fix(ca): gate per-service cert/key download behind TOTP+admin scope; require explicit PFX password; add rate limit (DC-076) [glm-grade=A]

Merge dc/DC-074-sites-ssrf: DC-074 sites SSRF hardening [glm-grade=A]
fix(sites): SSRF hardening — validate upstream + externalUrl reject private/reserved hosts (DC-074) [glm-grade=A]
2026-08-18 16:40:28 -07:00 · 2026-08-18 15:31:14 -07:00 · 2026-08-18 15:31:07 -07:00 · 2026-08-18 15:10:40 -07:00 · 2026-08-18 15:10:36 -07:00 · 2026-08-18 14:54:06 -07:00
10 changed files with 1776 additions and 54 deletions
@@ -0,0 +1,350 @@
+/**
+ * DC-076: Per-service CA cert / private key disclosure hardening
+ *
+ * Bug class:
+ *   1. /api/v1/ca/cert/<domain> and /api/v1/ca/certs were listed in
+ *      middleware.js PUBLIC_ROUTES. TOTP/session is the gate; if an
+ *      operator ever disables TOTP (ops command, fresh-install setup
+ *      state, .disabled-* rename of totp-config.json), an unauthenticated
+ *      attacker reaching `https://ca.sami/api/ca/cert/<domain>?format=key`
+ *      would receive the per-service RSA private key for any domain whose
+ *      cert Caddy has ever signed — that's a per-service key disclosure,
+ *      not just a CA fingerprint leak. Even WITH TOTP enabled, any
+ *      read-scope credential could pull a private key, which is over-
+ *      privileged for "I just want to look at the dashboard".
+ *   2. The route's `password` query param defaulted to the literal string
+ *      `'dashcaddy'` — a hardcoded credential published in source. Every
+ *      PFX file Caddy signed silently used the same published password.
+ *   3. The route had no rate limit — every request forks an `openssl`
+ *      process and writes to disk, so an authenticated admin in a loop
+ *      could exhaust CPU/IO.
+ *
+ * Post-fix (this commit):
+ *   1. /api/v1/ca/cert/<domain> + /api/v1/ca/certs removed from
+ *      PUBLIC_ROUTES — TOTP/session always required.
+ *   2. The route additionally requires `admin` scope (defense in depth
+ *      against future middleware-ordering mistakes and against the case
+ *      where TOTP is enabled but a read-scope API key is in use).
+ *   3. PFX format now REQUIRES an explicit 8-64 char password (no
+ *      default). Other formats (key, pem, crt, fullchain) reject `=`
+ *      in the password arg to keep copy-paste mistakes from
+ *      contaminating logs.
+ *   4. Per-IP rate limit: 10 req/min/IP with Retry-After + 429.
+ *
+ * The suite covers:
+ *   1. middleware PUBLIC_ROUTES no longer contains the ca cert/certs paths
+ *   2. /cert/<domain> rejects with 403 when no admin scope (read scope,
+ *      missing scope, malformed scope all rejected)
+ *   3. /cert/<domain> rejects with 400 when PFX password missing or weak
+ *   4. /cert/<domain> rejects with 400 when domain is malformed
+ *      (path traversal, single label, control chars)
+ *   5. /cert/<domain> returns 200 + cert bytes when admin scope + valid
+ *      password supplied (mocked openssl)
+ *   6. Rate limit: 10 req/min/IP allowed, 11th 429 with Retry-After
+ *   7. /certs list endpoint requires admin scope (regression for the
+ *      public listing)
+ */
+
+const express = require('express');
+const request = require('supertest');
+const fs = require('fs');
+const path = require('path');
+
+// We pull the route's internal helpers by requiring the module under test
+// and inspecting its internals via the closure-scoped functions. The cleanest
+// path is to mount the route and assert behavior end-to-end through HTTP.
+const caRoutes = require('../../routes/ca');
+
+// ---------------------------------------------------------------------------
+// Test fixture: a minimal Express app that mounts /ca with stubbed ctx.
+// The route captures `platformPaths` at module-load time, so the actual
+// production paths are used. Test scenarios that would need an isolated
+// cert dir are covered at the response-shape level (asserting 400/403/429
+// codes) rather than the file-content level.
+// ---------------------------------------------------------------------------
+
+function createCaApp({ scope, installMocks = true, tempDirs } = {}) {
+  // We don't mock platform-paths because the test scenarios that need
+  // filesystem-isolated cert dirs (PFX, cert-file serving) are covered
+  // by their pre-staged files in the system temp dir, and the 200-happy
+  // path for non-PFX formats is asserted at the response-shape level
+  // rather than the file-content level. The route's pre-existing PKI
+  // files at the real platformPaths.pkiDir either exist (production
+  // setup) or trigger the 500 "CA certificates not found" path — both
+  // are acceptable for the scope/admin/password/rate-limit assertions.
+  const app = express();
+  app.use(express.json({ limit: '1mb' }));
+  const wrap = (fn) => (req, res, next) => Promise.resolve(fn(req, res, next)).catch(next);
+  const caRoutes = require('../../routes/ca');
+
+  const ok = (res, data) => res.json({ ok: true, ...data });
+  const errorResponse = (res, statusCode, message, extras) => {
+    res.status(statusCode).json({
+      success: false,
+      error: message,
+      code: (extras && extras.code) || null,
+      ...(extras || {}),
+    });
+  };
+  const asyncHandler = wrap;
+
+  const ctx = {
+    asyncHandler,
+    ok,
+    errorResponse,
+    siteConfig: { tld: '.sami' },
+  };
+  const ca = caRoutes(ctx);
+
+  // Mount a tiny auth shim that stamps req.auth before the route runs.
+  // This mirrors what the global totpAuthMiddleware + jwtApiKeyAuthMiddleware
+  // do in production: req.auth = { type, scope, ... }.
+  app.use((req, _res, next) => {
+    req.auth = { type: 'session', scope: scope || [] };
+    // req.ip is read by the rate limiter
+    req.ip = '127.0.0.1';
+    next();
+  });
+  app.use('/ca', ca);
+  return { app };
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe('DC-076: CA cert/key disclosure hardening', () => {
+  describe('middleware PUBLIC_ROUTES no longer whitelists the per-service cert/key endpoints', () => {
+    // Read the public-routes source so a future refactor that re-adds the
+    // path is caught by THIS test (not by an external integration test
+    // that depends on running TOTP-disabled).
+    const fs = require('fs');
+    const middlewareSrc = fs.readFileSync(
+      path.join(__dirname, '../../src/utilities/middleware.js'), 'utf8');
+    // Extract the PUBLIC_ROUTES block (best-effort text scan — catches
+    // both `path: '/api/v1/ca/cert/...'` and `path: '/api/v1/ca/certs'`).
+    const caCertEntry = middlewareSrc.match(/path:\s*['"]\/api\/v1\/ca\/cert\/[^'"]*['"]/);
+    const caCertsEntry = middlewareSrc.match(/path:\s*['"]\/api\/v1\/ca\/certs['"]/);
+
+    test('/api/v1/ca/cert/ prefix is NOT in PUBLIC_ROUTES', () => {
+      expect(caCertEntry).toBeNull();
+    });
+    test('/api/v1/ca/certs exact path is NOT in PUBLIC_ROUTES', () => {
+      expect(caCertsEntry).toBeNull();
+    });
+  });
+
+  describe('/cert/:domain — admin scope required (defense in depth)', () => {
+    test('no scope at all -> 403 with DC-076_INSUFFICIENT_SCOPE', async () => {
+      const { app } = createCaApp({ scope: [] });
+      const res = await request(app)
+        .get('/ca/cert/dns1.sami?format=key');
+      expect(res.status).toBe(403);
+      expect(res.body.code).toBe('DC-076_INSUFFICIENT_SCOPE');
+      expect(res.body.requiredScope).toBe('admin');
+    });
+
+    test('read-only scope -> 403 with DC-076_INSUFFICIENT_SCOPE', async () => {
+      const { app } = createCaApp({ scope: ['read'] });
+      const res = await request(app)
+        .get('/ca/cert/dns1.sami?format=key');
+      expect(res.status).toBe(403);
+      expect(res.body.code).toBe('DC-076_INSUFFICIENT_SCOPE');
+      expect(res.body.actualScope).toEqual(['read']);
+    });
+
+    test('write scope (but not admin) -> 403', async () => {
+      const { app } = createCaApp({ scope: ['read', 'write'] });
+      const res = await request(app)
+        .get('/ca/cert/dns1.sami?format=key');
+      expect(res.status).toBe(403);
+    });
+
+    test('admin scope -> proceeds past the scope gate', async () => {
+      const { app } = createCaApp({ scope: ['admin'] });
+      const res = await request(app)
+        .get('/ca/cert/dns1.sami?format=key');
+      // Will fail later (no password? actually format=key doesn't need pw)
+      // but MUST NOT 403. We expect a 4xx for the cert file not existing
+      // (the test stubs open the route, but the openssl mock below would
+      // still hit a real openssl — we test 200 only when mocks are wired).
+      // For the no-mock path, we accept anything except 403.
+      expect(res.status).not.toBe(403);
+    });
+
+    test('scope field coerced defensively (string, not array) -> 403', async () => {
+      const { app } = createCaApp({ scope: 'admin' });
+      // Override the auth shim to set a malformed scope
+      app.use((req, _res, next) => {
+        req.auth = { type: 'session', scope: 'admin' /* not an array */ };
+        next();
+      });
+      const res = await request(app)
+        .get('/ca/cert/dns1.sami?format=key');
+      expect(res.status).toBe(403);
+    });
+  });
+
+  describe('/cert/:domain — PFX format requires explicit password', () => {
+    test('no password supplied -> 400 DC-076_PASSWORD_REQUIRED', async () => {
+      const { app } = createCaApp({ scope: ['admin'] });
+      const res = await request(app)
+        .get('/ca/cert/dns1.sami?format=pfx');
+      expect(res.status).toBe(400);
+      expect(res.body.code).toBe('DC-076_PASSWORD_REQUIRED');
+    });
+
+    test('default password "dashcaddy" was the pre-fix behavior — now rejected', async () => {
+      // Pre-fix: the route used `password = 'dashcaddy'` as default; PFX
+      // files were signed with that string. Post-fix: an explicit password
+      // shorter than 8 chars or matching the old default shape ("dashcaddy"
+      // is 9 chars, lowercase only) must be REJECTED if it doesn't match
+      // the policy. The policy is 8-64 chars from [A-Za-z0-9!@#%^_+,.~:-],
+      // so "dashcaddy" is technically 9 chars and would pass... but we
+      // test that an EXPLICIT password is required (no implicit default)
+      // by sending no password and asserting 400.
+      const { app } = createCaApp({ scope: ['admin'] });
+      const noPw = await request(app)
+        .get('/ca/cert/dns1.sami?format=pfx');
+      expect(noPw.status).toBe(400);
+      expect(noPw.body.code).toBe('DC-076_PASSWORD_REQUIRED');
+    });
+
+    test('short password (< 8 chars) -> 400 DC-076_PASSWORD_INVALID', async () => {
+      const { app } = createCaApp({ scope: ['admin'] });
+      const res = await request(app)
+        .get('/ca/cert/dns1.sami?format=pfx&password=short');
+      expect(res.status).toBe(400);
+      expect(res.body.code).toBe('DC-076_PASSWORD_INVALID');
+    });
+
+    test('password with `=` -> 400 DC-076_PASSWORD_INVALID', async () => {
+      const { app } = createCaApp({ scope: ['admin'] });
+      const res = await request(app)
+        .get('/ca/cert/dns1.sami?format=pfx&password=abcdefgh=');
+      expect(res.status).toBe(400);
+      expect(res.body.code).toBe('DC-076_PASSWORD_INVALID');
+    });
+
+    test('password with disallowed char (e.g. `/`) -> 400', async () => {
+      const { app } = createCaApp({ scope: ['admin'] });
+      const res = await request(app)
+        .get('/ca/cert/dns1.sami?format=pfx&password=abc/12345');
+      expect(res.status).toBe(400);
+      expect(res.body.code).toBe('DC-076_PASSWORD_INVALID');
+    });
+
+    test('non-PFX format (key) does NOT require a password (regression for PFX-only password logic)', async () => {
+      // The point of this test is to prove that the new DC-076 password
+      // gate only fires for PFX. Other formats (key, pem, crt, fullchain)
+      // must not 400 on missing-password.
+      //
+      // We can't easily test the 200 happy path here because the route
+      // calls `openssl x509 -in server.crt -noout -dates` to check cert
+      // expiry, and a fake server.crt makes that fall through to cert
+      // regeneration (which calls real openssl and writes real certs to
+      // the real platformPaths.generatedCertsDir — not what we want in a
+      // unit test). Instead, we assert that the route does NOT 400 with
+      // the password-required shape. We use /format=crt which has the
+      // simplest validation path.
+      const { app } = createCaApp({ scope: ['admin'] });
+      // No password supplied; format=crt. Should NOT 400 with
+      // DC-076_PASSWORD_REQUIRED (that's only for PFX).
+      const res = await request(app)
+        .get('/ca/cert/dns1.sami?format=crt');
+      if (res.status === 400 && res.body.code === 'DC-076_PASSWORD_REQUIRED') {
+        throw new Error('non-PFX format wrongly required a password: ' + JSON.stringify(res.body));
+      }
+      // The actual response could be 200 (cert served) or 500 (cert files
+      // missing in test env, or openssl error from fake data) — both
+      // are acceptable; what matters is NOT 400 DC-076_PASSWORD_REQUIRED.
+      expect(res.status).not.toBe(400);
+    });
+  });
+
+  describe('/cert/:domain — domain validation', () => {
+    test('rejects single-label domain (no dot)', async () => {
+      const { app } = createCaApp({ scope: ['admin'] });
+      const res = await request(app)
+        .get('/ca/cert/dns1?format=key');
+      expect(res.status).toBe(400);
+      expect(res.body.code).toBe('DC-076_DOMAIN_INVALID');
+    });
+
+    test('rejects domain with `..` (path traversal)', async () => {
+      const { app } = createCaApp({ scope: ['admin'] });
+      const res = await request(app)
+        .get('/ca/cert/..%2Fetc%2Fpasswd?format=key');
+      // Express decodes %2F in the path -> /ca/cert/../etc/passwd
+      // The new regex `^[a-z0-9]...` rejects this entirely.
+      expect([400, 404]).toContain(res.status);
+    });
+
+    test('rejects domain with control char (\\n)', async () => {
+      const { app } = createCaApp({ scope: ['admin'] });
+      const res = await request(app)
+        .get('/ca/cert/evil%0A.com?format=key');
+      expect([400, 404]).toContain(res.status);
+    });
+
+    test('rejects uppercase domain (must be lowercase per the new regex)', async () => {
+      const { app } = createCaApp({ scope: ['admin'] });
+      const res = await request(app)
+        .get('/ca/cert/DNS1.SAMI?format=key');
+      expect(res.status).toBe(400);
+      expect(res.body.code).toBe('DC-076_DOMAIN_INVALID');
+    });
+  });
+
+  describe('/cert/:domain — rate limit', () => {
+    test('first 10 requests in 60s succeed (or fail non-rate-limit), 11th returns 429', async () => {
+      // 10 requests should all NOT be 429 (the rate-limit counter is
+      // reset per module load, so each test starts fresh).
+      for (let i = 0; i < 10; i++) {
+        const { app } = createCaApp({ scope: ['admin'] });
+        const r = await request(app).get('/ca/cert/dns1.sami?format=key');
+        expect(r.status).not.toBe(429);
+      }
+      // 11th MUST be 429 (the rate limit is in-module state; only the
+      // last test's app shares state with itself, so we use the same
+      // app for the 11th request).
+      const { app } = createCaApp({ scope: ['admin'] });
+      // First 10
+      for (let i = 0; i < 10; i++) {
+        await request(app).get('/ca/cert/dns1.sami?format=key');
+      }
+      const over = await request(app).get('/ca/cert/dns1.sami?format=key');
+      expect(over.status).toBe(429);
+      expect(over.body.code).toBe('DC-076_RATE_LIMITED');
+      expect(over.headers['retry-after']).toMatch(/^\d+$/);
+    });
+  });
+
+  describe('/certs — list endpoint requires admin scope', () => {
+    test('no admin scope -> 403', async () => {
+      const { app } = createCaApp({ scope: ['read'] });
+      const res = await request(app).get('/ca/certs');
+      expect(res.status).toBe(403);
+    });
+    test('admin scope -> 200', async () => {
+      const { app } = createCaApp({ scope: ['admin'] });
+      const res = await request(app).get('/ca/certs');
+      expect(res.status).toBe(200);
+    });
+  });
+
+  describe('static /root.crt and /info remain public (CA cert IS public)', () => {
+    test('GET /ca/root.crt does not require admin scope', async () => {
+      const { app } = createCaApp({ scope: [] });
+      const res = await request(app).get('/ca/root.crt');
+      // 200 if the file is there, 404 if not — but NEVER 403
+      expect([200, 404]).toContain(res.status);
+    });
+    test('GET /ca/info does not require admin scope', async () => {
+      const { app } = createCaApp({ scope: [] });
+      const res = await request(app).get('/ca/info');
+      // 200 if cert-info.json is there, 404 if not — but NEVER 403
+      expect([200, 404]).toContain(res.status);
+    });
+  });
+});
@@ -0,0 +1,272 @@
+/**
+ * DC-073: regression tests for the caddy-upstreams mute endpoints.
+ *
+ * Pre-fix, only the bare `/caddy/upstreams/mute` body-style endpoint
+ * rejected unknown hosts with a 400 "not a known upstream". The
+ * path-style `/:host/mute` and `/:host/unmute` endpoints skipped that
+ * check entirely and would silently call `setMuted(phantom, true)`,
+ * persisting a phantom entry into the watcher's muted Set (which is
+ * disk-persisted via `_saveState()`).
+ *
+ * These tests prove:
+ *   (1) every endpoint now rejects an unknown host with 400
+ *   (2) the rejection happens BEFORE setMuted is invoked (no state
+ *       corruption — `fakeWatcher.setMuted` is asserted to be
+ *       untouched on the rejection path)
+ *   (3) the rejection message is the canonical "not a known upstream"
+ *       so callers can branch on it
+ *   (4) known hosts still mute / unmute correctly (no regression)
+ *   (5) the bare handler still accepts the body { host, muted: 'false' }
+ *       string-coercion quirk it had before (so the original
+ *       caddy-upstreams.routes.test.js suite keeps passing)
+ *
+ * @module __tests__/routes/caddy-upstreams-dc073
+ */
+
+const express = require('express');
+const { validateAndMuteHost } = require('../../routes/caddy-upstreams').__test;
+
+function buildRouter(deps) {
+  const mod = require('../../routes/caddy-upstreams');
+  return mod(deps);
+}
+
+function buildApp(mod_deps) {
+  const app = express();
+  app.use(express.json());
+  app.use((req, res, next) => {
+    res.success = (data) => res.json({ success: true, ...data });
+    res.errorResponse = (msg, code) => res.status(code || 500).json({ success: false, error: msg });
+    next();
+  });
+  app.use(buildRouter({
+    asyncHandler: (fn, _ctx) => async (req, res, next) => {
+      try { await fn(req, res, next); } catch (e) { next(e); }
+    },
+    ...mod_deps,
+  }));
+  // Error middleware MUST be registered AFTER routes so it actually catches.
+  app.use((err, req, res, next) => {
+    if (err && err.statusCode === 400) {
+      return res.status(400).json({ success: false, error: err.message });
+    }
+    return res.status(err?.statusCode || 500).json({ success: false, error: err?.message || 'unknown' });
+  });
+  return app;
+}
+
+function makeKnownWatcher(known = ['known.svc.example:80', '1.1.1.1:80']) {
+  const upstreams = new Map(known.map(h => [h, { host: h }]));
+  return {
+    upstreams,
+    setMuted: jest.fn((host, muted) => ({ host, muted: !!muted })),
+    snapshot: jest.fn(() => ({ upstreams: [], config: {} })),
+  };
+}
+
+describe('routes/caddy-upstreams — DC-073 phantom-mute regression', () => {
+  describe('validateAndMuteHost helper (unit)', () => {
+    test('rejects empty / non-string host', () => {
+      const w = makeKnownWatcher();
+      expect(() => validateAndMuteHost(w, '', true)).toThrow(/non-empty string/);
+      expect(() => validateAndMuteHost(w, null, true)).toThrow(/non-empty string/);
+      expect(() => validateAndMuteHost(w, undefined, true)).toThrow(/non-empty string/);
+      expect(() => validateAndMuteHost(w, 12345, true)).toThrow(/non-empty string/);
+      expect(w.setMuted).not.toHaveBeenCalled();
+    });
+
+    test('rejects host longer than 253 chars', () => {
+      const w = makeKnownWatcher();
+      const long = 'a'.repeat(254);
+      expect(() => validateAndMuteHost(w, long, true)).toThrow(/non-empty string/);
+      expect(w.setMuted).not.toHaveBeenCalled();
+    });
+
+    test('rejects host with charset-violating chars', () => {
+      const w = makeKnownWatcher();
+      for (const bad of ['host name', 'host?', 'host/abc', 'host;rm', 'host${x}', 'host<>']) {
+        expect(() => validateAndMuteHost(w, bad, true)).toThrow(/valid host/);
+      }
+      expect(w.setMuted).not.toHaveBeenCalled();
+    });
+
+    test('rejects host not in watcher.upstreams (phantom-mute vector)', () => {
+      const w = makeKnownWatcher(['known:80']);
+      // This is the regression: pre-fix, this call would have
+      // silently added 'phantom.test:12345' to watcher.muted.
+      expect(() => validateAndMuteHost(w, 'phantom.test:12345', true))
+        .toThrow(/not a known upstream/);
+      expect(w.setMuted).not.toHaveBeenCalled();
+    });
+
+    test('accepts a known host and forwards setMuted(host, wantMuted)', () => {
+      const w = makeKnownWatcher(['known:80']);
+      const result = validateAndMuteHost(w, 'known:80', true);
+      expect(w.setMuted).toHaveBeenCalledWith('known:80', true);
+      expect(result).toEqual({ host: 'known:80', muted: true });
+
+      w.setMuted.mockClear();
+      const result2 = validateAndMuteHost(w, 'known:80', false);
+      expect(w.setMuted).toHaveBeenCalledWith('known:80', false);
+      expect(result2).toEqual({ host: 'known:80', muted: false });
+    });
+
+    test('handles missing watcher / upstreams map (defensive)', () => {
+      expect(() => validateAndMuteHost(null, 'x:80', true)).toThrow(/not a known upstream/);
+      expect(() => validateAndMuteHost({}, 'x:80', true)).toThrow(/not a known upstream/);
+      expect(() => validateAndMuteHost({ upstreams: null }, 'x:80', true)).toThrow(/not a known upstream/);
+    });
+  });
+
+  describe('POST /caddy/upstreams/mute (bare body-style)', () => {
+    test('rejects unknown host with 400 (was already correct, regression-proof)', async () => {
+      const w = makeKnownWatcher(['known:80']);
+      const app = buildApp({ caddyUpstreamWatcher: w, healthChecker: { incidents: [] } });
+      const server = app.listen(0);
+      const { port } = server.address();
+      const res = await fetch(`http://127.0.0.1:${port}/caddy/upstreams/mute`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ host: 'phantom:12345' }),
+      });
+      const body = await res.json();
+      server.close();
+      expect(res.status).toBe(400);
+      expect(body.error).toMatch(/not a known upstream/);
+      expect(w.setMuted).not.toHaveBeenCalled();
+    });
+
+    test('muted: "false" string still coerces to unmute (regression from caddy-upstreams.routes.test.js)', async () => {
+      const w = makeKnownWatcher(['known:80']);
+      const app = buildApp({ caddyUpstreamWatcher: w, healthChecker: { incidents: [] } });
+      const server = app.listen(0);
+      const { port } = server.address();
+      const res = await fetch(`http://127.0.0.1:${port}/caddy/upstreams/mute`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ host: 'known:80', muted: 'false' }),
+      });
+      const body = await res.json();
+      server.close();
+      expect(body.success).toBe(true);
+      expect(w.setMuted).toHaveBeenCalledWith('known:80', false);
+    });
+  });
+
+  describe('POST /caddy/upstreams/:host/mute (path-style) — DC-073 main fix', () => {
+    test('rejects unknown host with 400 instead of silent phantom-mute', async () => {
+      const w = makeKnownWatcher(['known:80']);
+      const app = buildApp({ caddyUpstreamWatcher: w, healthChecker: { incidents: [] } });
+      const server = app.listen(0);
+      const { port } = server.address();
+      // Pre-fix this would have silently added 'phantom.test:12345' to
+      // the watcher's muted Set and called _saveState(). Post-fix it
+      // returns 400 and never touches the watcher.
+      const res = await fetch(`http://127.0.0.1:${port}/caddy/upstreams/phantom.test:12345/mute`, {
+        method: 'POST',
+      });
+      const body = await res.json();
+      server.close();
+      expect(res.status).toBe(400);
+      expect(body.error).toMatch(/not a known upstream/);
+      expect(w.setMuted).not.toHaveBeenCalled();
+    });
+
+    test('mutes a known host via bare POST (no body)', async () => {
+      const w = makeKnownWatcher(['known.svc.example:80']);
+      const app = buildApp({ caddyUpstreamWatcher: w, healthChecker: { incidents: [] } });
+      const server = app.listen(0);
+      const { port } = server.address();
+      const res = await fetch(`http://127.0.0.1:${port}/caddy/upstreams/known.svc.example:80/mute`, {
+        method: 'POST',
+      });
+      const body = await res.json();
+      server.close();
+      expect(res.status).toBe(200);
+      expect(body.success).toBe(true);
+      expect(w.setMuted).toHaveBeenCalledWith('known.svc.example:80', true);
+    });
+
+    test('mutes via ?muted=true query', async () => {
+      const w = makeKnownWatcher(['known.svc.example:80']);
+      const app = buildApp({ caddyUpstreamWatcher: w, healthChecker: { incidents: [] } });
+      const server = app.listen(0);
+      const { port } = server.address();
+      const res = await fetch(`http://127.0.0.1:${port}/caddy/upstreams/known.svc.example:80/mute?muted=true`, {
+        method: 'POST',
+      });
+      const body = await res.json();
+      server.close();
+      expect(w.setMuted).toHaveBeenCalledWith('known.svc.example:80', true);
+      expect(body.success).toBe(true);
+    });
+
+    test('unmutes via body { muted: false }', async () => {
+      const w = makeKnownWatcher(['known.svc.example:80']);
+      const app = buildApp({ caddyUpstreamWatcher: w, healthChecker: { incidents: [] } });
+      const server = app.listen(0);
+      const { port } = server.address();
+      const res = await fetch(`http://127.0.0.1:${port}/caddy/upstreams/known.svc.example:80/mute`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ muted: false }),
+      });
+      const body = await res.json();
+      server.close();
+      expect(w.setMuted).toHaveBeenCalledWith('known.svc.example:80', false);
+      expect(body.success).toBe(true);
+    });
+  });
+
+  describe('POST /caddy/upstreams/:host/unmute (path-style) — DC-073 main fix', () => {
+    test('rejects unknown host with 400 instead of silent phantom-unmute', async () => {
+      const w = makeKnownWatcher(['known:80']);
+      const app = buildApp({ caddyUpstreamWatcher: w, healthChecker: { incidents: [] } });
+      const server = app.listen(0);
+      const { port } = server.address();
+      const res = await fetch(`http://127.0.0.1:${port}/caddy/upstreams/phantom.test:12345/unmute`, {
+        method: 'POST',
+      });
+      const body = await res.json();
+      server.close();
+      expect(res.status).toBe(400);
+      expect(body.error).toMatch(/not a known upstream/);
+      expect(w.setMuted).not.toHaveBeenCalled();
+    });
+
+    test('unmutes a known host', async () => {
+      const w = makeKnownWatcher(['known.svc.example:80']);
+      const app = buildApp({ caddyUpstreamWatcher: w, healthChecker: { incidents: [] } });
+      const server = app.listen(0);
+      const { port } = server.address();
+      const res = await fetch(`http://127.0.0.1:${port}/caddy/upstreams/known.svc.example:80/unmute`, {
+        method: 'POST',
+      });
+      const body = await res.json();
+      server.close();
+      expect(res.status).toBe(200);
+      expect(w.setMuted).toHaveBeenCalledWith('known.svc.example:80', false);
+      expect(body.success).toBe(true);
+    });
+  });
+
+  describe('router introspection (DC-057-style mount-count assertion)', () => {
+    test('exactly one POST handler per (method,path) — no duplicate registration', () => {
+      const w = makeKnownWatcher();
+      const router = buildRouter({
+        asyncHandler: (fn) => fn,
+        caddyUpstreamWatcher: w,
+        healthChecker: { incidents: [] },
+      });
+      const sigs = router.stack
+        .filter((l) => l.route)
+        .map((l) => Object.keys(l.route.methods).map((m) => `${m.toUpperCase()} ${l.route.path}`))
+        .flat();
+      // Each (method,path) should appear exactly once
+      const counts = sigs.reduce((m, s) => (m[s] = (m[s] || 0) + 1, m), {});
+      for (const [sig, n] of Object.entries(counts)) {
+        expect({ sig, n }).toEqual({ sig, n: 1 });
+      }
+    });
+  });
+});
@@ -0,0 +1,192 @@
+/**
+ * DC-072: WebSocket exec scope-based authorization + containerId charset
+ * hardening.
+ *
+ * Bug class under test:
+ *   1. Pre-fix `routes/exec.js` captured `auth.scope` (line 39/46) but
+ *      NEVER enforced it. A JWT or API key whose scope was `['read']`
+ *      (a legitimate monitoring/observability scope) would be granted a
+ *      full PTY-backed shell inside any running container. Container
+ *      exec is root-equivalent inside the container's user namespace,
+ *      so this is a privilege escalation: a read-only key holder could
+ *      run arbitrary commands, exfiltrate mounted volumes, or pivot
+ *      to the host network.
+ *
+ *   2. Pre-fix `containerId` regex `/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$/`
+ *      accepted mixed case, `_`, `-`, `.`, and any length up to 128.
+ *      Docker container IDs are exactly 64 lowercase hex (or 12-char
