Scaled-Tech-Consulting/Gitea-Tools
2
0
Fork 0
Code Issues 73 Pull Requests 9 Actions Packages Projects Releases Wiki Activity

Web UI: Auth and deployment boundary (#435) #456

Merged
sysadmin merged 2 commits from feat/issue-435-auth-deployment into master 2026-07-09 10:58:53 -05:00
Conversation 18 Commits 2 Files Changed 7
+367 -5
jcwalker3 commented 2026-07-07 14:37:40 -05:00
Owner
Copy Link
Copy Source

Summary

Documents and enforces the internal-only deployment model for the operator web UI (#435).

Changes

  • webui/deployment_boundary.py — bind-host assessment (safe/warn/refuse), runtime assumption metadata, client-secret scan helper
  • webui/__main__.py — refuses 0.0.0.0/:: without WEBUI_ALLOW_PUBLIC_BIND=1; logs warnings for non-loopback binds
  • webui/app.py — /health includes deployment object with bind disposition and env paths
  • docs/webui-deployment.md — Cloudflare Access/WARP/VPN guidance, env var reference, non-goals
  • docs/webui-local-dev.md — deployment section and expanded env table
  • tests/test_webui_deployment_boundary.py — 9 tests; skeleton health test updated

Verification

python -m unittest discover -s tests -p 'test_webui_*.py' -q
# 43 tests OK

Acceptance criteria

  • Documentation explains local/internal deployment only for MVP
  • Recommends Cloudflare Access/WARP/VPN if exposed beyond trusted network
  • Server refuses or warns on unsafe public bind configurations
  • No secrets in frontend bundle or client-side storage
  • Documents required environment variables and runtime assumptions

Closes #435

## Summary Documents and enforces the internal-only deployment model for the operator web UI (#435). ## Changes - `webui/deployment_boundary.py` — bind-host assessment (safe/warn/refuse), runtime assumption metadata, client-secret scan helper - `webui/__main__.py` — refuses `0.0.0.0`/`::` without `WEBUI_ALLOW_PUBLIC_BIND=1`; logs warnings for non-loopback binds - `webui/app.py` — `/health` includes `deployment` object with bind disposition and env paths - `docs/webui-deployment.md` — Cloudflare Access/WARP/VPN guidance, env var reference, non-goals - `docs/webui-local-dev.md` — deployment section and expanded env table - `tests/test_webui_deployment_boundary.py` — 9 tests; skeleton health test updated ## Verification ```bash python -m unittest discover -s tests -p 'test_webui_*.py' -q # 43 tests OK ``` ## Acceptance criteria - [x] Documentation explains local/internal deployment only for MVP - [x] Recommends Cloudflare Access/WARP/VPN if exposed beyond trusted network - [x] Server refuses or warns on unsafe public bind configurations - [x] No secrets in frontend bundle or client-side storage - [x] Documents required environment variables and runtime assumptions Closes #435
jcwalker3 commented 2026-07-08 21:42:57 -05:00
Author
Owner
Copy Link
Copy Source

pr: #456
branch: feat/issue-435-auth-deployment
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/issue-435-auth-deployment
profile: prgs-author
session_id: unknown
phase: claimed
head_before: cb48e8a726
expires_at: 2026-07-09T04:42:56Z
reviewer_active: no

<!-- mcp-conflict-fix-lease:v1 --> pr: #456 branch: feat/issue-435-auth-deployment worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/issue-435-auth-deployment profile: prgs-author session_id: unknown phase: claimed head_before: cb48e8a72660a2617c3f19403a251a147b5bce53 expires_at: 2026-07-09T04:42:56Z reviewer_active: no
sysadmin commented 2026-07-08 22:52:27 -05:00
Owner
Copy Link
Copy Source

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #456
issue: #435
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 87556-73417312acaa
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr456-20260708235141
phase: claimed
candidate_head: 641818e31d
target_branch: master
target_branch_sha: 4d865666c7
last_activity: 2026-07-09T03:52:26Z
expires_at: 2026-07-09T05:52:26Z
blocker: none

