release-2.5.0 (#994)

* feat(sshid) - sshid.io equivalent for termix (#919) * feat(ssh-id): database schema, migrations and field encryption Adds ssh_identities, ssh_identity_keys and ssh_identity_ca tables (public keys stored plaintext for the unauthenticated resolver; CA private key registered for per-user field encryption), with UNIQUE(user_id), an index on ssh_identity_keys(identity_id), and idempotent CREATE TABLE migrations. * feat(ssh-id): backend API — resolver, key management, CA and certificates Mounts /sshid (nginx route added). Public text/plain authorized_keys resolver (+ exact /:algo filter, HTML viewer) and CA public-key endpoint; no-store + noindex headers on every resolver response including early 404s. Authenticated management: claim/rename/delete handle, add/import/generate/enable/delete keys, and a per-user CA (create/rotate/delete) with pure-Node OpenSSH certificate issuance. Audit logging on all mutations; UNIQUE races map to a precise 409. Unit tests for key parsing and certificate signing (ssh-keygen-validated). * feat(ssh-id): frontend panel, API client and i18n SSH ID panel wired into the app rail and AppShell: claim handle, resolver URL + curl one-liner, key list, generate, paste/import, CA enable/rotate/remove with server trust command, and per-key certificate issuance. API client re-exported through main-axios.ts; all strings i18n'd. * style(ssh-id): align panel and resolver page with Termix theme - Rebuild the SSH ID sidebar panel with the theme's square components (SectionCard / SettingRow / FakeSwitch) instead of rounded ad-hoc cards; use accent-brand and destructive tokens rather than raw red/green. - Fix panel scrolling: move overflow to a block scroll container so the cards keep their natural height instead of being clipped. - Restyle the public resolver HTML page (/sshid/u/:handle) to the Termix dark theme: square corners, #18181b/#303032 palette, #f59145 accent, uppercase section labels. - Tidy copy: 'Save To Credentials' label, drop the redundant generate intro, and correct the generate tooltip (the key is stored when saving to vault). * feat: rename to Termix ID, improve UI, backend inconsistencies, and general bug fixes --------- Co-authored-by: LukeGus <bugattiguy527@gmail.com> * ci(deps): bump actions/checkout from 6 to 7 in the github-actions group (#922) Bumps the github-actions group with 1 update: [actions/checkout](https://github.com/actions/checkout). Updates `actions/checkout` from 6 to 7 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps-dev): bump the dev-patch-updates group with 11 updates (#923) Bumps the dev-patch-updates group with 11 updates: | Package | From | To | | --- | --- | --- | | [@codemirror/search](https://github.com/codemirror/search) | `6.7.0` | `6.7.1` | | [@codemirror/view](https://github.com/codemirror/view) | `6.43.0` | `6.43.1` | | [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite) | `4.3.0` | `4.3.1` | | [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.8` | `4.1.9` | | [@vitest/ui](https://github.com/vitest-dev/vitest/tree/HEAD/packages/ui) | `4.1.8` | `4.1.9` | | [eslint-plugin-react-refresh](https://github.com/ArnaudBarre/eslint-plugin-react-refresh) | `0.5.2` | `0.5.3` | | [lint-staged](https://github.com/lint-staged/lint-staged) | `17.0.7` | `17.0.8` | | [prettier](https://github.com/prettier/prettier) | `3.8.3` | `3.8.4` | | [sharp](https://github.com/lovell/sharp) | `0.35.1` | `0.35.2` | | [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.3.0` | `4.3.1` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.8` | `4.1.9` | Updates `@codemirror/search` from 6.7.0 to 6.7.1 - [Changelog](https://github.com/codemirror/search/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/search/commits) Updates `@codemirror/view` from 6.43.0 to 6.43.1 - [Changelog](https://github.com/codemirror/view/blob/main/CHANGELOG.md) - [Commits](https://github.com/codemirror/view/commits) Updates `@tailwindcss/vite` from 4.3.0 to 4.3.1 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.1/packages/@tailwindcss-vite) Updates `@vitest/coverage-v8` from 4.1.8 to 4.1.9 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/coverage-v8) Updates `@vitest/ui` from 4.1.8 to 4.1.9 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/ui) Updates `eslint-plugin-react-refresh` from 0.5.2 to 0.5.3 - [Release notes](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/releases) - [Changelog](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/blob/main/CHANGELOG.md) - [Commits](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/compare/v0.5.2...v0.5.3) Updates `lint-staged` from 17.0.7 to 17.0.8 - [Release notes](https://github.com/lint-staged/lint-staged/releases) - [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md) - [Commits](https://github.com/lint-staged/lint-staged/compare/v17.0.7...v17.0.8) Updates `prettier` from 3.8.3 to 3.8.4 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.8.3...3.8.4) Updates `sharp` from 0.35.1 to 0.35.2 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](https://github.com/lovell/sharp/compare/v0.35.1...v0.35.2) Updates `tailwindcss` from 4.3.0 to 4.3.1 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.1/packages/tailwindcss) Updates `vitest` from 4.1.8 to 4.1.9 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/vitest) --- updated-dependencies: - dependency-name: "@codemirror/search" dependency-version: 6.7.