+ *      short form). The pre-fix validator would pass any string that
+ *      looked vaguely ID-shaped; Docker's inspect() would then 404.
+ *
+ * Post-fix: `assertExecScope(auth)` requires `admin` scope and throws a
+ * 403-tagged error. `isValidContainerId(id)` accepts only 12 or 64
+ * lowercase hex chars. Both helpers are exported via `__test`.
+ */
+
+const { __test } = require('../../routes/exec');
+const { assertExecScope, isValidContainerId } = __test;
+
+function check(cond, msg) {
+  if (!cond) throw new Error('assertion failed: ' + msg);
+}
+
+describe('DC-072: exec WebSocket scope-based authorization', () => {
+  describe('assertExecScope — admin required', () => {
+    test('admin scope passes', () => {
+      // Should not throw
+      assertExecScope({ type: 'jwt', scope: ['admin'] });
+      assertExecScope({ type: 'apikey', scope: ['admin', 'read'] });
+    });
+
+    test('read-only scope rejected with DC-072_INSUFFICIENT_SCOPE', () => {
+      let caught = null;
+      try {
+        assertExecScope({ type: 'apikey', scope: ['read'] });
+      } catch (e) {
+        caught = e;
+      }
+      check(caught !== null, 'expected assertExecScope to throw on read-only scope');
+      check(caught.code === 'DC-072_INSUFFICIENT_SCOPE', `expected code DC-072_INSUFFICIENT_SCOPE, got ${caught.code}`);
+      check(caught.statusCode === 403, `expected statusCode 403, got ${caught.statusCode}`);
+      check(caught.requiredScope === 'admin', `expected requiredScope=admin, got ${caught.requiredScope}`);
+      check(Array.isArray(caught.actualScope) && caught.actualScope[0] === 'read', `expected actualScope=['read'], got ${JSON.stringify(caught.actualScope)}`);
+    });
+
+    test('write-only scope rejected (write ≠ admin)', () => {
+      let caught = null;
+      try {
+        assertExecScope({ type: 'jwt', scope: ['write'] });
+      } catch (e) {
+        caught = e;
+      }
+      check(caught !== null, 'expected assertExecScope to throw on write-only scope');
+      check(caught.code === 'DC-072_INSUFFICIENT_SCOPE', `expected code DC-072_INSUFFICIENT_SCOPE, got ${caught.code}`);
+      check(caught.statusCode === 403, `expected statusCode 403, got ${caught.statusCode}`);
+    });
+
+    test('empty scope rejected', () => {
+      let caught = null;
+      try {
+        assertExecScope({ type: 'apikey', scope: [] });
+      } catch (e) {
+        caught = e;
+      }
+      check(caught !== null, 'expected assertExecScope to throw on empty scope');
+      check(caught.code === 'DC-072_INSUFFICIENT_SCOPE', 'expected DC-072_INSUFFICIENT_SCOPE code');
+    });
+
+    test('undefined scope rejected (null-safety)', () => {
+      let caught = null;
+      try {
+        assertExecScope({ type: 'jwt' }); // no scope field
+      } catch (e) {
+        caught = e;
+      }
+      check(caught !== null, 'expected assertExecScope to throw on undefined scope');
+      check(caught.code === 'DC-072_INSUFFICIENT_SCOPE', 'expected DC-072_INSUFFICIENT_SCOPE code');
+    });
+
+    test('null auth rejected', () => {
+      let caught = null;
+      try {
+        assertExecScope(null);
+      } catch (e) {
+        caught = e;
+      }
+      check(caught !== null, 'expected assertExecScope to throw on null auth');
+      check(caught.code === 'DC-072_INSUFFICIENT_SCOPE', 'expected DC-072_INSUFFICIENT_SCOPE code');
+    });
+
+    test('non-array scope rejected (defensive)', () => {
+      let caught = null;
+      try {
+        assertExecScope({ type: 'apikey', scope: 'admin' }); // string, not array
+      } catch (e) {
+        caught = e;
+      }
+      check(caught !== null, 'expected assertExecScope to throw on non-array scope');
+      check(caught.code === 'DC-072_INSUFFICIENT_SCOPE', 'expected DC-072_INSUFFICIENT_SCOPE code');
+    });
+
+    test('error envelope carries operator-actionable fields', () => {
+      let caught = null;
+      try {
+        assertExecScope({ type: 'apikey', keyId: 'k_test', scope: ['read'] });
+      } catch (e) {
+        caught = e;
+      }
+      check(caught.message === 'Container exec requires admin scope', `expected canonical message, got ${caught.message}`);
+      check(typeof caught.requiredScope === 'string' && caught.requiredScope === 'admin', 'requiredScope present');
+      check(Array.isArray(caught.actualScope), 'actualScope is array');
+    });
+  });
+
+  describe('isValidContainerId — Docker charset (12 or 64 lowercase hex)', () => {
+    test('64-char lowercase hex accepted (full Docker ID)', () => {
+      // Real-world example: dashcaddy-api container ID
+      check(isValidContainerId('abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789') === true, '64-char hex should pass');
+    });
+
+    test('12-char lowercase hex accepted (short form)', () => {
+      check(isValidContainerId('abcdef012345') === true, '12-char hex should pass');
+    });
+
+    test('uppercase hex rejected (Docker IDs are lowercase)', () => {
+      check(isValidContainerId('ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789') === false, 'uppercase 64-char should fail');
+      check(isValidContainerId('ABCDEF012345') === false, 'uppercase 12-char should fail');
+    });
+
+    test('mixed case rejected', () => {
+      check(isValidContainerId('Abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789') === false, 'mixed case 64-char should fail');
+    });
+
+    test('non-hex chars rejected', () => {
+      check(isValidContainerId('zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz') === false, 'g-z hex should fail');
+      check(isValidContainerId('abc!@#$%^&*()_+-=[]{}|\\:;\'",.<>/?0123456789012345678901234567890123') === false, 'special chars should fail');
+    });
+
+    test('underscore / dot / dash rejected (pre-fix allowed these)', () => {
+      // Pre-fix regex accepted `_`, `-`, `.` — all are non-Docker
+      check(isValidContainerId('my_container_1') === false, 'underscore should fail');
+      check(isValidContainerId('my.container.1') === false, 'dot should fail');
+      check(isValidContainerId('my-container-1') === false, 'dash should fail');
+    });
+
+    test('wrong length rejected', () => {
+      check(isValidContainerId('abcdef0123456') === false, '13-char should fail');     // 12 + 1
+      check(isValidContainerId('abcdef01234567') === false, '14-char should fail');   // 12 + 2
+      check(isValidContainerId('abcdef0123456789a') === false, '65-char should fail'); // 64 + 1
+    });
+
+    test('empty string rejected', () => {
+      check(isValidContainerId('') === false, 'empty string should fail');
+    });
+
+    test('null / undefined / non-string rejected (defensive)', () => {
+      check(isValidContainerId(null) === false, 'null should fail');
+      check(isValidContainerId(undefined) === false, 'undefined should fail');
+      check(isValidContainerId(12345) === false, 'number should fail');
+      check(isValidContainerId({}) === false, 'object should fail');
+      check(isValidContainerId([]) === false, 'array should fail');
+    });
+
+    test('whitespace / padding rejected', () => {
+      check(isValidContainerId('  abcdef012345  ') === false, 'padded should fail');
+      check(isValidContainerId('\nabcdef012345\n') === false, 'CRLF-padded should fail');
+    });
+
+    test('CRLF injection rejected (defensive against pre-fix attack class)', () => {
+      // Pre-fix regex accepted 128 chars with dots; a payload like
+      // `aa.bb.cc.dd\r\nSet-Cookie:...` would have passed. Post-fix
+      // the LF + non-hex + wrong-length combo fails on every axis.
+      check(isValidContainerId('aa\r\nbb') === false, 'CRLF payload should fail');
+    });
+  });
+
+  describe('__test exports shape', () => {
+    test('exports assertExecScope and isValidContainerId', () => {
+      check(typeof __test.assertExecScope === 'function', 'assertExecScope is a function');
+      check(typeof __test.isValidContainerId === 'function', 'isValidContainerId is a function');
+    });
+  });
+});
@@ -0,0 +1,535 @@
+/**
+ * DC-074: SSRF hardening for sites.js — `/site` and `/site/external`
+ * must reject upstream hosts that resolve to private/reserved ranges
+ * BEFORE they reach the Caddyfile.
+ *
+ * Bug class: an authenticated dashboard operator could call
+ *   POST /api/v1/site        {domain: "x.example.com", upstream: "10.0.0.1:80"}
+ *   POST /api/v1/site/external {subdomain: "x", externalUrl: "http://192.168.1.5"}
+ * and end up with a Caddy site block that proxies PUBLIC traffic to an
+ * INTERNAL host. Caddy runs on DNS2 (same network as the targets), so
+ * the SSRF lands.
+ *
+ * Pre-fix: `/site`'s only upstream check was `^[a-z0-9.-]+:\d{1,5}$/i`,
+ * which accepts 192.168.1.1:80 and 169.254.169.254:80 (the AWS
+ * metadata IP) with no problem. `/site/external` used `validateURL`
+ * without `blockPrivate: true` at all.
+ *
+ * Post-fix: a new helper `validateUpstream()` in `fleet-validation.js`
+ * reuses the resolver+private-range checks fleet-validation already has
+ * for DC-068, gating Caddyfile writes behind a public-IP requirement.
+ * Opt-in via `SITES_ALLOW_PRIVATE_UPSTREAMS=true` for operators who
+ * intentionally proxy to private targets.
+ *
+ * The suite covers three layers:
+ *   1. Helper unit tests — validateUpstream with mocked DNS / literal IPs
+ *   2. Route integration tests — POST /site and POST /site/external
+ *      reject each known private range, accept public IPs and hostnames
+ *   3. Regression — pre-fix payload `10.0.0.1:80` is rejected (the
+ *      canonical SSRF regression proof)
+ */
+const express = require('express');
+const request = require('supertest');
+
+const {
+  validateUpstream,
+  isPrivateOrReservedIPv4,
+  isPrivateOrReservedIPv6,
+} = require('../../src/utilities/fleet-validation');
+
+// ---------------------------------------------------------------------------
+// Test fixtures
+// ---------------------------------------------------------------------------
+
+const LOG = () => ({ info: jest.fn(), warn: jest.fn(), error: jest.fn() });
+
+/**
+ * Build a minimal Express app that mounts /api/v1/sites with stubbed
+ * caddy/dns/buildDomain/addServiceToConfig. The stubs record every call
+ * so tests can assert the route does NOT mutate the Caddyfile when it
+ * should reject.
+ */
+function createSitesApp({ log, caddyStub, buildDomainStub, dnsStub, addServiceToConfigStub } = {}) {
+  const app = express();
+  app.use(express.json({ limit: '1mb' }));
+  const sites = require('../../routes/sites');
+  const wrap = (fn) => (req, res, next) => Promise.resolve(fn(req, res, next)).catch(next);
+  const caddy = caddyStub || {
+    read: async () => '# stub caddyfile\n',
+    modify: jest.fn(async () => ({ success: true })),
+    adminUrl: 'http://127.0.0.1:2019',
+    filePath: '/tmp/stub-Caddyfile',
+  };
+  const dns = dnsStub || {
+    universalCreateRecord: jest.fn(async () => true),
+  };
+  app.use('/api/v1', sites({
+    asyncHandler: wrap,
+    ok: (res, data) => res.json({ ok: true, ...data }),
+    successMessage: (res, msg) => res.json({ ok: true, message: msg }),
+    caddy,
+    dns,
+    fetchT: async () => ({ ok: true, json: async () => ({}) }),
+    buildDomain: buildDomainStub || ((sub) => `${sub}.example.com`),
+    addServiceToConfig: addServiceToConfigStub || jest.fn(async () => true),
+    siteConfig: { dnsServerIp: '127.0.0.1' },
+    log: log || LOG(),
+  }));
+  // JSON error middleware — must mirror the shape sites.js's production
+  // global error middleware emits so route tests can assert on it. Without
+  // this, Express's default error handler returns an HTML stack trace and
+  // res.body.error is undefined.
+  // eslint-disable-next-line no-unused-vars
+  app.use((err, req, res, next) => {
+    const status = err.statusCode || 500;
+    res.status(status).json({
+      error: err.message || 'Internal Server Error',
+      code: err.code || null,
+      field: err.field || null,
+    });
+  });
+  return { app, caddy };
+}
+
+/** Mock dns.promises.lookup to return a specific IP for any hostname.
+ *  Returns an array of `{address, family}` records since fleet-validation
+ *  calls `dns.lookup(name, {all: true})`. */
+function mockDnsLookup(map) {
+  const dns = require('dns');
+  const original = dns.promises.lookup;
+  dns.promises.lookup = async (hostname, opts) => {
+    for (const [pattern, ip] of Object.entries(map)) {
+      if (hostname === pattern || (pattern instanceof RegExp && pattern.test(hostname))) {
+        const family = ip.includes(':') ? 6 : 4;
+        return [{ address: ip, family }];
+      }
+    }
+    // Default: throw ENOTFOUND
+    const err = new Error('ENOTFOUND');
+    err.code = 'ENOTFOUND';
+    throw err;
+  };
+  return () => {
+    dns.promises.lookup = original;
+  };
+}
+
+// ---------------------------------------------------------------------------
+// 1. Helper unit tests
+// ---------------------------------------------------------------------------
+
+describe('DC-074: validateUpstream (helper)', () => {
+  let restoreDns;
+
+  beforeEach(() => {
+    delete process.env.SITES_ALLOW_PRIVATE_UPSTREAMS;
+  });
+
+  afterEach(() => {
+    if (restoreDns) restoreDns();
+    delete process.env.SITES_ALLOW_PRIVATE_UPSTREAMS;
+  });
+
+  describe('format validation', () => {
+    test('rejects empty / non-string with INVALID_UPSTREAM', async () => {
+      expect(await validateUpstream('')).toMatchObject({ ok: false, code: 'INVALID_UPSTREAM' });
+      expect(await validateUpstream(null)).toMatchObject({ ok: false, code: 'INVALID_UPSTREAM' });
+      expect(await validateUpstream(undefined)).toMatchObject({ ok: false, code: 'INVALID_UPSTREAM' });
+      expect(await validateUpstream(42)).toMatchObject({ ok: false, code: 'INVALID_UPSTREAM' });
+    });
+
+    test('rejects missing port with INVALID_UPSTREAM', async () => {
+      expect(await validateUpstream('hostonly')).toMatchObject({ ok: false, code: 'INVALID_UPSTREAM' });
+    });
+
+    test('rejects non-integer port with INVALID_PORT', async () => {
+      expect(await validateUpstream('host:abc')).toMatchObject({ ok: false, code: 'INVALID_PORT' });
+      expect(await validateUpstream('host:80.5')).toMatchObject({ ok: false, code: 'INVALID_PORT' });
+    });
+
+    test('rejects out-of-range port with INVALID_PORT', async () => {
+      expect(await validateUpstream('host:0')).toMatchObject({ ok: false, code: 'INVALID_PORT' });
+      expect(await validateUpstream('host:65536')).toMatchObject({ ok: false, code: 'INVALID_PORT' });
+      expect(await validateUpstream('host:99999999')).toMatchObject({ ok: false, code: 'INVALID_PORT' });
+      expect(await validateUpstream('host:-1')).toMatchObject({ ok: false, code: 'INVALID_PORT' });
+    });
+  });
+
+  describe('private IPv4 reject (literal)', () => {
+    const PRIVATE_V4 = [
+      ['127.0.0.1', 'loopback'],
+      ['127.255.255.1', 'loopback'],
+      ['10.0.0.1', 'RFC 1918'],
+      ['172.16.0.1', 'RFC 1918'],
+      ['192.168.1.1', 'RFC 1918'],
+      ['169.254.169.254', 'link-local'],          // AWS IMDS
+      ['100.64.0.1', 'CGNAT'],
+      ['224.0.0.1', 'multicast'],
+      ['255.255.255.255', 'broadcast'],
+      ['0.0.0.0', 'reserved'],
+    ];
+    for (const [ip, wantLabel] of PRIVATE_V4) {
+      test(`rejects ${ip} (${wantLabel})`, async () => {
+        const r = await validateUpstream(`${ip}:80`);
+        expect(r.ok).toBe(false);
+        expect(r.code).toBe('PRIVATE_IPV4');
+        expect(r.message).toMatch(new RegExp(wantLabel, 'i'));
+      });
+    }
+  });
+
+  describe('private IPv6 reject (literal)', () => {
+    test('rejects ::1 (loopback)', async () => {
+      const r = await validateUpstream('[::1]:80');
+      expect(r.ok).toBe(false);
+      expect(r.code).toBe('PRIVATE_IPV6');
+    });
+
+    test('rejects fe80::1 (link-local)', async () => {
+      const r = await validateUpstream('[fe80::1]:80');
+      expect(r.ok).toBe(false);
+      expect(r.code).toBe('PRIVATE_IPV6');
+    });
+
+    test('rejects fc00::1 (ULA)', async () => {
+      const r = await validateUpstream('[fc00::1]:80');
+      expect(r.ok).toBe(false);
+      expect(r.code).toBe('PRIVATE_IPV6');
+    });
+  });
+
+  describe('public IPs accepted (literal)', () => {
+    test('accepts 8.8.8.8', async () => {
+      const r = await validateUpstream('8.8.8.8:53');
+      expect(r.ok).toBe(true);
+      expect(r.host).toBe('8.8.8.8');
+      expect(r.port).toBe(53);
+      expect(r.family).toBe(4);
+    });
+
+    test('accepts 1.1.1.1', async () => {
+      const r = await validateUpstream('1.1.1.1:443');
+      expect(r.ok).toBe(true);
+      expect(r.port).toBe(443);
+    });
+  });
+
+  describe('hostname resolve', () => {
+    test('accepts hostname that resolves to public IP', async () => {
+      restoreDns = mockDnsLookup({ 'public.example.com': '8.8.8.8' });
+      const r = await validateUpstream('public.example.com:443');
+      expect(r.ok).toBe(true);
+      expect(r.resolvedIp).toBe('8.8.8.8');
+      expect(r.family).toBe(4);
+    });
+
+    test('rejects hostname that resolves to private IP (DNS rebinding defense)', async () => {
+      restoreDns = mockDnsLookup({ 'evil.example.com': '10.0.0.5' });
+      const r = await validateUpstream('evil.example.com:80');
+      expect(r.ok).toBe(false);
+      expect(r.code).toBe('PRIVATE_IPV4');
+      expect(r.message).toMatch(/evil\.example\.com.*10\.0\.0\.5/);
+    });
+
+    test('rejects hostname that fails to resolve', async () => {
+      // mockDnsLookup default throws ENOTFOUND
+      const r = await validateUpstream('does-not-exist.invalid:80');
+      expect(r.ok).toBe(false);
+      expect(r.code).toMatch(/DNS_/);
+    });
+
+    test('rejects hostname with invalid charset pre-DNS', async () => {
+      const r = await validateUpstream('host with spaces:80');
+      expect(r.ok).toBe(false);
+      expect(r.code).toBe('INVALID_HOST');
+    });
+  });
+
+  describe('SITES_ALLOW_PRIVATE_UPSTREAMS opt-in', () => {
+    test('default rejects private IPs', async () => {
+      const r = await validateUpstream('10.0.0.1:80');
+      expect(r.ok).toBe(false);
+    });
+
+    test('opt-in accepts private literal IP', async () => {
+      process.env.SITES_ALLOW_PRIVATE_UPSTREAMS = 'true';
+      const r = await validateUpstream('10.0.0.1:80');
+      expect(r.ok).toBe(true);
+    });
+
+    test('opt-in accepts private DNS-resolved host', async () => {
+      process.env.SITES_ALLOW_PRIVATE_UPSTREAMS = 'true';
+      restoreDns = mockDnsLookup({ 'internal.example.com': '10.0.0.5' });
+      const r = await validateUpstream('internal.example.com:80');
+      expect(r.ok).toBe(true);
+    });
+
+    test('explicit allowPrivate:false overrides env opt-in (programmatic guard)', async () => {
+      process.env.SITES_ALLOW_PRIVATE_UPSTREAMS = 'true';
+      const r = await validateUpstream('10.0.0.1:80', { allowPrivate: false });
+      expect(r.ok).toBe(false);
+      expect(r.code).toBe('PRIVATE_IPV4');
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// 2. Route integration tests — POST /site
+// ---------------------------------------------------------------------------
+
+describe('DC-074: POST /api/v1/site — SSRF hardening', () => {
+  let restoreDns;
+  let caddyStub;
+
+  beforeEach(() => {
+    delete process.env.SITES_ALLOW_PRIVATE_UPSTREAMS;
+    caddyStub = {
+      read: async () => '# stub caddyfile\n',
+      modify: jest.fn(async () => ({ success: true })),
+      adminUrl: 'http://127.0.0.1:2019',
+      filePath: '/tmp/stub-Caddyfile',
+    };
+  });
+
+  afterEach(() => {
+    if (restoreDns) restoreDns();
+    delete process.env.SITES_ALLOW_PRIVATE_UPSTREAMS;
+  });
+
+  const REGRESSION_CASES = [
+    ['10.0.0.1:80',          'PRIVATE_IPV4'],
+    ['172.16.0.1:80',        'PRIVATE_IPV4'],
+    ['192.168.1.1:80',       'PRIVATE_IPV4'],
+    ['127.0.0.1:80',         'PRIVATE_IPV4'],
+    ['169.254.169.254:80',   'PRIVATE_IPV4'],   // AWS IMDS
+    ['100.64.0.1:80',        'PRIVATE_IPV4'],   // CGNAT
+    ['224.0.0.1:80',         'PRIVATE_IPV4'],   // multicast
+    ['0.0.0.0:80',           'PRIVATE_IPV4'],   // reserved
+    ['[::1]:80',             'PRIVATE_IPV6'],
+    ['[fc00::1]:80',         'PRIVATE_IPV6'],
+  ];
+
+  for (const [upstream, wantCode] of REGRESSION_CASES) {
+    test(`rejects upstream="${upstream}" with code=${wantCode}`, async () => {
+      const { app } = createSitesApp({ caddyStub });
+      const res = await request(app)
+        .post('/api/v1/site')
+        .send({ domain: 'evil.example.com', upstream });
+      expect(res.status).toBe(400);
+      expect(res.body.error).toMatch(/\[DC-074\]/);
+      expect(res.body.error).toMatch(/SITES_ALLOW_PRIVATE_UPSTREAMS/);
+      // caddy.modify() must NOT have been called (gate happens before write)
+      expect(caddyStub.modify).not.toHaveBeenCalled();
+    });
+  }
+
+  test('rejects DNS-resolved private IP (rebinding defense)', async () => {
+    restoreDns = mockDnsLookup({ 'looks-public.example.com': '10.0.0.5' });
+    const { app } = createSitesApp({ caddyStub });
+    const res = await request(app)
+      .post('/api/v1/site')
+      .send({ domain: 'evil.example.com', upstream: 'looks-public.example.com:80' });
+    expect(res.status).toBe(400);
+    expect(res.body.error).toMatch(/10\.0\.0\.5/);
+    expect(caddyStub.modify).not.toHaveBeenCalled();
+  });
+
+  test('accepts public literal IP', async () => {
+    const { app } = createSitesApp({ caddyStub });
+    const res = await request(app)
+      .post('/api/v1/site')
+      .send({ domain: 'new.example.com', upstream: '8.8.8.8:80' });
+    expect(res.status).toBe(200);
+    expect(caddyStub.modify).toHaveBeenCalledTimes(1);
+  });
+
+  test('accepts hostname resolving to public IP', async () => {
+    restoreDns = mockDnsLookup({ 'real.example.com': '8.8.8.8' });
+    const { app } = createSitesApp({ caddyStub });
+    const res = await request(app)
+      .post('/api/v1/site')
+      .send({ domain: 'new.example.com', upstream: 'real.example.com:80' });
+    expect(res.status).toBe(200);
+    expect(caddyStub.modify).toHaveBeenCalledTimes(1);
+  });
+
+  test('SITES_ALLOW_PRIVATE_UPSTREAMS=true opts in for private literal', async () => {
+    process.env.SITES_ALLOW_PRIVATE_UPSTREAMS = 'true';
+    const { app } = createSitesApp({ caddyStub });
+    const res = await request(app)
+      .post('/api/v1/site')
+      .send({ domain: 'lab.example.com', upstream: '10.0.0.1:80' });
+    expect(res.status).toBe(200);
+    expect(caddyStub.modify).toHaveBeenCalledTimes(1);
+  });
+
+  test('SITES_ALLOW_PRIVATE_UPSTREAMS=true opts in for private-resolved hostname', async () => {
+    process.env.SITES_ALLOW_PRIVATE_UPSTREAMS = 'true';
+    restoreDns = mockDnsLookup({ 'internal.lan': '10.0.0.5' });
+    const { app } = createSitesApp({ caddyStub });
+    const res = await request(app)
+      .post('/api/v1/site')
+      .send({ domain: 'lab.example.com', upstream: 'internal.lan:80' });
+    expect(res.status).toBe(200);
+  });
+
+  test('rejects out-of-range port without invoking private-IP check', async () => {
+    const { app } = createSitesApp({ caddyStub });
+    const res = await request(app)
+      .post('/api/v1/site')
+      .send({ domain: 'new.example.com', upstream: '8.8.8.8:99999' });
+    expect(res.status).toBe(400);
+    expect(res.body.error).toMatch(/INVALID_PORT|\[DC-074\]/);
+    expect(caddyStub.modify).not.toHaveBeenCalled();
+  });
+
+  test('rejects upstream with spaces (charset) without invoking private-IP check', async () => {
+    const { app } = createSitesApp({ caddyStub });
+    const res = await request(app)
+      .post('/api/v1/site')
+      .send({ domain: 'new.example.com', upstream: 'not a host:80' });
+    expect(res.status).toBe(400);
+    expect(caddyStub.modify).not.toHaveBeenCalled();
+  });
+});
+
+// ---------------------------------------------------------------------------
+// 3. Route integration tests — POST /site/external
+// ---------------------------------------------------------------------------
+
+describe('DC-074: POST /api/v1/site/external — SSRF hardening', () => {
+  let restoreDns;
+  let caddyStub;
+
+  beforeEach(() => {
+    delete process.env.SITES_ALLOW_PRIVATE_UPSTREAMS;
+    caddyStub = {
+      read: async () => '# stub caddyfile\n',
+      modify: jest.fn(async () => ({ success: true })),
+      adminUrl: 'http://127.0.0.1:2019',
+      filePath: '/tmp/stub-Caddyfile',
+    };
+  });
+
+  afterEach(() => {
+    if (restoreDns) restoreDns();
+    delete process.env.SITES_ALLOW_PRIVATE_UPSTREAMS;
+  });
+
+  const REGRESSION_CASES = [
+    'http://10.0.0.1',
+    'http://192.168.1.1',
+    'http://127.0.0.1',
+    'http://169.254.169.254',     // AWS IMDS via URL form
+    'http://100.64.0.1',          // CGNAT — caught by validateUpstream defense-in-depth, not validateURL
+    'http://0.0.0.0',
+    'http://[::1]',
+    'http://[fc00::1]',
+  ];
+
+  for (const externalUrl of REGRESSION_CASES) {
+    test(`rejects externalUrl="${externalUrl}"`, async () => {
+      const { app } = createSitesApp({ caddyStub });
+      const res = await request(app)
+        .post('/api/v1/site/external')
+        .send({ subdomain: 'ext', externalUrl });
+      // 400 from validateURL OR from validateUpstream — either path closes the gate.
+      expect(res.status).toBe(400);
+      expect(caddyStub.modify).not.toHaveBeenCalled();
+    });
+  }
+
+  test('rejects DNS-resolved private IP', async () => {
+    restoreDns = mockDnsLookup({ 'looks-public.example.com': '10.0.0.5' });
+    const { app } = createSitesApp({ caddyStub });
+    const res = await request(app)
+      .post('/api/v1/site/external')
+      .send({ subdomain: 'ext', externalUrl: 'http://looks-public.example.com' });
+    expect(res.status).toBe(400);
+    expect(res.body.error).toMatch(/\[DC-074\]|Private URLs/);
+    expect(caddyStub.modify).not.toHaveBeenCalled();
+  });
+
+  test('accepts externalUrl with public hostname', async () => {
+    restoreDns = mockDnsLookup({ 'api.example.com': '8.8.8.8' });
+    const { app } = createSitesApp({ caddyStub });
+    const res = await request(app)
+      .post('/api/v1/site/external')
+      .send({ subdomain: 'ext', externalUrl: 'http://api.example.com' });
+    expect(res.status).toBe(200);
+    expect(caddyStub.modify).toHaveBeenCalledTimes(1);
+  });
+
+  test('accepts externalUrl with public literal IP', async () => {
+    const { app } = createSitesApp({ caddyStub });
+    const res = await request(app)
+      .post('/api/v1/site/external')
+      .send({ subdomain: 'ext', externalUrl: 'http://8.8.8.8' });
+    expect(res.status).toBe(200);
+  });
+
+  test('SITES_ALLOW_PRIVATE_UPSTREAMS=true opts in for private externalUrl', async () => {
+    process.env.SITES_ALLOW_PRIVATE_UPSTREAMS = 'true';
+    const { app } = createSitesApp({ caddyStub });
+    const res = await request(app)
+      .post('/api/v1/site/external')
+      .send({ subdomain: 'ext', externalUrl: 'http://10.0.0.5' });
+    expect(res.status).toBe(200);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// 4. Regression — pre-fix payload (the canonical SSRF regression proof)
+// ---------------------------------------------------------------------------
+
+describe('DC-074: regression — pre-fix payloads are now rejected', () => {
+  test('the canonical SSRF payload `10.0.0.1:80` is rejected at the route layer', async () => {
+    const caddyStub = {
+      read: async () => '',
+      modify: jest.fn(async () => ({ success: true })),
+      adminUrl: 'http://127.0.0.1:2019',
+      filePath: '/tmp/stub-Caddyfile',
+    };
+    const { app } = createSitesApp({ caddyStub });
+    const res = await request(app)
+      .post('/api/v1/site')
+      .send({ domain: 'evil.attacker.com', upstream: '10.0.0.1:80' });
+    expect(res.status).toBe(400);
+    // Pre-fix this payload would have been accepted, the regex happily
+    // matches `[a-z0-9.-]+:\d{1,5}` against `10.0.0.1:80`, and a Caddy
+    // site block would have been written that proxied public HTTPS
+    // traffic at `evil.attacker.com` to the internal 10.0.0.1:80.
+    expect(caddyStub.modify).not.toHaveBeenCalled();
+  });
+
+  test('the canonical SSRF payload `http://192.168.1.5` is rejected at the external endpoint', async () => {
+    const caddyStub = {
+      read: async () => '',
+      modify: jest.fn(async () => ({ success: true })),
+      adminUrl: 'http://127.0.0.1:2019',
+      filePath: '/tmp/stub-Caddyfile',
+    };
+    const { app } = createSitesApp({ caddyStub });
+    const res = await request(app)
+      .post('/api/v1/site/external')
+      .send({ subdomain: 'ext', externalUrl: 'http://192.168.1.5' });
+    expect(res.status).toBe(400);
+    expect(caddyStub.modify).not.toHaveBeenCalled();
+  });
+});
+
+// ---------------------------------------------------------------------------
+// 5. Sanity — fleet-validation helper exports still work as before
+// ---------------------------------------------------------------------------
+
+describe('DC-074: fleet-validation helpers still exported and unchanged behavior', () => {
+  test('isPrivateOrReservedIPv4 still detects the same set as before', () => {
+    expect(isPrivateOrReservedIPv4('10.0.0.1').isPrivate).toBe(true);
+    expect(isPrivateOrReservedIPv4('8.8.8.8').isPrivate).toBe(false);
+  });
+
+  test('isPrivateOrReservedIPv6 still detects the same set as before', () => {
+    expect(isPrivateOrReservedIPv6('::1').isPrivate).toBe(true);
+    expect(isPrivateOrReservedIPv6('2001:4860:4860::8888').isPrivate).toBe(false);
+  });
+});
@@ -123,17 +123,106 @@ module.exports = function(ctx) {
    res.send(script);
  }, 'ca-install-script'));

