Update the administration template after its release succeeded. Verify every bundled frontend against its latest stable release and validate the published archives; all four user templates already reference their latest versions.
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
Restore session-aware OAuth binding and read public authentication URLs from committed host policy snapshots. Keep MCP, configuration, upgrade and alert-command admission tied to actual transport sends, while allowing transfer rollback and reply processing to complete without circular lock waits.
Add authenticated-route, persistence rollback, transfer-result ordering and stalled-send regression coverage. Capture task identity before request contexts can be recycled.
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
Harden tenant permissions, transfer admission, authentication and bounded request handling. Add member NAT domain settings, migration guidance and regression coverage.
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
Ignore history rows without initialized daily or monthly state so deleted and quarantined services cannot panic dashboard startup. Cover startup and statistics preservation with regression tests.
Thanks to Zachariah Mithani (@zachariah-mithani, AploSec) for privately reporting the retained service history startup panic.
Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
The initial selective strip covered only the Authorization header, but the
dashboard also accepts its JWT via the ?token= query parameter and the
nz-jwt cookie (jwt.go TokenLookup channels). A dashboard credential arriving
through those channels would still reach a NAT backend.
Apply the same classify-then-strip rule to all three channels at NAT
ingress: values verified as dashboard-issued are removed, foreign values
are preserved byte-for-byte. Adds a ServeNAT flow test exercising the live
classifier and a wiring test pinning the gate injection in main().
Since 2640b86 (v2.2.11, 2026-07-20) the NAT ingress deleted the entire
Authorization header, breaking self-hosted apps behind the tunnel that
authenticate with their own Bearer tokens (e.g. the Qinglong panel login
loop).
Strip only credentials issued by this dashboard and forward foreign ones:
- controller.IsDashboardCredential classifies an Authorization value as
dashboard-issued via a signature-only JWT parser derived from the auth
middleware (same key, HS256 pinned, claims validation deliberately
skipped so an expired panel token is still recognized and kept out of
the tunnel) or an api_tokens lookup for PAT-shaped values. Unknown PATs,
foreign signatures, other schemes and missing values pass through. When
classification cannot complete (parser not ready, DB nil or error) the
verdict fails closed (strip) and the log carries a fixed reason only,
never credential content.
- Both NAT capability variants (default, and agent-compat legacy /
invalid-capability / post-consume paths) replace the unconditional
Del("Authorization") with stripDashboardCredential. The rpc package
receives the classifier through SetNATDashboardCredentialGate, the same
injection pattern as SetMCPKillSwitchObserver; an unwired gate keeps the
historical strip-everything behavior.
Tests: controller classification semantics (panel JWT, expired panel JWT
and panel PAT stripped; foreign-signed JWT, unknown nzp_ token, random
strings, non-Bearer schemes and missing header pass through; parser
unavailable, DB nil and DB error fail closed with credential-free logs)
plus rpc unit and flow coverage for both variants (dashboard credentials
never reach the forwarded bytes; foreign and missing Authorization are
forwarded untouched).
Compatibility: no API, database or frontend changes; NAT backends that do
not use Authorization behave exactly as before.
* feat(auth): allow JWT IP changes by configuration
* fix(auth): make JWT IP change setting concurrency-safe
* test(auth): move JWT IP change setting tests out of MCP test file
naibaandnaiba/CloudCode
github-actions[bot]
Sam5440andnaiba/CloudCode
Krisandnaiba
xvkong233
77-QiQi
NikoCat233