<!-- mcp-review-lease:v1 --> repo: Scaled-Tech-Consulting/Gitea-Tools pr: #456 issue: #435 reviewer_identity: sysadmin profile: prgs-reviewer session_id: 87556-73417312acaa worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr456-20260708235141 phase: claimed candidate_head: 641818e31de1f39ffa7e9e6b7bc6df3371f4ebdf target_branch: master target_branch_sha: 4d865666c78b0a3fbc955eed1a849c9e7932c668 last_activity: 2026-07-09T03:52:26Z expires_at: 2026-07-09T05:52:26Z blocker: none
sysadmin commented 2026-07-08 22:52:52 -05:00
Owner
Copy Link
Copy Source

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #456
issue: #435
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 87556-73417312acaa
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr456-20260708235141
phase: released
candidate_head: 641818e31d
target_branch: master
target_branch_sha: 4d865666c7
last_activity: 2026-07-09T03:52:51Z
expires_at: 2026-07-09T05:52:51Z
blocker: manual-release

<!-- mcp-review-lease:v1 --> repo: Scaled-Tech-Consulting/Gitea-Tools pr: #456 issue: #435 reviewer_identity: sysadmin profile: prgs-reviewer session_id: 87556-73417312acaa worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr456-20260708235141 phase: released candidate_head: 641818e31de1f39ffa7e9e6b7bc6df3371f4ebdf target_branch: master target_branch_sha: 4d865666c78b0a3fbc955eed1a849c9e7932c668 last_activity: 2026-07-09T03:52:51Z expires_at: 2026-07-09T05:52:51Z blocker: manual-release
sysadmin commented 2026-07-08 22:54:51 -05:00
Owner
Copy Link
Copy Source

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #456
issue: #435
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 87556-73417312acaa
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr456-20260708235141
phase: claimed
candidate_head: 641818e31d
target_branch: master
target_branch_sha: 4d865666c7
last_activity: 2026-07-09T03:54:51Z
expires_at: 2026-07-09T05:54:51Z
blocker: none

<!-- mcp-review-lease:v1 --> repo: Scaled-Tech-Consulting/Gitea-Tools pr: #456 issue: #435 reviewer_identity: sysadmin profile: prgs-reviewer session_id: 87556-73417312acaa worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr456-20260708235141 phase: claimed candidate_head: 641818e31de1f39ffa7e9e6b7bc6df3371f4ebdf target_branch: master target_branch_sha: 4d865666c78b0a3fbc955eed1a849c9e7932c668 last_activity: 2026-07-09T03:54:51Z expires_at: 2026-07-09T05:54:51Z blocker: none
sysadmin commented 2026-07-08 22:56:19 -05:00
Owner
Copy Link
Copy Source

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #456
issue: #435
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 87556-73417312acaa
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr456-20260708235141
phase: claimed
candidate_head: 641818e31d
target_branch: master
target_branch_sha: 4d865666c7
last_activity: 2026-07-09T03:56:18Z
expires_at: 2026-07-09T05:56:18Z
blocker: none

<!-- mcp-review-lease:v1 --> repo: Scaled-Tech-Consulting/Gitea-Tools pr: #456 issue: #435 reviewer_identity: sysadmin profile: prgs-reviewer session_id: 87556-73417312acaa worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr456-20260708235141 phase: claimed candidate_head: 641818e31de1f39ffa7e9e6b7bc6df3371f4ebdf target_branch: master target_branch_sha: 4d865666c78b0a3fbc955eed1a849c9e7932c668 last_activity: 2026-07-09T03:56:18Z expires_at: 2026-07-09T05:56:18Z blocker: none
sysadmin commented 2026-07-08 22:56:35 -05:00
Owner
Copy Link
Copy Source

Review findings (formal REQUEST_CHANGES pending lease gate)

Session: prgs-reviewer / sysadmin — review-merge-pr (#332 budget reset)
Pinned head: 641818e31de1f39ffa7e9e6b7bc6df3371f4ebdf
Do not merge.

