3 Commits

Include renames

Author	SHA1	Message	Date
Tomas DvorakandDevin	89f3d84234	fix: full-stack E2E hardening — client blobs, modal errors, audit coverage, MCP context ... - api-client: getResponseBody returns Blob for non-JSON (fixes storage preview/download TypeError); postgen.mjs reapplies the patch on regen - Modal: error prop renders inside the dialog so request failures are visible instead of hidden behind the overlay (6 pages wired) - lib/api: extract server-provided error message from error.body - Modal: unique id per instance (duplicate modal-title broke aria-label) - nginx: index.html no-cache + immutable /assets (stale shell pointed at deleted hashed assets after redeploy → white screen) - vite: drop dead Google Fonts runtime caching (fonts are vendored) - functions: audit function.created/updated/deleted/invoked - AuditPage: expand action filter to all recorded actions - MCP: whoami uses /context for API keys; projectId/orgId resolve via /context with auth-aware precedence (stale `primora use` selection can never authorize a differently-scoped key) Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>	2026-09-24 22:51:10 +02:00
Tomas DvorakandDevin	2d6135121e	security: harden agent surface — vault_exec allow-list, SSRF, error hygiene ... Stress-test remediation across MCP, CLI, and backend: - primora_vault_exec rewritten as an allow-list (was deny-list): colon-form single-token commands bypassed it, leaking every vault secret; verbatim env-name injection allowed NODE_OPTIONS=--require host RCE. Now fixed read-mostly command set, arg/path deny regex, strict env-name grammar, loader-hook name blocklist. All prior bypasses verified denied; allowed commands still inject. - SSRF: webhook/job URL validation now blocks cloud metadata IPs (169.254.169.254, fd00:ec2::254) inside the link-local allowance and non-canonical IP encodings (decimal/hex bare hosts) smuggled as "docker service names". - Path params encodeURIComponent in all client consumers — encodeURI left ?#& intact, smuggling query segments through {name} params. - primora_upload_object strict-validates contentBase64 — Buffer.from silently dropped invalid chars. - MCP no-creds startup degrades instead of crashing mid-handshake. - GET /api/v1/context — API-key self-discovery; fixes the CLI dead end (login --api-key validates the key + seeds org/project, use/context/whoami work under key auth). - CLI: unknown commands / bare group exit 1 with hints; mri numeric coercion reversed via raw-argv restore (007 stays "007"); login --json; orgs:rm / projects:rm / buckets:rm behind --yes; fetch-failed errors name the cause. - Error hygiene: pgx.ErrNoRows -> 404, pgconn codes -> clean 400/409 without SQLSTATE leaks, validator failures formatted, services.InputError maps input faults to 400 (webhook URL/event errors were 500s), presign on local driver -> 400. - Webhook events accept wildcard patterns (*, ns.*, custom.*) matched via SQL LIKE — client-published events can be webhooked. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>	2026-09-24 21:56:11 +02:00
Tomas Dvorak	7ddfb1f52b	initiall commit	2026-04-10 12:03:31 +02:00