Phase 3 Step 3: Advanced Features & Real-Time Capabilities#

🎯 Advanced Features Step - This step implements real-time capabilities, completes advanced attack features, and finishes resource management functionality.

Table of Contents#

Phase 3 Step 3: Advanced Features & Real-Time Capabilities

Overview#

With core functionality verified and user management complete, this step focuses on advanced features that enhance the user experience: real-time updates via SSE, advanced attack configuration options, complete resource management workflows, and enhanced campaign operations.

Critical Context Notes#

SSE Architecture: Server-Sent Events provide lightweight trigger notifications (not full data streaming) for real-time updates
Attack Editor Context: Dictionary attacks support ephemeral wordlists, mask attacks create one-time mask lists, brute force is a UI wrapper for incremental masks
Resource Management: Upload page supports file drop zones, inline editing for small files, and atomic operations to prevent orphaned data
Hash List Integration: Crackable uploads support dual input modes (file upload + text paste) with intelligent hash type detection
Real-time Features: Toast notifications batch rapid events, SSE connections handle reconnection, project-scoped filtering prevents data leaks
Campaign Operations: Export/import uses JSON schema with GUID-based resource references, lifecycle operations include start/pause/resume/stop
Performance Requirements: Live keyspace estimation via /api/v1/web/attacks/estimate, real-time progress tracking without performance impact
Testing Strategy: All user-facing functionality must have both E2E tests (mocked and full E2E). Follow the full testing architecture document and refer to .cursor/rules/testing/e2e-docker-infrastructure.mdc and .cursor/rules/testing/testing-patterns.mdc for detailed guidelines.
E2E Testing Structure: frontend/e2e/ contains mocked E2E tests (fast, no backend), frontend/tests/e2e/ contains full E2E tests (slower, real backend). Configs: playwright.config.ts (mocked) vs playwright.config.e2e.ts (full backend)

Real-Time Features Implementation#

Server-Sent Events (SSE) Infrastructure#

🔧 Technical Context: SSE provides lightweight trigger notifications (not full data streaming). Events are project-scoped to prevent data leaks. Frontend uses EventSource with reconnection handling.

Real-Time Dashboard Updates#

REALTIME-001: Dashboard real-time capabilities
- Campaign progress updates via SSE (DRM-002a)
  - Progress UI: Smooth progress bar animations with percentage displays
  - Visual Feedback: Progress bars change color based on campaign state (purple=running, green=completed)
  - Live Updates: Keyspace-weighted progress via SSE without page refresh
  - Performance: Throttled updates to prevent UI flooding
- Agent status updates in real-time (DRM-002b)
  - Status Indicators: Real-time badge color changes (🟢 Online → 🔴 Offline)
  - Agent Sheet: Live updates in the slide-out Agent Status Sheet
  - Table Updates: Agent list table rows update status without full refresh
  - Performance Metrics: Live temperature, utilization, and hash rate displays
- Task completion notifications with targeted component refresh (DRM-002d)
  - Task Status: Real-time updates to running/completed task counts
  - Agent Assignment: Show which agents receive new tasks
  - Completion Feedback: Visual confirmation when tasks finish
- System health status updates (DRM-002e)
  - Health Cards: Color-coded service status indicators (Redis, MinIO, PostgreSQL)
  - Alert Banners: System-wide health issues displayed prominently
  - Recovery Actions: Retry buttons for failed services
- SSE connection cleanup and timeout handling (DRM-002f)
  - Connection Status: Visual indicator of SSE connection state
  - Reconnection Logic: Automatic reconnection with exponential backoff
  - Fallback Mode: Switch to polling when SSE fails

Toast Notification System Enhancement#

Advanced Attack Features#

Advanced Attack Configuration#

🔧 Technical Context: Dictionary attacks support user-friendly modifier buttons (+Change Case, +Substitute Characters) that abstract hashcat rule complexity. Advanced users can select rule files directly. Ephemeral wordlists stored only on Attack object. All UI components must use idiomatic Shadcn-Svelte patterns.