+  // DC-076: per-service cert/key download — TOTP + admin scope required.
+  // Pre-fix this endpoint (a) had a hardcoded `password = 'dashcaddy'` default
+  // for the PFX format — a default credential published in source; (b) was
+  // public-listed in middleware.js PUBLIC_ROUTES (TOTP bypassed when TOTP is
+  // disabled — single ops command or fresh-install setup state), and (c)
+  // accepted ANY TOTP-authenticated scope (read scope was enough to pull
+  // private keys). Fix: require explicit password (no default), require
+  // TOTP/session (dropped from PUBLIC_ROUTES — see middleware.js), and
+  // require `admin` scope at the route layer as defense-in-depth against
+  // future middleware-ordering mistakes.
+  const CA_CERT_DOMAINS_RE = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+$/;
+  // Per-DC-076: PFX password now required, ≥ 8 chars, no `=` (pkcs12
+  // interprets `=` as a base64 padding marker that downstream tooling
+  // can mis-handle; reject it to keep the password copy-paste-safe).
+  const CA_PFX_PASSWORD_RE = /^[A-Za-z0-9!@#%^_+,.~:-]{8,64}$/;
+  const CA_CERT_RATE_LIMIT = { windowMs: 60_000, max: 10 };
+  const caCertRateBuckets = new Map(); // ip -> { count, resetAt }
+  function caCertRateLimit(ip) {
+    const now = Date.now();
+    const b = caCertRateBuckets.get(ip);
+    if (!b || b.resetAt <= now) {
+      caCertRateBuckets.set(ip, { count: 1, resetAt: now + CA_CERT_RATE_LIMIT.windowMs });
+      return { allowed: true, remaining: CA_CERT_RATE_LIMIT.max - 1 };
+    }
+    if (b.count >= CA_CERT_RATE_LIMIT.max) {
+      return { allowed: false, remaining: 0, retryAfterMs: b.resetAt - now };
+    }
+    b.count += 1;
+    return { allowed: true, remaining: CA_CERT_RATE_LIMIT.max - b.count };
+  }
+  function requireCaCertAdminScope(req, res) {
+    // TOTP is enforced by `totpAuthMiddleware` globally. Here we additionally
+    // require the `admin` scope — even a read-scope API key or read-scope
+    // JWT must NOT be able to pull a private key. Auth context is mounted on
+    // `req.auth` by the upstream middlewares.
+    const auth = req.auth || {};
+    const scope = Array.isArray(auth.scope) ? auth.scope : [];
+    if (!scope.includes('admin')) {
+      ctx.errorResponse(res, 403,
+        'Admin scope required to download per-service private keys. Re-authenticate with an admin-scoped credential.',
+        { code: 'DC-076_INSUFFICIENT_SCOPE', requiredScope: 'admin', actualScope: scope });
+      return false;
+    }
+    return true;
+  }
+
  // Generate and download SSL certificate for a service
  router.get('/cert/:domain', ctx.asyncHandler(async (req, res) => {
-    const { domain } = req.params;
-    const { password = 'dashcaddy', format = 'pfx' } = req.query;
+    if (!requireCaCertAdminScope(req, res)) return;

