Feature Request

This is partially due to a Discord channel chat but also some nice to haves I've been thinking about. Running tests manually is fine but it seems like we could make this much more useful. Some use cases I am imagining. Changes are made in dev, promoted to prod, tests run in prod after deployment An increase in app token login failures, run tests to verify access Changes are made throughout the day, run nightly tests While I do think a lot of this is possible outside PSU, I do think that surfacing this in the platform would be very helpful. We don't need it to be extremely complicated but offering a few more integration points would be nice. More configurable test execution options (suite, cases, etc) to limit which tests are run Triggers can run test suites\cases (git sync in prod, run tests) Triggers based on test results (failed tests, run email script) Scheduled test runs (nightly tests) Improved test run reporting (similar to job runs with more filtering, origin, rerun etc) General documentation around running Playwright in PSU (service desktop and accounts etc)

shouldnt i be able to hit the swagger page and then click try now on a /testAuth api with windows auth and the admin rold on it, and it return a 200? right now i am getting a 403 forbidden. if i get a token with powershell and do a login and pass it in, it works just fine

Currently, there seems to be no way to make apps complaint with WCAG standards for screen reader support. Consider the following: New-UDTextbox -Id 'HardWords' -Label 'Nougat Croissant Valet' The screenreader may read the label as " noujet Croi-sant val-it" , a known issue with screen readers. This is what Aria-Label would be used for in web development. A new property on all the elements such as - Aria-Label "noo-gah Krwah-sahn val-ay" would resolve this issue. A even better solution is a way to inject HTML tag attributes into any element in the same fashion as New-UDStyle for styling such as New-UDAttributes or a similar name.

I believe all modern services should natively provide TOTP and I would love to see it in PSU. Here is all the algorithm stuff you need to do it in pwsh: https://github.com/ecspresso/TOTPPowerShellModule Whats missing on that page: When checking user input against the results from the function, it is important not to just use "-eq" (according to AI). This is how to do it safely: function Compare-ConstantTime { #prevents timing based attacks param([string]$a, [string]$b) if ($a.Length -ne $b.Length) { return $false } $result = 0 for ($i = 0; $i -lt $a.Length; $i++) { $result = $result -bor ($a[$i].GetHashCode() -bxor $b[$i].GetHashCode()) } return $result -eq 0 } I have already implement something similar in the past but it was quite cumbersome to set everything up (authentication.ps1, login.ps1, storing and retrieving secrets) so a native implementation would be awesome. Thank you for considering ~~

I'd like to see some more options for tweaking application auto startup. For example if a app isnt as important the app could be put on a delayed startup similar to how services in windows work. This would help get PSU up and running quicker in the event the server needs to restart

Hi everyone, I'm currently running a setup with a WAF using the OWASP Core Rule Set (CRS). I've encountered two specific rules causing total page blanking (403 errors) for legitimate traffic. While i can change the rule set and make exclusions, i was hoping that there could be changes made to PSU so others wont run into the same problem. 1. Rule 943120 Possible Session Fixation Attack: SessionID Parameter Name with No Referrer Legitimate requests containing a sessionID parameter are blocked if the Referrer header is missing. In the logs the /dashboardhub path was flagged with this rule on every app page, causing it to load blank pages. AI was suggesting moving the session id to a cookie instead of the URL parameter to get around the rule trigger. 2. Rule 942421 (SQL Injection - Special Characters) Requests are blocked when the .NET cookies contains a high number (3) of special characters. Environment: - Docker hosted reverse proxy "Caddy" with Coraza plugin: https://github.com/docker-servers/coraza-caddy - CRS Version: 4.25.0 Index of all rules: https://web.archive.org/web/20230901104426/https://www.netnea.com/cms/core-rule-set-inventory/ Here are a few more rules that i observed in detection mode but ultimately where irrelevant after blocking the 2 rules above. [image] Thanks!

I would like to be able to create a schedule that can be assigned to multiple scripts. I'm thinking something like Schedule When to run Every Day at Midnight What to run Script 1 script 2 Or something like that.

In order to save cpu and memory resources on our PSU instance we dont have all apps running 24/7. Currently when a technician wants to use an app that is offline they have to ask me to turn it on for them. I would like to see a way to grant the ability to turn an app on via the PSU portal and have the ability tied to security roles.

When i try to add HEAD to the code in the endpoints.ps1, it breaks the api's [image] endpoints.ps1 Cannot validate argument on parameter 'Method'. The argument "HEAD" does not belong to the set "GET,POST,PUT,DELETE,OPTIONS,PATCH" specified by the ValidateSet attribute. Supply an argument that is in the set and then try the command again.