sarg3nt
diff --git a/‎gearbox/internal/framework/handler/handler.go‎
Lines changed: 156 additions & 13 deletions b/‎gearbox/internal/framework/handler/handler.go‎
Lines changed: 156 additions & 13 deletions
@@ -3,6 +3,7 @@ package handler
 import (
 	"log/slog"
 	"net/http"
+	"strings"
 	"sync"
 	"time"
 
@@ -206,23 +207,98 @@ func (h *Handler) getDefaultServerID() string {
 	return ""
 }
 
+// activeBoxCookieName is the cookie key that persists the user's selected
+// box across navigations. Lets gear links (e.g. /haproxy) drop the verbose
+// `?box_id=` query string and still resolve the active context.
+const activeBoxCookieName = "gearbox_active_box"
+
+// acceptsHTML reports whether the client appears to be requesting an HTML
+// document (vs. an XHR/fetch JSON call). Used to scope the box_id-stripping
+// redirect to navigations only.
+func acceptsHTML(r *http.Request) bool {
+	accept := r.Header.Get("Accept")
+	if accept == "" {
+		return false
+	}
+	// Cheap substring check is fine — quality factors don't change the answer
+	// for our use case (a navigation always advertises text/html very near
+	// the front of the Accept list).
+	for _, want := range []string{"text/html", "application/xhtml+xml"} {
+		if strings.Contains(accept, want) {
+			return true
+		}
+	}
+	return false
+}
+
+// activeBoxCookieMaxAge is one year — long enough to feel persistent.
+// Cleared explicitly via clearActiveBoxCookie when the user picks "All boxes".
+const activeBoxCookieMaxAge = 60 * 60 * 24 * 365
+
+// requestIsTLS reports whether the current request appears to be served
+// over HTTPS, either directly (r.TLS != nil) or via a TLS-terminating
+// proxy that forwards X-Forwarded-Proto=https (the HAProxy front-end in
+// this homelab does exactly that). Used to gate the Secure cookie
+// attribute so cookies are HTTPS-only in production but still work on
+// plain http://localhost during development.
+func requestIsTLS(r *http.Request) bool {
+	if r.TLS != nil {
+		return true
+	}
+	if strings.EqualFold(r.Header.Get("X-Forwarded-Proto"), "https") {
+		return true
+	}
+	return false
+}
+
+// setActiveBoxCookie writes the active-box id to an HttpOnly cookie scoped
+// to the whole site. SameSite=Lax so cross-site navigations (share-links,
+// bookmarks) still pick it up; HttpOnly so JS can't read it. Secure is
+// set whenever the request is itself TLS — addresses CodeQL
+// js/clear-text-cookie / go-cookie-not-secure.
+func setActiveBoxCookie(w http.ResponseWriter, r *http.Request, boxID string) {
+	http.SetCookie(w, &http.Cookie{
+		Name:     activeBoxCookieName,
+		Value:    boxID,
+		Path:     "/",
+		MaxAge:   activeBoxCookieMaxAge,
+		HttpOnly: true,
+		Secure:   requestIsTLS(r),
+		SameSite: http.SameSiteLaxMode,
+	})
+}
+
+// clearActiveBoxCookie removes the persisted box selection. Triggered by
+// `?box_id=` (empty value) or by visiting /bx (the fleet picker) — both
+// signal the user wants the all-boxes context.
+func clearActiveBoxCookie(w http.ResponseWriter, r *http.Request) {
+	http.SetCookie(w, &http.Cookie{
+		Name:     activeBoxCookieName,
+		Value:    "",
+		Path:     "/",
+		MaxAge:   -1,
+		HttpOnly: true,
+		Secure:   requestIsTLS(r),
+		SameSite: http.SameSiteLaxMode,
+	})
+}
+
 // InjectIntegrationStatus is middleware that adds integration status, the
 // active-box context, the enabled-box roster, and user permissions to the
 // request context. This is what drives the sidebar's scope-aware rendering
 // and the header's box-switcher chip.
 //
-// Active-box resolution:
-//   - If `?box_id=<id>` is present in the URL and refers to an enabled box,
-//     that box is the active context. The sidebar shows that box's enabled
-//     gears (plus all ScopeBoxAgnostic / ScopeSystem gears).
-//   - Otherwise the active context is empty ("box-agnostic"). The sidebar
-//     hides ScopeBox gears (they require a selection) and shows only
-//     ScopeBoxAgnostic + ScopeSystem entries.
+// Active-box resolution (in priority order):
+//  1. `?box_id=<id>` in the URL — explicit override. Also written to the
+//     active-box cookie so subsequent navigations don't need the query
+//     string. An empty `?box_id=` clears the cookie (used to deselect).
+//  2. The `gearbox_active_box` cookie — sticky preference from a prior
+//     selection. Subject to the same enabled-box validation as the URL.
+//  3. None — "All boxes" / box-agnostic context. Sidebar hides ScopeBox
+//     gears; the Bx fleet view becomes the entry point.
 //
 // System gears (keyed by database.SystemServerID) are loaded unconditionally
-// because they are install-wide. The legacy "fall back to the first enabled
-// box" behavior is gone — the Bx fleet view is now the user's entry point
-// when no box is explicitly selected.
+// because they are install-wide.
 func (h *Handler) InjectIntegrationStatus(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		ctx := r.Context()
@@ -243,16 +319,83 @@ func (h *Handler) InjectIntegrationStatus(next http.Handler) http.Handler {
 
