Merge branch 'release/v12.0.0' of https://github.com/utmstack/UTMStack into release/v12.0.0

Author: Kbayero

agent-manager/agent/agent_imp.go

@@ -261,13 +261,16 @@ func (s *AgentService) ListAgents(ctx context.Context, req *ListRequest) (*ListA
 
 	// Scoped by the caller: the panel asks for one tenant, and only the
 	// platform asks for all of them.
-	where := ""
 	if req.GetTenantId() != "" {
-		where = fmt.Sprintf("tenant_id = '%s'", sanitizeTenant(req.GetTenantId()))
+		filter = append(filter, utils.Filter{
+			Field: "tenant_id",
+			Op: utils.Is,
+			Value:sanitizeTenant(req.GetTenantId()),
+		})
 	}
 
 	agents := []models.Agent{}
-	total, err := s.DBConnection.GetByPagination(&agents, page, filter, where, false)
+	total, err := s.DBConnection.GetByPagination(&agents, page, filter, "", false)
 	if err != nil {
 		catcher.Error("failed to fetch agents", err, map[string]any{"process": "agent-manager"})
 		return nil, status.Errorf(codes.Internal, "failed to fetch agents: %v", err)

agent-manager/agent/collector_imp.go

@@ -258,13 +258,16 @@ func (s *CollectorService) ListCollector(ctx context.Context, req *ListRequest)
 
 	// Scoped by the caller: the panel asks for one tenant, and only the
 	// platform asks for all of them.
-	where := ""
 	if req.GetTenantId() != "" {
-		where = fmt.Sprintf("tenant_id = '%s'", sanitizeTenant(req.GetTenantId()))
+		filter = append(filter, utils.Filter{
+			Field: "tenant_id",
+			Op: utils.Is,
+			Value:sanitizeTenant(req.GetTenantId()),
+		})
 	}
 
 	collectors := []models.Collector{}
-	total, err := s.DBConnection.GetByPagination(&collectors, page, filter, where, false)
+	total, err := s.DBConnection.GetByPagination(&collectors, page, filter, "", false)
 	if err != nil {
 		catcher.Error("failed to fetch collectors", err, map[string]any{"process": "agent-manager"})
 		return nil, status.Errorf(codes.Internal, "failed to fetch collectors: %v", err)

backend/main.go

@@ -38,9 +38,11 @@ func main() {
 
 	modules := initModules(db, cfg)
 
-	adminEmail := env.String("UTMSTACK_ADMIN_EMAIL", "admin@localhost", false)
+	adminEmail := env.String("UTMSTACK_ADMIN_EMAIL", "admin", false)
 	created, err := modules.tenant.GetBootstrapUsecase().EnsureDefaultTenant(
-		appCtx, adminEmail, env.String("UTMSTACK_ADMIN_PASSWORD", "", false))
+		appCtx, adminEmail,
+		env.String("UTMSTACK_ADMIN_PASSWORD", "", false),
+		env.String("UTMSTACK_DEFAULT_DOMAIN", "", false))
 	if err != nil {
 		_ = catcher.Error("failed to create the default tenant", err, nil)
 		panic(err)

backend/modules/alerts/domain/alert.go

@@ -137,6 +137,7 @@ type UtmAlert struct {
 	StatusObservation string          `json:"statusObservation,omitempty"`
 	Impact            *Impact         `json:"impact,omitempty"`
 	ImpactScore       int             `json:"impactScore,omitempty"`
+	Echoes            int64           `json:"echoes,omitempty"`
 	Adversary         *Side           `json:"adversary,omitempty"`
 	Target            *Side           `json:"target,omitempty"`
 	LastEvent         json.RawMessage `json:"lastEvent,omitempty"`

backend/modules/appconfig/connectors/repository.go

@@ -11,4 +11,8 @@ type Repository interface {
 	GetByKey(ctx context.Context, key string) (*domain.Config, error)
 	GetOwn(ctx context.Context, key string) (*domain.Config, error)
 	Save(ctx context.Context, c *domain.Config) error
+	// CountValueContains returns how many rows for `key` (across all tenants)
+	// have `needle` as a substring of their JSON value. Used to check whether
+	// a branding asset URL is still referenced before deleting its file.
+	CountValueContains(ctx context.Context, key, needle string) (int, error)
 }