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@codemirror/view" dependency-version: 6.43.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@tailwindcss/vite" dependency-version: 4.3.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@vitest/coverage-v8" dependency-version: 4.1.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: "@vitest/ui" dependency-version: 4.1.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: eslint-plugin-react-refresh dependency-version: 0.5.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: lint-staged dependency-version: 17.0.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: prettier dependency-version: 3.8.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: sharp dependency-version: 0.35.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: tailwindcss dependency-version: 4.3.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates - dependency-name: vitest dependency-version: 4.1.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-patch-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump nanoid in the prod-patch-updates group (#925) Bumps the prod-patch-updates group with 1 update: [nanoid](https://github.com/ai/nanoid). Updates `nanoid` from 5.1.11 to 5.1.15 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](https://github.com/ai/nanoid/compare/5.1.11...5.1.15) --- updated-dependencies: - dependency-name: nanoid dependency-version: 5.1.15 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: prod-patch-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump the major-updates group with 5 updates (#926) Bumps the major-updates group with 5 updates: | Package | From | To | | --- | --- | --- | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.2.0` | `5.0.0` | | [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js) | `9.39.4` | `10.0.1` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.9.2` | `26.0.0` | | [concurrently](https://github.com/open-cli-tools/concurrently) | `9.2.1` | `10.0.3` | | [eslint](https://github.com/eslint/eslint) | `9.39.4` | `10.5.0` | Updates `js-yaml` from 4.2.0 to 5.0.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/4.2.0...5.0.0) Updates `@eslint/js` from 9.39.4 to 10.0.1 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/commits/v10.0.1/packages/js) Updates `@types/node` from 25.9.2 to 26.0.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `concurrently` from 9.2.1 to 10.0.3 - [Release notes](https://github.com/open-cli-tools/concurrently/releases) - [Commits](https://github.com/open-cli-tools/concurrently/compare/v9.2.1...v10.0.3) Updates `eslint` from 9.39.4 to 10.5.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/compare/v9.39.4...v10.5.0) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: major-updates - dependency-name: "@eslint/js" dependency-version: 10.0.1 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major-updates - dependency-name: "@types/node" dependency-version: 26.0.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major-updates - dependency-name: concurrently dependency-version: 10.0.3 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major-updates - dependency-name: eslint dependency-version: 10.5.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: major-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat(ssh): add HashiCorp Vault SSH signer authentication * fix: small fixes to vault feature to align with Termix codebase * chore: add view docs links for vault/termix id * fix: file upload fails with 400 and missing schema migrations on upgrade (#929) Two bugs introduced in v2.4.1: 1. uploadFileStream uses fileManagerApi.post() which triggers axios's transformRequest to JSON-serialize the FormData because the instance default Content-Type is application/json. Change to postForm() which sets Content-Type: multipart/form-data so the browser XHR sends the correct multipart body with boundary. 2. Two schema items added to schema.ts were not included in migrateSchema() in db/index.ts, causing 500 errors on existing installations upgrading from v2.4.0: - user_preferences.status_color_scheme (no such column) - dashboard_service_links table (no such table) Fixes #928 Co-authored-by: sash <sash@fominykh.io> * fix: support PuTTY PPK ssh keys (#930) * fix: chunk large file manager uploads (#932) * fix: route dashboard hosts by protocol (#934) * fix: resolve tunnel endpoints reliably (#935) * Fix Electron OIDC browser auth failures (#936) * Allow RDP connections without stored credentials (#937) * Sync role credential shares for OIDC users (#938) * Fix terminal link dialog layering (#940) * Confirm large files before opening editor (#942) * Confirm closing active host connections (#943) * Preserve file path case in