[bherila]

Motivation

• Address a security regression where the proxy could serve CAS-cached static assets scoped only by project_id and url_path, allowing assets from different environments or deployments in the same project to be served on the current host.
• Prevent prefixed URLs like /_temps/assets/{deployment_slug}/... from discarding the slug and serving a colliding path from another deployment.
• Ensure the change is recorded in the repository CHANGELOG.md per project conventions.

Description

• Restrict CAS DB lookups in serve_asset_from_store to require the routed project_id, environment_id, and deployment_id instead of selecting the newest same-project row by deployment_id (change in crates/temps-proxy/src/proxy.rs).
• Validate /_temps/assets/{deployment_slug}/... requests against the currently routed deployment slug before using the path for a CAS lookup (change in crates/temps-proxy/src/proxy.rs).
• Add helper methods to ProxyContext: static_asset_scope_ids and matches_current_deployment_slug to encapsulate scoping and slug checks (added to crates/temps-proxy/src/proxy.rs).
• Add an Unreleased CHANGELOG.md entry describing the scoped CAS static-asset fallback security fix.

Testing

• Ran cargo check -p temps-proxy --lib, which completed successfully with no warnings-as-errors blocking compilation.
• Ran cargo test -p temps-proxy --lib; the test run completed build and executed unit tests with 305 tests passing, but 26 tests failed and 6 were ignored because this environment lacks a Docker socket at /var/run/docker.sock (the failures are Docker-dependent tests), so the failures are environmental rather than caused by the logic change.
• Verified git diff --check and updated CHANGELOG.md as required by repository conventions.

---

Codex Task

[github-actions]

📓 Changelog preview

This is what your commits will add to the generated CHANGELOG.md at release time (via git-cliff). Do not edit CHANGELOG.md by hand — it is generated from your Conventional Commit messages.

## [Unreleased]

### CI

- **self-hosted:** Add build/test workflow on push to bherila fork
- **self-hosted:** Recreate example-plugin web/dist before cargo check
- **self-hosted:** Also recreate temps-cli/dist placeholder
- **self-hosted:** Run hosted unit-test crate set, skip integration-heavy crates
- **self-hosted:** Exclude temps-screenshots live-browser tests

### Fixed

- **proxy:** Scope CAS static asset lookup

[bherila]

The functional change was carried into upstream security-hardening PR gotempsh#676 and its merged replacement gotempsh#677. Upstream gotempsh#676 explicitly lists this fork PR in its source coverage.

Fork main has now been fast-forwarded to upstream main at 7250ab59b38d3138014ade7f5d6391c856eaa4f7. Closing this obsolete fork PR as part of the upstream synchronization; its branch history is retained.