Commit Graph
8 Commits
Author SHA1 Message Date
maziggy 3fa9ed2b91 Add authentication to 200+ API endpoints (CVE-2026-25505)
Security fix for critical vulnerability (CVSS 9.8) where API endpoints
were accessible without authentication when auth was enabled.

Changes:
- Add RequirePermissionIfAuthEnabled() to all unprotected route files:
  archives, projects, settings, api_keys, groups, cloud, github_backup,
  support, notifications, notification_templates, maintenance, filaments,
  external_links, smart_plugs, discovery, firmware, kprofiles, camera,
  ams_history, pending_uploads, updates, spoolman, system, print_queue,
  printers
- Keep image-serving endpoints (thumbnails, timelapse, photos, camera
  streams, icons) unauthenticated since <img> tags cannot send headers
- Add backend integration tests for endpoint auth enforcement
- Add frontend tests for ownership-based permissions (canModify)

Fixes: CVE-2026-25505
2026-02-03 08:44:07 +01:00
maziggy 7eb6058928 Spoolman: Show "Open in Spoolman" for linked spools (Issue #210)
When a spool is already linked in Spoolman, the FilamentHoverCard now shows
"Open in Spoolman" button instead of "Link to Spoolman". This allows users
to quickly navigate to the spool's page in Spoolman for editing.

Changes:
- Add GET /api/v1/spoolman/spools/linked endpoint returning tag->spool_id map
- FilamentHoverCard shows "Open in Spoolman" when linkedSpoolId is set
- "Link to Spoolman" only shows when spool is not linked
- Fix unlinked spools detection to strip JSON quotes from empty tags
- Add toast notifications for link success/failure
- Invalidate linked-spools query after linking
- Add backend tests for linked spools endpoint
- Add frontend tests for LinkSpoolModal

Closes #210
2026-02-02 09:23:50 +01:00
maziggy 0caa68b77f Auto-create Spoolman 'tag' extra field on connect (Issue #123)
The 'tag' extra field is required in Spoolman for storing RFID/UUID
identifiers that link Bambu Lab spools to Spoolman entries. Previously,
users had to manually create this field in Spoolman, causing sync
failures for fresh installations.

Added ensure_tag_extra_field() method to SpoolmanClient that:
- Checks if the 'tag' field exists via GET /api/v1/field/spool/tag
- Creates it via POST if missing

The method is called automatically:
- On app startup when auto-connecting to Spoolman
- When user clicks "Connect" in Spoolman settings
2026-01-22 09:23:40 +01:00
maziggy 61c6473eca Fix Bambu Lab spool detection in Spoolman sync and AMS cards
The spool detection only checked tray_uuid and tag_uid, but some Bambu Lab
  spools have RFID read issues causing these to be missing while still having
  valid tray_info_idx (Bambu filament preset ID like "GFA00").

  Backend changes (backend/app/services/spoolman.py):
  - Add tray_info_idx to AMSTray dataclass
  - Parse tray_info_idx from raw MQTT data in parse_ams_tray()
  - Check tray_info_idx first in is_bambu_lab_spool() - most reliable indicator
  - Bambu Lab presets start with "GF" (GFA00, GFB00, GFL00, etc.)
  - Fall back to tray_uuid then tag_uid for unique spool identification
  - Add warning when Bambu spool detected but no unique ID for Spoolman

  Backend changes (backend/app/api/routes/spoolman.py):
  - Update /sync/{printer_id} and /sync-all to pass tray_info_idx
  - Guard against empty spool_tag when adding to tracking set

  Frontend changes (frontend/src/pages/PrintersPage.tsx):
  - Add isBambuLabSpool() helper with same detection logic as backend
  - Update all 4 vendor detection locations in AMS cards to use new helper

  Detection priority (same on frontend and backend):
  1. tray_info_idx starts with "GF" (Bambu preset ID)
  2. tray_uuid is valid 32-char hex (non-zero)
  3. tag_uid is valid 16-char hex (non-zero)
2026-01-15 16:23:09 +01:00
maziggy 6eedf55713 Fix Spoolman sync skipping Bambu Lab spools with missing tray_uuid
The spool detection logic only checked tray_uuid (32 hex chars) to identify
  Bambu Lab spools. Some spools have RFID read issues causing missing or
  invalid tray_uuid while still having valid tag_uid (16 hex chars).

  Changes:
  - Update is_bambu_lab_spool() to accept tag_uid as fallback parameter
  - Prefer tray_uuid for identification, fall back to tag_uid if invalid
  - Use whichever valid identifier for Spoolman tag storage and matching
  - Update both /sync/{printer_id} and /sync-all endpoints

  This fixes spools being incorrectly marked as "Non-Bambu Lab spool (no RFID
  tag)" when they have valid tag_uid but missing/zero tray_uuid.
2026-01-15 16:01:55 +01:00
maziggy b4bc046684 Clear Spoolman location when spool is removed from AMS
Previously, when syncing to Spoolman, the location field was set to the
  printer/AMS slot but was never cleared when the spool was removed from
  the AMS.

  Now during sync, the system tracks which tray UUIDs are currently in the
  AMS and clears the location for any spools that were previously at this
  printer but are no longer present.

  Changes:
  - Add clear_location parameter to update_spool() method
  - Add find_spools_by_location_prefix() to find spools at a printer
  - Add clear_location_for_removed_spools() to clear stale locations
  - Update sync_printer_ams and sync_all_printers endpoints to clear
    locations for removed spools after syncing
2026-01-09 07:43:40 +01:00
maziggy 5b8d24f2ce - Spoolman: Add link spool feature, UUID display, and sync feedback
- Link to Spoolman: Manually link existing Spoolman spools to AMS trays
    - Hover over AMS slot to see "Link to Spoolman" button
    - Select from list of unlinked Spoolman spools
    - Automatically sets extra.tag field in Spoolman
  - Spool UUID display: View and copy Bambu Lab spool UUID in AMS hover card
    - Shows first 8 chars with copy button (full UUID to clipboard)
    - Fallback copy method for HTTP contexts
  - Sync feedback: Shows synced count and skipped spools with reasons
    - Expandable list when more than 5 skipped
    - Color swatches for identification
  - Fixed Spoolman 400 Bad Request: extra field values must be valid JSON
  - Updated documentation (wiki, website)
2026-01-02 09:20:24 +01:00
Martin Ziegler a862958deb Added Spoolman support to add unknown Bambu Lab spools and track them 2025-11-30 19:30:14 +01:00