nexxo f5f4d2a8cd fix(security): close the Livewire bypass of the admin host restriction ... Admin actions post to /livewire/update, which a path-scoped guard skips — an operator session could drive admin components through a PUBLIC hostname despite ADMIN_HOSTS. The restriction is now registered as Livewire-persistent middleware and listed on the admin route group, so Livewire re-applies it from the component snapshot. Proven by replaying a snapshot taken from the real rendered page: identical payload -> 404 on a public host, 200 on the allowed host (positive control, so the test cannot pass for the wrong reason). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>		2026-07-25 20:50:22 +02:00
..
Actions	fix(auth/admin): atomic user+customer signup; Rule::in for country validation (comma-safe)	2026-07-25 18:33:09 +02:00
Console	feat(engine): orchestrator core (state machine + tick + lock)	2026-07-25 09:54:52 +02:00
Http	feat(security): admin console can be pinned to non-public hostnames	2026-07-25 20:45:54 +02:00
Livewire	fix(portal): cloud status labels for all instance states; scale storage curve into the quota	2026-07-25 19:16:16 +02:00
Mail	fix(admin): confirm maintenance delivery via MessageSent (retryable until sent); guard resend/cancel on derived state; fix flaky non-unique host wg_ip	2026-07-25 16:14:01 +02:00
Models	fix(portal): scope the per-instance maintenance badge to that instance's host	2026-07-25 19:12:33 +02:00
Notifications	fix(engine-b): default-deny firewall, disk-based capacity, synchronous credential mail	2026-07-25 12:39:15 +02:00
Providers	fix(security): close the Livewire bypass of the admin host restriction	2026-07-25 20:50:22 +02:00
Provisioning	fix(monitoring): cap monitoring retries at the run budget; dependency-free liveness probe	2026-07-25 20:19:32 +02:00
Services	feat(monitoring): Uptime Kuma support via a REST bridge + resilient monitoring policy	2026-07-25 20:04:58 +02:00