Juan Denis 1fe8ada10d Look up agent registration tokens by digest ...

POST /servers/register needs no login and ran a slow PBKDF2 check
against every pending server per request, so a few IPs under the
5/min limit could keep the single worker's CPU busy. Tokens carry 256
random bits, so store a SHA-256 digest and find the row directly;
hashes issued before this still verify until they expire.

2026-10-26 01:00:48 -04:00

..

schemas

feat(search): add resource picker contract

2026-08-21 09:20:54 -04:00

__init__.py

Initial project structure and core API implementation

2026-01-17 04:22:12 -05:00

_access.py

Compute visible workspace ids in one place

2026-10-10 16:56:42 -04:00

_query.py

refactor(list-queries): one PageQuery door for the page/per_page dialect (C3)

2026-08-19 00:10:09 -04:00

_request.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

admin.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

advanced_ssl.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

agent_plugins.py

Read 40 more route bodies through json_object()

2026-10-10 21:48:18 -04:00

agent_poll.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

ai.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

api_analytics.py

Give common API errors stable codes and service wording

2026-10-04 18:59:25 -04:00

api_keys.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

app_attachments.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

app_slots.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

app_volumes.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

apps.py

Read 40 more route bodies through json_object()

2026-10-10 21:48:18 -04:00

auth.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

backups.py

Read 40 more route bodies through json_object()

2026-10-10 21:48:18 -04:00

bandwidth.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

buildpacks.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

builds.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

connect.py

Remove internal plan citations from app code

2026-10-10 15:50:45 -04:00

connections.py

Read 40 more route bodies through json_object()

2026-10-10 21:48:18 -04:00

container_status.py

Remove internal plan citations from app code

2026-10-10 15:50:45 -04:00

contracts.py

feat(api): add typed endpoint contracts and envelopes

2026-08-18 02:47:57 -04:00

cron.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

dashboards.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

database_engines.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

databases.py

Validate Postgres helper SQL and report user errors

2026-10-26 00:43:13 -04:00

db_tuner.py

Read 40 more route bodies through json_object()

2026-10-10 21:48:18 -04:00

ddns.py

Read 40 more route bodies through json_object()

2026-10-10 21:48:18 -04:00

deploy.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

deployment_jobs.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

deployments.py

Remove bare plan-section citations

2026-10-10 20:25:49 -04:00

dns_cutover.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

dns_providers.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

dns_zones.py

Read 40 more route bodies through json_object()

2026-10-10 21:48:18 -04:00

docker.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

docs.py

Add API keys, analytics, webhooks, and middleware

2026-03-04 01:53:46 -05:00

doctor.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

domains.py

Keep custom-domain HTTPS across vhost rebuilds

2026-10-26 00:49:57 -04:00

env_vars.py

feat: expose value-free effective environment provenance through app access boundary

2026-10-24 05:58:02 -04:00

environments.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

error_logs.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

event_subscriptions.py

refactor(webhooks): move subscription use cases behind service boundary

2026-08-18 02:56:33 -04:00

files.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

firewall.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

fleet_doctor.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

fleet_monitor.py

Enforce workspace access on every server route

2026-10-26 00:35:55 -04:00

fleet.py

Enforce workspace access on every server route

2026-10-26 00:35:55 -04:00

git.py

Read 40 more route bodies through json_object()

2026-10-10 21:48:18 -04:00

htaccess_tools.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

image_updates.py

Remove internal plan citations from app code

2026-10-10 15:50:45 -04:00

invitations.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

jobs.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

linked_panel.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

logs.py

Validate the journal priority parameter

2026-10-10 20:54:45 -04:00

managed_db_users.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

manifests.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

marketplace.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

metrics.py

fix(dashboard): avoid content blockers on metrics history requests (#133)

2026-09-04 22:20:22 -04:00

migrations.py

fix(authz): give every mutating route an explicit authorization decision

2026-08-19 21:44:17 -04:00

mobile.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

modules.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

monitoring.py

Read 40 more route bodies through json_object()

2026-10-10 21:48:18 -04:00

monitors.py

Read 40 more route bodies through json_object()

2026-10-10 21:48:18 -04:00

nginx_advanced.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

nginx.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

notifications.py

Read 40 more route bodies through json_object()

2026-10-10 21:48:18 -04:00

pairing.py

Read 40 more route bodies through json_object()

2026-10-10 21:48:18 -04:00

performance.py

fix(auth): resolve the caller through one identity door, not the raw JWT

2026-08-18 19:33:57 -04:00

php.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

plugins.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

ports.py

Add /ports/check and /ports/suggest

2026-10-03 22:46:54 -04:00

previews.py

feat: queue preview automation and preserve cleanup ownership through app deletion

2026-10-24 06:21:26 -04:00

private_urls.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

processes.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

projects.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

proxy.py

Enforce workspace access on every server route

2026-10-26 00:35:55 -04:00

python.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

queue_bus.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

recipes.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

recycle_bin.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

registrars.py

Read 40 more route bodies through json_object()

2026-10-10 21:48:18 -04:00

responses.py

feat(api): add typed endpoint contracts and envelopes

2026-08-18 02:47:57 -04:00

restore_points.py

Remove internal plan citations from app code

2026-10-10 15:50:45 -04:00

runs.py

Remove internal plan citations from app code

2026-10-10 15:50:45 -04:00

search.py

Remove internal plan citations from app code

2026-10-10 15:50:45 -04:00

secrets_webhooks.py

Drop imports that shadowed module-level names

2026-10-10 22:20:03 -04:00

security.py

Read 40 more route bodies through json_object()

2026-10-10 21:48:18 -04:00

server_templates.py

Read 40 more route bodies through json_object()

2026-10-10 21:48:18 -04:00

servers_agents.py

Enforce workspace access on every server route

2026-10-26 00:35:55 -04:00

servers_docker.py

Enforce workspace access on every server route

2026-10-26 00:35:55 -04:00

servers_remote.py

Enforce workspace access on every server route

2026-10-26 00:35:55 -04:00

servers.py

Look up agent registration tokens by digest

2026-10-26 01:00:48 -04:00

setup_health.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

shared_resources.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

site_imports.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

snapshots.py

Remove bare plan-section citations

2026-10-10 20:25:49 -04:00

source_connections.py

Read 40 more route bodies through json_object()

2026-10-10 21:48:18 -04:00

speed_test.py

Drop route try/excepts the 500 handler duplicates

2026-10-10 18:14:28 -04:00

ssl.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

sso.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

support_bundle.py

Drop route try/excepts the 500 handler duplicates

2026-10-10 18:14:28 -04:00

survey.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

system.py

Remove the /system process and service routes

2026-10-10 21:51:15 -04:00

telemetry.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

templates.py

Read 40 more route bodies through json_object()

2026-10-10 21:48:18 -04:00

test_sandbox.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

themes.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

two_factor.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

uptime.py

fix(authz): give every mutating route an explicit authorization decision

2026-08-19 21:44:17 -04:00

views.py

Read 40 more route bodies through json_object()

2026-10-10 21:48:18 -04:00

waf.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

walkthroughs.py

Read route bodies through json_object()

2026-10-10 20:53:43 -04:00

webhooks.py

feat: provision isolated generic previews with retryable resource cleanup

2026-10-24 06:11:46 -04:00

workspaces.py

Read 40 more route bodies through json_object()

2026-10-10 21:48:18 -04:00