[dviejokfs]

Summary

Bundles the security-hardening work that can be safely applied to current main from 39 of bherila's security PRs. The branch was rebased onto current upstream and reviewed as one integrated change rather than merging the fork PRs independently.

Critical fixes

• Parameterizes MariaDB data-browser filters and disables unsafe raw PostgreSQL filters.
• Restricts managed PostgreSQL images, applies the same allowlist and authoritative
  service-image checks to major upgrades and resumptions, and verifies local image
  identity fail-closed.
• Restores fail-closed project permission fallback and enforces Blob/KV project and token scope.
• Scopes internal proxy traffic to the caller's project using event-driven invalidation plus authoritative Docker ownership checks with per-project quotas, hard global concurrency, and fail-closed timeouts.
• Validates WebSocket origins, confines Docker secret paths, and safely quotes WAL-G environment values.
• Blocks unsafe webhook and custom AI endpoints with external-only resolution and redirects disabled.

High-severity fixes

• Tightens credential rotation, AI tools, repository access, email sending, deployment-token, template, and setup-token authorization.
• Hardens node placement, registry credential forwarding, HTTPS host validation, preview subdomains, auto-deploy opt-out, CAS assets, teardown, and container inventory.
• Replaces predictable MinIO credentials, pins helper images by immutable manifest digest, removes credentialed helper build residue, binds DNS changes to verified provider zones, opts preview environments out of production secrets, and checksum-pins Bun installation.

Source PR coverage

Critical: #48, #50, #53, #62, #70, #79, #82, #83, #85, #86, #92, #95, #96.

High: #47, #51, #52, #54, #55, #56, #57, #59, #60, #61, #63, #64, #65, #66, #67, #68, #69, #71, #72, #76, #84, #87, #88, #91, #93, #94.

#87 contributes only the owner-binding portion that is compatible with current main.

Not ported:

• fix(ci): remove duplicate trigger-pipeline causing vite-e2e cancellation #49 and feat(agents): AI autopilot agents framework with cron scheduling and autofixer #58 are superseded by feat(email-tracking): add event timeline UI and analytics dashboard #53 and fix(security): resolve dependency vulns and fix container exec tenant isolation #54.
• feat(workspace,sandbox): v0.0.8 security audit + sandbox path centralization + CLI auto-auth #73, feat(cli): release channels for temps upgrade and install.sh #74, feat(providers): resource limits + runtime panel for external services #75, fix(auth): preserve session cookie when clearing mfa_session after verify #77, and fix(logs,storage): runtime logs overhaul + storage UI polish #78 already have stronger equivalents on current main.
• fix(ci): set automatic_deploy=true in E2E project creation #80 is incomplete when applied endpoint-by-endpoint; analytics token authorization needs a separate centralized fix.
• fix(deployments): always trigger initial deployment for new environments #81 is stale/unsafe against the current authorization model.
• feat(serve): split public and admin console listeners #89 rejects valid Next.js runtime layouts and needs a compatibility-aware design.
• chore(0.1.0): backup retention via S3 lifecycle + responsive UX + fixes #90 can cross-wire existing Redis services without a durable allocation migration.

Compatibility and migration notes

• PostgreSQL raw filter strings are rejected; callers must use structured filters.
• Existing environment variables marked for preview inclusion are backed up and set to opt-out during migration. The down migration restores exactly those prior rows.
• Preview gateway and MinIO client helper defaults now use immutable multi-platform manifest digests.

Evidence

• cargo fmt --all — passed.
• git diff --check — passed.
• cargo check --lib — 0 errors across the workspace; only existing workspace/build-script/future-compatibility warnings.
• Repository commit hooks — passed, including formatting, generated API consistency, clippy, changelog policy, whitespace, EOF, and typo checks.
• cargo test -p temps-agent --lib — 48 passed.
• cargo test -p temps-environments --lib — 73 passed.
• cargo test -p temps-projects --lib — 108 passed.
• Deployment job-processor focused suite — 26 passed.
• cargo test -p temps-email --lib — 197 passed with local socket access.
• cargo test -p temps-providers --lib — 508 passed with local Docker/PostgreSQL access.
• PostgreSQL upgrade orchestrator Docker suite — 6 passed against published, allowlisted Timescale PostgreSQL 17/18 images, covering full upgrade, backup exec, snapshot ordering, dump retry, new-container startup, and rollback.
• cargo test -p temps-deployments --lib — 611 passed, 3 intentionally ignored, with local Docker/PostgreSQL access.
• apps/temps-e2e: bun run typecheck — passed.
• Scheduler explicit-target and label-mismatch fail-closed tests — 2 passed.
• Cross-project and sibling preview-subdomain conflict tests — 2 passed.
• Immutable preview-gateway and MinIO helper image tests — passed.
• Real PostgreSQL preview-inclusion migration up/down test — 1 passed; verifies existing-row backfill and restoration.
• Earlier focused suites on this branch passed for SQL query hardening, Blob/KV isolation, permission fallback, WebSocket origin validation, SSRF, image identity, WAL-G quoting, Docker secret paths, auto-deploy, MinIO credentials, DNS ownership, token scoping, and preview configuration.

Review focus

• Authorization fallbacks and deployment-token scope mapping.
• Internal proxy identity behavior (event invalidation/expiry, per-project 64/s burst-16 quotas, per-project concurrency 2, global concurrency 32, and bounded queue/inspect timeouts).
• Canonical, case-insensitive hostname claims across manual updates, environment/job creation and restoration, and atomic project-slug renames.
• Preview-variable migration backup table and rollback semantics.
• Operational impact of rejecting PostgreSQL raw filters.
• Phase-aware PostgreSQL major-upgrade image validation and idempotent SWAP retries.

[github-actions]

📓 Changelog preview

This is what your commits will add to the generated CHANGELOG.md at release time (via git-cliff). Do not edit CHANGELOG.md by hand — it is generated from your Conventional Commit messages.

## [Unreleased]

### Documentation

- **providers:** Describe structured MariaDB filters

### Fixed

- **security:** Harden critical trust boundaries
- **security:** Bundle high severity hardening
- **security:** Address integration review findings
- **security:** Close residual tenant identity races
- **security:** Centralize tenant hostname claims
- **security:** Canonicalize tenant identity claims
- **security:** Isolate proxy inspection quotas
- **ci:** Align tests with security hardening
- **security:** Close upgrade and placement bypasses
- **security:** Validate upgrade recovery paths
- **security:** Fail closed on invalid placement
- **security:** Enforce constrained scheduling

### Testing

- **providers:** Use supported upgrade images

[bherila]

I opened replacement PR #677 from bherila/temps: #677. It preserves the full #676 commit series and adds the focused forward fix for the docker-providers failure (postgres:17-bookworm test fixture rejected by the hardened image allowlist). Please review #677 as the superseding branch; #676 remains open for now.