Abhinav Raut 758a01ab74 guard knowledge base URL import against SSRF and fix OIDC transport defaults ...

The earlier SSRF work covered the provider, custom-tool, webhook, and OIDC
outbound calls but missed the knowledge base URL import path, which still used
http.DefaultClient. An admin importing a URL could reach loopback, link-local,
or RFC1918 hosts. Renamed the Manager's toolClient to httpClient (it is a
general SSRF-guarded outbound client now) and pointed fetchURL at it. The guard
sits on the dialer's Control, so it also runs on redirect targets, not just the
first hop.

Also fixed the OIDC discovery client. Its hand-built transport dropped two
defaults that http.DefaultTransport sets. Added Proxy: http.ProxyFromEnvironment
so it honors HTTP_PROXY/HTTPS_PROXY (SSO discovery now works behind an egress
proxy) and ForceAttemptHTTP2 so HTTP/2 is negotiated.

2026-07-17 19:24:31 +05:30

..

models

WIP: MVP with shadcn sidebar

2025-01-06 02:39:44 +05:30

auth.go

guard knowledge base URL import against SSRF and fix OIDC transport defaults

2026-07-17 19:24:31 +05:30