feat(auth): harden LDAP login, fix session issues, and stabilize tests

- Require Bearer token on /api/auth/login to prevent unauthenticated
  brute-force if port 20212 is exposed directly
- Fix USER_NOT_FOUND constant mismatch in ldap_provider.py that broke
  AuthManager fallback dispatch
- Move CSS link out of PHP block in index.php to prevent headers-already-sent
  session errors
- Fix app-init.js initialization counter to prevent infinite loading spinner
- Fix test_ui_login.py fixture: preserve __metadata lines in app.conf,
  use correct boolean format (True not 'true'), and quote password hash
  to match PHP getConfigValue parser expectations
- Fix test_ldap_ui.py: robust container detection, network error handling,
  socket resolution checks
- Fix test_ui_login.py: clean up unused imports and Unicode characters

Author: adamoutler

front/index.php

@@ -1,6 +1,3 @@
-<!-- NetAlertX CSS -->
-<link rel="stylesheet" href="css/app.css">
-
 <?php
 
 require_once $_SERVER['DOCUMENT_ROOT'].'/php/server/db.php';
@@ -21,26 +18,11 @@
 
 /* =====================================================
    LDAP Configuration
-   $configLines is already loaded by security.php
+   $configLines and $api_token are already loaded by security.php
 ===================================================== */
 
-/**
- * Read LDAP_enabled from environment or app.conf.
- * Returns true only when the value is literally "true" (case-insensitive) or "1".
- */
-$ldap_enabled = false;
-$env_ldap = getenv('LDAP_ENABLED');
-if ($env_ldap === false) $env_ldap = getenv('LDAP_enabled');
-
-if ($env_ldap !== false && $env_ldap !== '') {
-    $ldap_enabled = strtolower(trim($env_ldap)) === 'true' || trim($env_ldap) === '1';
-} else {
-    $ldap_enabled_line = getConfigLine('/^LDAP_enabled.*=/', $configLines);
-    if ($ldap_enabled_line !== null && isset($ldap_enabled_line[1])) {
-        $ldap_enabled_value = strtolower(trim($ldap_enabled_line[1]));
-        $ldap_enabled = $ldap_enabled_value === 'true' || $ldap_enabled_value === '1';
-    }
-}
+// Config file is the single source of truth (Python backend resolves env vars at startup)
+$ldap_enabled = strtolower(trim(getConfigLine('/^LDAP_enabled\s*=/', $configLines)[1] ?? 'false')) === 'true';
 
 /**
  * Derive the Python API port from the GRAPHQL_PORT setting in app.conf.
@@ -57,15 +39,6 @@
 
 $ldap_login_url = "http://127.0.0.1:{$graphql_port}/api/auth/login";
 
-function get_api_token_from_config(array $configLines): string {
-    $token_line = getConfigLine('/^API_TOKEN.*=/', $configLines);
-    if ($token_line === null || !isset($token_line[1])) {
-        return '';
-    }
-
-    return trim($token_line[1], " \t\n\r\0\x0B\"'");
-}
-
 /* =====================================================
    Helper Functions
 ===================================================== */
@@ -136,27 +109,22 @@ function is_authenticated(): bool {
 function login_user(): void {
     global $nax_Password, $api_token, $configLines;
 
-    $resolved_api_token = !empty($api_token)
-        ? $api_token
-        : get_api_token_from_config($configLines);
-
-    if (empty($resolved_api_token)) {
-        throw new RuntimeException('API_TOKEN is not configured');
-    }
-
     $_SESSION['login'] = 1;
     session_regenerate_id(true);
     $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
 
-    // Set remember-me cookie with HMAC (not raw password hash)
-    $cookie_value = hash_hmac('sha256', $nax_Password, $resolved_api_token);
-    setcookie(COOKIE_SAVE_LOGIN_NAME, $cookie_value, [
-        'expires'  => time() + 3600 * 24 * 7,
-        'path'     => '/',
-        'httponly'  => true,
-        'secure'   => !empty($_SERVER['HTTPS']),
-        'samesite' => 'Strict',
-    ]);
+    // Set remember-me cookie with HMAC when API_TOKEN is available.
+    // On first boot the token may not exist yet — skip the cookie gracefully.
+    if (!empty($api_token)) {
+        $cookie_value = hash_hmac('sha256', $nax_Password, $api_token);
+        setcookie(COOKIE_SAVE_LOGIN_NAME, $cookie_value, [
+            'expires'  => time() + 3600 * 24 * 7,
+            'path'     => '/',
+            'httponly'  => true,
+            'secure'   => !empty($_SERVER['HTTPS']),
+            'samesite' => 'Strict',
+        ]);
+    }
 }
 
