chore: merge dev to main #19

2026-05-23T01:10:38Z

jmiller commented

2026-05-23 01:10:38 +00:00

Merge all dev changes to main.

jmiller added 13 commits 2026-05-23 01:10:39 +00:00

fix: new Grafana SA token with datasource:create + visible heartbeat errors 2e4fdcb07e

- New service account token with correct RBAC permissions
- script.php postflight now shows success/failure messages to admin
- Logs all heartbeat attempts with HTTP code and cURL errors

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

chore(version): bump to 02.01.36 [skip ci] 307dc37d47

chore: update development channel 02.01.36 [skip ci] 42d530bfbf

refactor: replace Grafana API with heartbeat receiver provisioning b22842f302

Remove all Grafana API code (630 lines), obfuscated tokens, SA tokens,
ensureGrafanaPlugin, provisionGrafanaDatasource, buildDashboardModel.

Replace with simple HTTP POST to heartbeat receiver on bench server.
Receiver writes Grafana provisioning YAML and restarts Grafana container.
No API tokens or RBAC permissions needed.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

chore(version): bump to 02.01.37 [skip ci] c97432495b

chore: update development channel 02.01.37 [skip ci] 5020b58da1

security: make plugin hard to disable + block uninstall b17b36e02e

- enforceLocked() runs every page load — re-enables, re-locks, re-protects
  if someone tampers with the database flags
- preflight() blocks uninstall attempts with error message
- Logs tampering attempts to mokowaas log category

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

chore(version): bump to 02.01.38 [skip ci] d3281066dc

chore: update development channel 02.01.38 [skip ci] aec849c9ae

security: restrict plugin settings to master user + rename Gitea to MokoGitea 48cb040505

- Non-master users blocked from editing MokoWaaS plugin config
- isOurPlugin() helper checks extension_id against our plugin
- Blocks both edit view and save task for non-master users
- Renamed bare 'Gitea' references to 'MokoGitea' in docs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

security: hide MokoWaaS from plugin list for non-master users ea66ad4b4a

Injects JS on com_plugins that removes the MokoWaaS row from the
plugin table. Combined with the edit/save block, non-master users
cannot see, edit, or save the plugin settings.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

chore(version): bump to 02.01.39 [skip ci] 142ee2387e

chore: update development channel 02.01.39 [skip ci]

Universal: Build & Release / Build & Release Pipeline (pull_request) Failing after 25s

Details

8edced75d3

jmiller merged commit a45a6cb59c into main

2026-05-23 01:10:42 +00:00

jmiller referenced this issue from a commit

2026-05-23 01:12:48 +00:00

Revert "Merge pull request 'chore: merge dev to main' (#19) from dev into main"

Sign in to join this conversation.