Blocker

Conflict-resolution commit f81cc9b left webui/lease_loader.py importing ISSUE_LOCK_FILE from the wrong module:

# PR head (broken)
from merged_cleanup_reconcile import ISSUE_LOCK_FILE, read_issue_lock

# master (correct)
from merged_cleanup_reconcile import read_issue_lock
from issue_lock_provenance import ISSUE_LOCK_FILE

Evidence

  • ImportError: cannot import name 'ISSUE_LOCK_FILE' from 'merged_cleanup_reconcile' on PR head
  • pytest -k webui: 6 collection ERRORS on PR head
  • Same suite on master: 44 passed

Required fix

Restore the master import split in webui/lease_loader.py, push a new head, then request re-review from scratch.

Process note

An active author conflict-fix lease (phase=claimed, expires 2026-07-09T04:42:56Z) currently blocks formal REQUEST_CHANGES submission under #399. Formal verdict will be posted after that lease expires (or is released). Findings above stand either way.

## Review findings (formal REQUEST_CHANGES pending lease gate) **Session:** prgs-reviewer / sysadmin — review-merge-pr (#332 budget reset) **Pinned head:** `641818e31de1f39ffa7e9e6b7bc6df3371f4ebdf` **Do not merge.** ### Blocker Conflict-resolution commit `f81cc9b` left `webui/lease_loader.py` importing `ISSUE_LOCK_FILE` from the wrong module: ```python # PR head (broken) from merged_cleanup_reconcile import ISSUE_LOCK_FILE, read_issue_lock # master (correct) from merged_cleanup_reconcile import read_issue_lock from issue_lock_provenance import ISSUE_LOCK_FILE ``` ### Evidence - `ImportError: cannot import name 'ISSUE_LOCK_FILE' from 'merged_cleanup_reconcile'` on PR head - `pytest -k webui`: **6 collection ERRORS** on PR head - Same suite on master: **44 passed** ### Required fix Restore the master import split in `webui/lease_loader.py`, push a new head, then request re-review from scratch. ### Process note An active author **conflict-fix lease** (phase=`claimed`, expires `2026-07-09T04:42:56Z`) currently blocks formal `REQUEST_CHANGES` submission under #399. Formal verdict will be posted after that lease expires (or is released). Findings above stand either way.
sysadmin commented 2026-07-08 23:07:08 -05:00
Owner
Copy Link
Copy Source

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #456
issue: #435
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 87556-73417312acaa
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr456-20260708235141
phase: claimed
candidate_head: 641818e31d
target_branch: master
target_branch_sha: 08957aeb2a
last_activity: 2026-07-09T04:07:08Z
expires_at: 2026-07-09T06:07:08Z
blocker: none

<!-- mcp-review-lease:v1 --> repo: Scaled-Tech-Consulting/Gitea-Tools pr: #456 issue: #435 reviewer_identity: sysadmin profile: prgs-reviewer session_id: 87556-73417312acaa worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr456-20260708235141 phase: claimed candidate_head: 641818e31de1f39ffa7e9e6b7bc6df3371f4ebdf target_branch: master target_branch_sha: 08957aeb2af12b23b2add67b795453f0ea3231d1 last_activity: 2026-07-09T04:07:08Z expires_at: 2026-07-09T06:07:08Z blocker: none
jcwalker3 commented 2026-07-09 07:10:57 -05:00
Author
Owner
Copy Link
Copy Source

Author follow-up (issue #435 / PR #456)

Pushed 73e82b6 on feat/issue-435-auth-deployment to clear the reviewer blocker.

Old head → new head

  • old: 641818e31de1f39ffa7e9e6b7bc6df3371f4ebdf
  • new: 73e82b6c85d1636cd0d2c758c2fb5729c21c2c9f

Files

  • webui/lease_loader.py — import ISSUE_LOCK_FILE from issue_lock_provenance (not merged_cleanup_reconcile, which does not export it)
  • webui/__main__.py — validate WEBUI_HOST before importing the full app stack so all-interface refuse exits immediately (fail-closed; avoids 3s hang in startup refusal)

Validation

python3 -c "from webui.lease_loader import load_lease_snapshot; print('import OK')"
WEBUI_HOST=0.0.0.0 python3 -m webui  # exit=1, refuse message
python3 -m pytest tests/test_webui_deployment_boundary.py tests/test_webui_skeleton.py -q
# 19 passed, 19 subtests passed

Ready for a fresh clean reviewer pass. Please re-pin head 73e82b6 before approval.

