anti
8d18c59201
Gate all 8 swarm-controller operator routes (enroll, list/get/decommission hosts, deploy, teardown, check, list deckies) with the centralized require_admin RBAC dependency alongside require_operator_cert; mTLS becomes defense-in-depth instead of the only gate. /heartbeat stays cert-fingerprint pinned (worker-facing) and /swarm/health stays open (liveness only). CLI swarm commands now send Authorization: Bearer $DECNET_API_TOKEN with a 401/403 hint covering the must_change_password bootstrap flow. Bump pyjwt to 2.13.0 and pip to 26.1.2 (pip-audit PYSEC-2026-175/177/178/179, PYSEC-2026-196); authz suite re-verified on the new pyjwt. Closes ASVS_L2_AUDIT.md V4.1.1a and V4.1.1b (CRITICAL).
75 lines
1.6 KiB
Plaintext
75 lines
1.6 KiB
Plaintext
.venv/
|
|
.venv*/
|
|
docker-compose.yaml
|
|
.311/
|
|
.3[0-9][0-9]/
|
|
logs/
|
|
.claude/*
|
|
CLAUDE.md
|
|
__pycache__/
|
|
*.pyc
|
|
*.pyo
|
|
*.egg-info/
|
|
dist/
|
|
build/
|
|
decnet-compose.yml
|
|
# Per-topology compose fragments emitted by `decnet topology deploy`.
|
|
decnet-topology-*-compose.yml
|
|
# Docker build context cache.
|
|
.docker/
|
|
decnet-state.json
|
|
*.ini
|
|
decnet.log*
|
|
*.loggy
|
|
*.nmap
|
|
linterfails.log
|
|
webmail
|
|
windows1
|
|
*.db
|
|
*.db-shm
|
|
*.db-wal
|
|
decnet.*.log
|
|
# Rotated copies (logrotate appends .1, .2, .gz...) — the existing
|
|
# decnet.*.log glob doesn't catch the suffix.
|
|
decnet.*.log.*
|
|
decnet.json
|
|
.env*
|
|
.env.local
|
|
.coverage
|
|
.hypothesis/
|
|
profiles/*
|
|
tests/test_decnet.db*
|
|
|
|
# Nested git clone of the wiki — not a submodule, just a local
|
|
# working copy so we can edit docs without a full round-trip.
|
|
wiki-checkout/
|
|
|
|
# Scratch test/debug outputs that leak from saved `pytest > hang.log`
|
|
# or `pytest > schem` redirections.
|
|
hang.log
|
|
schem
|
|
*.pytest.log
|
|
|
|
# pydeps-style dependency graph dumps from local analysis runs.
|
|
deps.txt
|
|
|
|
# Node modules vendored under decnet/canary/ for the obfuscator helper.
|
|
# The package.json is the source of truth; modules are reinstalled at
|
|
# build/deploy time.
|
|
node_modules/
|
|
package-lock.json
|
|
|
|
# TTP rule-precision corpus pulled from prod sqlite. Real attacker
|
|
# payloads — operator-only artifact. The synthetic ``seed_*.jsonl``
|
|
# files alongside ARE committed and exercise the harness in CI.
|
|
tests/ttp/rule_precision/corpus/*.jsonl
|
|
tests/ttp/rule_precision/corpus/seed_*.jsonl
|
|
threatfox-api.json
|
|
|
|
# MITRE ATT&CK STIX bundle — 50 MB, fetched at runtime via attack_stix.py
|
|
enterprise-attack-*.json
|
|
|
|
# pytest failure dump files
|
|
testfail
|
|
.phaseloop/
|