Dev

[vsilent]

Registration/Auth from Status Panel web UI

[Copilot]

Pull request overview

Adds agent self-registration support so a Status Panel instance can register itself with the Stacker Server (via CLI and a local API endpoint), and persists the returned registration data for later use.

Changes:

• Introduce a new status register CLI subcommand to register an agent and optionally save /etc/status-panel/registration.json.
• Add POST /api/v1/register to the local Axum API to trigger agent self-registration from the web/UI or install flow.
• Add agent::registration module to collect a server fingerprint, call the remote registration API, and save the registration result.

Reviewed changes

Copilot reviewed 20 out of 22 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/main.rs	Adds Register CLI subcommand and wiring to registration module + persistence.
src/comms/local_api.rs	Adds POST /api/v1/register route and handler to perform registration and save locally.
src/agent/registration.rs	New module implementing fingerprint collection, remote registration request, and saving registration JSON.
src/agent/mod.rs	Exposes the new registration module.
TODO.md	Adds roadmap items for marketplace integration and registration flow.
README.md	Refreshes project overview/docs and highlights capabilities.

Comments suppressed due to low confidence (4)

src/comms/local_api.rs:1584

• The request payload allows an arbitrary server URL override, and the handler uses it directly to build an outbound reqwest request. Because this endpoint is unauthenticated, this becomes an SSRF primitive (POST to attacker-chosen host/port) and can also exfiltrate the machine fingerprint. Consider removing the override from the HTTP API (keep it for the CLI if needed), or strictly validate/allowlist the host + enforce https before making the request.

async fn commands_wait(
    State(state): State<SharedState>,
    Path(_hash): Path<String>,
    Query(params): Query<WaitParams>,
    headers: HeaderMap,
) -> impl IntoResponse {
    if let Err(resp) = validate_agent_id(&headers) {
        return resp.into_response();
    }
    // Optional signing for GET /wait (empty body) controlled by env flag
    let require_sig = std::env::var("WAIT_REQUIRE_SIGNATURE")
        .map(|v| v == "true")
        .unwrap_or(false);
    if require_sig {
        if let Err(resp) = verify_stacker_post(&state, &headers, &[], "commands:wait").await {
            return resp.into_response();
        }
    } else {
        // Lightweight rate limiting without signature

src/comms/local_api.rs:1604

• register_handler performs synchronous disk I/O via save_registration() from within an async Axum handler. This can block the Tokio runtime under load. Consider switching save_registration to tokio::fs (async) or calling the existing sync function inside tokio::task::spawn_blocking, and returning a warning in the response if persistence fails (so callers can detect partial success).

                headers
                    .get("X-Agent-Id")
                    .and_then(|v| v.to_str().ok())
                    .unwrap_or(""),
            )
            .await
        {
            state.audit.rate_limited(
                headers
                    .get("X-Agent-Id")
                    .and_then(|v| v.to_str().ok())
                    .unwrap_or(""),
                None,
            );
            return (
                StatusCode::TOO_MANY_REQUESTS,
                Json(json!({"error": "rate limited"})),

src/comms/local_api.rs:918

• A new HTTP endpoint (POST /api/v1/register) is added, but there are existing route integration tests in tests/http_routes.rs covering most endpoints. Consider adding tests for this route (at least validating expected status codes and any access restrictions you implement, e.g., loopback-only / already-registered behavior), so regressions don’t silently expose the endpoint.

async fn capabilities_handler(State(state): State<SharedState>) -> impl IntoResponse {
    let compose_agent_env = std::env::var("COMPOSE_AGENT_ENABLED")
        .ok()
        .and_then(|v| v.parse::<bool>().ok());
    let compose_agent = compose_agent_env.unwrap_or(state.config.compose_agent_enabled);

src/comms/local_api.rs:918

• POST /api/v1/register is exposed on the same router that binds to 0.0.0.0 (see serve()), but the handler currently has no authentication/authorization and no restriction to loopback clients. This allows any network-reachable caller to trigger registration attempts and overwrite /etc/status-panel/registration.json. Consider requiring an authenticated session (when with_ui), or at minimum rejecting non-loopback ConnectInfo/ClientIp and refusing to run if already registered unless an explicit force flag is provided.

async fn metrics_ws_stream(state: SharedState, mut socket: WebSocket) {
    let mut rx = state.metrics_tx.subscribe();

    // Send latest snapshot immediately
    let current = state.metrics_store.read().await.clone();
    if let Ok(text) = serde_json::to_string(&current) {
        let _ = socket.send(Message::Text(text.into())).await;
    }

    while let Ok(snapshot) = rx.recv().await {
        if let Ok(text) = serde_json::to_string(&snapshot) {
            if socket.send(Message::Text(text.into())).await.is_err() {
                break;
            }
        }
    }
}

async fn capabilities_handler(State(state): State<SharedState>) -> impl IntoResponse {
    let compose_agent_env = std::env::var("COMPOSE_AGENT_ENABLED")
        .ok()
        .and_then(|v| v.parse::<bool>().ok());
    let compose_agent = compose_agent_env.unwrap_or(state.config.compose_agent_enabled);

---

You can also share your feedback on Copilot code review. Take the survey.