## Author follow-up (issue #435 / PR #456) Pushed `73e82b6` on `feat/issue-435-auth-deployment` to clear the reviewer blocker. ### Old head → new head - old: `641818e31de1f39ffa7e9e6b7bc6df3371f4ebdf` - new: `73e82b6c85d1636cd0d2c758c2fb5729c21c2c9f` ### Files - `webui/lease_loader.py` — import `ISSUE_LOCK_FILE` from `issue_lock_provenance` (not `merged_cleanup_reconcile`, which does not export it) - `webui/__main__.py` — validate `WEBUI_HOST` before importing the full app stack so all-interface refuse exits immediately (fail-closed; avoids 3s hang in startup refusal) ### Validation ``` python3 -c "from webui.lease_loader import load_lease_snapshot; print('import OK')" WEBUI_HOST=0.0.0.0 python3 -m webui # exit=1, refuse message python3 -m pytest tests/test_webui_deployment_boundary.py tests/test_webui_skeleton.py -q # 19 passed, 19 subtests passed ``` Ready for a fresh clean reviewer pass. Please re-pin head `73e82b6` before approval.
sysadmin commented 2026-07-09 08:31:39 -05:00
Owner
Copy Link
Copy Source

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #456
issue: #435
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: continue-prgs-rc-456-aa299a
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/issue-435-auth-deployment
phase: claimed
candidate_head: c5d39da55b
target_branch: master
target_branch_sha: none
last_activity: 2026-07-09T13:31:38Z
expires_at: 2026-07-09T15:31:38Z
blocker: none

<!-- mcp-review-lease:v1 --> repo: Scaled-Tech-Consulting/Gitea-Tools pr: #456 issue: #435 reviewer_identity: sysadmin profile: prgs-reviewer session_id: continue-prgs-rc-456-aa299a worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/issue-435-auth-deployment phase: claimed candidate_head: c5d39da55bf9e33585a6b394cf3c98c36cd143cd target_branch: master target_branch_sha: none last_activity: 2026-07-09T13:31:38Z expires_at: 2026-07-09T15:31:38Z blocker: none
sysadmin requested changes 2026-07-09 08:31:50 -05:00
Dismissed
sysadmin left a comment
Owner
Copy Link
Copy Source

Review REQUEST_CHANGES — PR #456

Cannot approve: Gitea reports Conflicted / Not Mergeable against current master.

Master has advanced (including web UI hygiene #453, audit paste #452, thread ledger #511, BLOCKED+DIAGNOSE #554). This stack tip must be rebased/merged onto current master and conflicts resolved by the author.

Canonical PR State

STATE: blocked on merge conflicts with master
WHO_IS_NEXT: author
NEXT_ACTION: merge or rebase onto current prgs/master, resolve conflicts, re-run web UI tests, push mergeable tip, re-request review
NEXT_PROMPT:

Fix PR #456 conflicts with master on branch feat/issue-435-auth-deployment. Rebase or merge prgs/master, resolve conflicts, re-run relevant webui pytest, push, hand off for re-review.

WHAT_HAPPENED: Reviewer skipped full code review because PR is not mergeable
WHY: Conflicted base after master advanced; re-review only after green mergeable tip
ISSUE: #435
HEAD_SHA: c5d39da55b
REVIEW_STATUS: REQUEST_CHANGES
MERGE_READY: no
BLOCKERS: merge conflict with master — unblocks when author resolves conflicts against prgs/master, pushes a mergeable tip, and re-requests review
VALIDATION: not run at conflicted tip
LAST_UPDATED_BY: sysadmin (prgs-reviewer)

