Function sync_vulnerability_count

webapp_modern.py:3132–3273

Synchronize vulnerability count across all data sources and network intelligence

()

            # card, and counting it here would contradict that.
            'degraded': sum(1 for p in ragnar_peers if p['online']
                            and p.get('health') is not None
                            and not p['health'].get('reachable')),
            'duplicate_unit_ids': duplicates,
            'duplicate_names': duplicate_names,
            'unnumbered_units': unnumbered,
            # Mesh-wide health, rolled up server-side so a fleet of thousands is
            # one small object here instead of the browser crunching every node.
            'health': health_rollup,
        },
    })


@app.route('/api/mesh/control', methods=['POST'])
def mesh_control():
    """Start/stop one of this unit's monitors — the mesh's write endpoint.

    Reachable two ways, both trusted:
      * a tagged peer Ragnar over the tailnet (the auth bypass in
        check_authentication lets THIS one POST through on WireGuard identity);
      * the local operator with a session (self-control, no network hop).

    Everything actuable is allowlisted in `_mesh_apply_control`; there is no way
    to reach an arbitrary route from here.
    """
    if not mesh_available:
        return jsonify({'success': False, 'error': 'mesh_manager unavailable'}), 503
    data = request.get_json(silent=True) or {}
    result = _mesh_apply_control(data.get('feature'), data.get('action'))
    return jsonify(result), (200 if result.get('success') else 400)


@app.route('/api/mesh/peer-control', methods=['POST'])
def mesh_peer_control():
    """Operator-facing proxy: tell a *peer* unit to start/stop a monitor.

    The browser can't dial a peer's tailnet IP (it isn't on the tailnet — that's
    the whole reason peer data is pulled server-side), so this unit relays the
    command over the tailnet on the operator's behalf, exactly as it relays
    polls. A command aimed at THIS unit is applied directly with no network hop.
    """
    if not mesh_available:
        return jsonify({'success': False, 'error': 'mesh_manager unavailable'}), 503
    if not _mesh_enabled():
        return jsonify({'success': False, 'error': 'Mesh is not enabled on this unit.'}), 400
    data = request.get_json(silent=True) or {}
    feature = (data.get('feature') or '').strip().lower()
    action = (data.get('action') or '').strip().lower()
    node_id = (data.get('node_id') or '').strip()
    if feature not in _MESH_CONTROLLABLE:
        return jsonify({'success': False, 'error': f'Unknown feature {feature!r}.'}), 400
    if action not in ('start', 'stop'):
        return jsonify({'success': False, 'error': f'Unknown action {action!r}.'}), 400

    # Everything below can touch Tailscale/the network, so guard it: this route
    # must ALWAYS return JSON. A 500 HTML error page here is what surfaces in the
    # browser as an opaque "SyntaxError: The string did not match the expected
    # pattern" when the client tries to parse it, hiding the real cause.
    try: