Release v0.8.0

[eniac111]

Release v0.8.0

New Features

Thunderbird Policy Type

Manage Mozilla Thunderbird on enrolled desktops with the same mechanism used for Firefox ESR.

• Agent writes the managed policies.json that Thunderbird expects, merged from all bound policies; removing the last policy restores the original file.
• Flatpak installations are detected and enforced alongside RPM/DEB installations.
• Managed files carry a "managed by Bor" marker and are protected by the tamper watcher — external edits are detected and immediately restored.
• Web UI: full policy editor with the complete Thunderbird policy catalogue.

Microsoft Edge for Business Policy Type

• Agent writes bor_managed.json into each Edge managed-policy directory; removing the last bound policy cleans the file up from every directory.
• Web UI: tree-based editor with the Edge policy catalogue, JSON validation, and setting preview before enabling.

Firewalld Zone Policy Type

• New Firewalld policy type manages firewalld zones on enrolled nodes: services, ports, forward ports, rich rules, masquerade, interfaces, sources, and zone target.
• Agent writes zone XML to /etc/firewalld/zones/, validates with firewall-cmd --check-config, and reloads firewalld; files are tamper-protected like all other managed files.
• Web UI: dedicated firewalld zone editor.

Polkit: Variable Conditions

• Polkit rules now support variable conditions via action.lookup() for matching on action variables.
• Fix: multiple action IDs in one rule are now correctly joined with ||.

Per-Action RBAC for Users and Roles

• User and role administration is now guarded by per-action permissions instead of a single blanket permission, allowing finer-grained delegation of admin duties.

Web UI Overhaul (UX Sprints 0–4)

A full modernization pass over the PatternFly 6 web interface:

• URL routing — every page now has a real URL with working browser back/forward and deep links; expired sessions are detected and redirected to login; a global error boundary prevents white-screen crashes.
• Full-page policy editor — the policy editor is now a routed page (/policies/:id/edit) instead of nested modals; the Package editor's nested tabs were flattened into disclosures.
• Policy safety rails — unsaved-changes guard, confirmation for destructive type changes, JSON validation for Chrome/Edge values, read-only Configuration view for released policies, and setting preview in the tree editors.
• Policy lifecycle from the list — release/unrelease policies directly from the Policies list view.
• Scalable lists — server-side pagination, filtering, and sorting for Nodes and Compliance; search, sorting, and empty states across all list pages; dashboard stat tiles link to pre-filtered lists and keep last-good data on transient refresh errors.
• Destructive-action protection — type-to-confirm dialogs for all resource deletes, plus server-side guards that prevent deleting, disabling, or demoting the last Super Admin.
• MFA usability — backup codes can be copied/downloaded and must be acknowledged before finishing enrollment; the MFA settings tabs were disambiguated.
• Login — password reveal toggle and Caps Lock hint.
• Navigation — sidebar grouped into Fleet / Policy / System; single left-aligned page title with subtitle.
• Quality-of-life — searchable dropdowns, editable node notes, kebab menu on policy bindings, theme-aware audit-log status badges.
• Accessibility (WCAG 2.2 AA) — accessible tree roles in the policy editors, aria-live status messages, focus-ring and dark-mode/high-contrast correctness via PatternFly 6 design tokens, and an eslint-plugin-jsx-a11y lint gate in CI. See docs/ACCESSIBILITY.md for the compliance record.

Proto-Driven Policy Catalogues

• The Firefox, Thunderbird, Chrome, and Edge policy catalogues shown in the web UI are now generated from protobuf annotations — one source of truth shared by server, agent, and frontend.

Security

This release includes a dedicated hardening pass:

• Agent identity is now strictly bound to the mTLS client certificate, and MFA/RBAC enforcement paths were hardened on the server.
• Legacy SHA-256-encrypted TOTP secrets are transparently migrated to HKDF-derived encryption on first read.
• The Ubuntu PPA and Fedora COPR repository import helpers now block redirect-based SSRF; only allowlisted redirect targets are followed.
• Audit log CSV export is guarded against spreadsheet formula injection.
• The auto-generated initial admin password is no longer printed to the server log (where it would land in journald/centralized logging); it is written to a root-only file (mode 0600) instead.
• PKI: the server TLS certificate is automatically regenerated when its SANs no longer match the configured hostnames.
• All open Dependabot alerts were resolved, including the react-router RSC CSRF advisory (GHSA-qwww-vcr4-c8h2) fixed by the react-router 8 upgrade.

Bug Fixes

• Dashboard keeps showing the last good data during transient refresh errors instead of flashing empty.
• Audit log default action badge uses a fixed gray with sufficient dark-mode contrast.
• CI: nfpm pinned to v2.46.3 to stay compatible with the Go 1.25 toolchain.

Platform & Dependency Updates

• Frontend: React 18.3 → 19.2, react-router-dom replaced by react-router 8.3, PatternFly 6.6 prop migration, TypeScript typecheck now enforced in CI.
• Server + agent: google.golang.org/grpc → 1.82.1, golang.org/x/crypto → 0.52.0, golang.org/x/net → 0.55.0, golang.org/x/text → 0.39.0.
• CI: frontend design-token guardrail (bans legacy --pf-v5-* variables, ratchets raw hex literals), accessibility lint gate.

Notes

• Agents must be upgraded to v0.8.0 to enforce the new Thunderbird, Edge, and Firewalld policy types; older agents ignore policy types they do not understand.
• The protobuf policy schema gained thunderbird.proto and firewalld.proto and extends the polkit and edge messages; regenerate any external tooling built against proto/policy/.
• Frontend development now requires Node.js 22.22+ (react-router 8 engines requirement).

---

This discussion was created from the release Release v0.8.0.