Merge branch 'fix/s3-region-full-url'

Author: h0tak88r

internal/api/ui/index.html

@@ -105,9 +105,19 @@ <h1 class="auth-title">AutoAR</h1>
           <span class="nav-icon"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="13 17 18 12 13 7"/><polyline points="6 17 11 12 6 7"/></svg></span>
           <span>ADB Auditor</span>
         </div>
-        <div class="nav-item" id="nav-securitylab" data-label="Security Lab">
+        <div class="nav-item nav-group-head" id="nav-securitylab" data-label="Security Lab" aria-expanded="false">
           <span class="nav-icon"><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M14.5 2v17.5c0 1.4-1.1 2.5-2.5 2.5h0c-1.4 0-2.5-1.1-2.5-2.5V2"/><path d="M8.5 2h7"/><path d="M14.5 16h-5"/></svg></span>
           <span>Security Lab</span>
+          <svg class="nav-caret" xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="9 18 15 12 9 6"/></svg>
+        </div>
+        <div class="nav-subitems" id="securitylab-subnav" role="menu">
+          <div class="nav-subitem" data-sltab="jwt" role="menuitem">JWT Analyzer</div>
+          <div class="nav-subitem" data-sltab="regex" role="menuitem">Regex Workbench</div>
+          <div class="nav-subitem" data-sltab="depconf" role="menuitem">Dependency Confusion</div>
+          <div class="nav-subitem" data-sltab="ssrf" role="menuitem">SSRF Payloads</div>
+          <div class="nav-subitem" data-sltab="xss" role="menuitem">XSS Cheat Sheet</div>
+          <div class="nav-subitem" data-sltab="dorks" role="menuitem">Recon Dorks</div>
+          <div class="nav-subitem" data-sltab="takeover" role="menuitem">Takeover Reference</div>
         </div>
 
         <div class="nav-item" id="nav-r2" data-label="R2 Browser">

internal/api/ui/pages/router-navigation.js

@@ -26,13 +26,26 @@
         adbauditor: '/ui/adbauditor/?mode=adb',
       };
       const frame = document.getElementById(`${view}-frame`);
-      if (frame && !frame.getAttribute('data-loaded')) {
+      if (view === 'securitylab') {
+        // Deep-link a specific tool when chosen from the sidebar submenu.
+        const slTab = state._securityLabTab;
+        state._securityLabTab = null;
+        if (frame && !frame.getAttribute('data-loaded')) {
+          frame.setAttribute('data-loaded', '1');
+          setTimeout(() => {
+            try { frame.src = '/ui/securitylab/' + (slTab ? '#' + slTab : ''); }
+            catch (e) { console.warn('[router] securitylab iframe init failed', e); }
+          }, 30);
+        } else if (frame && slTab) {
+          // Already loaded — switch tab in place, no reload.
+          try { frame.contentWindow.postMessage({ type: 'securitylab-tab', tab: slTab }, '*'); }
+          catch (e) { /* ignore cross-frame edge cases */ }
+        }
+      } else if (frame && !frame.getAttribute('data-loaded')) {
         frame.setAttribute('data-loaded', '1');
         setTimeout(() => {
-          try {
-            if (view === 'securitylab') frame.src = '/ui/securitylab/';
-            else frame.src = auditorPathMap[view] || `/ui/apkauditor/?mode=${modeMap[view]}`;
-          } catch (e) {
+          try { frame.src = auditorPathMap[view] || `/ui/apkauditor/?mode=${modeMap[view]}`; }
+          catch (e) {
             // Keep SPA navigation alive even if iframe init fails in a browser/extension edge case.
             console.warn('[router] auditor iframe init failed', e);
           }

internal/api/ui/pages/shell-wiring.js

@@ -10,6 +10,30 @@
       }
     });
 