file manager UI (#941) * fix: preserve unicode guacamole tokens (#933) * Persist VNC authentication settings (#944) * Fix Guacamole websocket base path (#946) * Promote file manager terminals to tabs (#939) * Guard Guacamole disconnect during startup (#945) * chore: increment ver * feat: bitwarden ssh agent integration * feat: serial connections support * fix: various small bug fixes * feat: open all sessions in a folder and terminal custom theme color support * feat: cross host file manager clipboard and several small bug fixes * feat: tailscale/wireguard support and added a new status state for when backend is checking status * feat: grafana like server stats history, new alert system, ntfy/webhook support * feat: new grid and widget based homepage function * feat: new donate button in dashboard * fix: alert ui incorrectly using termix css and fixed issue with alert system not loading * chore: fix ci checks (#966) * Fix dashboard service link creation (#950) * Fix jump host SOCKS5 proxy selection (#951) * Fix jump host SOCKS5 proxy selection * fix: type jump host socks proxy config * Fix tmux detection path handling (#949) * Support GUACD_URL environment config (#952) * Retry autostart tunnel host fetches (#953) * Retry autostart tunnel host fetches * chore: format tunnel route * Fix PUID html ownership in Docker entrypoint (#954) * feat: allow custom tunnel endpoints (#977) * fix: skip metrics start for non-ssh hosts (#976) * Fix Proxmox import auth fallback (#956) * Fix Proxmox import auth fallback * chore: format proxmox import auth * Fix SSH heading syntax highlighting (#955) * Fix SSH heading syntax highlighting * chore: format terminal highlighter * Initialize auth before fullscreen terminal routes (#957) * Add WebAuthn passkey authentication (#959) * chore: add Biome tooling (#965) * chore: add biome tooling * chore: support tailwind syntax in biome * Fix VNC required argument handshake (#968) * Prioritize host results in command palette search (#969) * Prevent sidebar host hover layout shift (#970) * Add terminal font zoom with mouse wheel (#971) * Add host temperature metrics card (#972) * Make file downloads reliable in desktop app (#973) * Add app rail hover expansion setting (#974) * fix: use correct translation key for nav.close (#964) * fix(tunnel): skip endpoint credential validation for direct tunnels (#963) * fix: SSH port connection bug (#975) * fix: chunked upload for files >=1.5GB to bypass browser ArrayBuffer limit (#948) * feat: support SSH agent auth across SSH features (#960) * feat: add Podman container runtime support (#958) * chore: update readme and release notes * fix: stabilize Windows app icon (#978) * Add safe host sharing export (#979) * Add external editor support for file manager (#985) * Rework SSH credential password handling (#984) * Support password fallback for SSH key credentials * Complete SSH credential password fallback * Fix runtime base path for auth callbacks (#982) * Fix TUI terminal output highlighting (#983) Co-authored-by: LukeGus <bugattiguy527@gmail.com> * Add app fullscreen mode (#993) * Fix host metrics startup polling (#986) * chore: update release notes * fix: line chart text overlap * chore: update RELEASE_NOTES.md * chore: add donation goal to readme * chore: update readme * fix: hide full-screen button in electron app * fix: failed unit tests * chore: lint, format, and bump version to 2.5.0 * chore: remove timeout from crowdin translate * chore: sync Crowdin translations for 2.5.0 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: DivByZero <mr.oplus@yahoo.fr> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: devdanetra <46488477+devdanetra@users.noreply.github.com> Co-authored-by: Aleksandr Fominykh <neoformalex@users.noreply.github.com> Co-authored-by: sash <sash@fominykh.io> Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com>
2026-10-31 23:55:23 +00:00 · 2026-06-29 13:28:26 -05:00
1 parent fd27a366d0
commit 9de904dd4c
@@ -0,0 +1,660 @@
+import express, { type Request, type Response } from "express";
+import type { AuthenticatedRequest } from "../../../types/index.js";
+import { getDb } from "../db/index.js";
+import { AuthManager } from "../../utils/auth-manager.js";
+import { DatabaseSaveTrigger } from "../db/index.js";
+import { databaseLogger } from "../../utils/logger.js";
+import { sendWebhook, sendNtfy } from "../../utils/notification-sender.js";
+
+const router = express.Router();
+const authManager = AuthManager.getInstance();
+const authenticateJWT = authManager.createAuthMiddleware();
+
+const VALID_TRIGGER_TYPES = new Set([
+  "host_offline",
+  "host_online",
+  "cpu_threshold",
+  "memory_threshold",
+  "disk_threshold",
+  "health_check_failure",
+  "health_check_recovery",
+  "user_login",
+]);
+
+router.use(authenticateJWT);
+
+// ---- Notification Channels ----
+
+/**
+ * @openapi
+ * /notification-channels:
+ *   get:
+ *     summary: List notification channels for the current user
+ *     tags:
+ *       - Alerts
+ *     responses:
+ *       200:
+ *         description: List of notification channels.
