Merge branch 'master' into production

Author: Michael Schwarz

CLAUDE.md

@@ -314,6 +314,24 @@ job,function=stop_job event="{\"jobId\":123,\"cluster\":\"test\",\"startTime\":1
 - Messages are logged; no responses are sent back to publishers
 - If NATS client is unavailable, API subscriptions are skipped (logged as warning)
 
+### Security Considerations
+
+**The NATS API has no application-layer authentication or authorization.** Unlike
+the REST endpoints (which require a JWT with `RoleAPI`), the subscribers process
+any message delivered on the configured subjects. Anyone with publish rights to
+those subjects on the broker can:
+
+- Insert arbitrary jobs (potentially attributed to other users)
+- Mark running jobs as stopped, triggering archive/finalization
+- Overwrite node state and health metadata for any cluster
+
+Operators MUST restrict publish ACLs at the NATS broker (per-account or
+per-subject permissions) so that only trusted producers — e.g. the scheduler
+integration on a known host or service account — can publish to the configured
+`subject-job-event` and `subject-node-state` subjects. A shared, unrestricted
+NATS broker is not a safe deployment topology for this API. A startup warning
+is logged when these subscriptions are enabled.
+
 ## Development Guidelines
 
 ### Performance
@@ -323,6 +341,21 @@ records, archives) at scale. All code changes must prioritize maximum throughput
 and minimal latency. Avoid unnecessary allocations, prefer streaming over
 buffering, and be mindful of lock contention. When in doubt, benchmark.
 
+### Commit Message Convention
+
+Commits must use conventional commit prefixes so goreleaser can generate the
+changelog automatically. Only commits with these prefixes appear in releases:
+
+| Prefix  | Changelog group        |
+|---------|------------------------|
+| `feat:` | New Features           |
+| `fix:`  | Bug fixes              |
+| `sec:`  | Security updates       |
+| `docs:` | Documentation updates  |
+
+Scoped variants are also recognised, e.g. `feat(api):`, `fix(deps):`.
+Commits without one of these prefixes are excluded from the changelog.
+
 ### Change Impact Analysis
 
 For any significant change, you MUST:

Makefile

@@ -1,6 +1,6 @@
 TARGET = ./cc-backend
 FRONTEND = ./web/frontend
-VERSION = 1.5.3
+VERSION = 1.5.4
 GIT_HASH := $(shell git rev-parse --short HEAD || echo 'development')
 CURRENT_TIME = $(shell date +"%Y-%m-%d:T%H:%M:%S")
 LD_FLAGS = '-s -X main.date=${CURRENT_TIME} -X main.version=${VERSION} -X main.commit=${GIT_HASH}'

README.md

@@ -1,10 +1,9 @@
 # NOTE
 
-While we do our best to keep the master branch in a usable state, there is no guarantee the master branch works.
-Please do not use it for production!
+While we do our best to keep the main branch in a usable state, there is no
+guarantee the main branch works. Please do not use it for production!
 
-Please have a look at the [Release
-Notes](https://github.com/ClusterCockpit/cc-backend/blob/master/ReleaseNotes.md)
+Please have a look at the [Release Notes](https://github.com/ClusterCockpit/cc-backend/blob/main/ReleaseNotes.md)
 for breaking changes!
 
 # ClusterCockpit REST and GraphQL API backend
@@ -41,7 +40,7 @@ For real-time integration with HPC systems, the backend can subscribe to
 state updates, providing an alternative to REST API polling.
 
 Completed batch jobs are stored in a file-based job archive according to
-[this specification](https://github.com/ClusterCockpit/cc-specifications/tree/master/job-archive).
+[this specification](https://github.com/ClusterCockpit/cc-specifications/tree/main/job-archive).
 The backend supports authentication via local accounts, an external LDAP
 directory, and JWT tokens. Authorization for APIs is implemented with
 [JWT](https://jwt.io/) tokens created with public/private key encryption.
@@ -243,73 +242,73 @@ The effective configuration is logged at startup for verification.
 
