Xiangzhe 753dde6c86 fix(security): route OAuth auto-import through the LOCAL_ONLY tier ...

The cursor / kiro / raycast auto-import routes read host-local credential files,
but the broad /api/oauth/ PUBLIC prefix classified them PUBLIC — which skips the
LOCAL_ONLY tier entirely, so the loopback-only guard never ran. They are now
excluded from PUBLIC (classify MANAGEMENT) and added to LOCAL_ONLY_API_PREFIXES,
so a non-loopback caller is rejected before the handler runs. OAuth callbacks and
browser flows under /api/oauth/ stay PUBLIC.

Reported by @ntdat812 via GHSA-wgwc-crjm-pmwv and @koyokr via GHSA-gxv4-955v-v6cm.

2026-08-21 14:26:41 -03:00

..

classify.test.ts

fix: Stabilize live dashboard WebSocket routing (#6335)

2026-07-09 23:19:32 -03:00

client-api-policy-fallback.test.ts

Release v3.8.18 (#3482)

2026-06-09 15:56:24 -03:00

client-api-policy.test.ts

feat(api): accept x-goog-api-key header for client-facing auth (#7034) (#7236)

2026-07-17 10:48:14 -03:00

csrf.test.ts

Release v3.8.43 (#5609)

2026-07-02 10:47:13 -03:00

discovery-routes-local-only.test.ts

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

ip-filter-enforcement-6131.test.ts

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

management-policy.test.ts

fix(mcp): preserve caller identity for internal REST hops (#9260)

2026-08-05 21:45:27 -03:00

oauth-autoimport-local-only.test.ts

fix(security): route OAuth auto-import through the LOCAL_ONLY tier

2026-08-21 14:26:41 -03:00

pipeline.test.ts

feat: add Kiro API key authentication (#6587)

2026-07-09 22:49:06 -03:00

probe-9033-repro.test.ts

fix(db): add transient-error retry to corruption probe to prevent data loss under concurrent load (#9541)

2026-08-06 22:55:10 -03:00

proxy-contract.test.ts

fix(security): match client-API aliases case-insensitively in the authz matcher

2026-08-21 13:14:53 -03:00

proxy-matcher-case.test.ts

chore(test): type security test bodies, drop unused eslint-disable

2026-08-21 13:28:11 -03:00

public-origin.test.ts

Release v3.8.41 (#5327)

2026-06-29 16:51:03 -03:00

public-policy.test.ts

fix(providers): refresh web client user agents (#1699)

2026-04-28 02:41:19 -03:00

route-guard-local-prefix.test.ts

Release v3.8.37 (#5053)

2026-06-26 02:51:06 -03:00

route-guard-skills-collect.test.ts

Continue fix bugs and upgrade skill_collector (#6294)

2026-07-09 19:43:43 -03:00

route-guard-version-get-exemption.test.ts

Release v3.8.39 (#5164)

2026-06-28 06:58:29 -03:00

route-guard-vnc-session-local-only.test.ts

feat(vnc-session): persistent noVNC browser login for web-cookie providers (#7892)

2026-07-22 10:46:04 -03:00

routeGuard.test.ts

fix(security): add chatgpt-web-codex-doctor to SPAWN_CAPABLE_PATTERNS

2026-08-21 13:23:01 -03:00

spawn-capable-prefixes-client-safe.test.ts

feat: add Video Bridge frame sampling (#10483)

2026-08-15 14:23:29 -03:00