Campaign Lifecycle Operations#

Campaign Export/Import#

Complete Resource Management#

Resource Upload Enhancement#

Resource Content Management#

Resource Detail Pages#

RESOURCE-DETAIL-001: Complete resource detail pages
- Resource detail page loads with full information (RES-006a)
- Resource content preview for supported types (RES-006b)
- Resource metadata editing and updates (RES-006c)
- Resource usage history and tracking (RES-006d)
- Resource content editing for small files (RES-006e)
- Resource download and export options (RES-006f)
- Resource deletion with usage validation (RES-006g)

Hash List Management Implementation#

Hash List Operations#

HASH-001: Complete hash list management system
- Hash list creation from file upload (dual input modes support) (HSH-001a)
- Hash list creation from text paste (intelligent parsing from metadata) (HSH-001b)
- Hash type auto-detection and validation (confidence scoring with override capability) (HSH-001c)
- Hash list preview and statistics (confirmation screen with detected types) (HSH-001d)
- Hash list deletion with cascade checks (HSH-001e)
- Hash isolation from surrounding metadata (shadow files, NTLM pairs) (HSH-001f)
- Multi-stage validation preventing malformed campaign creation (HSH-001g)

Hash List Integration#

HASH-002: Hash list campaign integration
- Hash list selection in campaign creation (HSH-002a)
- Hash list reuse across multiple campaigns (HSH-002b)
- Crackable upload flow with hash detection (streamlined workflow design) (HSH-002c)
- Hash list export in various formats (HSH-002d)
- Auto-campaign creation from uploaded hashes (dynamic wordlist generation) (HSH-002e)
- Progress visibility during upload and processing phases (HSH-002f)
- Manual hash type override when auto-detection fails (HSH-002g)

Advanced Features Testing#

Testing Guidelines & Requirements#

🧪 Critical Testing Context:

Test Structure: All user-facing functionality must have both E2E tests (mocked and full E2E). Strictly follow existing test structure and naming conventions as described in the full testing architecture document.
Test Execution:
- Run just test-frontend for mocked E2E tests (fast, no backend required)
- Run just test-e2e for full E2E tests (requires Docker setup, slower but complete integration testing)
- Important: Do not run full E2E tests directly - they require setup code and must run via the just test-e2e command
Test Utilities: Use or reuse existing test utils and helpers in frontend/tests/test-utils.ts for consistency and maintainability
API Integration: The OpenAPI spec for the current backend is in contracts/current_api_openapi.json and should be used for all backend API calls, with Zod objects generated from the spec in frontend/src/lib/schemas/
Test Notation: When tasks include notations like (E2E) or (Mock), tests must be created or updated to cover that specific functionality and confirm it works as expected

UI/UX Requirements & Standards#

Responsive Design: Ensure the interface is polished and follows project standards. While mobile support is not a priority, it should be functional and usable on modern desktop browsers and tablets from 1080x720 resolution on up. It is reasonable to develop for support of mobile resolutions.
Offline Capability: Ability to operate entirely without internet connectivity is a priority. No functionality should depend on public CDNs or other internet-based services.
API Integration: The OpenAPI spec for the current backend is in contracts/current_api_openapi.json and should be used for all backend API calls, with Zod objects having been generated from the spec in frontend/src/lib/schemas/.
Testing Coverage: All forms must be validated using the OpenAPI spec and the Zod objects. All forms must be validated on both server side and client side.

