Fix: strictly filter flows by agent UUID to prevent org-level data pollution

proxy/backoneClient.js

@@ -13,6 +13,10 @@ async function fetchFlows(limit = 500, agentUuid = null, siteUuid = null, interv
     backoneFetch('/data/stats/top/tls_sni/download', { filter_interval: intervalMinutes, settings_limit: 50 }, agentUuid, siteUuid),
   ]);
   if (!raw || !Array.isArray(raw)) return null;
+
+  // Safety check: Filter flows strictly to the requested agent to prevent Org-level pollution
+  const filteredRaw = agentUuid ? raw.filter(r => r.agent_uuid === agentUuid) : raw;
+
   const sniList = [];
   if (sniRaw && Array.isArray(sniRaw)) {
     for (const r of sniRaw) {
@@ -22,7 +26,7 @@ async function fetchFlows(limit = 500, agentUuid = null, siteUuid = null, interv
       }
     }
   }
-  return raw.map(r => {
+  return filteredRaw.map(r => {
     const port = r.remote_port ?? null;
     const portService = port ? (stats.PORT_SERVICE_MAP[port] ?? `Port ${port}`) : null;
     const appLabel = r.application?.label || portService;

proxy/backoneClientCore.js

@@ -37,7 +37,8 @@ function fixDates(obj) {
 async function backoneFetch(endpoint, params = {}, agentUuid = null, siteUuid = null) {
   if (agentUuid) {
     const agentId = agentMap[agentUuid];
-    if (agentId) {
+    // Only use filter_agents if agentId is a number or numeric string
+    if (agentId && !isNaN(Number(agentId))) {
       params.filter_agents = `[${agentId}]`;
     } else {
       params.settings_agent = agentUuid;