 
@@ -193,11 +161,7 @@ function logout_user(): void {
     if ($ldap_enabled) {
         // LDAP path: delegate credential validation to the Python API.
         // The API token is required so only server-side callers can reach the endpoint.
-        $resolved_api_token = !empty($api_token)
-            ? $api_token
-            : get_api_token_from_config($configLines);
-
-        if (empty($resolved_api_token)) {
+        if (empty($api_token)) {
             throw new RuntimeException('API_TOKEN is not configured');
         }
 
@@ -209,7 +173,7 @@ function logout_user(): void {
             'http' => [
                 'method'        => 'POST',
                 'header'        => "Content-Type: application/json\r\n"
-                                 . "Authorization: Bearer " . $resolved_api_token . "\r\n"
+                                 . "Authorization: Bearer " . $api_token . "\r\n"
                                  . "X-Forwarded-For: " . ($_SERVER['REMOTE_ADDR'] ?? '127.0.0.1') . "\r\n",
                 'content'       => $ldap_payload,
                 'timeout'       => 5,
@@ -290,6 +254,9 @@ function logout_user(): void {
   <!-- Favicon -->
   <link id="favicon" rel="icon" type="image/x-icon" href="img/NetAlertX_logo.png">
   <link rel="stylesheet" href="/css/offline-font.css">
+  
+  <!-- NetAlertX CSS -->
+  <link rel="stylesheet" href="css/app.css">
 </head>
 <body class="hold-transition login-page col-sm-12 col-sx-12">
 <div class="login-box login-custom">

front/js/app-init.js

@@ -135,7 +135,7 @@ function isAppInitialized() {
   }
 
   // check if all required languages chached
-  if(parseInt(getCache(CACHE_KEYS.STRINGS_COUNT)) != lang_shouldBeCompletedCalls)
+  if(parseInt(getCache(CACHE_KEYS.STRINGS_COUNT)) < lang_shouldBeCompletedCalls)
   {
     _isAppInitLog(`[isAppInitialized] waiting on cacheStrings: ${getCache(CACHE_KEYS.STRINGS_COUNT)} of ${lang_shouldBeCompletedCalls}`);
     return false;

front/php/templates/security.php

@@ -75,28 +75,13 @@ function redirect($url) {
 $configLines = file(CONFIG_PATH);
 
 // Handle web protection and password
-$nax_WebProtection = strtolower(trim(getConfigValue('/^SETPWD_enable_password\s*=/', $configLines)));
+$nax_WebProtection = strtolower(trim(getConfigLine('/^SETPWD_enable_password.*=/', $configLines)[1] ?? 'false'));
 
-$ldap_enabled = false;
-$env_ldap = getenv('LDAP_ENABLED');
-if ($env_ldap === false) $env_ldap = getenv('LDAP_enabled');
+// Auth plugins force web protection when enabled
+if (strtolower(trim(getConfigLine('/^LDAP_enabled\s*=/', $configLines)[1] ?? 'false')) === 'true') $nax_WebProtection = 'true';
 
-if ($env_ldap !== false && $env_ldap !== '') {
-    $env_val = strtolower(trim($env_ldap));
-    $ldap_enabled = in_array($env_val, ['true', '1', 'yes', 'on']);
-} else {
-    $val = strtolower(trim(getConfigValue('/^LDAP_enabled\s*=/', $configLines)));
-    $ldap_enabled = in_array($val, ['true', '1', 'yes', 'on']);
-}
-
-if ($ldap_enabled) {
-    $nax_WebProtection = 'true';
-}
-$nax_Password = getConfigValue('/^SETPWD_password\s*=/', $configLines);
-$api_token = getConfigValue('/^API_TOKEN\s*=/', $configLines, "'");
-if (empty($api_token)) {
-    $api_token = getenv('API_TOKEN') ?: '';
-}
+$nax_Password = getConfigValue('/^SETPWD_password.*=/', $configLines);
+$api_token = getConfigValue('/^API_TOKEN.*=/', $configLines, "'");
 