-    if (!/^[a-zA-Z0-9!@#%^_+=,.:-]{1,64}$/.test(password)) {
-      throw new ValidationError('Invalid password. Use only letters, numbers, and basic symbols (max 64 chars).');
+    const { domain } = req.params;
+
+    // DC-076: password is REQUIRED for the pfx format (no `=`) and must
+    // be ≥ 8 chars. Previously `password = 'dashcaddy'` — a hardcoded
+    // default that silently signed every PFX with the same published
+    // password. Other formats (key, pem, crt, fullchain) do not need a
+    // password and ignore the param.
+    const wantsPfx = !req.query.format || req.query.format === 'pfx';
+    let password = req.query.password;
+    if (wantsPfx) {
+      if (typeof password !== 'string' || password === '') {
+        return ctx.errorResponse(res, 400,
+          'PFX format requires an explicit `password` query param (8-64 chars, no `=`). '
+          + 'A published default is unsafe — pick your own.',
+          { code: 'DC-076_PASSWORD_REQUIRED' });
+      }
+      if (!CA_PFX_PASSWORD_RE.test(password)) {
+        return ctx.errorResponse(res, 400,
+          'PFX password must be 8-64 chars from [A-Za-z0-9!@#%^_+,.~:-].',
+          { code: 'DC-076_PASSWORD_INVALID' });
+      }
+    } else {
+      // For non-PFX formats, still reject `=` in the password so a copy-paste
+      // mistake can't accidentally inject a base64 padding token into a path
+      // someone else might log.
+      if (password !== undefined && (typeof password !== 'string' || password.includes('='))) {
+        return ctx.errorResponse(res, 400, 'password (if supplied) must be a string without `=`.',
+          { code: 'DC-076_PASSWORD_INVALID' });
+      }
    }

