hammy275/comp-status

A set of programs to view the status and resource usage of computers.

comp-status's Issues

Proper Rate-Limiting

API Refactor

API endpoints should be in /api/, and have much more sensible names.

Too Much /give_data

The setTimeout should only be setup once!

Move to SQLite

Use that Timestamp

In preparation for future use, a timestamp exists (and is sent to clients) of when the given server information was generated. This should be used, changing the color of the name of the PC as the time gets older and older (specifying the time since last request if longer than 30 secs or a minute have passed).

Turbo on Windows

Turbo boost knowledge just doesn't work on Windows, so it should be hidden from view in the Web-UI, and not sent to the central-server by the server.

Preview Image

Image of the UI on the README

Database Lock

To prevent the server manager and the central-server itself from trying to compete over the database file, a lock should be implemented so both programs can't access it at the same time.

Leaking Tokens

This issue is being opened even though the bug has already been patched.

Long story short, since implementing the authentication system, when central-server would store the data associated with a computer as received from server, it would also store that server's token! A patch was released a couple hours earlier today, but the vulnerability itself was pretty bad; anyone with a valid login could use client to obtain any token used by a server!

Issue has been patched, this will be closed as soon as its opened.

Don't send cookies in requests

Allow enabling/disabling of CORS

Fix Modal Stuff

Items that come after the modal button will still be interactable and not be grayed out when bringing up a modal. This should seriously be fixed!

Header + Login

We should use a login page instead of a page to punch it in alongside computer information. Additionally, there should be a Navigation Bar at the top for navigating pages and showing the status that used to be in the status box.

Make the Site Look Better

Will be needed for #34.

Will probably stick with Bulma, just going to try to tune the dark mode to look nicer, and really polish out the layout of everything.

Invalid Username/password Bug

If a temporary-token expires through a central-server restart, the web UI reports an invalid username/password. This needs to be replaced with an error stating the need to retrieve a temporary-token, or not displaying anything to the user.

Ping on boot

Ping on boot. If it fails, ask for IP address. There should also be the ability to "lock" the IP address, so the prompt won't occur unless "settings.json" is deleted or corrupted, even if several pings fail.

Permanent Token Pollution

Since permanent tokens literally last forever, we need to take some measures to prevent a giant amount of them from being generated. Ideas include:

• Allowing an auth flow of username/password --> temp-token --> comp-status requests, so people not using cookies on the web client don't need to worry about creating a ton of tokens. Note that on cookie switch, we should attempt to automatically delete our token.
• 1 permanent token per account. This way, the token represents the user, and can be deleted easily instead of guessing the token in the case of an attack on the user's permanent token.

Setup Instructions

There are literally no instructions to set this up, they should be made and put on the Wiki!!

Finish LICENSE

Add LICENSE information at the top of source files and stuff. Probably also add a copyright notice or something.

Work on Computers without "coretemp"

On some systems, psutil.sensors_temperatures() won't return a coretemp, this needs to be accounted for.

Android Client

The original purpose of this project was to have an app that could allow monitoring of computer usage at a quick glance. Now that security is done with to the best of my abilities, it's time I get this done.

User management in web ui

Need a new permission for this.
Would also be nice for server manager to have the ability to change permissions of users.

Fix Bad Colors

The colors for high CPU usage and such are reversed

Token Manager Improvements

• Let the delete button actually stay on the side of the dropdown menu
• For the permanent tokens, show the user said token is assigned to
• On token delete, remove it from the dropdown menu client-side without having to refresh.

Get Computer Data on Page Load

User types

A user should be a "computer user" (can only send data to central-server), "regular user" (takes computer data from central-server), or "both". This won't be a type thing, rather will use the permissions system

ipAddress Storage Key Not Cleared Properly

If one logs in without a custom IP, the custom IP field isn't cleared. This means on refresh, the site assumes that we DO want to use a custom IP if we ever used one in the past!

Manage Tokens in Web UI

Swagger/OpenAPI Docs

Now that the API is refactored to make more sense (#40), some API docs should be made.

Old Computer Removal

We should allow the removal of computers from the computer dictionary when they are offline (probably manually)

Redirect to Login Page when Logged Out

Decrease `server` report speed to every 3-ish seconds

The Web UI needs a Darkmode

Or at least a dark background, like seriously.

Auto-Login with Perma Token

Attempt login if we have a perma token already from cookies.

To my knowledge, this is fixing a regression.

Turn Managers into In-Window Pop-Ups

Should hopefully lead to a much cleaner web UI.

Delete Temp-Token on Logout

This would require users to be able to delete their own tokens. Put simply, this would prevent tons of temporary tokens from polluting the list of tokens.

Clean up web request logic

Permanent token system

Username + password gets permanent token. Permanent token retrieves 24 hour lasting tokens. 24 hour lasting tokens used for doing things. Both types are revokable.

Temporary Token Labels

Permanent tokens are labeled the assigned user in the web UI. The same should be done for temporary tokens.

Windows Server

Requires completion of #10

CPU Usage per Core

First Time Setup Wizard

With the DOCKERFILE (most likely) coming soon, it would be pretty nice to not have to launch a shell in the container to do first time setup.

As such, the web UI should present a first time setup if the database is not configured, and hasn't been previously configured.

Page Refresh Removes Everything But Login Even Though We're Logged In With Permissions

1.0.0 Release

Right now, comp-status releases purely by commit. There needs to be releases!

Configuration

Central server needs some configuration options like a custom port!

Make IP Address Optional

If not specified, just send API requests to /endpoint.

Store in Local Storage Instead of Cookies

We should move everything to Local Storage. This way, we aren't sending the cookies to the server when the server doesn't even care about them.

Make Usernames Not Case-Sensitive

Usernames aren't passwords, they don't need to be case-sensitive.

Use JSON for Communications

Currently, any information being sent to central-server has to be a Python dict. This should be changed to JSON to make writing clients for languages other than Python easier.

AUTHENTICATION

I'll probably make a simple username and password authentication. For both the server and client, a username and password is sent to the central-server, which returns a token for future use.

Since I don't have the technical nor mathematical knowledge currently to create tokens that properly decrypt server-side, they will instead be a randomly generated string of characters, which expire when the central-server shuts down.

No way I'm going to do this right, but there's a first time for everything.