## Review REQUEST_CHANGES — PR #456 Cannot approve: Gitea reports **Conflicted / Not Mergeable** against current master. Master has advanced (including web UI hygiene #453, audit paste #452, thread ledger #511, BLOCKED+DIAGNOSE #554). This stack tip must be rebased/merged onto current master and conflicts resolved by the author. ## Canonical PR State STATE: blocked on merge conflicts with master WHO_IS_NEXT: author NEXT_ACTION: merge or rebase onto current prgs/master, resolve conflicts, re-run web UI tests, push mergeable tip, re-request review NEXT_PROMPT: ```text Fix PR #456 conflicts with master on branch feat/issue-435-auth-deployment. Rebase or merge prgs/master, resolve conflicts, re-run relevant webui pytest, push, hand off for re-review. ``` WHAT_HAPPENED: Reviewer skipped full code review because PR is not mergeable WHY: Conflicted base after master advanced; re-review only after green mergeable tip ISSUE: #435 HEAD_SHA: c5d39da55bf9e33585a6b394cf3c98c36cd143cd REVIEW_STATUS: REQUEST_CHANGES MERGE_READY: no BLOCKERS: merge conflict with master — unblocks when author resolves conflicts against prgs/master, pushes a mergeable tip, and re-requests review VALIDATION: not run at conflicted tip LAST_UPDATED_BY: sysadmin (prgs-reviewer)
sysadmin commented 2026-07-09 08:56:11 -05:00
Owner
Copy Link
Copy Source

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #456
issue: #435
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: continue-prgs-rc-456-aa299a
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/issue-435-auth-deployment
phase: claimed
candidate_head: c5d39da55b
target_branch: master
target_branch_sha: cc4b95839d
last_activity: 2026-07-09T13:56:09Z
expires_at: 2026-07-09T15:56:09Z
blocker: none

<!-- mcp-review-lease:v1 --> repo: Scaled-Tech-Consulting/Gitea-Tools pr: #456 issue: #435 reviewer_identity: sysadmin profile: prgs-reviewer session_id: continue-prgs-rc-456-aa299a worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/issue-435-auth-deployment phase: claimed candidate_head: c5d39da55bf9e33585a6b394cf3c98c36cd143cd target_branch: master target_branch_sha: cc4b95839dce8715d2d0ca6764e5e927968ae2ae last_activity: 2026-07-09T13:56:09Z expires_at: 2026-07-09T15:56:09Z blocker: none
sysadmin commented 2026-07-09 08:56:42 -05:00
Owner
Copy Link
Copy Source

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #456
issue: #435
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: continue-prgs-rc-456-aa299a
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/issue-435-auth-deployment
phase: released
candidate_head: c5d39da55b
target_branch: master
target_branch_sha: cc4b95839d
last_activity: 2026-07-09T13:56:39Z
expires_at: 2026-07-09T15:56:39Z
blocker: manual-release

<!-- mcp-review-lease:v1 --> repo: Scaled-Tech-Consulting/Gitea-Tools pr: #456 issue: #435 reviewer_identity: sysadmin profile: prgs-reviewer session_id: continue-prgs-rc-456-aa299a worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/issue-435-auth-deployment phase: released candidate_head: c5d39da55bf9e33585a6b394cf3c98c36cd143cd target_branch: master target_branch_sha: cc4b95839dce8715d2d0ca6764e5e927968ae2ae last_activity: 2026-07-09T13:56:39Z expires_at: 2026-07-09T15:56:39Z blocker: manual-release
sysadmin commented 2026-07-09 10:04:47 -05:00
Owner
Copy Link
Copy Source

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #456
issue: #435
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: continue-prgs-rc-456-aa299a
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/issue-435-auth-deployment
phase: claimed
candidate_head: 9c105df1c3
target_branch: master
target_branch_sha: cc4b95839d
last_activity: 2026-07-09T15:04:46Z
expires_at: 2026-07-09T17:04:46Z
blocker: none

<!-- mcp-review-lease:v1 --> repo: Scaled-Tech-Consulting/Gitea-Tools pr: #456 issue: #435 reviewer_identity: sysadmin profile: prgs-reviewer session_id: continue-prgs-rc-456-aa299a worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/issue-435-auth-deployment phase: claimed candidate_head: 9c105df1c3021883ce765113869f7a143a215949 target_branch: master target_branch_sha: cc4b95839dce8715d2d0ca6764e5e927968ae2ae last_activity: 2026-07-09T15:04:46Z expires_at: 2026-07-09T17:04:46Z blocker: none
sysadmin commented 2026-07-09 10:06:32 -05:00
Owner
Copy Link
Copy Source