-    if (!domain || !/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/i.test(domain)) {
-      return ctx.errorResponse(res, 400, `Invalid domain name. Must be a valid hostname (e.g., dns1${ctx.siteConfig.tld})`);
+    // DC-076: per-IP rate limit — each cert request forks an `openssl` process
+    // and writes to disk. An authenticated admin polling the endpoint in a
+    // loop could exhaust CPU/IO. 10 req/min/IP is enough for normal use
+    // (regenerate one cert, check 4 formats, done) and tight enough to stop
+    // a runaway client.
+    const clientIp = req.ip || req.connection?.remoteAddress || 'unknown';
+    const rl = caCertRateLimit(clientIp);
+    if (!rl.allowed) {
+      res.setHeader('Retry-After', Math.ceil(rl.retryAfterMs / 1000));
+      return ctx.errorResponse(res, 429,
+        `Rate limit exceeded for /api/v1/ca/cert/* (${CA_CERT_RATE_LIMIT.max} req/${CA_CERT_RATE_LIMIT.windowMs/1000}s per IP). Retry in ${Math.ceil(rl.retryAfterMs / 1000)}s.`,
+        { code: 'DC-076_RATE_LIMITED', retryAfterMs: rl.retryAfterMs });
+    }
+    res.setHeader('X-RateLimit-Limit', String(CA_CERT_RATE_LIMIT.max));
+    res.setHeader('X-RateLimit-Remaining', String(rl.remaining));
+
+    if (!CA_CERT_DOMAINS_RE.test(domain)) {
+      return ctx.errorResponse(res, 400, `Invalid domain name. Must be a valid hostname (e.g., dns1${ctx.siteConfig.tld})`,
+        { code: 'DC-076_DOMAIN_INVALID' });
    }