backend/modules/appconfig/connectors/usecase.go

@@ -19,7 +19,11 @@ type BrandingUsecase interface {
 	Get(ctx context.Context) (*dto.BrandingResponse, error)
 	Update(ctx context.Context, actor string, req dto.BrandingRequest) (*dto.BrandingResponse, error)
 	Seed(ctx context.Context, req dto.BrandingRequest) (*dto.BrandingResponse, error)
-	SetAsset(ctx context.Context, actor, slot, url string) (*dto.BrandingResponse, error)
+	// SetAsset returns the updated branding plus the URL previously stored in
+	// `slot` (empty if none). Callers use the previous URL to garbage-collect
+	// the now-unreferenced file.
+	SetAsset(ctx context.Context, actor, slot, url string) (resp *dto.BrandingResponse, previousURL string, err error)
+	IsBrandingAssetReferenced(ctx context.Context, url string) (bool, error)
 	GetPublic(ctx context.Context) (*dto.BrandingPublic, error)
 	BrandNameProvider
 }

backend/modules/appconfig/handler/branding_assets.go

@@ -2,6 +2,7 @@ package handler
 
 import (
 	"bytes"
+	"context"
 	"crypto/rand"
 	"encoding/hex"
 	"errors"
@@ -99,24 +100,25 @@ func (h *BrandingHandler) storeBrandingFile(slot string, fh *multipart.FileHeade
 		return "", err
 	}
 
-	// Best-effort: drop older files for this slot so they don't accumulate.
-	deleteBrandingFilesExcept(dir, slot+"-", filename)
 	return brandingURLPrefix + "/" + filename, nil
 }
 
-func deleteBrandingFilesExcept(dir, prefix, keep string) {
-	entries, err := os.ReadDir(dir)
-	if err != nil {
+// removeIfUnreferenced deletes the file backing `url` when no tenant's branding
+// row still references it. `url` must be a stored branding URL (returned by
+// storeBrandingFile) — external URLs are ignored.
+func (h *BrandingHandler) removeIfUnreferenced(ctx context.Context, url string) {
+	if !strings.HasPrefix(url, brandingURLPrefix+"/") {
 		return
 	}
-	for _, e := range entries {
-		if e.IsDir() {
-			continue
-		}
-		if name := e.Name(); strings.HasPrefix(name, prefix) && name != keep {
-			_ = os.Remove(filepath.Join(dir, name))
-		}
+	referenced, err := h.usecase.IsBrandingAssetReferenced(ctx, url)
+	if err != nil || referenced {
+		return
+	}
+	name := strings.TrimPrefix(url, brandingURLPrefix+"/")
+	if name == "" || strings.ContainsAny(name, "/\\") {
+		return
 	}
+	_ = os.Remove(filepath.Join(h.uploadDir, brandingSubdir, name))
 }
 
 // UploadAsset godoc
@@ -155,7 +157,7 @@ func (h *BrandingHandler) UploadAsset(c *gin.Context) {
 		c.JSON(http.StatusUnsupportedMediaType, gin.H{"error": err.Error()})
 		return
 	}
-	resp, err := h.usecase.SetAsset(c.Request.Context(), c.GetString("user_email"), slot, url)
+	resp, previous, err := h.usecase.SetAsset(c.Request.Context(), c.GetString("user_email"), slot, url)
 	audit.Record(c, audit_connectors.Event{Action: "branding.asset.uploaded", ResourceType: "branding", ResourceID: slot},
 		audit_domain.CONFIG_CHANGED, audit_domain.CONFIG_CHANGED, err)
 	if errors.Is(err, usecase.ErrUnknownAssetSlot) {
@@ -167,6 +169,9 @@ func (h *BrandingHandler) UploadAsset(c *gin.Context) {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "could not save asset"})
 		return
 	}
+	if previous != "" && previous != url {
+		h.removeIfUnreferenced(c.Request.Context(), previous)
+	}
 	c.JSON(http.StatusOK, resp)
 }
 

backend/modules/appconfig/handler/bulk_branding.go

@@ -141,14 +141,21 @@ func (h *BulkBrandingHandler) UploadAsset(c *gin.Context) {
 	}
 	actorEmail := c.GetString("user_email")
 	var result common_models.BulkResult
+	replaced := make(map[string]struct{})
 	for _, tid := range tenantIDs {
 		// ponytail: skip default (platform-plane) tenant — bulk calls must not silently overwrite operator branding
 		if tid == authz.DefaultTenantID {
 			continue
 		}
 		ctx := authz.WithTenantID(c.Request.Context(), tid)
-		_, err := h.brand.SetAsset(ctx, actorEmail, slot, url)
+		_, previous, err := h.brand.SetAsset(ctx, actorEmail, slot, url)
 		result.Append(tid, err)
+		if err == nil && previous != "" && previous != url {
+			replaced[previous] = struct{}{}
+		}
+	}
+	for previous := range replaced {
+		bh.removeIfUnreferenced(c.Request.Context(), previous)
 	}
 	c.JSON(http.StatusOK, result)
 }

backend/modules/appconfig/repository/config.go

@@ -99,6 +99,21 @@ func (r *pgRepo) GetOwn(ctx context.Context, key string) (*domain.Config, error)
 	return &c, nil
 }
 