 ## Project file structure
 
-- [`.github/`](https://github.com/ClusterCockpit/cc-backend/tree/master/.github)
+- [`.github/`](https://github.com/ClusterCockpit/cc-backend/tree/main/.github)
   GitHub Actions workflows and dependabot configuration for CI/CD.
-- [`api/`](https://github.com/ClusterCockpit/cc-backend/tree/master/api)
+- [`api/`](https://github.com/ClusterCockpit/cc-backend/tree/main/api)
   contains the API schema files for the REST and GraphQL APIs. The REST API is
   documented in the OpenAPI 3.0 format in
   [./api/swagger.yaml](./api/swagger.yaml). The GraphQL schema is in
   [./api/schema.graphqls](./api/schema.graphqls).
-- [`cmd/cc-backend`](https://github.com/ClusterCockpit/cc-backend/tree/master/cmd/cc-backend)
+- [`cmd/cc-backend`](https://github.com/ClusterCockpit/cc-backend/tree/main/cmd/cc-backend)
   contains the main application entry point and CLI implementation.
-- [`configs/`](https://github.com/ClusterCockpit/cc-backend/tree/master/configs)
+- [`configs/`](https://github.com/ClusterCockpit/cc-backend/tree/main/configs)
   contains documentation about configuration and command line options and required
   environment variables. Sample configuration files are provided.
-- [`init/`](https://github.com/ClusterCockpit/cc-backend/tree/master/init)
+- [`init/`](https://github.com/ClusterCockpit/cc-backend/tree/main/init)
   contains an example of setting up systemd for production use.
-- [`internal/`](https://github.com/ClusterCockpit/cc-backend/tree/master/internal)
+- [`internal/`](https://github.com/ClusterCockpit/cc-backend/tree/main/internal)
   contains library source code that is not intended for use by others.
-  - [`api`](https://github.com/ClusterCockpit/cc-backend/tree/master/internal/api)
+  - [`api`](https://github.com/ClusterCockpit/cc-backend/tree/main/internal/api)
     REST API handlers and NATS integration
-  - [`archiver`](https://github.com/ClusterCockpit/cc-backend/tree/master/internal/archiver)
+  - [`archiver`](https://github.com/ClusterCockpit/cc-backend/tree/main/internal/archiver)
     Job archiving functionality
-  - [`auth`](https://github.com/ClusterCockpit/cc-backend/tree/master/internal/auth)
+  - [`auth`](https://github.com/ClusterCockpit/cc-backend/tree/main/internal/auth)
     Authentication (local, LDAP, OIDC) and JWT token handling
-  - [`config`](https://github.com/ClusterCockpit/cc-backend/tree/master/internal/config)
+  - [`config`](https://github.com/ClusterCockpit/cc-backend/tree/main/internal/config)
     Configuration management and validation
-  - [`graph`](https://github.com/ClusterCockpit/cc-backend/tree/master/internal/graph)
+  - [`graph`](https://github.com/ClusterCockpit/cc-backend/tree/main/internal/graph)
     GraphQL schema and resolvers
-  - [`importer`](https://github.com/ClusterCockpit/cc-backend/tree/master/internal/importer)
+  - [`importer`](https://github.com/ClusterCockpit/cc-backend/tree/main/internal/importer)
     Job data import and database initialization
-  - [`metricdispatch`](https://github.com/ClusterCockpit/cc-backend/tree/master/internal/metricdispatch)
+  - [`metricdispatch`](https://github.com/ClusterCockpit/cc-backend/tree/main/internal/metricdispatch)
     Dispatches metric data loading to appropriate backends
-  - [`repository`](https://github.com/ClusterCockpit/cc-backend/tree/master/internal/repository)
+  - [`repository`](https://github.com/ClusterCockpit/cc-backend/tree/main/internal/repository)
     Database repository layer for jobs and metadata
-  - [`routerConfig`](https://github.com/ClusterCockpit/cc-backend/tree/master/internal/routerConfig)
+  - [`routerConfig`](https://github.com/ClusterCockpit/cc-backend/tree/main/internal/routerConfig)
     HTTP router configuration and middleware
-  - [`tagger`](https://github.com/ClusterCockpit/cc-backend/tree/master/internal/tagger)
+  - [`tagger`](https://github.com/ClusterCockpit/cc-backend/tree/main/internal/tagger)
     Job classification and application detection
