sencho

mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-07-27 04:11:01 +00:00

Files

T

Anso 5b607de227 fix(api-tokens): harden scope enforcement and block sensitive endpoints (#228 )

* fix(api-tokens): harden scope enforcement and add expiration support

- Fix deploy-only allowlist to match actual routes (deploy, down, restart,
  stop, start, update) instead of non-existent /up, /pull, /compose/* paths
- Block API tokens from auth-sensitive routes (password change, node token
  generation) that bypass scope enforcement middleware
- Add WebSocket scope enforcement: read-only/deploy-only tokens can only
  access logs and notifications, not host console or container exec
- Prevent API token self-replication: tokens cannot create, list, or revoke
  other tokens regardless of scope
- Map deploy-only tokens to admin role so they pass requireAdmin on deploy
  routes (scope middleware still restricts which endpoints they can reach)
- Add optional token expiration (30, 60, 90, 365 days or no expiry)
- Add token name length validation (max 100 characters)
- Surface fetchTokens errors in frontend instead of swallowing silently
- Fix docs: correct deploy-only scope description and GitHub Actions example

* fix(api-tokens): block all sensitive management endpoints from API tokens

User management, SSO configuration, node management, license management,
and console access are now human-session-only. Add comprehensive unit
tests for scope enforcement, blocked endpoints, expiration, and revocation.

* fix(api-tokens): fix TS18048 possibly-undefined in test

2026-03-28 22:14:22 -04:00

features

fix(api-tokens): harden scope enforcement and block sensitive endpoints (#228 )

2026-03-28 22:14:22 -04:00

getting-started

feat: SSO & LDAP authentication for Team Pro (#209 )

2026-03-28 03:30:01 -04:00

images

docs: refresh screenshots (#227 )

2026-03-28 21:29:56 +00:00

operations

feat: RBAC, atomic deployments, fleet backups, and licensing (Pro) (#185 )