 		enabled := h.getEnabledServers()
 
-		// Resolve the active box from ?box_id= (if any, enabled, and valid).
+		// Resolve the active box: URL takes precedence, cookie is fallback.
+		// `?box_id=` with an empty value is the explicit "deselect" signal —
+		// we honor it by clearing the cookie and skipping cookie fallback.
 		var activeBox *models.BoxConfig
-		if requested := r.URL.Query().Get("box_id"); requested != "" {
+		var requestedID string
+		urlHasBoxID := r.URL.Query().Has("box_id")
+		_, hasCookie := r.Cookie(activeBoxCookieName)
+		hasCookieSet := hasCookie == nil
+		if urlHasBoxID {
+			requestedID = r.URL.Query().Get("box_id")
+		} else if c, err := r.Cookie(activeBoxCookieName); err == nil {
+			requestedID = c.Value
+		}
+		if requestedID != "" {
 			for i := range enabled {
-				if enabled[i].ID == requested {
+				if enabled[i].ID == requestedID {
 					activeBox = &enabled[i]
 					break
 				}
 			}
 		}
+		// First-login fallback: if the request has no `?box_id=`, no
+		// previously-set cookie, and the user is landing on a page that
+		// benefits from a box context (i.e. not /bx, which means "show
+		// all"), seed the active box from the first enabled entry. This
+		// stops the sidebar from looking empty for users who haven't
+		// explicitly picked a box yet — the most common cause of first-
+		// login confusion.
+		if activeBox == nil && !urlHasBoxID && !hasCookieSet && len(enabled) > 0 &&
+			r.URL.Path != "/bx" && !strings.HasPrefix(r.URL.Path, "/bx/") {
+			activeBox = &enabled[0]
+			setActiveBoxCookie(w, r, activeBox.ID)
+		}
+		// Persist / clear the cookie based on what the URL signaled, then
+		// redirect to the same path with `box_id` stripped so URLs stay clean.
+		// Other query params are preserved (e.g. /logs?source=foo). Only
+		// HTML document GETs get the redirect — XHR/fetch (`Accept` lacks
+		// text/html) keep the param transparently so existing JS callers
+		// that still pass `?box_id=` don't break.
+		if urlHasBoxID && r.Method == http.MethodGet && acceptsHTML(r) {
+			if activeBox != nil {
+				setActiveBoxCookie(w, r, activeBox.ID)
+			} else {
+				clearActiveBoxCookie(w, r)
+			}
+			q := r.URL.Query()
+			q.Del("box_id")
+			redir := r.URL.Path
+			if encoded := q.Encode(); encoded != "" {
+				redir += "?" + encoded
+			}
+			http.Redirect(w, r, redir, http.StatusSeeOther)
+			return
+		}
+		// Cookie still needs writing for non-HTML callers that explicitly
+		// passed `?box_id=` (e.g. an early SPA-style call) so the next
+		// document GET doesn't have to re-resolve.
+		if urlHasBoxID {
+			if activeBox != nil {
+				setActiveBoxCookie(w, r, activeBox.ID)
+			} else {
+				clearActiveBoxCookie(w, r)
+			}
+		}
+		if r.URL.Path == "/bx" || r.URL.Path == "/bx/" {
+			// /bx is the all-boxes view — clear any sticky selection so
+			// the chip reads "All boxes" and the sidebar hides box-scoped
+			// gears. Clear whenever the cookie is present, not just when
+			// it resolved to an enabled box: otherwise a stale cookie
+			// (referencing a deleted/disabled box) survives indefinitely
+			// AND blocks the first-login auto-select branch below
+			// because hasCookieSet stays true.
+			if hasCookieSet {
+				clearActiveBoxCookie(w, r)
+			}
+			activeBox = nil
+		}
 		if activeBox != nil {
 			ctx = auth.SetSelectedBox(ctx, activeBox)
 		}