Fix tenant isolation and authentication for Node-RED dashboards

[bcbetterninja]

Problem and change

Dashboard URLs bypassed tenant authentication and fell back to the default Node-RED runtime, so opening a page from a selected tenant could show a legacy/global dashboard. Public tenant webhook aliases could also reach dashboard pages and Socket.IO.

• Authenticate configured dashboard paths, assets and socket requests through the selected admin session or kiosk credentials. Remove the manager's implicit default-tenant fallback; overwrite caller-supplied tenant headers at the proxy.
• Block dashboard roots through public webhook aliases before transport handshakes, and add runtime dashboard HTTP/Socket.IO middleware as a second check. Strip platform cookies and authenticated ingress bearer credentials before tenant code sees requests.
• Discover actual FlowFuse pages through a manager-authenticated tenant catalog. Resolve existing /dash/<page-id> links to that tenant's configured page URL, return 404 for missing IDs, and mark stale synced entities unavailable without deleting assignments or notes.
• Preserve desktop enrollment checks and Android assigned-page checks. Proxy auth checks return 401/403 instead of login redirects.

Compatibility and rollout

Deploy the proxy, server and Node-RED manager together. Intentionally public HTTP-in callers must use /in/public/<tenant-slug>/<flow-path>; unmatched root paths now require authentication. Browser cookies are not forwarded to tenant runtimes. FlowFuse page names remain configurable; authorization protects access. Classic Dashboard tabs are not imported as FlowFuse pages.

Android's separate display-session cookie now covers configured same-host paths while server checks enforce current page assignments. Android dynamic Socket.IO remains denied until per-display channel authorization is available.

Validation

• Server suite: 114 passed, 1 PostgreSQL integration test skipped locally (CI supplies PostgreSQL).
• Production build and TypeScript test/source checks passed.
• Real nginx proxy integration: 5 tests passed for anonymous/forged requests, tenant header isolation, kiosk fallback, upgrade forwarding, internal routes and desktop enrollment checks.
• Node-RED manager self-tests passed, including two-tenant HTTP fixtures, custom dashboard roots, forged dashboard credentials, public aliases, catalog authentication, legacy redirects and socket middleware.
• Release version tests: 4 passed; deployment tests: 23 passed; diff check passed.
• Proxy regressions added to PR and release validation workflows.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 4c11921b-7b28-4952-9338-ec0fc3fac0de

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0a8cb0f106

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b7fee1587d

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".