+ */
+router.get("/notification-channels", (req, res) => {
+  const userId = (req as AuthenticatedRequest).userId;
+  try {
+    const rows = getDb()
+      .$client.prepare(
+        "SELECT * FROM notification_channels WHERE user_id = ? ORDER BY id ASC",
+      )
+      .all(userId);
+    res.json(rows);
+  } catch (err) {
+    databaseLogger.error("Failed to list notification channels", {
+      operation: "list_channels",
+      error: err,
+    });
+    res.status(500).json({ error: "Failed to list channels" });
+  }
+});
+
+/**
+ * @openapi
+ * /notification-channels:
+ *   post:
+ *     summary: Create a notification channel
+ *     tags:
+ *       - Alerts
+ */
+router.post("/notification-channels", (req, res) => {
+  const userId = (req as AuthenticatedRequest).userId;
+  const { name, type, config, enabled } = req.body as {
+    name: string;
+    type: string;
+    config: unknown;
+    enabled?: boolean;
+  };
+
+  if (!name || typeof name !== "string" || !name.trim()) {
+    return res.status(400).json({ error: "name is required" });
+  }
+  if (type !== "webhook" && type !== "ntfy") {
+    return res.status(400).json({ error: "type must be 'webhook' or 'ntfy'" });
+  }
+  if (!config || typeof config !== "object") {
+    return res.status(400).json({ error: "config is required" });
+  }
+  if (type === "ntfy") {
+    const c = config as Record<string, unknown>;
+    if (!c.url || typeof c.url !== "string")
+      return res.status(400).json({ error: "ntfy config requires url" });
+    if (!c.topic || typeof c.topic !== "string")
+      return res.status(400).json({ error: "ntfy config requires topic" });
+  }
+  if (type === "webhook") {
+    const c = config as Record<string, unknown>;
+    if (!c.url || typeof c.url !== "string")
+      return res.status(400).json({ error: "webhook config requires url" });
+  }
+
+  try {
+    const result = getDb()
+      .$client.prepare(
+        `INSERT INTO notification_channels (user_id, name, type, config, enabled)
+         VALUES (?, ?, ?, ?, ?)`,
+      )
+      .run(
+        userId,
+        name.trim(),
+        type,
+        JSON.stringify(config),
+        enabled !== false ? 1 : 0,
+      );
+    const row = getDb()
+      .$client.prepare("SELECT * FROM notification_channels WHERE id = ?")
