CluPilotCloud/tests/Feature
nexxo 0066b1c6a0
tests / pest (push) Successful in 7m28s Details
tests / assets (push) Successful in 19s Details
tests / release (push) Successful in 4s Details
feat(security): a way back into the console that does not need the console
The allowlist is managed in the console, which is fine until the address you
manage it from changes — and then the page that would fix the problem is the
page the problem blocks. Every gate needs a door that does not depend on
itself, and on a server that door is a shell:

  php artisan clupilot:console-access show
  php artisan clupilot:console-access allow 203.0.113.7
  php artisan clupilot:console-access open

The address check moved to RestrictConsoleNetwork::isNetwork() so the command
and the console apply the same rule. Codex caught the version that did not: a
typo like 203.0.113.9/99 was stored, reported as success, and matched nothing —
leaving whoever was recovering still locked out, now believing they were not.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-07-27 03:09:13 +02:00
..
Admin feat(security): a way back into the console that does not need the console 2026-07-27 03:09:13 +02:00
Auth fix(auth): throttle Fortify endpoints (registration had no limiter — signup-spam guard) 2026-07-25 18:38:44 +02:00
Billing fix(billing): hold only what cannot be matched, and let migrations roll back 2026-07-26 13:57:11 +02:00
Provisioning feat(billing): Stripe owns the billing cycle, we own capability 2026-07-26 13:36:28 +02:00
BillingTest.php feat(portal): billing page — current plan, upgrades, extra storage, add-ons 2026-07-25 13:36:52 +02:00
CartTest.php fix(billing): normalise both sides of the VAT comparison; cast the timestamp 2026-07-26 09:36:07 +02:00
ComponentTest.php feat(portal): Fortify auth + Login/2FA/Dashboard + component kit 2026-07-25 01:20:25 +02:00
DashboardTest.php feat(portal): Fortify auth + Login/2FA/Dashboard + component kit 2026-07-25 01:20:25 +02:00
ExampleTest.php chore: bootstrap CluPilot control-plane (Laravel 13, Docker stack) 2026-07-25 00:21:30 +02:00
ImpersonationTest.php fix(admin): harden impersonation + datacenter code per Codex review 2026-07-25 13:50:16 +02:00
OperatorInPortalTest.php fix(portal): no silent no-ops without a customer; maintenance visible per instance; maintenance form redesign 2026-07-25 19:10:44 +02:00
PortalTabsTest.php feat(billing): the plan catalogue becomes three tables, and config stops selling 2026-07-26 12:05:56 +02:00
PublicSiteGateTest.php fix(traffic): release the throttle at month end; close the Livewire bypass 2026-07-25 23:36:38 +02:00
ReleaseVersionTest.php feat(deploy): releases you can pin to, and a version that tells the truth 2026-07-26 15:21:38 +02:00
SeatsTest.php feat(portal): seats management — invite/role/revoke against plan limit 2026-07-25 14:40:18 +02:00
SettingsTest.php fix(portal): enforce customer lifecycle per Codex review 2026-07-25 14:45:03 +02:00
TrafficTest.php feat(billing): the plan catalogue becomes three tables, and config stops selling 2026-07-26 12:05:56 +02:00
WelcomeTest.php feat(landing): public marketing homepage at / (+ legal placeholders) 2026-07-25 08:59:39 +02:00