+// CountValueContains counts rows for `key` across every tenant whose JSON value
+// contains `needle`. Branding URLs carry a 16-hex-char nonce, so a substring
+// match is unambiguous — no other row's value can collide.
+func (r *pgRepo) CountValueContains(ctx context.Context, key, needle string) (int, error) {
+	var n int64
+	err := r.db.WithContext(tenancy.WithAllTenantsRead(ctx)).
+		Model(&domain.Config{}).
+		Where("key = ? AND value LIKE ?", key, "%"+needle+"%").
+		Count(&n).Error
+	if err != nil {
+		return 0, err
+	}
+	return int(n), nil
+}
+
 func (r *pgRepo) Save(ctx context.Context, c *domain.Config) error {
 	tenant := actingTenant(ctx)
 

backend/modules/appconfig/usecase/branding.go

@@ -51,10 +51,11 @@ func (s *brandingService) isWhiteLabelEntitled(_ context.Context) bool {
 }
 
 // read loads the stored branding (JSON in the `branding` config row), falling
-// back to defaults when unset or unparseable.
+// back to defaults when unset or unparseable. Uses GetOwn so a tenant without
+// its own row gets defaults instead of inheriting the master tenant's brand.
 func (s *brandingService) read(ctx context.Context) (dto.BrandingResponse, error) {
 	resp := dto.BrandingResponse{ProductName: defaultProductName}
-	row, err := s.repo.GetByKey(ctx, brandingConfigKey)
+	row, err := s.repo.GetOwn(ctx, brandingConfigKey)
 	if err != nil {
 		return resp, err
 	}
@@ -133,29 +134,44 @@ func (s *brandingService) Seed(ctx context.Context, req dto.BrandingRequest) (*d
 	return &resp, nil
 }
 
-func (s *brandingService) SetAsset(ctx context.Context, actor, slot, url string) (*dto.BrandingResponse, error) {
+func (s *brandingService) SetAsset(ctx context.Context, actor, slot, url string) (*dto.BrandingResponse, string, error) {
 	cur, err := s.read(ctx)
 	if err != nil {
-		return nil, err
+		return nil, "", err
 	}
+	var previous string
 	switch slot {
 	case AssetLogo:
-		cur.LogoURL = url
+		previous, cur.LogoURL = cur.LogoURL, url
 	case AssetLogoDark:
-		cur.LogoDarkURL = url
+		previous, cur.LogoDarkURL = cur.LogoDarkURL, url
 	case AssetFavicon:
-		cur.FaviconURL = url
+		previous, cur.FaviconURL = cur.FaviconURL, url
 	case AssetReportLogo:
-		cur.ReportLogoURL = url
+		previous, cur.ReportLogoURL = cur.ReportLogoURL, url
 	case AssetReportCover:
-		cur.ReportCoverURL = url
+		previous, cur.ReportCoverURL = cur.ReportCoverURL, url
 	default:
-		return nil, ErrUnknownAssetSlot
+		return nil, "", ErrUnknownAssetSlot
 	}
 	if err := s.save(ctx, actor, &cur); err != nil {
-		return nil, err
+		return nil, "", err
+	}
+	return &cur, previous, nil
+}
+
+// IsBrandingAssetReferenced reports whether any tenant's branding row still
+// mentions `url`. Callers use this after replacing an asset to decide whether
+// the file on disk can be removed.
+func (s *brandingService) IsBrandingAssetReferenced(ctx context.Context, url string) (bool, error) {
+	if strings.TrimSpace(url) == "" {
+		return false, nil
+	}
+	n, err := s.repo.CountValueContains(ctx, brandingConfigKey, url)
+	if err != nil {
+		return false, err
 	}
-	return &cur, nil
+	return n > 0, nil
 }
 
 // GetPublic returns the effective branding for the (unauthenticated) login page.