-  - [`taskmanager`](https://github.com/ClusterCockpit/cc-backend/tree/master/internal/taskmanager)
+  - [`taskmanager`](https://github.com/ClusterCockpit/cc-backend/tree/main/internal/taskmanager)
     Background task management and scheduled jobs
-  - [`metricstoreclient`](https://github.com/ClusterCockpit/cc-backend/tree/master/internal/metricstoreclient)
+  - [`metricstoreclient`](https://github.com/ClusterCockpit/cc-backend/tree/main/internal/metricstoreclient)
     Client for cc-metric-store queries
-- [`pkg/`](https://github.com/ClusterCockpit/cc-backend/tree/master/pkg)
+- [`pkg/`](https://github.com/ClusterCockpit/cc-backend/tree/main/pkg)
   contains Go packages that can be used by other projects.
-  - [`archive`](https://github.com/ClusterCockpit/cc-backend/tree/master/pkg/archive)
+  - [`archive`](https://github.com/ClusterCockpit/cc-backend/tree/main/pkg/archive)
     Job archive backend implementations (filesystem, S3, SQLite)
-  - [`metricstore`](https://github.com/ClusterCockpit/cc-backend/tree/master/pkg/metricstore)
+  - [`metricstore`](https://github.com/ClusterCockpit/cc-backend/tree/main/pkg/metricstore)
     In-memory metric data store with checkpointing and metric loading
-- [`tools/`](https://github.com/ClusterCockpit/cc-backend/tree/master/tools)
+- [`tools/`](https://github.com/ClusterCockpit/cc-backend/tree/main/tools)
   Additional command line helper tools.
-  - [`archive-manager`](https://github.com/ClusterCockpit/cc-backend/tree/master/tools/archive-manager)
+  - [`archive-manager`](https://github.com/ClusterCockpit/cc-backend/tree/main/tools/archive-manager)
     Commands for getting infos about an existing job archive, importing jobs
     between archive backends, and converting archives between JSON and Parquet formats.
-  - [`archive-migration`](https://github.com/ClusterCockpit/cc-backend/tree/master/tools/archive-migration)
+  - [`archive-migration`](https://github.com/ClusterCockpit/cc-backend/tree/main/tools/archive-migration)
     Tool for migrating job archives between formats.
-  - [`convert-pem-pubkey`](https://github.com/ClusterCockpit/cc-backend/tree/master/tools/convert-pem-pubkey)
+  - [`convert-pem-pubkey`](https://github.com/ClusterCockpit/cc-backend/tree/main/tools/convert-pem-pubkey)
     Tool to convert external pubkey for use in `cc-backend`.
-  - [`gen-keypair`](https://github.com/ClusterCockpit/cc-backend/tree/master/tools/gen-keypair)
+  - [`gen-keypair`](https://github.com/ClusterCockpit/cc-backend/tree/main/tools/gen-keypair)
     contains a small application to generate a compatible JWT keypair. You find
     documentation on how to use it
-    [here](https://github.com/ClusterCockpit/cc-backend/blob/master/docs/JWT-Handling.md).
-- [`web/`](https://github.com/ClusterCockpit/cc-backend/tree/master/web)
-  Server-side templates and frontend-related files:
-  - [`frontend`](https://github.com/ClusterCockpit/cc-backend/tree/master/web/frontend)
+    [here](https://github.com/ClusterCockpit/cc-backend/blob/main/docs/JWT-Handling.md).
+  - [`web/`](https://github.com/ClusterCockpit/cc-backend/tree/main/web)
+    Server-side templates and frontend-related files:
+  - [`frontend`](https://github.com/ClusterCockpit/cc-backend/tree/main/web/frontend)
     Svelte components and static assets for the frontend UI
-  - [`templates`](https://github.com/ClusterCockpit/cc-backend/tree/master/web/templates)
+  - [`templates`](https://github.com/ClusterCockpit/cc-backend/tree/main/web/templates)
     Server-side Go templates, including monitoring views
-- [`gqlgen.yml`](https://github.com/ClusterCockpit/cc-backend/blob/master/gqlgen.yml)
+- [`gqlgen.yml`](https://github.com/ClusterCockpit/cc-backend/blob/main/gqlgen.yml)
   Configures the behaviour and generation of
   [gqlgen](https://github.com/99designs/gqlgen).
-- [`startDemo.sh`](https://github.com/ClusterCockpit/cc-backend/blob/master/startDemo.sh)
+- [`startDemo.sh`](https://github.com/ClusterCockpit/cc-backend/blob/main/startDemo.sh)
   is a shell script that sets up demo data, and builds and starts `cc-backend`.

