mirror of
https://github.com/ruvnet/RuView
synced 2026-08-04 19:31:42 +00:00
ruv
c641fc44ae
Closes #520, #514, #443. ## #520 / #514 — stale Docker image, missing UI assets `ruvnet/wifi-densepose:latest` was published before `ui/observatory*` and `ui/pose-fusion*` were added; users see /app/ui missing those files and the v0.6+ packet format doesn't reach the server. Two fixes: 1. `docker/Dockerfile.rust` now `RUN`s a build-time guard after `COPY ui/` that fails the build if `index.html` / `observatory.html` / `pose-fusion.html` / `viz.html` (or the `observatory/` / `pose-fusion/` / `components/` / `services/` directories) are missing, plus an exec-bit check on `/app/sensing-server`. A stale image can never be silently produced again. 2. New `.github/workflows/sensing-server-docker.yml` rebuilds + pushes on every change to the Dockerfile, the server crate, the signal/vitals/ wifiscan crates, the workspace manifests, the `ui/` tree, or itself — plus `v*` tags and manual dispatch. Pushes to both `docker.io/ruvnet/ wifi-densepose` AND `ghcr.io/ruvnet/wifi-densepose` with `latest` + `vX.Y.Z` + `sha-<short>` tags, then post-push smoke-tests the artifact: /health, /api/v1/info, the observatory + pose-fusion HTML, AND the bearer-auth path (no token → 401, wrong → 401, correct → 200). Uses the `DOCKERHUB_USERNAME`/`DOCKERHUB_TOKEN` repo secrets; ghcr.io rides on the workflow's GITHUB_TOKEN. ## #443 — sensing-server REST API auth model QE security audit raised that 40+ /api/v1/* routes have no auth layer with a default `0.0.0.0` bind. New `wifi_densepose_sensing_server::bearer_auth` module + middleware: - Env-var-gated: `RUVIEW_API_TOKEN` unset/empty ⇒ middleware is a no-op (current LAN-mode behaviour preserved — **no default change**); set ⇒ every `/api/v1/*` request must carry `Authorization: Bearer <token>` or the server returns 401. - Constant-time byte compare via local `ct_eq` (no new dep). - `/health*`, `/ws/sensing`, and `/ui/*` are intentionally never gated (orchestrator probes + local browsers). - Startup logs which mode is active and warns when auth is ON with a `0.0.0.0` bind. - 8 unit tests on the middleware via `tower::ServiceExt::oneshot` (sensing-server lib tests 191 → 199, 0 failures). Verified locally: `cargo build --workspace --no-default-features` ✓, `cargo test -p wifi-densepose-sensing-server --no-default-features` ✓. Co-Authored-By: claude-flow <ruv@ruv.net>
57 lines
1.8 KiB
TOML
57 lines
1.8 KiB
TOML
[package]
|
|
name = "wifi-densepose-sensing-server"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
description = "Lightweight Axum server for WiFi sensing UI with RuVector signal processing"
|
|
license.workspace = true
|
|
authors = ["rUv <ruv@ruv.net>", "WiFi-DensePose Contributors"]
|
|
repository.workspace = true
|
|
documentation = "https://docs.rs/wifi-densepose-sensing-server"
|
|
keywords = ["wifi", "sensing", "server", "websocket", "csi"]
|
|
categories = ["web-programming::http-server", "science"]
|
|
readme = "README.md"
|
|
|
|
[lib]
|
|
name = "wifi_densepose_sensing_server"
|
|
path = "src/lib.rs"
|
|
|
|
[[bin]]
|
|
name = "sensing-server"
|
|
path = "src/main.rs"
|
|
|
|
[dependencies]
|
|
# Web framework
|
|
axum = { workspace = true }
|
|
tower-http = { version = "0.5", features = ["fs", "cors", "set-header"] }
|
|
tokio = { workspace = true, features = ["full", "process"] }
|
|
futures-util = "0.3"
|
|
ruvector-mincut = { workspace = true }
|
|
|
|
# Serialization
|
|
serde = { workspace = true }
|
|
serde_json.workspace = true
|
|
|
|
# Logging
|
|
tracing.workspace = true
|
|
tracing-subscriber = { workspace = true }
|
|
|
|
# Time
|
|
chrono = { version = "0.4", features = ["serde"] }
|
|
|
|
# CLI
|
|
clap = { workspace = true }
|
|
|
|
# Multi-BSSID WiFi scanning pipeline (ADR-022 Phase 3)
|
|
wifi-densepose-wifiscan = { version = "0.3.0", path = "../wifi-densepose-wifiscan" }
|
|
|
|
# Signal processing with RuvSense pose tracker (accuracy sprint).
|
|
# default-features = false drops the optional ndarray-linalg/BLAS chain so that
|
|
# `--no-default-features` at the workspace root can produce a Windows-friendly
|
|
# build without vcpkg/openblas (issue #366, #415).
|
|
wifi-densepose-signal = { version = "0.3.0", path = "../wifi-densepose-signal", default-features = false }
|
|
|
|
[dev-dependencies]
|
|
tempfile = "3.10"
|
|
# `tower::ServiceExt::oneshot` for in-process Router tests (bearer_auth).
|
|
tower = { workspace = true }
|