    const pkiPath = platformPaths.pkiDir;
@@ -240,8 +329,9 @@ ${safeDomain.includes('.') ? `DNS.2 = *.${safeDomain}` : ''}`;
    }
  }, 'ca-cert'));

-  // List generated certificates
+  // List generated certificates (DC-076: TOTP-gated; previously public-listed)
  router.get('/certs', ctx.asyncHandler(async (req, res) => {
+    if (!requireCaCertAdminScope(req, res)) return;
    const certsDir = platformPaths.generatedCertsDir;

    if (!await exists(certsDir)) {
@@ -4,7 +4,9 @@
 * Exposes:
 *   GET    /api/v1/caddy/upstreams                       — full snapshot
 *   GET    /api/v1/caddy/upstreams/incidents             — open dead-upstream incidents (via healthChecker)
- *   POST   /api/v1/caddy/upstreams/:host/mute            — body { muted: true|false }  (also via query ?muted=true)
+ *   POST   /api/v1/caddy/upstreams/mute                  — body { host, muted: true|false }
+ *   POST   /api/v1/caddy/upstreams/:host/mute            — body { muted: true|false } OR query ?muted=true
+ *   POST   /api/v1/caddy/upstreams/:host/unmute          — clears the mute
 *
 * Auth: same as the rest of /api/v1 — handled by the global middleware
 * (the router is mounted under the auth-gated apiRouter in app.js).
@@ -16,6 +18,48 @@ const express = require('express');
 const { success, errorResponse } = require('../src/utils/responses');
 const { ValidationError } = require('../src/utilities/errors');

+/**
+ * DC-073: shared mute helper — used by all three mute endpoints so the
+ * host-validation logic can't drift.
+ *
+ * Pre-fix, only the bare `/caddy/upstreams/mute` body-style endpoint
+ * rejected unknown hosts (with a "not a known upstream" 400). The
+ * path-style `/:host/mute` and `/:host/unmute` endpoints skipped that
+ * check entirely, so an authenticated operator could POST
+ * `/caddy/upstreams/phantom.test:12345/mute` and the watcher would
+ * silently add `phantom.test:12345` to its muted Set and `_saveState()`
+ * would persist it to disk. The phantom entry then survives container
+ * restarts, pollutes the snapshot view (the muted Set is iterated in
+ * places like the dashboard's "muted upstreams" badge), and would
+ * silently disable any future probe that happened to resolve to the
+ * same string.
+ *
+ * Post-fix, every mute path runs through this helper so:
+ *   (1) host format is well-formed (rejects injection / `:` / `?` / etc.)
+ *   (2) host is in `caddyUpstreamWatcher.upstreams` (the live registry
+ *       populated by `scanSites()` reading every `reverse_proxy` from
+ *       /etc/caddy/sites/*. A phantom host cannot reach setMuted.)
+ *   (3) the muted Set never holds entries the scanner doesn't know.
+ *
+ * @param {Object} watcher caddyUpstreamWatcher instance
+ * @param {string} host raw host string from the request
+ * @param {boolean} wantMuted true to mute, false to unmute
+ * @returns {{host: string, muted: boolean}} the result of setMuted
+ * @throws {ValidationError} on invalid format or unknown host
+ */
+function validateAndMuteHost(watcher, host, wantMuted) {
+  if (typeof host !== 'string' || host.length === 0 || host.length > 253) {
+    throw new ValidationError('host must be a non-empty string up to 253 chars');
+  }
+  if (!/^[a-z0-9._:-]+$/i.test(host)) {
+    throw new ValidationError('host must be a valid host[:port] string');
+  }
+  if (!watcher || !watcher.upstreams || !watcher.upstreams.has(host)) {
+    throw new ValidationError(`host ${host} is not a known upstream (run scan first)`);
+  }
+  return watcher.setMuted(host, wantMuted);
+}
+
 module.exports = function({ asyncHandler, caddyUpstreamWatcher, healthChecker }) {
  const router = express.Router();

@@ -55,62 +99,48 @@ module.exports = function({ asyncHandler, caddyUpstreamWatcher, healthChecker })
    success(res, { incidents: open });
  }, 'caddy-upstreams-incidents'));

-  // POST /caddy/upstreams/mute  body { host, muted }
-  // POST /caddy/upstreams/:host/mute  body { muted: true } OR query ?muted=true
-  // Both shapes supported because the dashboard code is small and either is
-  // ergonomic depending on caller.
-  const handleMute = asyncHandler(async (req, res) => {
-    if (!caddyUpstreamWatcher) {
-      return errorResponse(res, 503, 'Caddy upstream watcher not initialized');
-    }
-    const host = req.params.host || req.body?.host;
-    if (!host || typeof host !== 'string' || !/^[a-z0-9._:-]+$/i.test(host)) {
-      throw new ValidationError('host must be a valid host[:port] string');
-    }
-    // Accept muted as boolean body field OR ?muted=true|false query OR
-    // a { muted: true|false } JSON body. Default to toggling on bare POST
-    // without a muted value (this is the "mute it" path).
-    let muted;
-    if (typeof req.body?.muted === 'boolean') muted = req.body.muted;
-    else if (typeof req.query.muted === 'string') muted = req.query.muted === 'true';
-    else muted = true; // POST with no body = mute
-
-    const result = caddyUpstreamWatcher.setMuted(host, muted);
-    success(res, result);
-  }, 'caddy-upstreams-mute');
-
  // Bare /mute with JSON body {host, muted}. Default mutes when muted is
  // absent or unparseable; require muted === false explicitly to unmute.
+  // DC-073: now routes through validateAndMuteHost so the unknown-host
+  // check applies (was already correct here pre-fix, but path-style
+  // was missing it — see validateAndMuteHost docblock).
  router.post('/caddy/upstreams/mute', asyncHandler(async (req, res) => {
    if (!caddyUpstreamWatcher) {
      return errorResponse(res, 503, 'Caddy upstream watcher not initialized');
    }
    const { host, muted } = req.body || {};
-    if (!host || typeof host !== 'string' || !/^[a-z0-9._:-]+$/i.test(host)) {
-      throw new ValidationError('host must be a valid host[:port] string');
-    }
    // Explicit boolean coercion — string 'false' should NOT mute.
    const wantMuted = muted === undefined ? true : muted === true;
-    if (caddyUpstreamWatcher.upstreams && !caddyUpstreamWatcher.upstreams.has(host)) {
-      throw new ValidationError(`host ${host} is not a known upstream (run scan first)`);
-    }
-    const result = caddyUpstreamWatcher.setMuted(host, wantMuted);
+    const result = validateAndMuteHost(caddyUpstreamWatcher, host, wantMuted);
    success(res, result);
  }, 'caddy-upstreams-mute-bare'));

-  // /:host/mute and /:host/unmute for path-style toggles
-  router.post('/caddy/upstreams/:host/mute', handleMute);
+  // Path-style /:host/mute — body { muted: true|false } OR query ?muted=true|false.
+  // DC-073: now also rejects unknown hosts (was the bug — see docblock).
+  router.post('/caddy/upstreams/:host/mute', asyncHandler(async (req, res) => {
+    if (!caddyUpstreamWatcher) {
+      return errorResponse(res, 503, 'Caddy upstream watcher not initialized');
+    }
+    let wantMuted;
+    if (typeof req.body?.muted === 'boolean') wantMuted = req.body.muted;
+    else if (typeof req.query.muted === 'string') wantMuted = req.query.muted === 'true';
+    else wantMuted = true; // bare POST = mute
+    const result = validateAndMuteHost(caddyUpstreamWatcher, req.params.host, wantMuted);
+    success(res, result);
+  }, 'caddy-upstreams-mute'));
+
+  // DC-073: path-style /:host/unmute now also rejects unknown hosts.
  router.post('/caddy/upstreams/:host/unmute', asyncHandler(async (req, res) => {
    if (!caddyUpstreamWatcher) {
      return errorResponse(res, 503, 'Caddy upstream watcher not initialized');
    }
-    const host = req.params.host;
-    if (!host || !/^[a-z0-9._:-]+$/i.test(host)) {
-      throw new ValidationError('host must be a valid host[:port] string');
-    }
-    const result = caddyUpstreamWatcher.setMuted(host, false);
+    const result = validateAndMuteHost(caddyUpstreamWatcher, req.params.host, false);
    success(res, result);
  }, 'caddy-upstreams-unmute'));

  return router;
-};
+};
+
+// Export the helper for unit tests so the validation surface can be
+// exercised without spinning up a full Express app.
+module.exports.__test = { validateAndMuteHost };
@@ -4,6 +4,50 @@ const url = require('url');

 const docker = new Docker();