+    // Security Lab is an expandable group: clicking the head toggles its tool list
+    // (it still navigates via the handler above); each sub-item deep-links to one tool.
+    const slHead = document.getElementById('nav-securitylab');
+    if (slHead) {
+      slHead.addEventListener('click', () => {
+        const expanded = slHead.classList.toggle('expanded');
+        slHead.setAttribute('aria-expanded', expanded ? 'true' : 'false');
+      });
+    }
+    document.querySelectorAll('#securitylab-subnav .nav-subitem').forEach((el) => {
+      el.addEventListener('click', (e) => {
+        e.stopPropagation();
+        const tab = el.dataset.sltab;
+        document.querySelectorAll('#securitylab-subnav .nav-subitem').forEach((x) => x.classList.remove('active'));
+        el.classList.add('active');
+        if (slHead) {
+          slHead.classList.add('expanded');
+          slHead.setAttribute('aria-expanded', 'true');
+        }
+        window.state._securityLabTab = tab;
+        window.navigateTo('securitylab');
+      });
+    });
+
     const refreshBtn = document.getElementById('refresh-btn');
     if (refreshBtn) refreshBtn.addEventListener('click', window.manualRefresh);
 

internal/api/ui/securitylab/index.html

@@ -506,6 +506,23 @@ <h1 class="title">Security Lab</h1>
       });
     });
 
+    // Deep-linking: the parent dashboard can open a specific tool either via the URL
+    // hash on first load (#ssrf) or via postMessage once the iframe is already loaded.
+    // We click the tab button so any lazy initialization (e.g. XSS) also runs.
+    (function () {
+      function openTab(name) {
+        if (!name) return;
+        const btn = document.querySelector('.tab[data-tab="' + name + '"]');
+        if (btn) btn.click();
+      }
+      openTab((location.hash || '').replace(/^#/, ''));
+      window.addEventListener('hashchange', () => openTab((location.hash || '').replace(/^#/, '')));
+      window.addEventListener('message', (e) => {
+        const d = e.data;
+        if (d && d.type === 'securitylab-tab' && typeof d.tab === 'string') openTab(d.tab);
+      });
+    })();
+
     function pretty(v) { try { return JSON.stringify(v, null, 2); } catch { return String(v); } }
     function b64urlDecode(str) {
       const pad = '='.repeat((4 - (str.length % 4)) % 4);

internal/api/ui/styles.css

@@ -275,6 +275,56 @@ input, select, textarea { font-family: inherit; }
   flex-shrink: 0;
 }
 
+/* Expandable nav group (Security Lab) */
+.nav-caret {
+  margin-left: auto;
+  flex-shrink: 0;
+  opacity: 0.55;
+  transition: transform 0.18s ease, opacity var(--transition);
+}
+.nav-group-head:hover .nav-caret { opacity: 0.9; }
+.nav-group-head.expanded .nav-caret { transform: rotate(90deg); opacity: 0.9; }
+.nav-subitems {
+  max-height: 0;
+  overflow: hidden;
+  transition: max-height 0.22s ease;
+  display: flex;
+  flex-direction: column;
+  gap: 2px;
+}
+.nav-group-head.expanded + .nav-subitems { max-height: 340px; padding: 2px 0; }
+.nav-subitem {
+  display: flex;
+  align-items: center;
+  padding: 7px 10px 7px 40px;
+  border-radius: 8px;
+  cursor: pointer;
+  color: var(--text-secondary);
+  font-size: 12.5px;
+  font-weight: 500;
+  white-space: nowrap;
+  position: relative;
+  transition: all var(--transition);
+}
+.nav-subitem::before {
+  content: '';
+  position: absolute;
+  left: 26px;
+  top: 50%;
+  width: 5px;
+  height: 5px;
+  border-radius: 50%;
+  background: currentColor;
+  opacity: 0.35;
+  transform: translateY(-50%);
+}
+.nav-subitem:hover { background: var(--bg-card); color: var(--text-primary); }
+.nav-subitem.active { color: var(--accent-cyan); background: var(--accent-cyan-dim); }
+.nav-subitem.active::before { opacity: 1; }
+/* Collapsed (icon-only) sidebar: hide the caret and the whole submenu. */
+.sidebar.collapsed .nav-caret,
+.sidebar.collapsed .nav-subitems { display: none; }
+
 .nav-badge {
   margin-left: auto;
   background: var(--accent-cyan-dim);