fix: security hardening of tokens, invites, secrets, egress and sign-in (batch 2026-10-16)

[fclairamb]

Implements the 15 specs from the 2026-10-11 → 2026-10-16 security scans, plus 3 earlier specs (OVH SMS receipts, worker env vars, LDAP docs). Each spec was implemented, audited against its text, then archived in specs/done/2026/10/.

Security fixes

• Critical: sign-in tokens are now signed with keys specific to their purpose, so the passkey login session and the 2FA temp token are no longer accepted as access tokens.
• Critical: accepting an invitation for an existing account now requires being signed in as that account (401 INVITE_LOGIN_REQUIRED, 403 INVITE_EMAIL_MISMATCH).
• Critical: Kubernetes connections refuse exec / auth-provider kubeconfigs and file references. inCluster is gated by SP_K8S_ALLOW_IN_CLUSTER.
• Critical: ${env:} references only resolve names listed in SP_CHECK_ENV_ALLOWLIST. The list is empty by default and is enforced both when a check is saved and when it runs.
• Critical: the MySQL check builds its connection from a struct, with AllowAllFiles=false, and its dial goes through the egress guard.
• High: Microsoft sign-in no longer links or creates an account from an unverified email ("nOAuth"). On a multi-tenant app, the email is trusted only when the ID token carries xms_edov.
• High: status-page subscriber webhooks and publication webhooks now go through the egress guard.
• High: updating or deleting a status-page component is scoped to its section, so another org's components can no longer be changed.
• High: a JS docker sub-check now obeys the SaaS docker gate and the egress guard.
• High: LAN, container and Kubernetes discovery now follow the egress policy. Refused types are hidden.
• High: Slack inbound endpoints refuse every request when no signing secret is set, response_url must be on hooks.slack.com, and request bodies are capped at 1 MiB.
• High: MCP OAuth tokens and scoped PATs are refused on REST, the realtime WS and the OAuth consent screen.
• Low: the TOTP code is now asked on every SSO / OAuth sign-in.
• Low: the 2FA, password-reset and change-password attempt counters are atomic.
• Low: a revoked or expired PAT is evicted from the cache on every replica.

Breaking changes and operator actions

• Every stored ${env:NAME} stops resolving until the name is listed in SP_CHECK_ENV_ALLOWLIST, on the server and on each private agent.
• An HTTP-mode Slack install needs SP_SLACK_SIGNING_SECRET. Socket Mode does not.
• A multi-tenant Microsoft app registration must add the email and xms_edov optional ID-token claims. The review query for existing links is in wiki/runbooks/operations-gotchas.md.
• Kubernetes connections that use exec, auth-provider or file references stop working. Using inCluster needs SP_K8S_ALLOW_IN_CLUSTER=true.
• Under an enforcing egress policy (SaaS by default), lan discovery is refused, and so is container discovery on SaaS shared nodes.
• Subscriber webhooks now follow SP_EGRESS_ALLOW_PRIVATE, so self-hosted instances accept private/LAN endpoints.
• MySQL usernames, passwords and database names can no longer contain @ / ( ) ? & :; a reference can be used instead.
• An existing account accepting an invite must sign in first. A TOTP user signing in through SSO gets the code prompt, and the server and dashboard must ship together for that.
• MCP OAuth tokens and scoped PATs get 401 on REST.
• SP_SERVER_CHECK_WORKER_NB and SP_SERVER_JOB_WORKER_NB now take effect.

Batch gate

• make build-backend lint-back test: 251/0/0 packages, 0 lint issues
• make test-postgres: 251/0/0 packages
• dash0 typecheck:e2e and lint:e2e: pass
• Full Playwright run: 939 passed, 1 failed, 15 skipped. The failure, in discovery.spec.ts, was a test expectation made stale by the discovery fallback, and it is fixed in e7ce071. Only discovery.spec.ts was re-run (30/0/0), not the full suite.

Follow-ups are filed in specs/backlog/2026-10-16-16 to -21.

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 92.13603% with 74 lines in your changes missing coverage. Please review.
✅ Project coverage is 83.23%. Comparing base (247e388) to head (d16e1b1).

Files with missing lines	Patch %	Lines
server/internal/db/postgres/postgres.go	85.71%	9 Missing ⚠️
server/internal/app/ovh_dlr_callback.go	77.14%	8 Missing ⚠️
server/internal/db/sqlite/sqlite.go	86.66%	8 Missing ⚠️
server/internal/handlers/statuspages/service.go	72.00%	7 Missing ⚠️
server/internal/handlers/auth/pat_cache.go	90.74%	5 Missing ⚠️
server/internal/handlers/checks/handler.go	16.66%	5 Missing ⚠️
server/internal/db/models/counter.go	50.00%	4 Missing ⚠️
server/internal/handlers/auth/jwt_keys.go	81.81%	4 Missing ⚠️
server/internal/handlers/auth/join_policy.go	94.11%	3 Missing ⚠️
server/internal/app/server.go	87.50%	2 Missing ⚠️
... and 15 more

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #572      +/-   ##
==========================================
+ Coverage   83.07%   83.23%   +0.15%     
==========================================
  Files        1200     1207       +7     
  Lines      123542   124137     +595     
==========================================
+ Hits       102632   103324     +692     
+ Misses      20902    20804      -98     
- Partials        8        9       +1     

Files with missing lines	Coverage Δ
server/internal/app/aichecks.go	80.95% <100.00%> (+0.95%)	⬆️
server/internal/authhandoff/authhandoff.go	82.02% <100.00%> (+1.53%)	⬆️
server/internal/checkers/checkmysql/checker.go	53.39% <100.00%> (+6.08%)	⬆️
...rver/internal/checkers/checkmysql/config/config.go	73.23% <100.00%> (+1.81%)	⬆️
server/internal/checkers/checkmysql/liblog.go	66.66% <ø> (ø)
server/internal/checkworker/backend/ws_tunnel.go	78.00% <100.00%> (ø)
server/internal/checkworker/worker.go	90.46% <100.00%> (-0.19%)	⬇️
server/internal/config/config.go	93.54% <100.00%> (+0.20%)	⬆️
server/internal/config/discord_oauth.go	100.00% <ø> (ø)
server/internal/config/envvars.go	100.00% <100.00%> (ø)
... and 86 more

... and 14 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.