+/**
+ * DC-072: WebSocket scope authorization — admin-only by default.
+ *
+ * Container exec is full root-equivalent access inside the target
+ * container. Granting it to a key whose scope is `['read']` violates
+ * least privilege. The validScopes list (`['read','write','admin']`)
+ * is defined in routes/auth/keys.js; exec requires `admin`.
+ *
+ * Defensive: the scope field is coerced via `Array.isArray(...) ? ... : []`
+ * so a malformed payload (string, object, null, undefined) cannot reach
+ * `.includes('admin')` and accidentally grant access. Every malformed
+ * shape falls into the rejection branch with the same 403 envelope.
+ *
+ * Tests should call `__test.assertExecScope(auth)` directly rather
+ * than spinning up a WebSocket server.
+ */
+function assertExecScope(auth) {
+  const scope = Array.isArray(auth && auth.scope) ? auth.scope : [];
+  if (!scope.includes('admin')) {
+    const err = new Error('Container exec requires admin scope');
+    err.code = 'DC-072_INSUFFICIENT_SCOPE';
+    err.statusCode = 403;
+    err.requiredScope = 'admin';
+    err.actualScope = scope;
+    throw err;
+  }
+}
+
+/**
+ * DC-072: Tighten containerId validation.
+ *
+ * Docker container IDs are exactly 64 lowercase hex chars (or 12-char
+ * short form). The pre-fix regex accepted `_`, `-`, `.`, mixed case,
+ * and up to 128 chars — Docker would then 404 the inspect call and
+ * the rejection would surface as a generic 500 in the WS error
+ * envelope. Pre-validate at the upgrade layer so the rejection is
+ * fast and the log line discriminates "malformed" from "unknown".
+ */
+function isValidContainerId(id) {
+  if (typeof id !== 'string') return false;
+  // Full 64-char hex, or 12-char short hex
+  return /^[0-9a-f]{64}$/.test(id) || /^[0-9a-f]{12}$/.test(id);
+}
+
 /**
 * Attach WebSocket server for container exec/shell
 * Route: ws://host/ws/exec/:containerId
@@ -21,8 +65,8 @@ module.exports = function attachExecWS(server, log, authManager) {

    const containerId = decodeURIComponent(match[1]);

-    // Validate container ID format to prevent injection
-    if (!/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$/.test(containerId)) {
+    // DC-072: Tighten containerId charset (64-char / 12-char lowercase hex)
+    if (!isValidContainerId(containerId)) {
      log.warn('exec', 'Invalid container ID in WebSocket path', { containerId });
      socket.write('HTTP/1.1 400 Bad Request\r\n\r\n');
      socket.destroy();
@@ -55,6 +99,35 @@ module.exports = function attachExecWS(server, log, authManager) {
      return;
    }

+    // DC-072: Container exec is root-equivalent — require admin scope.
+    // Pre-fix, a key issued with scope `['read']` (e.g., for monitoring)
+    // would get a full PTY shell inside any running container. The
+    // `auth.scope` was captured at lines 39/46 but never checked.
+    try {
+      assertExecScope(auth);
+    } catch (err) {
+      log.warn('exec', 'Insufficient scope for exec attempt', {
+        containerId,
+        authType: auth.type,
+        authId: auth.type === 'jwt' ? auth.userId : auth.keyId,
+        actualScope: err.actualScope,
+        requiredScope: err.requiredScope,
+        ip: req.socket.remoteAddress,
+      });
+      // 403 with a JSON error envelope over the upgrade socket so the
+      // dashboard can display "admin required" instead of guessing.
+      socket.write('HTTP/1.1 403 Forbidden\r\n');
+      socket.write('Content-Type: application/json\r\n');
+      socket.write('\r\n');
+      socket.end(JSON.stringify({
+        error: err.message,
+        code: err.code,
+        requiredScope: err.requiredScope,
+        actualScope: err.actualScope,
+      }));
+      return;
+    }
+
    // Auth passed — proceed with WebSocket upgrade
    wss.handleUpgrade(req, socket, head, (ws) => {
      handleExec(ws, containerId, log, auth);
@@ -67,6 +140,7 @@ module.exports = function attachExecWS(server, log, authManager) {
 async function handleExec(ws, containerId, log, auth) {
  let execStream = null;
  let execInstance = null;
+  const sessionStart = Date.now();

  try {
    const container = docker.getContainer(containerId);
@@ -78,10 +152,13 @@ async function handleExec(ws, containerId, log, auth) {
      return;
    }

+    // DC-072: Audit-log the exec session start. Pairs with the end-log
+    // below so the operator can correlate who opened which shell.
    log.info('exec', 'Authenticated exec session started', {
      containerId,
      authType: auth.type,
-      authId: auth.type === 'jwt' ? auth.userId : auth.keyId
+      authId: auth.type === 'jwt' ? auth.userId : auth.keyId,
+      containerName: info.Name,
    });

    // Detect available shell
@@ -120,7 +197,28 @@ async function handleExec(ws, containerId, log, auth) {
      }
    });

+    // DC-072: Track whether the end-log has fired so we don't double-log
+    // when both execStream 'end' and ws 'close' fire (Docker stream end
+    // closes the WS, which then fires 'close' too — without the flag
+    // we'd emit the same audit line twice with the same durationMs).
+    let ended = false;
+    const logSessionEnd = (reason) => {
+      if (ended) return;
+      ended = true;
+      log.info('exec', 'Exec session ended', {
+        containerId,
+        authType: auth.type,
+        authId: auth.type === 'jwt' ? auth.userId : auth.keyId,
+        durationMs: Date.now() - sessionStart,
+        reason,
+      });
+    };
+
    execStream.on('end', () => {
+      // DC-072: Audit-log the session end (duration + container) so a
+      // long-running session is observable in the error log. Normal
+      // shutdown path: Docker exec stream closes → log + tell client.
+      logSessionEnd('exec-stream-end');
      if (ws.readyState === ws.OPEN) {
        ws.send(JSON.stringify({ type: 'exit' }));
        ws.close();
@@ -148,6 +246,11 @@ async function handleExec(ws, containerId, log, auth) {
    });

    ws.on('close', () => {
+      // DC-072: Fallback audit-log for abnormal close (browser tab
+      // closed, network drop, container killed mid-session) where the
+      // execStream 'end' event never fires. The ended-flag guard makes
+      // this idempotent with the normal path above.
+      logSessionEnd('ws-close');
      if (execStream) {
        try { execStream.destroy(); } catch (_) {
          // Ignore stream teardown errors on socket close
@@ -172,3 +275,11 @@ async function handleExec(ws, containerId, log, auth) {
    }
  }
 }
+
+// Internal-only export for unit tests. Stripped from the public
+// surface; tests import this via the destructure form
+// `const { __test } = require('./routes/exec')`.
+module.exports.__test = {
+  assertExecScope,
+  isValidContainerId,
+};
@@ -4,6 +4,9 @@ const { CADDY, REGEX, LIMITS } = require('../src/utilities/constants');
 const { ValidationError, ConflictError, NotFoundError } = require('../src/utilities/errors');
 const { validateURL } = require('../src/security/input-validator');
 const { ok, successMessage } = require('../src/utils/responses');
+// DC-074: SSRF defense — reject upstream hosts that resolve to
+// private/reserved ranges before they reach the Caddyfile.
+const { validateUpstream } = require('../src/utilities/fleet-validation');

 /**
 * Sites route factory
@@ -166,8 +169,25 @@ module.exports = function({ asyncHandler, ok, caddy, dns, fetchT, buildDomain, a
    if (!domain || !upstream) throw new ValidationError('Domain and upstream are required');
    if (!REGEX.DOMAIN.test(domain)) throw new ValidationError('[DC-301] Invalid domain format');

-    const upstreamRegex = /^[a-z0-9.-]+:\d{1,5}$/i;
-    if (!upstreamRegex.test(upstream)) throw new ValidationError('Invalid upstream format. Use host:port');
+    // DC-074: SSRF defense — reject upstreams that resolve to private/
+    // reserved ranges BEFORE we write them into the Caddyfile. Without
+    // this, an authenticated dashboard operator can call POST /api/v1/site
+    // with `upstream: '10.0.0.1:80'` and end up with a Caddy site block
+    // that proxies public traffic to an internal host. Caddy runs on
+    // DNS2 (same network as the targets), so the SSRF lands.
+    //
+    // The existing upstreamRegex /^[a-z0-9.-]+:\d{1,5}$/i only checks
+    // charset — it happily accepts 192.168.1.1:80 and 169.254.169.254:80
+    // (the AWS metadata IP). validateUpstream() also does a DNS lookup
+    // for hostnames so a malicious operator can't sneak a public-looking
+    // domain past the gate and have it resolve to a private IP later.
+    const upstreamCheck = await validateUpstream(upstream);
+    if (!upstreamCheck.ok) {
+      // Don't echo attacker-supplied hostnames in the audit log; keep the
+      // canonical code + message but never write the raw value.
+      log?.warn?.('site', 'POST /site rejected by SSRF gate', { code: upstreamCheck.code });
+      throw new ValidationError(`[DC-074] ${upstreamCheck.message} (set SITES_ALLOW_PRIVATE_UPSTREAMS=true to opt in)`);
+    }

    const content = await caddy.read();
    const escapedDomain = domain.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
@@ -199,12 +219,40 @@ module.exports = function({ asyncHandler, ok, caddy, dns, fetchT, buildDomain, a
      throw new ValidationError('[DC-301] Invalid subdomain format');
    }

+    // DC-074: SSRF defense — validate the URL syntax via validateURL() (catches
+    // non-http(s) schemes, malformed URLs) AND validateUpstream() (catches
+    // every private/reserved range including CGNAT, multicast, TEST-NET
+    // ranges that validateURL's isPrivateIP() regex misses).
+    //
+    // We intentionally do NOT pass `blockPrivate: true` to validateURL()
+    // here — that's handled by validateUpstream() below, which honors the
+    // SITES_ALLOW_PRIVATE_UPSTREAMS opt-in. validateURL's blockPrivate path
+    // is a hard reject with no escape hatch, which would force operators
+    // who intentionally proxy to a private target to remove validation
+    // entirely.
    try {
      validateURL(externalUrl);
    } catch (validationErr) {
      throw new ValidationError(validationErr.message);
    }

+    // DC-074: validateUpstream() does the same rigorous private-IP check
+    // fleet-validation shipped for DC-068, with full CGNAT / multicast /
+    // broadcast / 0.0.0.0 / TEST-NET / benchmark range coverage and a DNS
+    // resolution step for hostnames (rebinding defense).
+    let parsedExternalUrl;
+    try {
+      parsedExternalUrl = new URL(externalUrl);
+    } catch (_) {
+      // validateURL() above already gates URL syntax — unreachable.
+      throw new ValidationError('Invalid external URL');
+    }
+    const externalCheck = await validateUpstream(`${parsedExternalUrl.hostname}:${parsedExternalUrl.port || (parsedExternalUrl.protocol === 'https:' ? '443' : '80')}`);
+    if (!externalCheck.ok) {
+      log?.warn?.('site', 'POST /site/external rejected by SSRF gate', { code: externalCheck.code });
+      throw new ValidationError(`[DC-074] ${externalCheck.message} (set SITES_ALLOW_PRIVATE_UPSTREAMS=true to opt in)`);
+    }
+
    const domain = buildDomain(subdomain);
    let dnsWarning = null;

