Resolve conflicts between main's security fixes and v4.5 features:
- Keep v4.5 features (log redaction, multi-S3 backups, transfer flow,
scheduled task modal, sidebar) and port main's fixes into them.
- Reuse RequiresDeployAbility for the Hostinger create endpoint.
- Align MCP tool abilities and descriptions with main's new deploy
requirements, and use deploy tokens in the affected MCP tests.
- Drop the duplicate DockerCleanupJobTest helper and tests, and the
exportBundle test for a method v4.5 removed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Require deploy permission for API changes that trigger server side effects, including resource deletion, storage access, provider operations, and database imports. Also escape Docker cleanup filters and sanitize log drain server names.
- GET /applications/{uuid}/previews and GET /applications/{uuid}/previews/{pull_request_id}
return preview deployments (read ability).
- POST /applications/{uuid}/previews opens a preview for a pull request and queues its
deployment, or redeploys an existing preview (deploy ability). It accepts git_type,
commit (required for Bitbucket), docker_tag (Docker Image apps), force, and
instant_deploy. GitHub App and GitLab App sources set git_type automatically.
- Fix POST /deploy with pull_request_id: pass the preview git_type to the deployment, so
deploy-key and public-repository applications build the pull request instead of the
base branch.
- Regenerate the OpenAPI spec (also adds the missing service_name logs parameter).
Uploading and starting a database import overwrites data, so a deploy
token is no longer enough. Import activity IDs must be numeric.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Import now always claims the server and rebinds Sentinel. Remove the
SSH-written ownership file, the write_remote/rebind_sentinel/claim
options, and the POST /servers/{uuid}/claim endpoint. The migrator now
fails when the target cannot take management. Disabling management
records transfer.management_disabled so the server shows as
transferable, and the transfer and import pages are simplified.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Container logs and scheduled-task commands and output are now shown only to
users who can edit the resource. The API returns them only to tokens with
the read:sensitive or root ability, the same as the MCP tools.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add an admin-only audit-events API endpoint and restrict audit-log UI access. Record integration token and secret manager changes, key access, and references in audit events.
There was no API for creating GitLab sources. Add /api/v1/gitlab-apps
list/create/update/delete with OpenAPI docs, sensitive-field redaction,
and feature coverage mirroring the GitHub Apps API.
Introduce V5Feature and config so V5 routes, jobs, commands, morph maps,
and model queries run only when enabled. Move V5 migrations to
migrations-v5 (loaded only when enabled), remove Flux from production
Docker/install paths, and add isolation tests.
Make start/stop/restart, deploy, enable/disable, and server validate
POST-only, with GET returning 405. Server validate accepts optional
install and uses ValidateAndInstallServerJob. Update OpenAPI and tests.
Expose DELETE for application, database, and service storage backup
schedules (with OpenAPI docs), reject storage deletes while schedules
exist, skip retention cleanup when no limits are set, and remove S3
archives using the execution’s S3 storage.
Add polymorphic volume backup scheduling for persistent volumes and directories, expose schedule management via API, and reorganize backup configuration and execution views.
peaklabs-dev
Andras BacsaiandClaude Opus 5.5