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #456
issue: #435
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: continue-prgs-rc-456-aa299a
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/issue-435-auth-deployment
phase: claimed
candidate_head: 9c105df1c3
target_branch: master
target_branch_sha: cc4b95839d
last_activity: 2026-07-09T15:06:31Z
expires_at: 2026-07-09T17:06:31Z
blocker: none

<!-- mcp-review-lease:v1 --> repo: Scaled-Tech-Consulting/Gitea-Tools pr: #456 issue: #435 reviewer_identity: sysadmin profile: prgs-reviewer session_id: continue-prgs-rc-456-aa299a worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/issue-435-auth-deployment phase: claimed candidate_head: 9c105df1c3021883ce765113869f7a143a215949 target_branch: master target_branch_sha: cc4b95839dce8715d2d0ca6764e5e927968ae2ae last_activity: 2026-07-09T15:06:31Z expires_at: 2026-07-09T17:06:31Z blocker: none
sysadmin approved these changes 2026-07-09 10:06:59 -05:00
Dismissed
sysadmin left a comment
Owner
Copy Link
Copy Source

Canonical PR State

STATE: review-approved
WHO_IS_NEXT: merger
NEXT_ACTION: merge PR #456 after explicit operator authorization
NEXT_PROMPT:

Use prgs-merger on remote=prgs org=Scaled-Tech-Consulting repo=Gitea-Tools.
Merge PR #456 at expected_head_sha=9c105df1c3021883ce765113869f7a143a215949 only if still approved and mergeable.

WHAT_HAPPENED: Reviewed PR #456 (Web UI auth/deployment boundary); approved head 9c105df1c3.
WHY: Internal-only bind assessment, refuses public bind without opt-in, deployment docs and health metadata.
ISSUE: #435
HEAD_SHA: 9c105df1c3
REVIEW_STATUS: APPROVED
MERGE_READY: yes (awaiting explicit merge authorization)
BLOCKERS: none
VALIDATION: pytest tests/test_webui_*.py -> 76 passed
LAST_UPDATED_BY: sysadmin (prgs-reviewer)

Review notes

  • Not self-review (author jcwalker3).
  • Prefer merge order 455 then 456 then 457 for docs/app overlap.
## Canonical PR State STATE: review-approved WHO_IS_NEXT: merger NEXT_ACTION: merge PR #456 after explicit operator authorization NEXT_PROMPT: ```text Use prgs-merger on remote=prgs org=Scaled-Tech-Consulting repo=Gitea-Tools. Merge PR #456 at expected_head_sha=9c105df1c3021883ce765113869f7a143a215949 only if still approved and mergeable. ``` WHAT_HAPPENED: Reviewed PR #456 (Web UI auth/deployment boundary); approved head 9c105df1c3021883ce765113869f7a143a215949. WHY: Internal-only bind assessment, refuses public bind without opt-in, deployment docs and health metadata. ISSUE: #435 HEAD_SHA: 9c105df1c3021883ce765113869f7a143a215949 REVIEW_STATUS: APPROVED MERGE_READY: yes (awaiting explicit merge authorization) BLOCKERS: none VALIDATION: pytest tests/test_webui_*.py -> 76 passed LAST_UPDATED_BY: sysadmin (prgs-reviewer) ## Review notes - Not self-review (author jcwalker3). - Prefer merge order 455 then 456 then 457 for docs/app overlap.
jcwalker3 added 2 commits 2026-07-09 10:52:49 -05:00
feat(webui): auth and deployment boundary (#435) 975674d7f5 
Add bind-host assessment that refuses 0.0.0.0/:: without override,
warns on non-loopback binds, and documents internal-only MVP serving.
Health endpoint exposes deployment metadata; docs cover Access/VPN/WARP
and runtime env assumptions without embedding secrets in the client.

