Juan DenisandClaude Opus 4.8 5598a1c6e2 fix(agent): rate-limit the poll /connect auth path ...

The WebSocket auth path (agent_gateway.on_auth) throttles auth attempts
per-IP via _check_auth_rate_limit, but the REST long-poll equivalent,
POST /api/v1/agent/connect, did full HMAC auth with no throttle. That left an
unthrottled credential-stuffing surface against agent auth while the WS path
stayed protected.

connect() now calls the same shared limiter before verify_agent_auth and
returns 429 when the per-IP window is exhausted. Adds a regression test that
drives the real endpoint through the limit.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-05-31 14:46:47 -04:00

..

__init__.py

Initial project structure and core API implementation

2026-01-17 04:22:12 -05:00

admin.py

Add audit graphs, server selector & UI tweaks

2026-03-24 05:53:20 -04:00

advanced_ssl.py

Add advanced SSL: wildcard, SAN, custom certs, health checks

2026-03-23 02:15:16 -04:00

agent_plugins.py

Add agent plugin system with full lifecycle management

2026-03-23 02:08:00 -04:00

agent_poll.py

fix(agent): rate-limit the poll /connect auth path

2026-05-31 14:46:47 -04:00

api_analytics.py

Add Services UI and service-detail pages

2026-03-07 12:15:02 -05:00

api_keys.py

Add API keys, analytics, webhooks, and middleware

2026-03-04 01:53:46 -05:00

apps.py

Add repository manifest detection and templates

2026-05-03 07:07:57 -04:00

auth.py

Fleet monitor + security and agent hardening

2026-03-23 01:58:28 -04:00

backups.py

Add dev launcher; harden backups & storage

2026-03-02 22:48:29 -05:00

builds.py

Refactor to consistently use app.root_path and update deployment model

2026-01-18 04:20:30 -05:00

cloud_provisioning.py

Add auth checks, logging, DNS API & UI

2026-03-24 06:10:58 -04:00

cron.py

Add cron job editing and tabbed route support

2026-03-03 22:11:30 -05:00

databases.py

Add security, logging, DB hardening & SCSS refactor

2026-03-23 22:00:36 -04:00

deploy.py

Refactor to consistently use app.root_path and update deployment model

2026-01-18 04:20:30 -05:00

deployment_jobs.py

Add deployment jobs and remote deployment runner

2026-04-29 00:39:16 -04:00

dns_zones.py

Add DNS zone management with provider integrations

2026-03-23 02:18:26 -04:00

docker.py

Add bulk container stats and UI workspace revamp

2026-05-03 06:12:39 -04:00

docs.py

Add API keys, analytics, webhooks, and middleware

2026-03-04 01:53:46 -05:00

domains.py

Add support for template file creation and bind mounts

2026-01-19 19:49:12 -05:00

email.py

Add invitations, email models, admin APIs

2026-03-04 02:34:49 -05:00

env_vars.py

Add environment variable management feature

2026-01-18 00:40:41 -05:00

environment_pipeline.py

Add WordPress environment pipeline API and models

2026-01-27 19:35:21 -05:00

event_subscriptions.py

Add API keys, analytics, webhooks, and middleware

2026-03-04 01:53:46 -05:00

files.py

Add security, logging, DB hardening & SCSS refactor

2026-03-23 22:00:36 -04:00

firewall.py

Replace jwt_required with RBAC, use socket auth

2026-02-08 23:14:13 -05:00

fleet_monitor.py

Add auth checks, logging, DNS API & UI

2026-03-24 06:10:58 -04:00

fleet.py

Add agent capability probing and reporting

2026-05-01 00:37:48 -04:00

ftp.py

Replace jwt_required with RBAC, use socket auth

2026-02-08 23:14:13 -05:00

git.py

Replace jwt_required with RBAC, use socket auth

2026-02-08 23:14:13 -05:00

invitations.py

Add invitations, email models, admin APIs

2026-03-04 02:34:49 -05:00

logs.py

Initial project structure and core API implementation

2026-01-17 04:22:12 -05:00

marketplace.py

Improve plugin loading, API client & marketplace UI

2026-05-03 17:17:32 -04:00

metrics.py

Replace jwt_required with RBAC, use socket auth

2026-02-08 23:14:13 -05:00

migrations.py

Add SSO/OAuth and DB migration framework

2026-03-04 01:37:22 -05:00

mobile.py

Add auth checks, logging, DNS API & UI

2026-03-24 06:10:58 -04:00

monitoring.py

Monitoring UI, public page & slug validation

2026-05-03 20:10:18 -04:00

nginx_advanced.py

Add Nginx advanced config: reverse proxy, load balancing, caching

2026-03-23 02:19:33 -04:00

nginx.py

Initial project structure and core API implementation

2026-01-17 04:22:12 -05:00

notifications.py

Add database query runner and notification preferences

2026-01-18 03:10:55 -05:00

pairing.py

Add short-code agent pairing flow

2026-04-29 03:08:21 -04:00

performance.py

Add performance optimization: Redis caching and background jobs

2026-03-23 02:27:52 -04:00

php.py

Initial project structure and core API implementation

2026-01-17 04:22:12 -05:00

plugins.py

Address Copilot review: plugin security + correctness

2026-05-17 11:21:08 -04:00

private_urls.py

Replace jwt_required with RBAC, use socket auth

2026-02-08 23:14:13 -05:00

processes.py

Initial project structure and core API implementation

2026-01-17 04:22:12 -05:00

python.py

Initial project structure and core API implementation

2026-01-17 04:22:12 -05:00

security.py

Add advanced security management features

2026-01-21 21:58:59 -05:00

server_templates.py

Add server templates with config drift detection and compliance

2026-03-23 02:11:16 -04:00

servers.py

Add connstring, file handlers, and security tests

2026-05-02 00:51:47 -04:00

source_connections.py

Add repository manifest detection and templates

2026-05-03 07:07:57 -04:00

ssl.py

Add standalone WordPress and SSL management UI

2026-01-25 22:48:12 -05:00

sso.py

Add audit fallback, builtin extensions, and ports

2026-05-03 15:57:02 -04:00

status_pages.py

Add status pages with health checks and incident management

2026-03-23 02:22:53 -04:00

system.py

Replace jwt_required with RBAC, use socket auth

2026-02-08 23:14:13 -05:00

templates.py

Add deployment jobs and remote deployment runner

2026-04-29 00:39:16 -04:00

two_factor.py

Fleet monitor + security and agent hardening

2026-03-23 01:58:28 -04:00

uptime.py

Add server uptime tracking and visualization

2026-01-17 13:37:40 -05:00

wordpress_sites.py

Add resource tier enforcement and UI for WordPress creation

2026-01-25 20:01:07 -05:00

wordpress.py

Add multi-site WordPress management and UI overhaul

2026-01-28 22:15:57 -05:00

workflows.py

Add workflow automation engine and triggers

2026-03-23 01:30:51 -04:00

workspaces.py

Add auth checks, logging, DNS API & UI

2026-03-24 06:10:58 -04:00