@askexenow/exe-os 0.9.387 → 0.9.389

package/deploy/compose/.env.askexe-control-plane.example

@@ -18,3 +18,9 @@ MONITOR_SHARE_ALL_SYSTEMS=false
 # --- AskExe central services (not customer-hosted) ---
 # License server, update API, API router, and exe-create are AskExe-owned services.
 # Customer VPSs consume them over HTTPS with EXE_LICENSE_KEY/API_ROUTER_KEY; they do not host them.
+
+# Dedicated token accepted by exe-update's stack-release publication endpoint.
+# Never reuse a registry pull token or customer license key here.
+EXE_REGISTRY_PROXY_PUBLISHER_TOKENS=
+# Public half of the stack-manifest signing key; mounted read-only into exe-update.
+EXE_STACK_PUBLIC_KEY_FILE=/opt/exe-stack/update-signing-public.pem

package/deploy/compose/.env.customer.example

@@ -119,7 +119,7 @@ WIKI_REQUIRE_MANAGED_PERMS=true
 # managed users join THAT workspace instead of creating their own. That is why
 # managed mode cannot be the shipped default: on a fresh stack the workspace
 # does not exist yet, so its id is unknowable at install time. Bootstrap the
-# stack first, then set these and redeploy. The wiki needs only EXE_ORG_ID.
+# stack first, then set these and redeploy. Wiki and ERP also use EXE_ORG_ID.
 EXE_ORG_ID=
 EXE_ORG_WORKSPACE_ID=
 

package/deploy/compose/.env.example

@@ -153,7 +153,7 @@ WIKI_REQUIRE_MANAGED_PERMS=true
 # managed users join THAT workspace instead of creating their own. That is why
 # managed mode cannot be the shipped default: on a fresh stack the workspace
 # does not exist yet, so its id is unknowable at install time. Bootstrap the
-# stack first, then set these and redeploy. The wiki needs only EXE_ORG_ID.
+# stack first, then set these and redeploy. Wiki and ERP also use EXE_ORG_ID.
 EXE_ORG_ID=
 EXE_ORG_WORKSPACE_ID=
 

package/deploy/compose/docker-compose.yml

@@ -1209,6 +1209,12 @@ services:
       EXE_REGISTRY_PROXY_UPSTREAM_USERNAME: "${EXE_REGISTRY_PROXY_UPSTREAM_USERNAME:-}"
       EXE_REGISTRY_PROXY_UPSTREAM_TOKEN: "${EXE_REGISTRY_PROXY_UPSTREAM_TOKEN:-}"
       EXE_REGISTRY_PROXY_PULL_TOKENS: "${EXE_REGISTRY_PROXY_PULL_TOKENS:-}"
+      # AskExe control-plane only. Publication remains disabled when unset;
+      # this must be a dedicated publisher token, never a pull/license token.
+      EXE_REGISTRY_PROXY_PUBLISHER_TOKENS: "${EXE_REGISTRY_PROXY_PUBLISHER_TOKENS:-}"
+      # Resolve the host-configured verifier through a fixed container path.
+      # /dev/null keeps non-publisher installs parseable and fail-closed.
+      EXE_STACK_PUBLIC_KEY_FILE: "/run/exe-stack-public-key.pem"
       EXE_REGISTRY_PROXY_ALLOWED_NAMESPACE: "${EXE_REGISTRY_PROXY_ALLOWED_NAMESPACE:-askexe}"
       # Bug 2b8eaf16: the packaged exe-update needs the billing DB URL to validate
       # license-key pulls against billing.stack_releases (registry-proxy reads
@@ -1216,6 +1222,13 @@ services:
       # service takes NO blanket env_file (bug 67d62490), the URL must be passed
       # explicitly here or license-based pull auth silently degrades to token-only.
       EXE_REGISTRY_PROXY_DATABASE_URL: "${EXE_REGISTRY_PROXY_DATABASE_URL:-${DATABASE_URL:-}}"
+    volumes:
+      - type: bind
+        source: "${EXE_STACK_PUBLIC_KEY_FILE:-/dev/null}"
+        target: /run/exe-stack-public-key.pem
+        read_only: true
+        bind:
+          create_host_path: false
     ports:
       - "127.0.0.1:${EXE_UPDATE_HOST_PORT:-3200}:${EXE_REGISTRY_PROXY_PORT:-3200}"
     networks:
@@ -1452,6 +1465,9 @@ services:
       MONITOR_ERROR_URL: http://exe-monitor-hub:8090/api/exe-monitor/errors
       MONITOR_API_KEY: ${MONITOR_API_KEY:-${EXE_MONITOR_KEY:-}}
       # GoTrue SSO: single sign-on across CRM + Wiki + ERP
+      # ERP reads this at login and writes it to the shared site configuration.
+      # Use the same organization as CRM/Wiki so managed grants are enforced.
+      EXE_ORG_ID: ${EXE_ORG_ID:-}
       GOTRUE_URL: http://gotrue:9999
       # Bug 98a528a7: the PUBLIC auth domain the ERP login page must send users to.
       # Without this env the ERP frontend has no idea of the customer's auth host and

package/deploy/compose/generate-env.ts

@@ -205,7 +205,7 @@ const MANAGED_PERMS_ENV_BLOCK = [
   "# managed users join THAT workspace instead of creating their own. That is why",
   "# managed mode cannot be the shipped default: on a fresh stack the workspace",
   "# does not exist yet, so its id is unknowable at install time. Bootstrap the",
-  "# stack first, then set these and redeploy. The wiki needs only EXE_ORG_ID.",
+  "# stack first, then set these and redeploy. Wiki and ERP also use EXE_ORG_ID.",
   "EXE_ORG_ID=",
   "EXE_ORG_WORKSPACE_ID=",
 ];

package/deploy/compose/sso-edge/sso-redirect.conf

@@ -278,6 +278,17 @@ location = /_sso_gate {
         set $sso_bearer $cookie_exe_sess;
     }
 
+    # Wiki uses a native signed bearer for application permissions. Its
+    # browser edge credential is the real apex session, not that native JWT.
+    # Wiki independently verifies that both credentials bind to the same user;
+    # deploy that binding check before this edge configuration. The main
+    # request's Authorization header remains unchanged. Other products retain
+    # their existing bearer precedence; cookie-less GoTrue API clients do too.
+    set $sso_wiki_session "$sso_product:$cookie_exe_sess";
+    if ($sso_wiki_session ~ "^Wiki:.+") {
+        set $sso_bearer $cookie_exe_sess;
+    }
+
     #    Neither source produced a credential → unauthenticated → login redirect.
     if ($sso_bearer = "") {
         return 401;
@@ -313,9 +324,13 @@ location @sso_gate_deny {
     return 401;
 }
 
-# Login redirect for unauthenticated top-level page loads.
-# $request_uri preserves the path + query the user was trying to reach.
+# Login redirect for unauthenticated top-level page loads. No request-derived
+# path or query is forwarded across origins: legacy product auth routes carried
+# password-reset tokens in both places, and nginx's decoded $uri is unsafe to
+# interpolate into a response Location header. Central authentication returns
+# to the product root; the product can navigate from there after establishing
+# its own server-validated session.
 location @sso_login {
     auth_request off;
-    return 302 "$sso_auth_base/?product=$sso_product&redirect=$sso_app_url$request_uri";
+    return 302 "$sso_auth_base/?product=$sso_product&redirect=$sso_app_url/";
 }