bluejay/bluejay-infra
1
0
Fork 0
Code Issues Pull Requests 15 Actions Packages Projects Releases Wiki Activity

Harden UpdateCenter public route methods #46

Merged
bluejay merged 1 commits from codex/updatecenter-public-route-hardening into main 2026-06-18 15:38:59 +00:00
Conversation 0 Commits 1 Files Changed 4 +19 -4
bluejay commented 2026-06-18 15:38:25 +00:00
Owner
Copy Link

P0 UpdateCenter public exposure hardening.

  • Make update.flowercore.io / updates.flowercore.io public IngressRoute GET/HEAD only.
  • Remove public update hosts from the read-write Rego allowlist.
  • Add C# manifest lint coverage so POST/OPTIONS cannot return to the public UpdateCenter route.
  • Update fc-updater verification docs away from public API schema access.

Proof:

  • dotnet.exe test tests/bluejay-infra-lint/BluejayInfraLint.Tests.csproj (102 passed).
  • Updater public-host tests in FlowerCore.Updater main already cover /login, /api/auth/login, /agent/install, and admin shell leakage.
  • Fresh live probe on 2026-06-18: /login returned 404 for GET, HEAD, POST, and OPTIONS.
P0 UpdateCenter public exposure hardening. - Make update.flowercore.io / updates.flowercore.io public IngressRoute GET/HEAD only. - Remove public update hosts from the read-write Rego allowlist. - Add C# manifest lint coverage so POST/OPTIONS cannot return to the public UpdateCenter route. - Update fc-updater verification docs away from public API schema access. Proof: - dotnet.exe test tests/bluejay-infra-lint/BluejayInfraLint.Tests.csproj (102 passed). - Updater public-host tests in FlowerCore.Updater main already cover /login, /api/auth/login, /agent/install, and admin shell leakage. - Fresh live probe on 2026-06-18: /login returned 404 for GET, HEAD, POST, and OPTIONS.
bluejay added 1 commit 2026-06-18 15:38:25 +00:00
harden updatecenter public route methods 14195e5da7
bluejay merged commit e4e03643a4 into main 2026-06-18 15:38:59 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
bluejay
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: bluejay/bluejay-infra#46
Delete Branch "codex/updatecenter-public-route-hardening"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?