Security & Auth Hardening
- Fleet role separation: Fleet API key now returns limited
fleetrole instead ofwriter— prevents fleet workers from accessing owner-only operations - Deploy requires owner: Deploy endpoint elevated from writer to owner permission
- First-run IP restriction: Initial account registration restricted to private/loopback networks
- SSRF fix:
api_worker_commandnow uses validated worker URL helper - XSS fix: Fleet dashboard uses data attributes + event delegation instead of inline JS interpolation
Compose Generator Fixes
- Interpolation escaping:
${VAR}in volumes/commands escaped as$${VAR}for Docker Compose (handles pre-escaped values correctly) - Named volume declaration: Generated compose files now declare named volumes at top level
- Required env var validation: Deploy rejects blank/whitespace-only required fields
Documentation
- Fleet docs rewritten to accurately describe REST heartbeat architecture (removed fictional WebSocket/join-token references)
- Service guides aligned with actual auth models (earnfm, repocket, iproyal, presearch)
- Fixed repocket policy contradiction
Tests
- Added
TestRequireRolecovering fleet escalation boundaries - Added
TestEscapeInterpolation,TestIsNamedVolume,TestNamedVolumeDeclaration - Updated existing tests for new auth requirements