+      .get(result.lastInsertRowid);
+    DatabaseSaveTrigger.triggerSave("notification_channel_created");
+    res.status(201).json(row);
+  } catch (err) {
+    databaseLogger.error("Failed to create notification channel", {
+      operation: "create_channel",
+      error: err,
+    });
+    res.status(500).json({ error: "Failed to create channel" });
+  }
+});
+
+/**
+ * @openapi
+ * /notification-channels/{id}:
+ *   put:
+ *     summary: Update a notification channel
+ *     tags:
+ *       - Alerts
+ */
+router.put("/notification-channels/:id", (req: Request, res: Response) => {
+  const userId = (req as AuthenticatedRequest).userId;
+  const channelId = Number(req.params.id);
+  const { name, type, config, enabled } = req.body as {
+    name?: string;
+    type?: string;
+    config?: unknown;
+    enabled?: boolean;
+  };
+
+  const existing = getDb()
+    .$client.prepare(
+      "SELECT id FROM notification_channels WHERE id = ? AND user_id = ?",
+    )
+    .get(channelId, userId);
+  if (!existing) return res.status(404).json({ error: "Channel not found" });
+
+  if (type && type !== "webhook" && type !== "ntfy") {
+    return res.status(400).json({ error: "type must be 'webhook' or 'ntfy'" });
+  }
+
+  try {
+    const updates: string[] = [];
+    const params: unknown[] = [];
+    if (name !== undefined) {
+      updates.push("name = ?");
+      params.push(name.trim());
+    }
+    if (type !== undefined) {
+      updates.push("type = ?");
+      params.push(type);
+    }
+    if (config !== undefined) {
+      updates.push("config = ?");
+      params.push(JSON.stringify(config));
+    }
+    if (enabled !== undefined) {
+      updates.push("enabled = ?");
+      params.push(enabled ? 1 : 0);
+    }
+
+    if (updates.length === 0) return res.json({ success: true });
+
+    params.push(channelId, userId);
+    getDb()
+      .$client.prepare(
+        `UPDATE notification_channels SET ${updates.join(", ")} WHERE id = ? AND user_id = ?`,
+      )
+      .run(...params);
+
+    const row = getDb()
+      .$client.prepare("SELECT * FROM notification_channels WHERE id = ?")
+      .get(channelId);
+    DatabaseSaveTrigger.triggerSave("notification_channel_updated");
+    res.json(row);
+  } catch (err) {
+    databaseLogger.error("Failed to update notification channel", {
+      operation: "update_channel",
+      error: err,
+    });
+    res.status(500).json({ error: "Failed to update channel" });
+  }
+});
+
+/**
+ * @openapi
+ * /notification-channels/{id}:
+ *   delete:
+ *     summary: Delete a notification channel
+ *     tags:
+ *       - Alerts
+ */
+router.delete("/notification-channels/:id", (req: Request, res: Response) => {
+  const userId = (req as AuthenticatedRequest).userId;
+  const channelId = Number(req.params.id);
+  const existing = getDb()
+    .$client.prepare(
+      "SELECT id FROM notification_channels WHERE id = ? AND user_id = ?",
+    )
+    .get(channelId, userId);
+  if (!existing) return res.status(404).json({ error: "Channel not found" });
+  getDb()
+    .$client.prepare("DELETE FROM notification_channels WHERE id = ?")
+    .run(channelId);
+  DatabaseSaveTrigger.triggerSave("notification_channel_deleted");
+  res.json({ success: true });
+});
+
+/**
+ * @openapi
+ * /notification-channels/{id}/test:
+ *   post:
+ *     summary: Send a test notification
+ *     tags:
+ *       - Alerts
+ */
+router.post(
+  "/notification-channels/:id/test",
+  async (req: Request, res: Response) => {
+    const userId = (req as AuthenticatedRequest).userId;
+    const channelId = Number(req.params.id);
+    const row = getDb()
+      .$client.prepare(
+        "SELECT * FROM notification_channels WHERE id = ? AND user_id = ?",
+      )
+      .get(channelId, userId) as { type: string; config: string } | undefined;
+    if (!row) return res.status(404).json({ error: "Channel not found" });
+
+    const testPayload = {
+      hostName: "Test Host",
+      hostId: 0,
+      triggerType: "test",
+      message: "This is a test notification from Termix",
+      severity: "info" as const,
+      timestamp: new Date().toISOString(),
+      ruleId: 0,
+      ruleName: "Test",
+    };
+
+    try {
+      let config: Record<string, unknown>;
+      try {
+        config = JSON.parse(row.config) as Record<string, unknown>;
+      } catch {
