2 Commits

Include renames

Author	SHA1	Message	Date
Juan DenisandClaude Fable 5	9b9aa34f01	test(seeds): one-door factories + persona headers + adoption ratchet (plan 77 G1/G2) ... tests/factories.py owns make_user/headers_for/make_application/ make_server/make_workspace; conftest personas (scoping_rbac, new viewer_headers/developer_headers fixtures) ride them. The byte-identical _seed_app pair (container scale/sleep), two variants (image_update, waf) and three server fixtures (fleet doctor/repair) migrate as proof. Ratchet freezes the 44-file hand-minted-JWT and 65-file direct-Application() populations. Note: test_fleet_doctor.py::test_dns_fail_when_unresolved fails pre-existing on this machine (warn vs fail), unrelated to this change. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-19 01:55:18 -04:00
Juan DenisandClaude Opus 4.8	ada030553a	feat(security): per-app WAF (ModSecurity v3 + OWASP CRS) ... - WafPolicy model (per app: mode off/detect/block, paranoia level, anomaly threshold, disabled CRS rule ids). - WafService: render_rules (SecRuleEngine + CRS include + paranoia/anomaly + SecRuleRemoveById), nginx_snippet, install/status (distro-aware, best-effort), apply() that writes per-app rules under /etc/nginx/serverkit-conf.d/waf and idempotently injects an include into the app vhost (graceful manual_include fallback), and audit-log event parsing. - API /api/v1/waf: per-app policy GET/PUT, apply, events, install status. - 29 tests: rule rendering per mode, rule-disable, nginx snippet, policy validation, audit-log parsing, API round-trip + auth. Backend only; WAF UI + verified install on a real nginx+ModSecurity host are follow-ups. Integration is additive — existing nginx/site management untouched. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-19 14:02:24 -04:00