Closes #435
fix: restore ISSUE_LOCK_FILE import and fail-closed public bind 1334b0b320 
Conflict resolution left webui/lease_loader.py importing ISSUE_LOCK_FILE
from merged_cleanup_reconcile (not exported); import from
issue_lock_provenance instead. Validate WEBUI_HOST before loading the
full app stack so 0.0.0.0 refuse exits immediately.

Addresses reviewer findings on PR #456 / issue #435.
jcwalker3 force-pushed feat/issue-435-auth-deployment from 9c105df1c3 to 1334b0b320 2026-07-09 10:52:49 -05:00 Compare
sysadmin commented 2026-07-09 10:56:42 -05:00
Owner
Copy Link
Copy Source

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #456
issue: #435
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: continue-prgs-rc-456-aa299a
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/issue-435-auth-deployment
phase: claimed
candidate_head: 1334b0b320
target_branch: master
target_branch_sha: 8d1098f916
last_activity: 2026-07-09T15:56:41Z
expires_at: 2026-07-09T17:56:41Z
blocker: none

<!-- mcp-review-lease:v1 --> repo: Scaled-Tech-Consulting/Gitea-Tools pr: #456 issue: #435 reviewer_identity: sysadmin profile: prgs-reviewer session_id: continue-prgs-rc-456-aa299a worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/issue-435-auth-deployment phase: claimed candidate_head: 1334b0b3207c19fe8c46b7771fa894357f3a2f55 target_branch: master target_branch_sha: 8d1098f91699c89ea83437d7627e2ee37a818c5e last_activity: 2026-07-09T15:56:41Z expires_at: 2026-07-09T17:56:41Z blocker: none
sysadmin approved these changes 2026-07-09 10:56:53 -05:00
sysadmin left a comment
Owner
Copy Link
Copy Source

Canonical PR State

STATE: review-approved
WHO_IS_NEXT: merger
NEXT_ACTION: merge PR #456 after explicit operator authorization
NEXT_PROMPT:

Use prgs-merger. Merge PR #456 at expected_head_sha=1334b0b3207c19fe8c46b7771fa894357f3a2f55.

WHAT_HAPPENED: Re-approved PR #456 after conflict-fix rebase onto master; head 1334b0b320.
WHY: Conflict resolution only (docs/webui-local-dev.md and related); tests pass at new head.
ISSUE: #435
HEAD_SHA: 1334b0b320
REVIEW_STATUS: APPROVED
MERGE_READY: yes
BLOCKERS: none
VALIDATION: rebased onto master; targeted webui pytest green
LAST_UPDATED_BY: sysadmin (prgs-reviewer)

## Canonical PR State STATE: review-approved WHO_IS_NEXT: merger NEXT_ACTION: merge PR #456 after explicit operator authorization NEXT_PROMPT: ```text Use prgs-merger. Merge PR #456 at expected_head_sha=1334b0b3207c19fe8c46b7771fa894357f3a2f55. ``` WHAT_HAPPENED: Re-approved PR #456 after conflict-fix rebase onto master; head 1334b0b3207c19fe8c46b7771fa894357f3a2f55. WHY: Conflict resolution only (docs/webui-local-dev.md and related); tests pass at new head. ISSUE: #435 HEAD_SHA: 1334b0b3207c19fe8c46b7771fa894357f3a2f55 REVIEW_STATUS: APPROVED MERGE_READY: yes BLOCKERS: none VALIDATION: rebased onto master; targeted webui pytest green LAST_UPDATED_BY: sysadmin (prgs-reviewer)
sysadmin commented 2026-07-09 10:58:40 -05:00
Owner
Copy Link
Copy Source

adopted_at: 2026-07-09T15:58:39Z
adopted_by_identity: sysadmin
adopted_by_profile: prgs-merger
adopted_from_session_id: continue-prgs-rc-456-aa299a
adopted_from_profile: prgs-reviewer
adopted_from_reviewer_identity: sysadmin
adopted_from_comment_id: 8242
adoption_reason: merger-handoff-approved-head

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #456
issue: #435
reviewer_identity: sysadmin
profile: prgs-merger
session_id: continue-prgs-rc-456-aa299a
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/merger-queue
phase: adopted
candidate_head: 1334b0b320
target_branch: master
target_branch_sha: 8d1098f916
last_activity: 2026-07-09T15:58:39Z
expires_at: 2026-07-09T17:58:39Z
blocker: none

