From d8ae7b8ce4380cb473df2d3f2798ad835e392d9e Mon Sep 17 00:00:00 2001
From: Matthew Grotke <mgrotke@gmail.com>
Date: Fri, 5 Jun 2026 02:43:17 -0400
Subject: [PATCH] Development

---
 .../routlin-dash/app/pages/radius/action.py   | 24 ++++++++++---
 .../app/pages/radius/content.json             | 35 ++++++++++++++++---
 2 files changed, 49 insertions(+), 10 deletions(-)

diff --git a/docker/routlin-dash/app/pages/radius/action.py b/docker/routlin-dash/app/pages/radius/action.py
index 77bbc69..feffa3a 100644
--- a/docker/routlin-dash/app/pages/radius/action.py
+++ b/docker/routlin-dash/app/pages/radius/action.py
@@ -38,12 +38,26 @@ def regenerate():
 @require_level('administrator')
 def options_save():
     mac_format = request.form.get('mac_format', 'aabbccddeeff')
-    apply_to   = request.form.get('apply_to', 'all')
-    ap_ips     = request.form.getlist('ap_ips')
-
     if mac_format not in VALID_MAC_FORMATS:
         flash('Invalid MAC format.', 'error')
         return redirect(f'/{_PAGE}')
+
+    cfg    = load_config()
+    before = copy.deepcopy(cfg.get('radius', {}).get('options', {}))
+    after  = {**before, 'mac_format': mac_format}
+    cfg.setdefault('radius', {})['options'] = after
+
+    changes = diff_fields(before, after)
+    flash(record_group(cfg, 'radius.options', 'setting', 'radius', changes, 'core apply'), 'success')
+    return redirect(f'/{_PAGE}')
+
+
+@bp.route('/action/radius/default_rule_save', methods=['POST'])
+@require_level('administrator')
+def default_rule_save():
+    apply_to = request.form.get('apply_to', 'all')
+    ap_ips   = request.form.getlist('ap_ips')
+
     if apply_to not in ('all', 'wireless', 'huntgroup'):
         flash('Invalid apply_to value.', 'error')
         return redirect(f'/{_PAGE}')
@@ -60,11 +74,11 @@ def options_save():
             return redirect(f'/{_PAGE}')
 
     before = copy.deepcopy(cfg.get('radius', {}).get('options', {}))
-    after  = {'mac_format': mac_format, 'apply_to': apply_to, 'ap_ips': ap_ips}
+    after  = {**before, 'apply_to': apply_to, 'ap_ips': ap_ips}
     cfg.setdefault('radius', {})['options'] = after
 
     changes = diff_fields(before, after)
-    flash(record_group(cfg, 'radius.options', 'setting', 'radius', changes, 'core apply'), 'success')
+    flash(record_group(cfg, 'radius.options', 'default_rule', 'radius', changes, 'core apply'), 'success')
     return redirect(f'/{_PAGE}')
 
 
diff --git a/docker/routlin-dash/app/pages/radius/content.json b/docker/routlin-dash/app/pages/radius/content.json
index 479ba39..6b35135 100644
--- a/docker/routlin-dash/app/pages/radius/content.json
+++ b/docker/routlin-dash/app/pages/radius/content.json
@@ -70,6 +70,31 @@
               ],
               "hint": "Must match your AP/controller's expected format."
             },
+            {
+              "type": "button_row",
+              "items": [
+                {
+                  "type": "button_primary",
+                  "action": "/action/radius/options_save",
+                  "method": "post",
+                  "text": "Save"
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "type": "card",
+      "label": "DEFAULT Rule Scope",
+      "client_requirement": "client_is_administrator+",
+      "items": [
+        {
+          "type": "form",
+          "action": "/action/radius/default_rule_save",
+          "method": "post",
+          "items": [
             {
               "type": "field",
               "label": "Apply DEFAULT Rule To",
@@ -77,15 +102,15 @@
               "input_type": "select",
               "value": "%RADIUS_APPLY_TO%",
               "options": [
-                {"value": "all",       "label": "All clients"},
-                {"value": "wireless",  "label": "Wireless clients only (NAS-Port-Type = Wireless-802.11)"},
-                {"value": "huntgroup", "label": "Wireless clients only (AP huntgroup by IP)"}
+                {"value": "all",       "label": "All authenticators"},
+                {"value": "wireless",  "label": "Wireless authenticators only (NAS-Port-Type = Wireless-802.11)"},
+                {"value": "huntgroup", "label": "Wireless authenticators only (AP huntgroup by IP)"}
               ],
               "hint": "Scoping to wireless only prevents the DEFAULT rule from assigning a VLAN to unknown wired switch ports. Huntgroup is more precise but requires AP IPs below."
             },
             {
               "type": "field",
-              "label": "Which of the following RADIUS Clients are Wireless Access Points that you wish to add to the huntgroup?",
+              "label": "Which of the following RADIUS Authenticators are Wireless Access Points that you wish to add to the huntgroup?",
               "name": "ap_ips",
               "input_type": "checkbox_group",
               "options": "%RADIUS_AP_IPS_OPTIONS%",
@@ -97,7 +122,7 @@
               "items": [
                 {
                   "type": "button_primary",
-                  "action": "/action/radius/options_save",
+                  "action": "/action/radius/default_rule_save",
                   "method": "post",
                   "text": "Save"
                 }