ReleaseNotes.md

@@ -1,9 +1,9 @@
-# `cc-backend` version 1.5.3
+# `cc-backend` version 1.5.4
 
 Supports job archive version 3 and database version 11.
 
-This is a bugfix release of `cc-backend`, the API backend and frontend
-implementation of ClusterCockpit.
+This is a security and bugfix release of `cc-backend`, the API backend and
+frontend implementation of ClusterCockpit.
 For release specific notes visit the [ClusterCockpit Documentation](https://clusterockpit.org/docs/release/).
 If you are upgrading from v1.5.1 no database migration is required.
 If you are upgrading from v1.5.0 you need to do another DB migration. This
@@ -15,6 +15,75 @@ While we are confident that the memory issue with the metricstore cleanup move
 policy is fixed, it is still recommended to use delete policy for cleanup.
 This is also the default.
 
+## Changes in 1.5.4
+
+### Security fixes
+
+- **JWT HMAC empty-key bypass (critical)**: `jwtSession.go` now refuses to
+  register when `CROSS_LOGIN_JWT_HS512_KEY` is unset. Previously, an empty HMAC
+  key allowed unauthenticated admin token forgery because `golang-jwt` verifies
+  any HS256/HS512 signature against an empty key.
+- **SQL injection via metric names (critical)**: Metric names supplied through
+  GraphQL (`[String!]`) were interpolated raw into `json_extract` SQL expressions.
+  Names are now validated against `^[a-zA-Z0-9_]+$` in
+  `jobsMetricStatisticsHistogram` and `buildFloatJSONCondition`.
+- **Path traversal via line-protocol tags (critical)**: `cluster` and `host`
+  tags from the metric line protocol flowed unvalidated into `path.Join` for
+  checkpoint/WAL file paths, enabling arbitrary file writes outside the
+  checkpoint root via NATS (unauthenticated) or `POST /api/write`. Path-traversal
+  sequences are now rejected in `DecodeLine` before the tags become path
+  components.
+- **CORS `AllowCredentials` disabled**: CORS middleware no longer sets
+  `AllowCredentials: true`, which was incompatible with `AllowedOrigins: ["*"]`
+  and could enable cross-origin credential theft.
+- **HSTS header added**: `Strict-Transport-Security` is now set for all
+  HTTPS connections.
+- **Security response headers**: Added `X-Content-Type-Options: nosniff`,
+  `X-Frame-Options: DENY`, `Referrer-Policy: same-origin`, and a conservative
+  `Content-Security-Policy` (blocks `frame-ancestors`, `object-src`, `base-uri`)
+  to harden against clickjacking and base-tag injection.
+- **Stored XSS in job message**: `job.metaData.message` is now rendered as
+  escaped text (CSS `white-space: pre-wrap`) instead of raw `{@html ...}` in
+  `Job.root` and `JobFootprint`.
+- **SQL injection in tag queries**: The tag-scope `IN` list and manager project
+  subquery in `CountTags` are now parameterized instead of interpolating
+  `user.Username` / `user.Projects` values sourced from OIDC/LDAP.
+- **GraphQL DoS hardening**: Query cost is bounded with `FixedComplexityLimit`
+  (5000). Non-positive `items-per-page` and `page` values are rejected with HTTP
+  400 to prevent integer underflow into unbounded `LIMIT`/`OFFSET` queries.
+- **CSRF defense-in-depth**: State-changing requests with a cross-site
+  `Sec-Fetch-Site` header are now rejected (fails open for non-browser clients),
+  complementing the existing `SameSite=Lax` session cookie.
+- **NATS API security warning**: A startup warning is now logged when NATS
+  subscriptions are enabled, reminding operators that the NATS API has no
+  application-layer authentication and that publish ACLs must be restricted at
+  the broker.
+
+### Bug fixes
+
+- **Roofline legend placement**: Roofline plot legends now use fixed
+  coordinates instead of dynamic placement, preventing the legend from
+  overlapping data points or being rendered off-canvas (#546).
+- **Subcluster usage tab labels**: Subcluster names in the status dashboard
+  usage tabs are no longer force-capitalized; the original cluster-defined
+  casing is preserved.
+- **NodeListRow host filter**: The running-jobs query in the node list row now
+  filters by exact node hostname (`eq`) instead of substring match
+  (`contains`), avoiding incorrect matches when one hostname is a prefix of
+  another.
+- **WAL files not reset on shutdown**: On graceful shutdown the metricstore wrote
+  a final binary snapshot but never rotated the per-host `current.wal` files (the
+  `RotateWALFilesAfterShutdown` helper was defined but never called). The stale
+  WAL files were replayed and then appended to again on the next start, so they
+  grew without bound across restarts and were only ever reset at the next periodic
+  checkpoint. `Shutdown` now rotates the WAL files for all successfully
+  snapshotted hosts.
+
+### Dependencies
+
+- **Go module upgrades**: Refreshed Go module dependencies to their latest
+  compatible versions.
+
 ## Changes in 1.5.3
 
 ### Bug fixes