+        return res
+          .status(400)
+          .json({ success: false, error: "Invalid channel config" });
+      }
+
+      if (row.type === "webhook") {
+        await sendWebhook(
+          config as unknown as Parameters<typeof sendWebhook>[0],
+          testPayload,
+        );
+      } else if (row.type === "ntfy") {
+        await sendNtfy(
+          config as unknown as Parameters<typeof sendNtfy>[0],
+          testPayload,
+        );
+      }
+      res.json({ success: true });
+    } catch (err) {
+      res.json({
+        success: false,
+        error: err instanceof Error ? err.message : String(err),
+      });
+    }
+  },
+);
+
+// ---- Alert Rules ----
+
+/**
+ * @openapi
+ * /alert-rules:
+ *   get:
+ *     summary: List alert rules for the current user
+ *     tags:
+ *       - Alerts
+ */
+router.get("/alert-rules", (req, res) => {
+  const userId = (req as AuthenticatedRequest).userId;
+  try {
+    const rules = getDb()
+      .$client.prepare(
+        "SELECT * FROM alert_rules WHERE user_id = ? ORDER BY id ASC",
+      )
+      .all(userId) as Array<{ id: number }>;
+
+    const channelMap = new Map<number, number[]>();
+    for (const rule of rules) {
+      const channels = getDb()
+        .$client.prepare(
+          "SELECT channel_id FROM alert_rule_channels WHERE rule_id = ?",
+        )
+        .all(rule.id) as Array<{ channel_id: number }>;
+      channelMap.set(
+        rule.id,
+        channels.map((c) => c.channel_id),
+      );
+    }
+
+    const result = rules.map((r) => ({
+      ...r,
+      channels: channelMap.get(r.id) ?? [],
+    }));
+    res.json(result);
+  } catch (err) {
+    databaseLogger.error("Failed to list alert rules", {
+      operation: "list_alert_rules",
+      error: err,
+    });
+    res.status(500).json({ error: "Failed to list alert rules" });
+  }
+});
+
+/**
+ * @openapi
+ * /alert-rules:
+ *   post:
+ *     summary: Create an alert rule
+ *     tags:
+ *       - Alerts
+ */
+router.post("/alert-rules", (req, res) => {
+  const userId = (req as AuthenticatedRequest).userId;
+  const {
+    name,
+    hostId,
+    enabled,
+    triggerType,
+    thresholdValue,
+    thresholdDurationSeconds,
+    cooldownMinutes,
+    channels = [],
+  } = req.body as {
+    name: string;
+    hostId?: number | null;
+    enabled?: boolean;
+    triggerType: string;
+    thresholdValue?: number | null;
+    thresholdDurationSeconds?: number | null;
+    cooldownMinutes?: number;
+    channels?: number[];
+  };
+
+  if (!name || typeof name !== "string" || !name.trim()) {
+    return res.status(400).json({ error: "name is required" });
+  }
+  if (!VALID_TRIGGER_TYPES.has(triggerType)) {
+    return res.status(400).json({ error: "Invalid triggerType" });
+  }
+  if (thresholdValue != null && (thresholdValue < 0 || thresholdValue > 100)) {
+    return res
+      .status(400)
+      .json({ error: "thresholdValue must be between 0 and 100" });
+  }
+  if (thresholdDurationSeconds != null && thresholdDurationSeconds < 0) {
+    return res
+      .status(400)
+      .json({ error: "thresholdDurationSeconds must be >= 0" });
+  }
+
+  try {
+    const now = new Date().toISOString();
+    const result = getDb()
+      .$client.prepare(
+        `INSERT INTO alert_rules
+           (user_id, host_id, name, enabled, trigger_type, threshold_value,
+            threshold_duration_seconds, cooldown_minutes, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      )
+      .run(
+        userId,
+        hostId ?? null,
+        name.trim(),
+        enabled !== false ? 1 : 0,
+        triggerType,
+        thresholdValue ?? null,
+        thresholdDurationSeconds ?? null,
+        cooldownMinutes ?? 15,
+        now,
+        now,
+      );
+    const ruleId = result.lastInsertRowid as number;
+
+    for (const channelId of channels) {
+      const owned = getDb()
+        .$client.prepare(
+          "SELECT id FROM notification_channels WHERE id = ? AND user_id = ?",
+        )
+        .get(channelId, userId);
+      if (!owned) continue;
+      getDb()
+        .$client.prepare(
+          "INSERT OR IGNORE INTO alert_rule_channels (rule_id, channel_id) VALUES (?, ?)",
+        )
+        .run(ruleId, channelId);
+    }
+
+    const row = getDb()
+      .$client.prepare("SELECT * FROM alert_rules WHERE id = ?")
