Publish curated Unraid-AppOps-Gateway source from 034c9f844d2455850ba37b31379b7edaa786583e

backend/app/connectors/nginx_proxy_manager.py

@@ -10,6 +10,7 @@ import httpx
 
 from ..core.config import settings
 from ..core.redaction import redact_message
+from ..services.exposure_preferences import runtime_nginx_access_list_checks_enabled
 from .base import BaseConnector
 
 
@@ -307,15 +308,16 @@ class NginxProxyManagerConnector(BaseConnector):
         }
 
     def exposure_summary(self) -> dict[str, Any]:
+        access_list_checks_enabled = runtime_nginx_access_list_checks_enabled()
         hosts = self.proxy_hosts()
         certs = self.certificates()
-        access_lists = self.access_lists()
+        access_lists = self.access_lists() if access_list_checks_enabled else {}
         if not hosts.get('success'):
             return {**hosts, 'data': {'warnings': []}}
         host_items = hosts.get('items', [])
         cert_items = certs.get('items', []) if certs.get('success') else []
         cert_by_id = {item.get('id'): item for item in cert_items}
-        warnings = self._build_warnings(host_items, cert_by_id)
+        warnings = self._build_warnings(host_items, cert_by_id, nginx_access_list_checks_enabled=access_list_checks_enabled)
         summary = {
             'totalProxyHosts': len(host_items),
             'enabledProxyHosts': sum(1 for item in host_items if item.get('enabled')),
@@ -327,6 +329,7 @@ class NginxProxyManagerConnector(BaseConnector):
             'hostsWithoutSslForce': sum(1 for item in host_items if item.get('enabled') and not item.get('sslForced')),
             'hostsWithWebsocket': sum(1 for item in host_items if item.get('websocketSupport')),
             'accessLists': access_lists.get('total', 0),
+            'nginxAccessListChecksEnabled': access_list_checks_enabled,
             'warnings': warnings,
         }
         return {'success': True, 'status': 'ok', 'message': 'exposure_summary_ok', **summary, 'data': summary}
@@ -353,7 +356,7 @@ class NginxProxyManagerConnector(BaseConnector):
         if not hosts.get('success'):
             return {**hosts, 'items': [], 'total': 0, 'data': {'items': []}}
         cert_by_id = {item.get('id'): item for item in certs.get('items', [])} if certs.get('success') else {}
-        items = self._build_warnings(hosts.get('items', []), cert_by_id)
+        items = self._build_warnings(hosts.get('items', []), cert_by_id, nginx_access_list_checks_enabled=runtime_nginx_access_list_checks_enabled())
         severity_order = {'critical': 3, 'high': 2, 'warning': 1, 'info': 0}
         status = 'warning' if items else 'ok'
         return {
@@ -609,7 +612,7 @@ class NginxProxyManagerConnector(BaseConnector):
         }
 
     @staticmethod
-    def _build_warnings(hosts: list[dict[str, Any]], cert_by_id: dict[Any, dict[str, Any]]) -> list[dict[str, Any]]:
+    def _build_warnings(hosts: list[dict[str, Any]], cert_by_id: dict[Any, dict[str, Any]], *, nginx_access_list_checks_enabled: bool = True) -> list[dict[str, Any]]:
         warnings: list[dict[str, Any]] = []
         for host in hosts:
             if not host.get('enabled'):
@@ -624,7 +627,7 @@ class NginxProxyManagerConnector(BaseConnector):
                 warnings.append({'type': 'certificate_expired', 'severity': 'critical', 'title': f'{label} certificate is expired', 'evidence': [label, str(cert.get('expiresOn'))], 'suggestedAction': 'review_certificate_in_npm'})
             elif cert and cert.get('isExpiringSoon'):
                 warnings.append({'type': 'certificate_expiring_soon', 'severity': 'warning', 'title': f'{label} certificate expires soon', 'evidence': [label, f"{cert.get('expiresInDays')} days", str(cert.get('expiresOn'))], 'suggestedAction': 'review_certificate_in_npm'})
-            if not host.get('accessListId'):
+            if nginx_access_list_checks_enabled and not host.get('accessListId'):
                 warnings.append({'type': 'public_host_without_access_list', 'severity': 'high', 'title': f'{label} has no access list', 'evidence': [label, target], 'suggestedAction': 'review_access_protection'})
             if not host.get('sslForced'):
                 warnings.append({'type': 'ssl_not_forced', 'severity': 'warning', 'title': f'{label} does not force SSL', 'evidence': [label], 'suggestedAction': 'review_ssl_policy'})