startsWith("/settings/storage"),
|
|
},
|
|
{
|
|
name: "Monitoring",
|
|
href: "/settings/monitoring",
|
|
icon: ChartBarSquareIcon,
|
|
description: "CPU, memory, disk, concurrency.",
|
|
match: (p) => p.startsWith("/settings/monitoring"),
|
|
},
|
|
],
|
|
},
|
|
{
|
|
key: "diagnostics",
|
|
items: [
|
|
{
|
|
name: "Live Events",
|
|
href: "/settings/live-events",
|
|
icon: BoltIcon,
|
|
description: "Real-time event stream.",
|
|
match: (p) => p.startsWith("/settings/live-events"),
|
|
},
|
|
],
|
|
},
|
|
];
|
|
|
|
const allItems = navSections.flatMap((s) => s.items);
|
|
|
|
function classNames(...classes: Array<string | false | null | undefined>) {
|
|
return classes.filter(Boolean).join(" ");
|
|
}
|
|
|
|
export default function SettingsLayout() {
|
|
const { pathname } = useLocation();
|
|
const matches = useMatches();
|
|
const currentName =
|
|
allItems.find((item) => item.match(pathname))?.name ?? "Settings";
|
|
const fullHeight = matches.some(
|
|
(m) => (m.handle as { fullHeight?: boolean } | undefined)?.fullHeight,
|
|
);
|
|
|
|
return (
|
|
<div
|
|
className={classNames(
|
|
"flex flex-col gap-6 lg:flex-row",
|
|
fullHeight && "min-h-0 flex-1",
|
|
)}
|
|
>
|
|
<aside className="lg:w-56 lg:shrink-0">
|
|
<nav className="sticky top-6">
|
|
<ul className="flex gap-1 overflow-x-auto lg:flex-col lg:gap-0.5">
|
|
{navSections.map((section, sectionIdx) => (
|
|
<Fragment key={section.key}>
|
|
{section.label ? (
|
|
<li
|
|
className={classNames(
|
|
"hidden lg:block lg:px-2.5 lg:pb-1 lg:text-xs lg:font-medium lg:uppercase lg:tracking-wider lg:text-fg-muted",
|
|
sectionIdx === 0 ? "lg:pt-0" : "lg:pt-4",
|
|
)}
|
|
>
|
|
{section.label}
|
|
</li>
|
|
) : sectionIdx > 0 ? (
|
|
<li
|
|
aria-hidden="true"
|
|
className="mx-1 self-stretch border-l border-line lg:mx-0 lg:my-2 lg:self-auto lg:border-l-0 lg:border-t"
|
|
/>
|
|
) : null}
|
|
{section.items.map((item) => {
|
|
const current = item.match(pathname);
|
|
return (
|
|
<li key={item.href}>
|
|
<Link
|
|
to={item.href}
|
|
aria-current={current ? "page" : undefined}
|
|
className={classNames(
|
|
"flex items-center gap-2 rounded-md px-2.5 py-2 text-sm whitespace-nowrap transition-colors",
|
|
current
|
|
? "bg-overlay text-fg"
|
|
: "text-fg-3 hover:bg-overlay hover:text-fg",
|
|
)}
|
|
>
|
|
<item.icon className="size-4 shrink-0" aria-hidden="true" />
|
|
{item.name}
|
|
</Link>
|
|
</li>
|
|
);
|
|
})}
|
|
</Fragment>
|
|
))}
|
|
</ul>
|
|
</nav>
|
|
</aside>
|
|
|
|
<div
|
|
className={classNames(
|
|
"min-w-0 flex-1",
|
|
fullHeight && "flex min-h-0 flex-col",
|
|
)}
|
|
>
|
|
<h1 className="mb-2 text-xl font-semibold tracking-tight text-fg">
|
|
{currentName}
|
|
</h1>
|
|
<Outlet />
|
|
</div>
|
|
</div>
|
|
);
|
|
}
|