+      .get(ruleId) as Record<string, unknown>;
+    DatabaseSaveTrigger.triggerSave("alert_rule_created");
+    res.status(201).json({ ...row, channels });
+  } catch (err) {
+    databaseLogger.error("Failed to create alert rule", {
+      operation: "create_alert_rule",
+      error: err,
+    });
+    res.status(500).json({ error: "Failed to create alert rule" });
+  }
+});
+
+/**
+ * @openapi
+ * /alert-rules/{id}:
+ *   put:
+ *     summary: Update an alert rule
+ *     tags:
+ *       - Alerts
+ */
+router.put("/alert-rules/:id", (req: Request, res: Response) => {
+  const userId = (req as AuthenticatedRequest).userId;
+  const ruleId = Number(req.params.id);
+
+  const existing = getDb()
+    .$client.prepare("SELECT id FROM alert_rules WHERE id = ? AND user_id = ?")
+    .get(ruleId, userId);
+  if (!existing) return res.status(404).json({ error: "Alert rule not found" });
+
+  const {
+    name,
+    hostId,
+    enabled,
+    triggerType,
+    thresholdValue,
+    thresholdDurationSeconds,
+    cooldownMinutes,
+    channels,
+  } = req.body as {
+    name?: string;
+    hostId?: number | null;
+    enabled?: boolean;
+    triggerType?: string;
+    thresholdValue?: number | null;
+    thresholdDurationSeconds?: number | null;
+    cooldownMinutes?: number;
+    channels?: number[];
+  };
+
+  if (triggerType && !VALID_TRIGGER_TYPES.has(triggerType)) {
+    return res.status(400).json({ error: "Invalid triggerType" });
+  }
+
+  try {
+    const updates: string[] = ["updated_at = ?"];
+    const params: unknown[] = [new Date().toISOString()];
+    if (name !== undefined) {
+      updates.push("name = ?");
+      params.push(name.trim());
+    }
+    if (hostId !== undefined) {
+      updates.push("host_id = ?");
+      params.push(hostId ?? null);
+    }
+    if (enabled !== undefined) {
+      updates.push("enabled = ?");
+      params.push(enabled ? 1 : 0);
+    }
+    if (triggerType !== undefined) {
+      updates.push("trigger_type = ?");
+      params.push(triggerType);
+    }
+    if (thresholdValue !== undefined) {
+      updates.push("threshold_value = ?");
+      params.push(thresholdValue ?? null);
+    }
+    if (thresholdDurationSeconds !== undefined) {
+      updates.push("threshold_duration_seconds = ?");
+      params.push(thresholdDurationSeconds ?? null);
+    }
+    if (cooldownMinutes !== undefined) {
+      updates.push("cooldown_minutes = ?");
+      params.push(cooldownMinutes);
+    }
+    params.push(ruleId, userId);
+
+    getDb()
+      .$client.prepare(
+        `UPDATE alert_rules SET ${updates.join(", ")} WHERE id = ? AND user_id = ?`,
+      )
+      .run(...params);
+
+    if (channels !== undefined) {
+      getDb()
+        .$client.prepare("DELETE FROM alert_rule_channels WHERE rule_id = ?")
+        .run(ruleId);
+      for (const channelId of channels) {
+        const owned = getDb()
+          .$client.prepare(
+            "SELECT id FROM notification_channels WHERE id = ? AND user_id = ?",
+          )
+          .get(channelId, userId);
+        if (!owned) continue;
+        getDb()
+          .$client.prepare(
+            "INSERT OR IGNORE INTO alert_rule_channels (rule_id, channel_id) VALUES (?, ?)",
+          )
+          .run(ruleId, channelId);
+      }
+    }
+
+    const row = getDb()
+      .$client.prepare("SELECT * FROM alert_rules WHERE id = ?")
