Function _rusense_inactivity_check

webapp_modern.py:624–679

Health-mode safety net — the INVERSE of the presence alert. Fires when a home that should be occupied shows NO activity for N awake-hours (a fall, not getting out of bed). The quiet/sleep window is excluded: the gap is measured from the LATER of the last real activity or this morning's

(po, notify_on, now, present)

            '/api/wardriving/bluetooth', '/api/wardriving/cells',
            '/api/wardriving/diagnostics',
        )
        write_api = ('/api/wardriving/stop', '/api/system/restart-service')
        if path in ('/', '/wardrive') or (request.method == 'GET' and path in readonly_api):
            return
        if request.method == 'POST' and path in write_api:
            return

    # Kiosk loopback bypass: any request originating from the Pi itself
    # (the on-screen kiosk runs chromium pointed at localhost) bypasses auth.
    # Anyone with local access already has shell on the device, so this
    # adds no attack surface vs. the existing network-facing auth.
    if request.remote_addr in ('127.0.0.1', '::1') and shared_data.config.get('kiosk_enabled'):
        return

    # Mesh machine auth: let a *peer Ragnar* reach this node's mesh endpoints
    # without a session. Identity is proven by WireGuard, not by a shared
    # secret — tailscaled tells us which tailnet node owns the source IP, and
    # we require that node to carry the mesh tag. Scoped hard on purpose:
    #   * reads — any GET under /api/mesh/* (observe the unit's data);
    #   * one write — POST /api/mesh/control ONLY, whose body is itself an
    #     allowlist (start/stop the four monitors, nothing else). Matched by
    #     exact path so join/leave/serve/peer-control stay session-only;
    #   * every other route stays session-gated;
    #   * fails closed — no tailscaled, no answer, or no tag means 401.
    # Tailnet membership alone is NOT enough. Every laptop and phone on the
    # tailnet would otherwise inherit Ragnar's full offensive toolset.
    if shared_data.config.get('mesh_enabled'):
        peer_read = request.method == 'GET' and path.startswith('/api/mesh/')
        peer_control = request.method == 'POST' and path == '/api/mesh/control'
        # Scan delegation writes a peer may make: start a scan on this unit, and
        # cancel one it started. Both exact-path allowlisted (cancel by prefix +
        # id) — this is the "worker" role. The operator's own scan endpoints
        # (/api/vuln-advanced/*) stay session-only, so a peer can run a
        # delegated scan here but can't drive this unit's UI.
        peer_scan_write = request.method == 'POST' and (
            path == '/api/mesh/scan/start'
            or path.startswith('/api/mesh/scan/cancel/'))
        # The fleet-update fan-out: a peer's "Update mesh" lands here to run this
        # unit's own git update. Exact-path allowlisted like the control write, and
        # the handler only ever runs git_updater against this checkout — a peer
        # cannot pick what runs, only that an update runs.
        peer_update = request.method == 'POST' and path == '/api/mesh/update'
        # File transfer: a peer may push a file to this unit's quarantined inbox.
        # Exact-path allowlisted; the handler itself only ever writes into the
        # inbox (never a live path) and can be turned off (mesh_file_receive).
        peer_file_push = request.method == 'POST' and path == '/api/mesh/files/push'
        if (peer_read or peer_control or peer_scan_write or peer_update
                or peer_file_push) and _is_mesh_peer_request():
            return

        # Share-only guest role. A device carrying the SHARE tag (tag:ragnar-share)
        # but NOT the mesh tag may ONLY drop a file into this unit's inbox — no
        # roster, no reads, no scans, no control. It never appears as a mesh unit
        # and cannot enumerate anything about this box. Optionally (operator
        # opt-in) it may also browse/fetch this unit's Mesh Share folder. The push
        # handler still honours mesh_file_receive, so "stop accepting" also stops
        # guests. Exact-path allowlisted and fail-closed.
        share_push = request.method == 'POST' and path == '/api/mesh/files/push'