Ilker ManapandClaude Opus 5.5
0569ecf1cc
From a review of everything since v0.3.0: - NetBox's UI was served on Rollcall's origin, so a script in a NetBox page (stored XSS, a custom link) could read the Rollcall UI's stored admin token and call Rollcall's API with the admin certificate. It now has a listener of its own (ipam.ui_listen, default :8444): another origin. The Rollcall UI builds its NetBox links from that port. - The proxy dropped X-Rollcall-User but not X-Rollcall_User, which a WSGI server reads as the same HTTP_X_ROLLCALL_USER; every spelling is dropped now. - Deployed machines fetched the root bundle over TLS checked against the system's trust store: a public CA's certificate for the rack's name would have done. The refresh is pinned to the Rollcall roots installed on the machine and takes only CA certificates (tried on node001 and node002). - A NetBox device type NetBox will not resize (0U while its devices have positions) no longer stops those machines' device sync; it is logged. - A NetBox cable on a device whose machine is gone here rolled back all cable and switch sync; such cables are skipped. - Switch names are looked up in NetBox 50 at a time (a large site would outgrow one URL). - rack_units: "vendor model" wins over the bare model when both are set (map order chose before); cable precedence comments match the code. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>