Diego Rodrigues de Sa e Souza 7a0bb8754d fix(security): refuse non-loopback MITM peers and hard-gate /api/providers/client (#16060) ... Reopened and merged on the owner's call (2026-10-10). Combines with #15886 (already on the tip): keeps its secret stripping for /api/providers/client, adds the hard-gate for that route, and replaces the IPv4-only MITM bind with the dual-stack listener + loopback peer guard (the DNS spoof also maps hosts to ::1). The pinned listen test now asserts the guard is installed before listen(). MITM + authz suites 320/320, eslint clean. Warning: base-red inherited: #15306.		2026-10-10 19:41:38 -03:00
..
classify.test.ts
client-api-policy-fallback.test.ts
client-api-policy.test.ts
credential-export-always-protected.test.ts
csrf.test.ts
discovery-routes-local-only.test.ts
ip-filter-enforcement-6131.test.ts
ip-filter-forwarded-headers.test.ts
management-policy.test.ts
oauth-autoimport-local-only.test.ts
peer-stamp-proxy-hop-headers.test.ts
peer-stamp.test.ts
pipeline.test.ts
probe-9033-repro.test.ts
proxy-contract.test.ts
proxy-matcher-case.test.ts
public-origin.test.ts
public-policy.test.ts
public-route-exact-match.test.ts
route-guard-local-prefix.test.ts
route-guard-providers-spawn-local-only.test.ts
route-guard-skills-collect.test.ts
route-guard-tunnel-processes-local-only.test.ts
route-guard-version-get-exemption.test.ts
route-guard-vnc-session-local-only.test.ts
routeGuard.test.ts
spawn-capable-prefixes-client-safe.test.ts