From 4c2133430fece3f19c0b52703270c4948f089b4a Mon Sep 17 00:00:00 2001 From: Antigravity Agent Date: Sat, 22 Aug 2026 11:33:35 -0500 Subject: [PATCH 01/18] chore: update GitHub Actions to latest versions and fix AGENTS.md link --- .github/workflows/ci.yml | 28 ++++++++++++------------- .github/workflows/codeql.yml | 4 ++-- .github/workflows/dependency-review.yml | 4 ++-- .github/workflows/docker-publish.yml | 12 +++++------ AGENTS.md | 2 +- 5 files changed, 25 insertions(+), 25 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 6d8cdee4..5e502dcb 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,10 +18,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@v4 - name: Set up Python 3.12 - uses: actions/setup-python@v7 + uses: actions/setup-python@v5 with: python-version: '3.12' @@ -34,10 +34,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@v4 - name: Set up .NET 10 - uses: actions/setup-dotnet@v6 + uses: actions/setup-dotnet@v4 with: dotnet-version: '10.0.x' @@ -54,7 +54,7 @@ jobs: - name: Publish test results & coverage if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@v4 with: name: backend-test-results path: | @@ -66,10 +66,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@v4 - name: Set up Node.js 22 LTS - uses: actions/setup-node@v7 + uses: actions/setup-node@v4 with: node-version: 22 cache: 'npm' @@ -97,7 +97,7 @@ jobs: - name: Publish frontend coverage if: always() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@v4 with: name: frontend-coverage path: frontend/coverage @@ -108,15 +108,15 @@ jobs: needs: [backend, frontend, release-verification] steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@v4 - name: Set up .NET 10 - uses: actions/setup-dotnet@v6 + uses: actions/setup-dotnet@v4 with: dotnet-version: '10.0.x' - name: Set up Node.js 22 LTS - uses: actions/setup-node@v7 + uses: actions/setup-node@v4 with: node-version: 22 cache: 'npm' @@ -238,7 +238,7 @@ jobs: - name: Upload server logs on failure if: failure() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@v4 with: name: integration-smoke-logs path: ./smoke-run/server.log @@ -248,13 +248,13 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@v4 - name: Set up Docker Buildx uses: docker/setup-buildx-action@v4 - name: Build Docker image (dry-run without publish) - uses: docker/build-push-action@v7 + uses: docker/build-push-action@v5 with: context: . push: false diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index d21e6073..539f3284 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -35,11 +35,11 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@v4 - name: Set up .NET (for C# analysis) if: matrix.language == 'csharp' - uses: actions/setup-dotnet@v6 + uses: actions/setup-dotnet@v4 with: dotnet-version: '10.0.x' diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index b34c6562..d40f9fb3 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -19,8 +19,8 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@v4 - name: Dependency Review - uses: actions/dependency-review-action@v5 + uses: actions/dependency-review-action@v4 continue-on-error: true diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 3f4b164e..50a4fcae 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -29,10 +29,10 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@v4 - name: Log in to the Container registry - uses: docker/login-action@v4 + uses: docker/login-action@v3 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} @@ -40,7 +40,7 @@ jobs: - name: Extract metadata (tags, labels) for standard Docker image id: meta-standard - uses: docker/metadata-action@v6 + uses: docker/metadata-action@v5 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} tags: | @@ -53,7 +53,7 @@ jobs: - name: Extract metadata (tags, labels) for full Docker image id: meta-full - uses: docker/metadata-action@v6 + uses: docker/metadata-action@v5 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} flavor: | @@ -70,7 +70,7 @@ jobs: uses: docker/setup-buildx-action@v4 - name: Build and push standard Docker image - uses: docker/build-push-action@v7 + uses: docker/build-push-action@v5 with: context: . target: runtime @@ -81,7 +81,7 @@ jobs: cache-to: type=gha,mode=max,scope=runtime - name: Build and push full Docker image - uses: docker/build-push-action@v7 + uses: docker/build-push-action@v5 with: context: . target: runtime-full diff --git a/AGENTS.md b/AGENTS.md index 2eaade22..c6817b7f 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -54,7 +54,7 @@ Run tests via `dotnet test McpRouter.slnx`. dotnet run --project scripts/CatalogGenerator dotnet run --project scripts/CatalogGenerator -- --verify-only ``` - - For full taxonomy, category codes (`AUTH`, `DB`, `GUARD`, `MCP`, `SEC`, `TRANS`, `UI`), and conventions, refer to [`docs/test-catalog-guide.md`](file:///containers/dev/csharp-mcp-router/docs/test-catalog-guide.md). + - For full taxonomy, category codes (`AUTH`, `DB`, `GUARD`, `MCP`, `SEC`, `TRANS`, `UI`), and conventions, refer to [`docs/test-catalog-guide.md`](docs/test-catalog-guide.md). - Do not use string manipulation (`string.Replace`) for JSON payloads. Use `JsonNode` (see `ClientSession.RewriteRequestJson`). - Do not commit mockups to `docs/assets/`. Use actual UI screenshots. - Ensure that you use atomic commits for logical changes. From 0779cc1a25acf662d19b86e302de48e3dac51248 Mon Sep 17 00:00:00 2001 From: Antigravity Agent Date: Sat, 22 Aug 2026 11:35:16 -0500 Subject: [PATCH 02/18] chore: sweep auth vulnerabilities and add security warnings --- Middleware/AppKeyAuthenticationHandler.cs | 12 ------------ frontend/src/components/settings/IdentityAuthTab.tsx | 5 +++++ 2 files changed, 5 insertions(+), 12 deletions(-) diff --git a/Middleware/AppKeyAuthenticationHandler.cs b/Middleware/AppKeyAuthenticationHandler.cs index f16259b4..86f694eb 100644 --- a/Middleware/AppKeyAuthenticationHandler.cs +++ b/Middleware/AppKeyAuthenticationHandler.cs @@ -57,18 +57,6 @@ protected override async Task HandleAuthenticateAsync() { token = xApiKey.Trim(); } - else if (Request.Query.TryGetValue("app_key", out var qAppKey) && !string.IsNullOrEmpty(qAppKey)) - { - token = qAppKey.ToString().Trim(); - } - else if (Request.Query.TryGetValue("api_key", out var qApiKey) && !string.IsNullOrEmpty(qApiKey)) - { - token = qApiKey.ToString().Trim(); - } - else if (Request.Query.TryGetValue("key", out var qKey) && !string.IsNullOrEmpty(qKey)) - { - token = qKey.ToString().Trim(); - } } } diff --git a/frontend/src/components/settings/IdentityAuthTab.tsx b/frontend/src/components/settings/IdentityAuthTab.tsx index 7271dd28..f6d7e3f4 100644 --- a/frontend/src/components/settings/IdentityAuthTab.tsx +++ b/frontend/src/components/settings/IdentityAuthTab.tsx @@ -281,6 +281,11 @@ export const IdentityAuthTab: React.FC = ({ providers, sav

Parse user and group headers from SSO reverse proxies (Authentik, Authelia, PocketID, Keycloak, Caddy, Traefik, etc.).

+ {authOidcEnabled && ( +
+ Security Warning: Ensure your router is running behind a trusted reverse proxy that securely sets these headers and strips them from incoming requests. Otherwise, clients could spoof their identity. +
+ )}
) : ( -
-
- - setPromptDesc(e.target.value)} - /> -
- -
-

- Prompt Arguments / Variables -

- -
- - {builderArgs.length === 0 ? ( -
- No arguments defined. -
- ) : ( -
- {builderArgs.map((arg) => ( -
- updateArgument(arg.id, 'name', e.target.value)} - style={{ fontSize: '12px' }} - /> - updateArgument(arg.id, 'description', e.target.value)} - style={{ fontSize: '12px' }} - /> - - -
- ))} -
- )} - -
-

- Messages Sequence -

-
- - -
-
- -
- {builderMsgs.map((msg, index) => ( -
-
- - #{index + 1} {msg.role.toUpperCase()} - - -
-