Andras Bacsai
b0f0f7d8d0
feat: harden auth flows and server mobile navigation
...
Add normalized email identity rate limiting for registration and forgot-password requests, and refresh Sentinel status from restart broadcasts.
Rework server sidebars and navbar for mobile menus and active status visibility.
2026-07-08 09:42:52 +02:00
Andras Bacsai
6ed92cb97a
fix(vultr): validate public network and token scope
...
Require IPv6 when public IPv4 is disabled, constrain cloud token
lookup by team and provider during deletion, and encode Vultr instance IDs
in API paths.
2026-07-07 21:39:57 +02:00
Andras Bacsai
31f904ef9f
Merge remote-tracking branch 'origin/next' into feature/vultr-cloud-provider
2026-07-07 21:23:07 +02:00
Andras Bacsai
a8000ac2ad
fix(hetzner): require at least one public IP protocol
2026-07-07 14:41:17 +02:00
Andras Bacsai
c9ffa0db96
Merge remote-tracking branch 'origin/next' into feat/hetzner-firewalls-and-internal-networks
2026-07-07 14:37:54 +02:00
Andras Bacsai
b939e09f12
refactor(hetzner): move advanced options into dropdown
2026-07-07 14:36:11 +02:00
Andras Bacsai
d723a52d9c
fix(hetzner): secure token-backed option fetches
...
Authorize stored Hetzner cloud provider tokens before fetching
firewalls or networks, hide provider error details, and keep server
creation intact if backup activation fails.
Collapse advanced Hetzner server options by default while preserving
visibility when advanced values are selected.
2026-07-07 14:24:15 +02:00
Andras Bacsai
11b35ba3c1
feat(api): add tags to resource creation
...
Normalize tag names before attaching them, reject names that are too short
after sanitization, and return 404 when removing tags not attached to the
resource.
Adds a per-team unique tag-name index and migrates duplicate tags onto the
kept record before creating the constraint.
2026-07-07 13:56:33 +02:00
Andras Bacsai
2ad11fdd9a
Merge remote-tracking branch 'origin/next' into feat/hetzner-firewalls-and-internal-networks
2026-07-07 13:47:51 +02:00
Andras Bacsai
c58b4fd69c
Merge remote-tracking branch 'origin/next' into feature/vultr-cloud-provider
2026-07-07 13:44:37 +02:00
Andras Bacsai
2caa5e67ff
fix(github): derive API URLs from GitHub HTML hosts ( #10610 )
2026-07-07 12:29:15 +02:00
Andras Bacsai
1adeed2a48
fix(github): preserve custom app API URLs
2026-07-03 12:01:16 +02:00
Andras Bacsai
9b060958aa
fix(ray): remove Ray debug hooks from runtime ( #10847 )
2026-07-03 11:40:20 +02:00
Andras Bacsai
a7dddccd2e
Merge remote-tracking branch 'origin/next' into ghe-support-helpers
2026-07-03 10:26:58 +02:00
Andras Bacsai
b90380f542
Merge remote-tracking branch 'origin/next' into ghe-support-helpers
2026-07-03 10:15:29 +02:00
Andras Bacsai
d73649ca15
Merge remote-tracking branch 'origin/next' into fix-ghe-app-install-url
2026-07-03 10:10:39 +02:00
Andras Bacsai
58f6f9e05b
feat(dev): add Lima testing server fixtures ( #10844 )
2026-07-03 10:07:55 +02:00
Andras Bacsai
eb56287b57
Merge remote-tracking branch 'origin/next' into 10633-invitation-link-redirect
2026-07-02 18:55:25 +02:00
Andras Bacsai
cf6f5a2678
feat(registry): add configurable docker registry url ( #9017 )
2026-07-02 18:52:46 +02:00
Andras Bacsai
c6c7ec1c31
fix(security): validate application domains safely
...
Use shared domain validation and normalization for application, service, and
preview domains so unsafe host input is rejected consistently.
Cover command-substitution payloads in application domain tests.
2026-07-02 17:47:04 +02:00
Andras Bacsai
954c1e369c
fix(env-vars): avoid service preview variable lookups ( #10837 )
2026-07-02 17:39:16 +02:00
Andras Bacsai
d5395f0500
fix(services): preserve template keys for selection
2026-07-02 17:16:40 +02:00
Andras Bacsai
0bf97df9af
feat: add internal endpoint controls
2026-07-02 16:35:39 +02:00
Andras Bacsai
88d5aff018
Merge remote-tracking branch 'origin/next' into team-level-mcp-enablement
2026-07-02 15:15:11 +02:00
Andras Bacsai
20b5b90cf9
Merge remote-tracking branch 'origin/next' into improve-s3-storage-handling
2026-07-02 15:06:11 +02:00
Andras Bacsai
78d9244caa
fix: improve s3 storage handling
2026-07-02 15:05:05 +02:00
Andras Bacsai
a06c1a7bf5
Improve storage mount path handling
2026-07-02 14:54:38 +02:00
Andras Bacsai
74f4d04f53
fix(backups): default S3 storage for backup schedules
...