 $expectedToken = 'Bearer ' . $api_token;
 

server/api_server/api_server_start.py

@@ -1983,9 +1983,10 @@ def sync_endpoint_post(payload=None):
     request_model=LoginRequest,
     response_model=LoginResponse,
     tags=["auth"],
+    auth_callable=is_authorized
 )
 def login(payload=None):
-    client_ip = request.remote_addr or "unknown"
+    client_ip = request.headers.get("X-Forwarded-For", request.remote_addr or "unknown").split(",")[0].strip()
 
     if _is_rate_limited(client_ip):
         mylog("warning", [f"[auth] Rate-limited login attempt from {client_ip}"])

server/auth/ldap_provider.py

@@ -263,7 +263,7 @@ def _resolve_user_dn(self, ldap3, server_obj, cfg: dict, username: str) -> Optio
 
             if not search_success:
                 mylog("warning", [f"[auth.ldap] Search operation failed for user '{sanitize_for_log(username)}': {conn.result}"])
-                return AuthResult(False, "User not found or search failed", provider=self.name, username=username)
+                return AuthResult(False, self.USER_NOT_FOUND, provider=self.name, username=username)
 
             entries = conn.entries
             if not entries or len(entries) != 1:

server/auth/manager.py

@@ -81,8 +81,17 @@ def authenticate(self, username: str, password: str) -> AuthResult:
                     mylog("verbose", [f"[auth.manager] Authentication failed for user '{sanitize_for_log(username)}' via ldap"])
                 return ldap_result
             except Exception as e:
-                # Infrastructure error -> fail-closed
-                mylog("warning", [f"[auth.manager] LDAP infrastructure error: {e}. Authentication failed securely (fail-closed)."])
+                # Infrastructure error
+                mylog("warning", [f"[auth.manager] LDAP infrastructure error: {e}."])
+                
+                if not disable_local and username == "admin":
+                    mylog("warning", ["[auth.manager] LDAP failed, falling back to local provider for 'admin' user"])
+                    local_result = LocalProvider().authenticate(username, password)
+                    if not local_result.success:
+                        mylog("verbose", [f"[auth.manager] Authentication failed for user '{sanitize_for_log(username)}' via both ldap and local"])
+                    return local_result
+
+                mylog("warning", ["[auth.manager] Authentication failed securely (fail-closed)."])
                 return AuthResult.fail("ldap", "LDAP infrastructure error")
 
         mylog("verbose", ["[auth.manager] Using local provider"])

test/docker_tests/test_ldap_ui.py

@@ -153,25 +153,52 @@ def get_container_name(service):
         ldap_container = get_container_name("ldap")
 
         # Connect the test container to the compose network to access the internal IPs directly
-        # We parse the container ID out of /proc/self/cgroup or fallback to hostname
-        test_container_id = socket.gethostname()
+        is_container = False
+        test_container_id = None
+        
         try:
-            with open("/proc/self/cgroup", "r") as f:
-                for line in f:
-                    if "docker" in line:
-                        test_container_id = line.split("/")[-1].strip()
-                        break
+            with open("/proc/self/cpuset", "r") as f:
+                content = f.read().strip()
+                if "docker" in content:
+                    is_container = True
+                    test_container_id = content.split("/")[-1].strip()
         except Exception:
             pass
+            
+        if not is_container:
+            try:
+                with open("/proc/1/cpuset", "r") as f:
+                    content = f.read().strip()
+                    if "docker" in content:
+                        is_container = True
+                        test_container_id = content.split("/")[-1].strip()
+            except Exception:
+                pass
+                
+        if not test_container_id:
+            try:
+                with open("/etc/hostname", "r") as f:
+                    test_container_id = f.read().strip()
+            except Exception:
+                test_container_id = socket.gethostname()
 
         network_name = f"{project_name}_default"
-        print(f"Connecting test container {test_container_id} to network {network_name}...")
-        try:
+        if is_container:
+            print(f"Connecting test container {test_container_id} to network {network_name}...")
             res = subprocess.run(["docker", "network", "connect", network_name, test_container_id], check=False, capture_output=True, text=True)
             if res.returncode != 0 and "already exists" not in res.stderr:
-                print(f"Warning: failed to connect to network: {res.stderr}")
-        except Exception as e:
-            print(f"Failed to connect to network {network_name}: {e}")
+                raise RuntimeError(f"Failed to connect to network {network_name}: {res.stderr}")
+            
+            # Check host resolution
+            try:
+                socket.getaddrinfo(container_name, 20211)
+            except socket.gaierror:
+                # Some environments take a second to propagate DNS
+                time.sleep(2)
+                try:
+                    socket.getaddrinfo(container_name, 20211)
+                except socket.gaierror as e:
+                    print(f"Warning: Could not resolve hostname {container_name} after connecting to network: {e}")
 
