fix: complete medium hardening updates for auth, RBAC, OAuth/SSO, secrets, and admin UI defaults (m-batch-1) (#3129)

* fix: request logging hardening and behavior consistency

Refs: A-04
Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

* fix: token scoping hardening and behavior consistency

Refs: C-06, C-26
Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

* fix: llm chat config hardening and behavior consistency

Refs: C-31
Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

* fix: permission model hardening and behavior consistency

Refs: C-34, L-13
Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

* fix: server team assignment hardening and behavior consistency

Refs: C-36
Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

* fix: import visibility defaults hardening and behavior consistency

Refs: C-37
Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

* fix: llm provider config hardening and behavior consistency

Refs: C-40
Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

* fix: tool header protection hardening and behavior consistency

Refs: C-41
Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

* fix: sso identity checks hardening and behavior consistency

Refs: O-08, O-13
Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

* fix: oauth state handling hardening and behavior consistency

Refs: O-12
Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

* fix: admin ui hardening and behavior consistency

Refs: U-02, U-03, U-04
Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

* docs: rc2 hardening release notes and behavior consistency

Refs: A-04, C-06, C-26, C-31, C-34, C-36, C-37, C-40, C-41, L-13, O-08, O-12, O-13, U-02, U-03, U-04
Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

* lint

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

* fix: harden medium security defaults and UI regression paths

A-04 C-34 L-13 O-12 U-02 U-04

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

* fix: escape pagination query params inside Alpine attributes

U-03

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

* chore: resolve migration and oauth lint warnings

C-34 O-12

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

* fix tests

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

* fix cdn

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

* test: harden playwright admin auth and entity timing stability

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

* test: stabilize localhost admin auth flow in playwright

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

* fix: align admin auth-form csrf token issuance and submission

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

* test: close remaining diff coverage gaps to 100 percent

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

---------

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

Author: crivetimihai

CHANGELOG.md

@@ -212,6 +212,13 @@ This release **tightens production defaults** and adds **defense-in-depth contro
 * **C-20**: Gateway sync endpoints now enforce explicit RBAC and scoped ownership checks with normalized token-team semantics
 * **C-35**: Server usage SSE now validates server existence and fails closed for missing IDs in scoped checks
 * **C-39**: Import flow strips untrusted ownership/team/visibility fields for scoped entities
+* **A-04**: Request logging masking now covers normalized key variants (snake/camel/kebab/case changes) while preserving non-sensitive metadata fields
+* **C-06 / C-26**: Token scoping now applies consistently for cookie and header auth paths, and normalizes `APP_ROOT_PATH` prefixes before route permission matching
+* **C-31 / C-40 / C-41**: LLM chat config, provider config secrets, and sensitive tool headers now use at-rest protection with response-time masking and backward-compatible read handling
+* **C-34 / L-13**: Permission fallback paths now rely on explicit constants and canonical permission mappings across decorators, validation, and role checks, with default non-admin roles receiving explicit `teams.read` and token self-management permissions
+* **C-36 / C-37**: Server team reassignment now validates target-team ownership membership, and import defaults prefer scoped visibility for safer tenant defaults
+* **O-08 / O-12 / O-13**: SSO/OAuth flows now require `email_verified: true` claims for login acceptance (including existing users), enforce trusted-domain policy consistently, and use opaque server-side OAuth state mapping
+* **U-02 / U-03 / U-04**: Admin UI now enforces CSRF tokens/origin checks for state-changing flows, sanitizes dynamic DOM insertions, and uses pinned integrity-checked external assets
 * **Token helpers**: Rich-token generation now distinguishes omitted teams from explicit `teams: null` to preserve intended scope semantics
 * Health diagnostics endpoint now follows standard bearer-token validation.
 * JSON-RPC and REST logging controls now use aligned permission checks.

docker-compose.yml

@@ -360,7 +360,7 @@ services:
       - JSON_SCHEMA_VALIDATION_STRICT=true
       - CORRELATION_ID_ENABLED=false
       - LLMCHAT_ENABLED=true
-      - OBSERVABILITY_ENABLED=false
+      - OBSERVABILITY_ENABLED=true
       # ═══════════════════════════════════════════════════════════════════════════
       # Database Connection Pool Configuration
       # ═══════════════════════════════════════════════════════════════════════════