Real-Time Updates Testing#

TEST-DRM-002: Real-Time Monitoring Tests
- DRM-002a: Campaign progress updates via SSE (E2E)
- DRM-002b: Agent status updates in real-time (E2E)
- DRM-002c: Crack notifications via toast system (E2E + Mock)
- DRM-002d: Task completion notifications with refresh (E2E)
- DRM-002e: System health status updates (E2E)
- DRM-002f: SSE connection cleanup and timeout handling (Mock)
- DRM-002g: Project-scoped event filtering (E2E)

Toast Notification Testing#

Advanced Attack Feature Testing#

TEST-ATT-004: Advanced Attack Feature Tests
- ATT-004a: Rule modificators and custom rules (E2E + Mock)
- ATT-004b: Dynamic wordlist integration (E2E + Mock)
- ATT-004c: Attack overlap detection and warnings (Mock)
- ATT-004d: Ephemeral resource creation for attacks (E2E + Mock)
- ATT-004e: Attack performance estimation (Mock)

Campaign Operations Testing#

Resource Management Testing#

Hash List Management Testing#

Validation & Success Criteria#

Real-Time Features Validation#

VALIDATE-001: Real-time capabilities are functional
- SSE connections establish and maintain properly
- Real-time updates work across all major components
- Toast notifications display correctly with proper batching
- Connection recovery works after network interruptions
- Project-scoped filtering prevents data leaks

Advanced Attack Features Validation#

VALIDATE-002: Advanced attack features are complete
- Rule modificators and custom rules work properly
- Dynamic wordlist generation functions correctly
- Attack overlap detection provides useful warnings
- Performance estimation provides accurate predictions
- All advanced features integrate with existing attack workflows

Resource Management Validation#

VALIDATE-003: Resource management is fully functional
- File upload handles large files and provides progress feedback
- Resource content editing works for all supported file types
- Resource detail pages provide comprehensive information
- Usage tracking and validation prevent orphaned references

Hash List Management Validation#

VALIDATE-004: Hash list management is complete
- Hash detection and validation work accurately
- Campaign integration handles all hash list scenarios
- Export/import functionality preserves data integrity
- Error handling provides clear guidance for resolution

Implementation Notes#

Key Technical Patterns#

Component Architecture: Use idiomatic Shadcn-Svelte components for all UI elements with proper accessibility and theming
SvelteKit Integration: Follow idiomatic SvelteKit 5 patterns for real-time updates, form handling, and state management
SSE Implementation: Use EventSource API with /api/v1/web/live/* endpoints for targeted component updates
Attack Editor Flow: Dictionary → searchable dropdowns, Mask → ephemeral lists, Brute Force → UI wrapper for incremental masks
Resource Upload: FileDropZone from Shadcn-Svelte-Extra, presigned URLs, atomic operations, progress tracking
Hash Detection: Multi-stage validation, confidence scoring, manual override capability, shadow file parsing
Campaign Export: JSON schema with GUID references, versioned imports, ephemeral resource rehydration
Performance Optimization: Real-time keyspace calculation, live complexity estimation, minimal data transfer

Real-Time Implementation Strategy#

Real-time features use lightweight trigger notifications rather than full data streaming:

SSE sends minimal event data to trigger component refreshes
Components refetch data using existing API endpoints
Project-scoped filtering prevents data leaks between projects
Connection management handles reconnection and cleanup

Advanced Attack Features Context#

These features enhance the attack configuration experience:

Rule modificators provide power users with advanced capabilities
Dynamic wordlists improve attack efficiency using project history
Overlap detection prevents wasted computational resources
Performance estimation helps users plan attack sequences

Resource Management Enhancement#

Complete resource management addresses identified gaps:

Upload page provides comprehensive file handling capabilities
Content editing enables in-place modification of resources
Detail pages centralize all resource-related information
Usage tracking prevents accidental deletion of active resources

Completion Definition#

This step is complete when:

Real-time updates work correctly across all components via SSE
Toast notification system provides comprehensive user feedback
Advanced attack features enhance configuration capabilities
Resource management provides complete upload, edit, and detail workflows
Hash list management handles all upload and campaign integration scenarios
All advanced features have comprehensive test coverage (Mock + E2E)
Performance is acceptable for all real-time and advanced features is acceptable for all real-time and advanced features