fix(gateway)!: replace token cookies with revocable sessions and harden abuse controls (#40)

- Replace user:token cookies with opaque server-side sessions, revocable on logout, delete, recreate and expiry; bind every credential to the path user and add cross-user regression tests.
- Rate-limit /users and /login, add optional signup invite codes and form same-origin checks, and unify login failures to 401.
- Require explicit ALLOW_INSECURE_COOKIES for plain HTTP, use __Host-dsh_gw_session when secure, and fix secure cookie deletion.
- Strip client-supplied forwarding/SSO headers, add an optional upstream allowlist, per-user in-flight and WebSocket message caps, credential-free handshake errors, and sweep-time state pruning.
- Digest-pin base images, hash-pin gateway dependencies, verify DSH_COMMIT in the build, and run the gateway image as non-root with a pinned Python base.
- Update manifests, production checklist, architecture/security docs and add an SSO preflight script.

BREAKING CHANGE: existing dsh_gw_session=<user>:<token> cookies are invalid; users must sign in again. Unknown users on POST /login now return 401 instead of 404, and the gateway refuses COOKIE_SECURE=false unless ALLOW_INSECURE_COOKIES=1.

Co-authored-by: SREDevOpsAgents <agents@sredevops.org>

.github/workflows/release.yaml

@@ -34,6 +34,7 @@ jobs:
     outputs:
       identity: ${{ steps.meta.outputs.identity }}
       dsh_version: ${{ steps.meta.outputs.dsh_version }}
+      dsh_commit: ${{ steps.meta.outputs.dsh_commit }}
       pnpm_version: ${{ steps.meta.outputs.pnpm_version }}
       release_revision: ${{ steps.meta.outputs.release_revision }}
       ghcr_image: ${{ steps.meta.outputs.ghcr_image }}
@@ -91,13 +92,28 @@ jobs:
             echo "tag '$tag' does not exist in this repository" >&2
             exit 1
           fi
-          if ! git ls-remote --tags --exit-code "$DSH_REPO" "$DSH_VERSION" >/dev/null; then
+          if ! upstream="$(git ls-remote --tags --exit-code "$DSH_REPO" \
+                "refs/tags/$DSH_VERSION^{}" "refs/tags/$DSH_VERSION")"; then
             echo "upstream ref '$DSH_VERSION' not found in $DSH_REPO" >&2
             exit 1
           fi
+          # Never release a ref that no longer resolves to the pinned commit: an
+          # annotated tag has a peeled ^{} line, a lightweight tag only the ref.
+          resolved="$(printf '%s\n' "$upstream" \
+            | awk -v t="refs/tags/$DSH_VERSION^{}" '$2 == t {print $1}' | head -n1)"
+          if [ -z "$resolved" ]; then
+            resolved="$(printf '%s\n' "$upstream" \
+              | awk -v t="refs/tags/$DSH_VERSION" '$2 == t {print $1}' | head -n1)"
+          fi
+          if [ "$resolved" != "$DSH_COMMIT" ]; then
+            echo "upstream $DSH_REPO@$DSH_VERSION resolved to '$resolved'," \
+              "versions.env pins DSH_COMMIT=$DSH_COMMIT" >&2
+            exit 1
+          fi
           {
             echo "identity=$identity"
             echo "dsh_version=$DSH_VERSION"
+            echo "dsh_commit=$DSH_COMMIT"
             echo "pnpm_version=$PNPM_VERSION"
             echo "release_revision=$RELEASE_REVISION"
             echo "ghcr_image=$GHCR_IMAGE"
@@ -139,7 +155,7 @@ jobs:
         run: |
           set -euo pipefail
           python -m pip install --upgrade pip
-          pip install -r requirements.txt -r requirements-dev.txt
+          pip install --require-hashes -r requirements.txt -r requirements-dev.txt
       - name: Lint
         if: needs.meta.outputs.run_tests == 'true'
         run: |
@@ -166,6 +182,7 @@ jobs:
       dockerfile: Dockerfile
       build-args: |
         DSH_VERSION=${{ needs.meta.outputs.dsh_version }}
+        DSH_COMMIT=${{ needs.meta.outputs.dsh_commit }}
         RELEASE_REVISION=${{ needs.meta.outputs.release_revision }}
         PNPM_VERSION=${{ needs.meta.outputs.pnpm_version }}
         VCS_REF=${{ github.sha }}