Show the S3 storage selector even when S3 backups are disabled, save
storage changes immediately, and improve responsive confirmation buttons.
2026-07-02 12:47:54 +02:00
Andras Bacsai
22b31f5671
fix(backups): require valid S3 storage selection
...
Preserve S3 backups when a single valid storage is available, require
explicit selection when multiple storages exist, and disable S3 when none
are available.
Make backup action controls responsive on narrow screens.
2026-07-01 11:14:20 +02:00
Andras Bacsai
78374b566a
fix members smtp pw update
2026-06-30 15:29:19 +02:00
Andras Bacsai
29445bf177
fix: align resource creation permissions
2026-06-29 15:57:17 +02:00
Andras Bacsai
7d65a4b496
Merge remote-tracking branch 'origin/next' into harden-database-import-files
2026-06-29 10:35:35 +02:00
Andras Bacsai
2d63d51237
fix: harden database backup imports
2026-06-29 10:27:01 +02:00
Andras Bacsai
bef94a9ce2
feat(mcp): add per-team server toggle
2026-06-25 11:42:19 +02:00
Andras Bacsai
22d05c78aa
Merge remote-tracking branch 'origin/next' into ghe-support-helpers
2026-06-15 12:55:34 +02:00
Andras Bacsai
507a8afa20
fix(github): sync app slug before generating installation path
2026-06-15 12:55:29 +02:00
Andras Bacsai
d2deaa8363
fix(auth): restrict Sentinel access and register S3 policy
2026-06-15 12:31:30 +02:00
Andras Bacsai
78d8afa602
Merge remote-tracking branch 'origin/next' into audit-policies
2026-06-15 12:05:19 +02:00
Andras Bacsai
403f8abcb4
Merge remote-tracking branch 'origin/next' into fix-ghe-app-install-url
2026-06-12 20:02:23 +02:00
Andras Bacsai
4f509c02be
fix(auth): validate invitation magic link tokens
...
Accept invitation links across configured public origins while still
rejecting stored invitations whose token no longer matches.
2026-06-12 16:17:45 +02:00
Andras Bacsai
61d2d17f52
feat(subscription): add Stripe action controls
...
Add subscription action handling and tests for cancel, resume, and refund flows while resolving StripeClient through the container.
2026-06-12 15:54:21 +02:00
Andras Bacsai
0d9a39ea23
fix(github): sync pending app credentials before slug lookup
2026-06-09 18:32:05 +02:00
Andras Bacsai
281184c040
fix(github): derive app API URLs from HTML hosts
...
Normalize GitHub organization values and derive API URLs for GitHub.com,
GHE.com, and enterprise hosts when creating or updating GitHub Apps.
2026-06-09 18:31:06 +02:00
Andras Bacsai
bc2c6068ea
fix(github): sync app slug before building install URL
...
Move GitHub App JWT generation and slug synchronization into shared helpers so installation URLs use the canonical GitHub slug. Encode GHE organization path segments and keep the app-scoped fallback for blank organizations.
2026-06-09 15:27:35 +02:00
Andras Bacsai
22f9f96db6
chore: inspect staged changes for commit message
2026-06-04 15:24:53 +02:00
Andras Bacsai
5973bb4d4f
fix(security): hide notification secrets from non-admins
...
Prevent users without update permission from reading notification credentials and manual webhook secrets in Livewire state or rendered forms.
2026-06-04 11:24:19 +02:00
Andras Bacsai
062ad57740
fix(security): enforce team access on mutable actions
...
Authorize cloud provider token access, audit sensitive operations, and
standardize public IDs across deployment and resource flows.
2026-06-04 11:03:06 +02:00
Andras Bacsai
9dca7ca351
Merge remote-tracking branch 'origin/next' into audit-policies
2026-06-04 10:18:54 +02:00
Andras Bacsai
981b670eb4
feat(services): show template update timestamps
2026-06-04 09:34:11 +02:00
Cornelis Terblanche
94abbe1590
Add Vultr cloud provider integration
2026-06-03 21:32:18 +02:00
Andras Bacsai