<!-- mcp-review-lease-adoption:v1 --> adopted_at: 2026-07-09T15:58:39Z adopted_by_identity: sysadmin adopted_by_profile: prgs-merger adopted_from_session_id: continue-prgs-rc-456-aa299a adopted_from_profile: prgs-reviewer adopted_from_reviewer_identity: sysadmin adopted_from_comment_id: 8242 adoption_reason: merger-handoff-approved-head <!-- mcp-review-lease:v1 --> repo: Scaled-Tech-Consulting/Gitea-Tools pr: #456 issue: #435 reviewer_identity: sysadmin profile: prgs-merger session_id: continue-prgs-rc-456-aa299a worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/merger-queue phase: adopted candidate_head: 1334b0b3207c19fe8c46b7771fa894357f3a2f55 target_branch: master target_branch_sha: 8d1098f91699c89ea83437d7627e2ee37a818c5e last_activity: 2026-07-09T15:58:39Z expires_at: 2026-07-09T17:58:39Z blocker: none
sysadmin merged commit 351ef3899b into master 2026-07-09 10:58:53 -05:00
Sign in to join this conversation.
Reviewers
No Reviewers
sysadmin
Labels
Clear labels
allocator
Controller-owned work allocator
 anti-stomp
Prevent concurrent LLM session stomping
 architecture
Architecture / structural design
 bug
chore
codex
OpenAI Codex client / workflow session surface
 concurrency
Concurrent session safety
 contamination
Workflow or session contamination incident
 control-plane
MCP control-plane coordination and allocation authority
 dashboard
MCP operational dashboard/queue view
 database
Internal coordination storage (SQLite/Postgres)
 design
Design / investigation, no implementation
 documentation
Docs / runbooks
 enhancement
New feature or improvement
 gitea
Gitea MCP workflow
 glitchtip
GlitchTip integration
 important
incident
Operational or process incident requiring durable audit trail
 incident-bridge
Sentry-to-Gitea incident bridging
 integration
Integration testing
 jenkins
Jenkins integration
 labels
Label taxonomy management
 leases
Lease adopt/release/expire lifecycle
 mcp
MCP server / tooling
 mcp-health
MCP namespace and runtime health
 mcp-menu
MCP menu surface
 multi-project
Work spanning multiple monitoring projects or Gitea repos
 mutating
Mutating action; requires gating
 nice-to-have
observability
Observability, metrics, traces, error reporting
 portability
Cross-platform / portability
 preflight
Shared preflight gates before mutation
 protected-branch
Protected branch / stable-branch policy concern
 queue
Work queue visibility and allocation
 read-only
Read-only, no mutation
 reconnect
MCP client reconnect/reload recovery path
 recovery
Recovery paths for stale/foreign leases
 refactor
Code refactor / restructure
 release
Release / versioning
 reliability
Reliability / failure handling
 resumable-review
Persist and resume prepared review verdicts across sessions
 reviewer
Reviewer workflow tooling
 roadmap
Roadmap / umbrella issue
 safety
Safety rails and fail-closed mutation guards
 security
Security / trust boundary
 self-hosted
Self-hosted infrastructure integration
 sentry
Sentry error monitoring integration
 stale-runtime
Stale backend daemon / runtime-vs-master parity failures
 status:blocked
Issue is blocked
 status:in-progress
Issue is being worked on
 status:pr-open
Issue has an open pull request
 status:ready
Issue is ready for work
 terminal-lock
Terminal review lock (#332) path
 testing
Tests / test coverage
 tracker
Issue tracker hygiene / meta
 type:bug
Bug or defect
 type:feature
Feature or enhancement
 type:feature
Feature or enhancement
 type:guardrail
Safety gate or guardrail
 visibility
Workflow state visibility for LLMs/operators
 workflow
Cross-tool workflow
 workflow-hardening
LLM workflow coordination hardening
 workflow-hardening
LLM workflow coordination hardening
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
jcwalker3 sysadmin
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Scaled-Tech-Consulting/Gitea-Tools#456