         # Wait for LDAP to become ready
         print("Waiting for LDAP server to accept connections...")

test/ui/test_ui_login.py

@@ -7,7 +7,6 @@
 import sys
 import os
 import time
-import subprocess
 
 import pytest
 from selenium.webdriver.common.by import By
@@ -18,45 +17,70 @@
 from .test_helpers import BASE_URL, wait_for_page_load  # noqa: E402
 
 
+def _is_setting_line(line, key):
+    """Return True only for 'KEY=value' lines, not 'KEY__metadata=...' lines."""
+    return line.startswith(key + "=") and not line.startswith(key + "__")
+
+
 @pytest.fixture(scope="module", autouse=True)
 def ensure_web_protection():
     """Ensure web protection is enabled for login tests and restored after."""
     config_path = "/data/config/app.conf"
-    
+
     # Read original state
     was_enabled = False
+    original_password_line = None
+    original_enable_line = None
+
     if os.path.exists(config_path):
         with open(config_path, "r") as f:
             for line in f:
-                if line.startswith("SETPWD_enable_password=") and "True" in line:
-                    was_enabled = True
-                    break
-    
+                if _is_setting_line(line, "SETPWD_enable_password"):
+                    original_enable_line = line
+                    if "true" in line.lower():
+                        was_enabled = True
+                elif _is_setting_line(line, "SETPWD_password"):
+                    original_password_line = line
+
     if not was_enabled:
-        # Enable web protection robustly via python
+        # Enable web protection — only replace value lines, preserve __metadata
         if os.path.exists(config_path):
             with open(config_path, "r") as f:
                 lines = f.readlines()
             with open(config_path, "w") as f:
                 for line in lines:
-                    if not line.startswith("SETPWD_enable_password") and not line.startswith("SETPWD_password"):
-                        f.write(line)
-                f.write("\nSETPWD_enable_password='true'\n")
-                f.write("SETPWD_password='8d969eef6ecad3c29a3a629280e686cf0c3f5d5a86aff3ca12020c923adc6c92'\n")
+                    if _is_setting_line(line, "SETPWD_enable_password"):
+                        continue  # will rewrite below
+                    if _is_setting_line(line, "SETPWD_password"):
+                        continue  # will rewrite below
+                    f.write(line)
+                f.write("SETPWD_enable_password=True\n")
+                if original_password_line:
+                    f.write(original_password_line)
+                else:
+                    f.write("SETPWD_password='8d969eef6ecad3c29a3a629280e686cf0c3f5d5a86aff3ca12020c923adc6c92'\n")
         time.sleep(2)  # Let disk sync catch up
-    
+
     yield
-    
-    # Restore original state
+
+    # Restore original state — only replace value lines, preserve __metadata
     if not was_enabled:
         if os.path.exists(config_path):
             with open(config_path, "r") as f:
                 lines = f.readlines()
             with open(config_path, "w") as f:
                 for line in lines:
-                    if not line.startswith("SETPWD_enable_password") and not line.startswith("SETPWD_password"):
-                        f.write(line)
-                f.write("\nSETPWD_enable_password='false'\n")
+                    if _is_setting_line(line, "SETPWD_enable_password"):
+                        continue
+                    if _is_setting_line(line, "SETPWD_password"):
+                        continue
+                    f.write(line)
+                if original_enable_line:
+                    f.write(original_enable_line)
+                else:
+                    f.write("SETPWD_enable_password=False\n")
+                if original_password_line:
+                    f.write(original_password_line)
 
 def get_login_password():
     """Get login password from config file or environment
@@ -108,7 +132,7 @@ def get_login_password():
             continue
 
     # If we couldn't determine the password from config, try default password
-    print("ℹ Password not determinable from config, falling back to default password...")
+    print("[i] Password not determinable from config, falling back to default password...")
 
     return "123456"