[AlexSanchez-bit]

No description provided.

[github-actions]

🛑 AI review — Sensitive area, extra care recommended

This PR touches critical paths or introduces changes the model cannot judge with sufficient confidence. Review carefully before merging.

🛑 architecture (silas-1.7-pro) — high/critical — please review

Summary: Adds claimless password token auth and makes agent command WebSocket require password_token, changing auth flow and endpoint contract without backwards compatibility.

• high backend/modules/soar/handler/command_ws.go:151 — Existing /soar/ws/command now requires password_token, breaking existing clients; make it optional during rollout or version the endpoint and document migration.
• high backend/modules/soar/handler/command_ws.go:100 — requirePasswordToken only verifies signature/expiry and does not bind the token to the authenticated actor, allowing any valid password_token to satisfy the second factor; include user/session claims and verify they match actor.
• high backend/modules/iam/usecase/auth.go:164 — EmptyLogin duplicates Login credential checks and intentionally bypasses TFA/directory auth while issuing a claimless 5-minute JWT; extract shared password verification and issue a scoped one-time token bound to the user.
• medium backend/modules/iam/handler/auth.go:114 — New /auth/empty_login exposes a separate password-verification endpoint; add rate limiting, audit, and authorization policy to prevent credential stuffing and misuse.
• medium frontend/src/features/datasources/services/agent-console.ts:47 — password_token is appended to WebSocket URL query string, exposing the JWT in logs/proxies; use a short-lived one-time token and avoid logging the URL, or use subprotocol if feasible.

🛑 bugs (silas-1.7-pro) — high/critical — please review

Summary: High: authMode effect cleanup cancels newly started agent command; claimless password_token is not bound to user and is replayable.

• high frontend/src/features/datasources/components/AgentConsole.tsx:102 — Changing the focus effect dependency from [] to [authMode] makes its cleanup run after a successful password prompt. submitAuth sets authMode off and then fireCommand assigns cancelRef.current; the re-render cleanup calls cancelRef.current?.(), immediately cancelling the just-started WebSocket command.
• high backend/modules/soar/handler/command_ws.go:110 — requirePasswordToken only verifies signature/expiry of a claimless JWT from SignEmpty. It does not bind the token to the authenticated actor or enforce single-use, so any valid password_token from any account can be replayed for multiple command streams within 5 minutes with any session.
• low backend/modules/iam/handler/auth.go:130 — _ = catcher.Error(...) swallows the error returned by the logging/catcher call. If logging fails, there is no fallback or visibility; handle or at least log the secondary error.
• low frontend/src/features/datasources/components/AgentConsole.tsx:147 — submitAuth/fireCommand does not check offline or noRemoteControl before firing the pending command, unlike run(). An offline or remote-control-disabled agent can still be prompted and a WebSocket attempt can be made.

🛑 security (silas-1.7-pro) — high/critical — please review

Summary: New password-token second factor is not bound to the session user and may accept any backend-signed JWT, allowing agent command auth bypass.

• high backend/modules/soar/handler/command_ws.go:111 — requirePasswordToken only calls signer.Verify and does not validate a distinct password-token claim, audience, or type. If the verifier accepts any backend-signed JWT, the existing session access token can be reused as password_token, bypassing the password second factor. Add a unique claim/audience for EmptyLogin tokens and verify it explicitly.
• high backend/modules/soar/handler/command_ws.go:151 — The password_token is not bound to the authenticated actor and is replayable for its 5-minute lifetime. A token obtained for one user can satisfy the second factor for another session. Include the user/session ID or a one-time nonce in the token and compare it to the authenticated actor before allowing the command stream.
• medium frontend/src/features/datasources/services/agent-console.ts:48 — password_token is placed in the WebSocket URL query string, exposing a bearer secret in proxy logs, access logs, browser network traces, or other URL-logging components. Prefer a header if the transport allows it, use Sec-WebSocket-Protocol, or send a short-lived one-time code that is not logged.
• medium backend/modules/iam/usecase/auth.go:178 — EmptyLogin issues a claimless JWT for 5 minutes and bypasses TFA. Because the token is not tied to a session, user, or one-time use, it weakens the second factor for high-impact agent commands. Bind the token to the requesting user/session, enforce single-use, and consider a shorter TTL.
• medium backend/modules/iam/handler/auth.go:120 — The new unauthenticated /auth/empty_login endpoint performs password verification and bypasses TFA, expanding the brute-force and credential-stuffing surface. Apply the same rate limiting, lockout, anomaly detection, and audit controls as /auth/login.
• low backend/modules/iam/handler/auth.go:128 — EmptyLogin returns 403 for deactivated users and 401 for invalid credentials, enabling user/status enumeration. Return a generic 401 response for all authentication failures.

🔴 go-deps — pending updates

🔍 Discovered 31 Go projects

📦 Dependencies with updates available:

  📁 ./agent:
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.38
     - google.golang.org/grpc: v1.84.0 → v1.85.0

  📁 ./tools/rulecheck:
     - github.com/threatwinds/go-sdk: v1.1.31 → v1.1.38

  📁 ./agent-manager:
     - github.com/threatwinds/go-sdk: v1.1.31 → v1.1.38
     - google.golang.org/grpc: v1.84.0 → v1.85.0

  📁 ./collectors/forwarder:
     - github.com/threatwinds/go-sdk: v1.1.31 → v1.1.38
     - google.golang.org/grpc: v1.84.0 → v1.85.0

  📁 ./collectors/as400:
     - github.com/threatwinds/go-sdk: v1.1.31 → v1.1.38
     - google.golang.org/grpc: v1.84.0 → v1.85.0

  📁 ./collectors/utmstack:
     - github.com/threatwinds/go-sdk: v1.1.31 → v1.1.38
     - google.golang.org/grpc: v1.84.0 → v1.85.0

  📁 ./installer:
     - github.com/cloudfoundry/gosigar: v1.3.128 → v1.3.130

  📁 ./backend:
     - github.com/aws/aws-sdk-go-v2/config: v1.33.11 → v1.33.12
     - github.com/aws/aws-sdk-go-v2/credentials: v1.20.11 → v1.20.12
     - github.com/aws/aws-sdk-go-v2/service/sts: v1.51.5 → v1.51.6
     - github.com/crowdstrike/gofalcon: v0.23.0 → v0.24.0
     - google.golang.org/api: v0.309.0 → v0.310.0
     - google.golang.org/grpc: v1.84.0 → v1.85.0

  📁 ./plugins/aws:
     - github.com/aws/aws-sdk-go-v2: v1.47.4 → v1.47.5
     - github.com/aws/aws-sdk-go-v2/config: v1.33.11 → v1.33.12
     - github.com/aws/aws-sdk-go-v2/credentials: v1.20.11 → v1.20.12
     - github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs: v1.90.2 → v1.90.3

  📁 ./plugins/gcp:
     - google.golang.org/api: v0.309.0 → v0.310.0

  📁 ./plugins/crowdstrike:
     - github.com/crowdstrike/gofalcon: v0.23.0 → v0.24.0

  📁 ./log-input:
     - google.golang.org/grpc: v1.84.0 → v1.85.0

❌ Please update dependencies before merging.