Protect admin token from container workspace #26

Merged

pti merged 4 commits from feat/admin-auth-boundary into main 2026-07-23 12:49:14 +02:00

Conversation 0 Commits 4 Files changed 5 +162 -11

pti commented 2026-07-23 12:36:54 +02:00

Owner

Copy link

Reject enabled admin-token paths resolving inside writable workspaces, including direct, symlinked, missing, and dangling paths. Verified with go test ./... and go vet ./... .

Reject enabled admin-token paths resolving inside writable workspaces, including direct, symlinked, missing, and dangling paths. Verified with go test ./... and go vet ./... .

pti added 1 commit 2026-07-23 12:36:54 +02:00

fix(up): protect admin token from containers ... 92c2fa938c

Reject admin token paths that resolve within a writable workspace before starting the server or container.

pti added 1 commit 2026-07-23 12:41:21 +02:00

fix(up): normalize admin token boundary paths ... 29825a684b

Expand home-relative paths before the workspace check and cover allowed external token targets.

pti added 1 commit 2026-07-23 12:43:41 +02:00

test(up): cover symlinked token parent 816ee142b2

pti added 1 commit 2026-07-23 12:47:18 +02:00

fix(up): validate disabled admin tokens ... e0588ae0a1

Token provisioning is unconditional, so reject configured admin token paths under writable workspaces even when the UI is disabled.

pti merged commit f8ab188c38 into main 2026-07-23 12:49:14 +02:00

pti referenced this pull request from a commit 2026-07-23 12:49:15 +02:00

Merge pull request 'Protect admin token from container workspace' (#26) from feat/admin-auth-boundary into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

pti/wraptool!26

No description provided.