Add PAT management-API endpoints for previously web-only features:
- secrets/<key> PATCH: access_mode + requires_approval (project admin)
- secrets/<key>/bindings POST/DELETE: secret-scope RBAC bindings
- secrets/<key>/meta PATCH/DELETE: custom metadata write
- projects/<ref> PATCH: require_reveal_approval/description/default_access_mode
- projects/<ref>/export: audited plaintext/encrypted export
- trash/restore bulk: restore|purge by ids or all
- teams/<ref>/groups + members: group CRUD and membership

All reuse DB-trigger/RLS gates from the web UI handlers. 416 tests.

security: enforce machine token roles, fix CSRF for mgmt API, fail-closed disabled check 05592ff20c

- New migration 0003: machine_get_row/machine_list_enc reject service-read
  tokens (no value_enc returned). Add crypto_provider column.
- App-level defense in depth: eso_get_secret and eso_list_secrets
  check machine_role and return 403 for service-read before decrypting.
- CSRF: exempt /api/v1/manage with Bearer token so CLI PAT POST/DELETE works.
- is_account_disabled: fail-closed (return True on DB error).
- Architecture docs updated.
- Tests updated for new role check + new CSRF exemption test.

security: safe form-field access, rate-limit ESO machine tokens 602d689010

test: mock disabled-check in login tests, expect third migration 013967d044

feat(ui): flatten ESO token-create nesting fe7e3d00d7

fix(db): drop old machine_get_row signature before return-type change 750820b631

db: squash migrations to single fresh-install baseline

CI / tox py + lint (pull_request) Has been cancelled

Details

dadb62434e

mhahl-a merged commit a08c59da21 into main

2026-08-16 09:54:19 +00:00

mhahl-a referenced this pull request from a commit

2026-08-16 09:54:20 +00:00