Juan DenisandTyler Boykin 783e195304 fix(git): enforce app-level authorization on deployment read endpoints ...

GHSA-6w78-q5vm-rfmh: four git deployment/webhook read endpoints checked
authentication but skipped app-level authorization, letting any active
user (even a foreign viewer) read cross-tenant deployment history and
logs that can contain secrets from pre/post-deploy scripts.

- git.deployments/<id>: resolve deployment -> app, 404/403 via
  app_access_tier before returning any log bytes
- git.deployments/webhook/<id>: gate on _webhook_visible_to (app-linked
  webhooks follow app visibility; unlinked stay panel-wide, plan 29 #11)
- deploy.history & deploy.webhook-logs: app_id queries require
  app_access_tier; global (no app_id) queries are panel-admin only

Adds backend/tests/test_git_deployment_authz.py (9 persona-matrix
regression tests) and bumps the test-count ratchet.

Co-authored-by: Tyler Boykin <25166954+CaptBoykin@users.noreply.github.com>

2026-08-03 23:44:56 -04:00

..

app

fix(git): enforce app-level authorization on deployment read endpoints

2026-08-03 23:44:56 -04:00

migrations

fix(monitoring): give the TLS certificate read its own clock

2026-07-28 00:22:56 -04:00

serverkit_installer

docs: adopt numbered filenames for docs/plans and update references

2026-07-01 20:49:41 -04:00

templates

docs(screenshots): recapture, and fix two bugs the capture exposed

2026-07-26 09:59:06 -04:00

tests

fix(git): enforce app-level authorization on deployment read endpoints

2026-08-03 23:44:56 -04:00

_dbcheck.py

Add test sandbox and harden install scripts

2026-07-20 22:26:19 -04:00

.bandit

Add dev launcher; harden backups & storage

2026-03-02 22:48:29 -05:00

.dockerignore

Compose: containerize backend & build frontend

2026-03-01 14:30:21 -05:00

.env.example

Add review rules and proxy/auth docs

2026-07-18 01:23:47 -04:00

.gitignore

Add dev launcher; harden backups & storage

2026-03-02 22:48:29 -05:00

cli.py

feat(cli): --json output on read-only admin CLI verbs

2026-07-11 01:22:49 -04:00

config.py

feat(deployments): simulated demo deploys through the real console pipeline

2026-07-23 16:58:46 -04:00

Dockerfile

fix(deploy): make docker-compose.yml frontend-only (backend runs on host)

2026-06-25 16:20:32 -04:00

requirements.txt

Add pip-audit CI gate and bump click

2026-07-20 02:16:47 -04:00

run.py

Add unified dev scripts and improve login UX

2026-01-25 18:33:25 -05:00

serverkit_cron_run.py

feat(cron): completion — run history, project scope, cwd/run-as (plan 34)

2026-07-07 20:29:29 -04:00

smoke_sandbox.py

Add test sandbox and harden install scripts

2026-07-20 22:26:19 -04:00

wp-cli.phar

Add multi-site WordPress management and UI overhaul

2026-01-28 22:15:57 -05:00