sencho

mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-07-26 20:00:08 +00:00

Files

T

Anso 954994cdc0 fix(api-tokens): harden scope enforcement and add expiration support (#224 )

- Fix deploy-only allowlist to match actual routes (deploy, down, restart,
  stop, start, update) instead of non-existent /up, /pull, /compose/* paths
- Block API tokens from auth-sensitive routes (password change, node token
  generation) that bypass scope enforcement middleware
- Add WebSocket scope enforcement: read-only/deploy-only tokens can only
  access logs and notifications, not host console or container exec
- Prevent API token self-replication: tokens cannot create, list, or revoke
  other tokens regardless of scope
- Map deploy-only tokens to admin role so they pass requireAdmin on deploy
  routes (scope middleware still restricts which endpoints they can reach)
- Add optional token expiration (30, 60, 90, 365 days or no expiry)
- Add token name length validation (max 100 characters)
- Surface fetchTokens errors in frontend instead of swallowing silently
- Fix docs: correct deploy-only scope description and GitHub Actions example

2026-03-28 17:15:05 -04:00

features

fix(api-tokens): harden scope enforcement and add expiration support (#224 )

2026-03-28 17:15:05 -04:00

getting-started

feat: SSO & LDAP authentication for Team Pro (#209 )

2026-03-28 03:30:01 -04:00

images

docs: refresh screenshots (#223 )

2026-03-28 19:49:42 +00:00

operations

feat: RBAC, atomic deployments, fleet backups, and licensing (Pro) (#185 )