@@ -415,10 +415,91 @@ function validateFleetHost(input) {
  };
 }

+/**
+ * Validate a `host:port` upstream string for use in Caddy's `reverse_proxy`.
+ *
+ * DC-074 SSRF hardening: an authenticated dashboard operator can call
+ * POST /api/v1/site with `upstream: '10.0.0.1:80'` and end up with a
+ * Caddyfile entry that proxies public traffic (https://attacker.example.com)
+ * to an INTERNAL host (10.0.0.1:80). Caddy runs on DNS2 — same network
+ * as the targets — so the proxy lands the request on the private host.
+ * The operator doesn't even need DNS-rebinding tricks: a literal IPv4
+ * like 192.168.1.1 is accepted by the existing `[a-z0-9.-]+:\d{1,5}`
+ * upstream regex.
+ *
+ * Reuses `resolveAndCheckAddress()` to:
+ *   - reject literal private IPv4 / IPv6
+ *   - resolve DNS names and reject any private-IP answer
+ *     (rebinding defense — the actual address Caddy connects to is
+ *     the resolved IP at registration time; Caddy itself resolves
+ *     the name per-request, so a malicious operator could flip the
+ *     A record between registration and connection. Acceptable
+ *     residual risk — the registration check is the main gate.)
+ *   - cap port to 1..65535 (defense vs. `host:99999999` integer
+ *     overflow / Caddy parser-bomb)
+ *
+ * Opt-in via SITES_ALLOW_PRIVATE_UPSTREAMS=true for operators who
+ * intentionally proxy to private targets (faster than a public DNS
+ * round-trip + central control plane).
+ *
+ * @param {string} upstream - "host:port" string (e.g. "10.0.0.1:80")
+ * @param {object} [opts]
+ * @param {boolean} [opts.allowPrivate] - override the env-var default
+ * @returns {Promise<{ok: true, host: string, port: number, resolvedIp?: string, family?: number} | {ok: false, code: string, message: string}>}
+ */
+async function validateUpstream(upstream, opts = {}) {
+  if (typeof upstream !== 'string' || upstream.length === 0) {
+    return { ok: false, code: 'INVALID_UPSTREAM', message: 'upstream is required' };
+  }
+
+  // Split on the LAST colon so IPv6 literals like `[::1]:80` parse
+  // correctly (and a malformed `[::1]` without port is rejected with
+  // a clean code, not a confusing TypeError from Number()).
+  const lastColon = upstream.lastIndexOf(':');
+  if (lastColon < 0) {
+    return { ok: false, code: 'INVALID_UPSTREAM', message: 'upstream must be host:port' };
+  }
+  const host = upstream.slice(0, lastColon);
+  const portStr = upstream.slice(lastColon + 1);
+
+  const portNum = Number(portStr);
+  if (!Number.isInteger(portNum) || portNum < 1 || portNum > 65535) {
+    return { ok: false, code: 'INVALID_PORT', message: 'upstream port must be an integer 1..65535' };
+  }
+
+  // Allow-list the host charset BEFORE the DNS lookup so attacker
+  // payloads can't make the resolver do work. Matches the fleet
+  // isValidHostnameSyntax check; sites.js's own `[a-z0-9.-]+` regex
+  // is more restrictive (only letters/digits/dots/hyphens) so
+  // we widen here to also accept bracketed IPv6. Anything else gets
+  // rejected pre-DNS.
+  const isBracketedIPv6 = host.startsWith('[') && host.endsWith(']');
+  const hostToCheck = isBracketedIPv6 ? host.slice(1, -1) : host;
+  if (!isValidHostnameSyntax(hostToCheck) && require('net').isIP(hostToCheck) === 0) {
+    return { ok: false, code: 'INVALID_HOST', message: `upstream host "${host}" is not a valid DNS name or IP address` };
+  }
+
+  const allowPrivate = typeof opts.allowPrivate === 'boolean'
+    ? opts.allowPrivate
+    : process.env.SITES_ALLOW_PRIVATE_UPSTREAMS === 'true';
+
+  const r = await resolveAndCheckAddress(hostToCheck, { allowPrivate });
+  if (!r.ok) return r; // bubbles up PRIVATE_IPV4 / PRIVATE_IPV6 / INVALID_HOSTNAME / DNS_*
+
+  return {
+    ok: true,
+    host,
+    port: portNum,
+    resolvedIp: r.ip,
+    family: r.family,
+  };
+}
+
 module.exports = {
  validateFleetHost,
  resolveAndCheckAddress,
  isPrivateOrReservedIPv4,
  isPrivateOrReservedIPv6,
  isValidHostnameSyntax,
+  validateUpstream,
 };
@@ -426,8 +426,21 @@ module.exports = function configureMiddleware(app, {
    { path: '/api/v1/ca/root.crt',       exact: true,  method: 'GET' },
    { path: '/api/v1/ca/install-script', exact: true,  method: 'GET' },
    { path: '/api/v1/health/ca',         exact: true,  method: 'GET' },
-    { path: '/api/v1/ca/cert/',          prefix: true, method: 'GET' },
-    { path: '/api/v1/ca/certs',          exact: true,  method: 'GET' },
+    // DC-076: /api/v1/ca/cert/<domain> and /api/v1/ca/certs MUST stay gated
+    // by TOTP/session. The /cert/<domain> endpoint returns the private key
+    // (format=key and format=pem both embed `server.key`; format=pfx wraps
+    // the same key in a PKCS#12 envelope). If an operator disables TOTP at
+    // any point in the future (ops command, fresh install with TOTP off
+    // during setup, .disabled-* rename of totp-config.json), an unauthenticated
+    // attacker reaching `https://ca.sami/api/ca/cert/<any-domain>?format=key`
+    // would receive the per-service RSA private key for every service whose
+    // cert Caddy has ever signed — that's a per-service key disclosure, not
+    // just a CA fingerprint leak. The `/api/v1/ca/info`, `/root.crt`, and
+    // `/install-script` paths above stay public (the root CA cert is public
+    // by design — devices need it to trust *.sami TLS); only the per-service
+    // private key and per-service cert list go behind auth. See DC-076 for
+    // the corresponding rate-limit + admin-scope + password-required
+    // hardening in routes/ca.js.
    { path: '/api/v1/csrf-token',        exact: true,  method: 'GET' },
    { path: '/api/v1/logo',              exact: true,  method: 'GET' },
    { path: '/api/v1/favicon',           exact: true,  method: 'GET' },
Author	SHA1	Message	Date
DashCaddy Polish Loop	2fef1c47e5	fix(ca): gate per-service cert/key download behind TOTP+admin scope; require explicit PFX password; add rate limit (DC-076) [glm-grade=A] CI / Test & Lint (push) Canceled after 0s Details CI / Security audit (push) Canceled after 0s Details	2026-08-18 16:40:28 -07:00
DashCaddy Polish Loop	e8c5a7a1fb	Merge dc/DC-074-sites-ssrf: DC-074 sites SSRF hardening [glm-grade=A] CI / Test & Lint (push) Canceled after 0s Details CI / Security audit (push) Canceled after 0s Details	2026-08-18 15:31:14 -07:00
DashCaddy Polish Loop	270e8d57e3	fix(sites): SSRF hardening — validate upstream + externalUrl reject private/reserved hosts (DC-074) [glm-grade=A] Pre-fix, an authenticated dashboard operator could call: POST /api/v1/site {domain:"evil.example.com", upstream:"10.0.0.1:80"} POST /api/v1/site/external {subdomain:"x", externalUrl:"http://192.168.1.5"} and end up with a Caddy site block that proxies PUBLIC traffic at evil.example.com to an INTERNAL host. Caddy runs on DNS2 (same network as the targets), so the SSRF lands. The pre-fix /site upstream regex /^[a-z0-9.-]+:\d{1,5}$/i only checked charset — it happily accepted 192.168.1.1:80 and 169.254.169.254:80 (AWS metadata IP). /site/external called validateURL() without blockPrivate:true, leaving the door wide open. (1) New helper validateUpstream() in fleet-validation.js — reuses resolveAndCheckAddress() (DC-068 SSRF work) to reject literal private IPv4/IPv6 (loopback / RFC1918 / link-local / CGNAT / multicast / broadcast / 0.0.0.0 / TEST-NET / benchmark ranges), resolve hostnames and reject private answers (rebinding defense), and cap port to 1..65535. Opt-in via SITES_ALLOW_PRIVATE_UPSTREAMS=true. (2) /site calls validateUpstream() BEFORE caddy.modify() — gate happens before any state mutation. Throws ValidationError with canonical [DC-074] tag and a redacted hostname audit log entry. (3) /site/external calls validateURL() (syntax only) + validateUpstream() (private-IP gate). validateURL's blockPrivate is intentionally NOT passed because it has no opt-in — that's what validateUpstream is for. (4) Tests (__tests__/routes/sites-dc074.routes.test.js, NEW, 60/60 passing): helper unit tests (format, literal IPv4/IPv6 private reject, public IP accept, hostname resolve + rebinding defense, env opt-in override), POST /site integration (10 regression payloads + public accept + opt-in + port range + charset), POST /site/external integration (8 regression payloads + public accept + DNS rebinding defense + opt-in), canonical SSRF regression proof (RFC 1918 literal IPv4 in upstream + RFC 1918 literal IPv4 in URL host), unchanged-behavior checks on isPrivateOrReservedIPv4/IPv6. Full repo suite: 2402/2402 tests in 102 suites (zero regressions). GLM-5.3 stand-in judge round 1 (deleg_384b9f53, 41.46s, 3 tool calls, MiniMax-M3 per Sami authorization 2026-08-17): A ship-first. Refs: codex-as-judge SKILL.md 'Stand-in fallback chain'. Verdict record: /root/dashcaddy-polish/.ump-verdicts/2026-08-18T22-35-00Z-dc-074-round-1-A.json	2026-08-18 15:31:07 -07:00
DashCaddy Polish Loop	7db152499c	Merge dc/DC-073-caddy-upstreams-host-validation: DC-073 phantom-mute hardening [glm-grade=A] CI / Test & Lint (push) Canceled after 0s Details CI / Security audit (push) Canceled after 0s Details	2026-08-18 15:10:40 -07:00
DashCaddy Polish Loop	a9bb4a1835	fix(caddy-upstreams): validate host is known upstream on all 3 mute endpoints (DC-073) [glm-grade=A] Bug class: silent state corruption via path-style endpoint inconsistency. Pre-fix, only POST /caddy/upstreams/mute (bare body-style) rejected unknown hosts with a 400. The path-style POST /caddy/upstreams/:host/mute and POST /caddy/upstreams/:host/unmute endpoints skipped that check entirely. An authenticated operator could POST /caddy/upstreams/phantom.test:12345/mute and caddyUpstreamWatcher.setMuted() would silently add the phantom host to its muted Set and _saveState() would persist it to disk. The phantom entry survives container restarts and pollutes the snapshot view. Fix: consolidate validation in a single validateAndMuteHost() helper used by all three mute endpoints. The helper enforces (1) host format charset, (2) length cap, (3) membership in caddyUpstreamWatcher.upstreams (the live registry populated by scanSites()). No phantom host can reach setMuted. Tests: 15 new regression tests in __tests__/routes/caddy-upstreams-dc073.routes.test.js — exercises the helper directly (unit) and via each endpoint (integration), asserts rejection happens BEFORE setMuted is called (no state corruption), and the existing 3 caddy-upstreams.routes.test.js cases still pass. Router introspection test asserts no duplicate route registrations. Full suite: 2342/2342 tests / 101 suites.	2026-08-18 15:10:36 -07:00
DashCaddy Polish Loop	b64f23301b	Merge dc/DC-072-exec-scope: DC-072 exec scope + containerId hardening (glm-grade=A) CI / Test & Lint (push) Canceled after 0s Details CI / Security audit (push) Canceled after 0s Details	2026-08-18 14:54:06 -07:00
DashCaddy Polish Loop	83d7c65bf2	fix(exec): scope-based authorization + tighten containerId charset (DC-072) [glm-grade=A] Pre-fix, dashcaddy-api/routes/exec.js (the ws://host/ws/exec/:containerId WebSocket container terminal endpoint) captured auth.scope at lines 39/46 but never enforced it — any API key or JWT, regardless of scope, got a full PTY-backed shell inside the running container. A key issued with scope ['read'] (a legitimate monitoring/observability scope) could escalate to a root-equivalent shell. Container exec is full root inside the container's user namespace, so this was a privilege-escalation across the auth trust boundary. Fix: 1. assertExecScope(auth) requires scope.includes('admin'); throws a tagged 403 error (DC-072_INSUFFICIENT_SCOPE) on rejection with requiredScope + actualScope in the envelope. 2. Called BEFORE wss.handleUpgrade so the WS gate cannot be bypassed. 3. 403 over the upgrade socket is JSON (code, requiredScope, actualScope) so the dashboard can show operator-actionable messages. 4. isValidContainerId(id) tightened to Docker's actual charset (12 or 64 lowercase hex). Pre-fix regex accepted _, -, ., mixed case, and any length up to 128; Docker would 404 the inspect and the rejection surfaced as a generic 500. 5. Audit-log pair: session start (container name + auth id) and session end with durationMs + reason ('exec-stream-end' vs 'ws-close' for abnormal disconnects); idempotent via ended-flag guard. 6. Both helpers exported via __test for unit tests (no live WS). Tests: 20 new tests in __tests__/routes/exec.routes.test.js cover: - assertExecScope: admin passes; read/write/empty/undefined/null/non-array rejected with the canonical 403 envelope. - isValidContainerId: 12/64 lowercase hex accepted; uppercase / mixed / non-hex / _.- / wrong length / null / non-string / padded / CRLF payload rejected. Full suite: 2327/2327 tests passing across 100 suites (zero regressions). GLM-5.3 round 1: A with 2 LOW polish (scope-coercion defensive comment + abnormal-close audit-log fallback). Both folded into the same commit. Round 2: A. Ship.	2026-08-18 14:53:57 -07:00
Hermes	1462024944	Merge feature/dc-064-discover-adopt-fetcht: DC-070 caddycode config sanitization [glm-grade=A] CI / Test & Lint (push) Canceled after 0s Details CI / Security audit (push) Canceled after 0s Details	2026-08-18 14:17:34 -07:00