Web UI: Auth and deployment boundary (#435) #456

Merged

sysadmin merged 2 commits from feat/issue-435-auth-deployment into master

2026-07-09 10:58:53 -05:00

Author	SHA1	Message	Date
sysadmin	1334b0b320	fix: restore ISSUE_LOCK_FILE import and fail-closed public bind Conflict resolution left webui/lease_loader.py importing ISSUE_LOCK_FILE from merged_cleanup_reconcile (not exported); import from issue_lock_provenance instead. Validate WEBUI_HOST before loading the full app stack so 0.0.0.0 refuse exits immediately. Addresses reviewer findings on PR #456 / issue #435.	2026-07-09 11:52:24 -04:00
sysadmin	975674d7f5	feat(webui): auth and deployment boundary (#435 ) Add bind-host assessment that refuses 0.0.0.0/:: without override, warns on non-loopback binds, and documents internal-only MVP serving. Health endpoint exposes deployment metadata; docs cover Access/VPN/WARP and runtime env assumptions without embedding secrets in the client. Closes #435	2026-07-09 11:50:40 -04:00

Author

SHA1

Message

Date

sysadmin

1334b0b320

fix: restore ISSUE_LOCK_FILE import and fail-closed public bind

Conflict resolution left webui/lease_loader.py importing ISSUE_LOCK_FILE
from merged_cleanup_reconcile (not exported); import from
issue_lock_provenance instead. Validate WEBUI_HOST before loading the
full app stack so 0.0.0.0 refuse exits immediately.

Addresses reviewer findings on PR #456 / issue #435.

2026-07-09 11:52:24 -04:00

sysadmin

975674d7f5

feat(webui): auth and deployment boundary (#435 )

Add bind-host assessment that refuses 0.0.0.0/:: without override,
warns on non-loopback binds, and documents internal-only MVP serving.
Health endpoint exposes deployment metadata; docs cover Access/VPN/WARP
and runtime env assumptions without embedding secrets in the client.

Closes #435

2026-07-09 11:50:40 -04:00