docs/docs/manage/rbac.md

@@ -63,10 +63,10 @@ Logical groups that:
 | Role | Scope | Permissions |
 |------|-------|-------------|
 | `platform_admin` | global | `["*"]` (all permissions) |
-| `team_admin` | team | admin.dashboard, gateways.read, gateways.create, gateways.update, gateways.delete, servers.read, servers.create, servers.update, servers.delete, teams.read, teams.update, teams.join, teams.delete, teams.manage_members, tools.read, tools.create, tools.update, tools.delete, tools.execute, resources.read, resources.create, resources.update, resources.delete, prompts.read, prompts.create, prompts.update, prompts.delete, a2a.read, a2a.create, a2a.update, a2a.delete, a2a.invoke, llm.read, llm.invoke |
-| `developer` | team | admin.dashboard, gateways.read, gateways.create, gateways.update, gateways.delete, servers.read, servers.create, servers.update, servers.delete, teams.join, tools.read, tools.create, tools.update, tools.delete, tools.execute, resources.read, resources.create, resources.update, resources.delete, prompts.read, prompts.create, prompts.update, prompts.delete, a2a.read, a2a.create, a2a.update, a2a.delete, a2a.invoke, llm.read, llm.invoke |
-| `viewer` | team | admin.dashboard, gateways.read, servers.read, teams.join, tools.read, resources.read, prompts.read, a2a.read, llm.read |
-| `platform_viewer` | global | admin.dashboard, gateways.read, servers.read, teams.join, tools.read, resources.read, prompts.read, a2a.read, llm.read |
+| `team_admin` | team | admin.dashboard, gateways.read, gateways.create, gateways.update, gateways.delete, servers.read, servers.create, servers.update, servers.delete, teams.read, teams.update, teams.join, teams.delete, teams.manage_members, tools.read, tools.create, tools.update, tools.delete, tools.execute, resources.read, resources.create, resources.update, resources.delete, prompts.read, prompts.create, prompts.update, prompts.delete, a2a.read, a2a.create, a2a.update, a2a.delete, a2a.invoke, llm.read, llm.invoke, tokens.create, tokens.read, tokens.update, tokens.revoke |
+| `developer` | team | admin.dashboard, gateways.read, gateways.create, gateways.update, gateways.delete, servers.read, servers.create, servers.update, servers.delete, teams.read, teams.join, tools.read, tools.create, tools.update, tools.delete, tools.execute, resources.read, resources.create, resources.update, resources.delete, prompts.read, prompts.create, prompts.update, prompts.delete, a2a.read, a2a.create, a2a.update, a2a.delete, a2a.invoke, llm.read, llm.invoke, tokens.create, tokens.read, tokens.update, tokens.revoke |
+| `viewer` | team | admin.dashboard, gateways.read, servers.read, teams.read, teams.join, tools.read, resources.read, prompts.read, a2a.read, llm.read, tokens.create, tokens.read, tokens.update, tokens.revoke |
+| `platform_viewer` | global | admin.dashboard, gateways.read, servers.read, teams.read, teams.join, tools.read, resources.read, prompts.read, a2a.read, llm.read, tokens.create, tokens.read, tokens.update, tokens.revoke |
 
 !!! info "Default Role Assignment"
     **New users automatically receive up to two roles upon creation:**
@@ -458,34 +458,24 @@ Permissions are defined in the `Permissions` class and control what actions user
 │ Permission Aggregation      │ ← Collect permissions from roles
 │ - Include inherited perms   │   (role inheritance supported)
 │ - Check for wildcard (*)    │
-└─────────────────────────────┘
-    │
-    ▼
-┌─────────────────────────────┐
-│ Fallback Permission Check   │ ← Implicit permissions (see below)
 └─────────────────────────────┘
     │
     ▼
   GRANT or DENY
 ```
 
-### Fallback Permissions
-
-The system grants implicit permissions without explicit role assignment. These are **not** shown in `/rbac/my/permissions` but are effective:
+### Explicit Team/Token Defaults
 
-| User Context | Implicit Permissions |
-|--------------|---------------------|
-| Any authenticated user | teams.create, teams.read |
-| Team member | teams.read (for their teams) |
-| Team owner | teams.read, teams.update, teams.delete, teams.manage_members |
-| Any authenticated user | tokens.* (for own tokens only) |
+Team and token management behavior is now controlled through explicit role permissions, not implicit fallback checks.
 
-!!! info "Why Fallback Permissions Exist"
-    Fallback permissions enable basic functionality without requiring explicit role assignment:
+| Role | Explicit Baseline Grants |
+|------|--------------------------|
+| `team_admin` | `teams.read`, `tokens.create`, `tokens.read`, `tokens.update`, `tokens.revoke` |
+| `developer` | `teams.read`, `tokens.create`, `tokens.read`, `tokens.update`, `tokens.revoke` |
+| `viewer` | `teams.read`, `tokens.create`, `tokens.read`, `tokens.update`, `tokens.revoke` |
+| `platform_viewer` | `teams.read`, `tokens.create`, `tokens.read`, `tokens.update`, `tokens.revoke` |
 
-    - Users can always create and view teams they belong to
-    - Team owners automatically have management rights
-    - Users can always manage their own API tokens
+Users without role assignments do not receive implicit team/token permissions.
 
 ### Admin API RBAC