mosaicstack/stack
1
0
Fork 0
Code Issues 42 Pull Requests Actions Packages Projects Releases 15 Wiki Activity

feat(#707): secure Discord service ingress #716

Merged
jason.woltje merged 1 commits from fix/tess-discord-ingress into main 2026-07-12 23:18:30 +00:00
Conversation 1 Commits 1 Files Changed 9 +484 -68
jason.woltje commented 2026-07-12 21:34:26 +00:00
Owner
Copy Link

Refs #707

Task: TESS-M1-SEC-004

Implements authenticated Discord ingress with default-deny allowlists, correlation metadata, and replay protection.

Refs #707 Task: TESS-M1-SEC-004 Implements authenticated Discord ingress with default-deny allowlists, correlation metadata, and replay protection.
jason.woltje added 1 commit 2026-07-12 21:34:27 +00:00
feat(#707): secure Discord service ingress
All checks were successful
ci/woodpecker/push/ci Pipeline was successful
Details
ci/woodpecker/pr/ci Pipeline was successful
Details
2879da1f6a
jason.woltje force-pushed fix/tess-discord-ingress from 2879da1f6a to 55ae77b6fd 2026-07-12 23:01:48 +00:00 Compare
jason.woltje commented 2026-07-12 23:17:25 +00:00
Author
Owner
Copy Link

VERIFIED APPROVE reviewer-of-record [W-jarvis:reviewer] head 55ae77b6fd

Evidence:

  • Exact PR head verified: 55ae77b6fd1c8e6609eb977a4342569a2e0c1c7a.
  • PR CI green: ci/woodpecker/pr/ci pipeline 1706 success.
  • Reviewed Discord ingress hardening: service-token Socket.IO auth, HMAC-signed envelopes, gateway-side guild/channel/user allowlists, service-principal scope, correlation/message metadata, and bounded replay rejection.
  • Plugin startup fails closed when Discord is enabled without service token, service user, or default-deny allowlists.
  • No live secrets in diff; only env names and test-only fixture token strings.
  • git diff --check clean; scope stays within TESS-M1-SEC-004 Discord ingress.
VERIFIED APPROVE reviewer-of-record [W-jarvis:reviewer] head 55ae77b6fd1c8e6609eb977a4342569a2e0c1c7a Evidence: - Exact PR head verified: `55ae77b6fd1c8e6609eb977a4342569a2e0c1c7a`. - PR CI green: `ci/woodpecker/pr/ci` pipeline 1706 success. - Reviewed Discord ingress hardening: service-token Socket.IO auth, HMAC-signed envelopes, gateway-side guild/channel/user allowlists, service-principal scope, correlation/message metadata, and bounded replay rejection. - Plugin startup fails closed when Discord is enabled without service token, service user, or default-deny allowlists. - No live secrets in diff; only env names and test-only fixture token strings. - `git diff --check` clean; scope stays within TESS-M1-SEC-004 Discord ingress.
jason.woltje merged commit 119f64e69d into main 2026-07-12 23:18:30 +00:00
jason.woltje deleted branch fix/tess-discord-ingress 2026-07-12 23:18:31 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
jason.woltje
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#716
Delete Branch "fix/tess-discord-ingress"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?