+      .get(ruleId) as Record<string, unknown>;
+    const linkedChannels = (
+      getDb()
+        .$client.prepare(
+          "SELECT channel_id FROM alert_rule_channels WHERE rule_id = ?",
+        )
+        .all(ruleId) as Array<{ channel_id: number }>
+    ).map((c) => c.channel_id);
+
+    DatabaseSaveTrigger.triggerSave("alert_rule_updated");
+    res.json({ ...row, channels: linkedChannels });
+  } catch (err) {
+    databaseLogger.error("Failed to update alert rule", {
+      operation: "update_alert_rule",
+      error: err,
+    });
+    res.status(500).json({ error: "Failed to update alert rule" });
+  }
+});
+
+/**
+ * @openapi
+ * /alert-rules/{id}:
+ *   delete:
+ *     summary: Delete an alert rule
+ *     tags:
+ *       - Alerts
+ */
+router.delete("/alert-rules/:id", (req: Request, res: Response) => {
+  const userId = (req as AuthenticatedRequest).userId;
+  const ruleId = Number(req.params.id);
+  const existing = getDb()
+    .$client.prepare("SELECT id FROM alert_rules WHERE id = ? AND user_id = ?")
+    .get(ruleId, userId);
+  if (!existing) return res.status(404).json({ error: "Alert rule not found" });
+  getDb().$client.prepare("DELETE FROM alert_rules WHERE id = ?").run(ruleId);
+  DatabaseSaveTrigger.triggerSave("alert_rule_deleted");
+  res.json({ success: true });
+});
+
+// ---- Alert Firings ----
+
+/**
+ * @openapi
+ * /alert-firings:
+ *   get:
+ *     summary: List alert firings for the current user
+ *     tags:
+ *       - Alerts
+ */
+router.get("/alert-firings", (req, res) => {
+  const userId = (req as AuthenticatedRequest).userId;
+  const limit = Math.min(Number(req.query.limit) || 50, 200);
+  const offset = Number(req.query.offset) || 0;
+  const acknowledgedParam = req.query.acknowledged;
+
+  try {
+    let whereClause = "af.user_id = ?";
+    const params: unknown[] = [userId];
+
+    if (acknowledgedParam === "true") {
+      whereClause += " AND af.acknowledged = 1";
+    } else if (acknowledgedParam === "false") {
+      whereClause += " AND af.acknowledged = 0";
+    }
+
+    const rows = getDb()
+      .$client.prepare(
+        `SELECT af.*, ar.name as rule_name
+         FROM alert_firings af
+         LEFT JOIN alert_rules ar ON ar.id = af.rule_id
+         WHERE ${whereClause}
+         ORDER BY af.fired_at DESC
+         LIMIT ? OFFSET ?`,
+      )
+      .all(...params, limit, offset);
+
+    const total = (
+      getDb()
+        .$client.prepare(
+          `SELECT COUNT(*) as c FROM alert_firings af WHERE ${whereClause}`,
+        )
+        .get(...params) as { c: number }
+    ).c;
+
+    res.json({ firings: rows, total });
+  } catch (err) {
+    databaseLogger.error("Failed to list alert firings", {
+      operation: "list_alert_firings",
+      error: err,
+    });
+    res.status(500).json({ error: "Failed to list alert firings" });
+  }
+});
+
+/**
+ * @openapi
+ * /alert-firings/{id}/acknowledge:
+ *   post:
+ *     summary: Acknowledge an alert firing
+ *     tags:
+ *       - Alerts
+ */
+router.post("/alert-firings/:id/acknowledge", (req: Request, res: Response) => {
+  const userId = (req as AuthenticatedRequest).userId;
+  const firingId = Number(req.params.id);
+  getDb()
+    .$client.prepare(
+      "UPDATE alert_firings SET acknowledged = 1 WHERE id = ? AND user_id = ?",
+    )
+    .run(firingId, userId);
+  DatabaseSaveTrigger.triggerSave("alert_firing_acknowledged");
+  res.json({ success: true });
+});
+
+/**
+ * @openapi
+ * /alert-firings/acknowledge-all:
+ *   post:
+ *     summary: Acknowledge all alert firings for the current user
+ *     tags:
+ *       - Alerts
+ */
+router.post("/alert-firings/acknowledge-all", (req, res) => {
+  const userId = (req as AuthenticatedRequest).userId;
+  getDb()
+    .$client.prepare(
+      "UPDATE alert_firings SET acknowledged = 1 WHERE user_id = ?",
+    )
+    .run(userId);
+  DatabaseSaveTrigger.triggerSave("alert_firings_acknowledged_all");
+  res.json({ success: true });
+});
+
+export default router;