Add validateAgentURL guard before any DB transaction in POST /workspaces
so that SSRF targets (cloud metadata, RFC-1918, loopback) are rejected
with 400 before the workspace row is written. The guard is placed
before BeginTx so rejection never touches the DB.
Two new tests:
- TestWorkspaceCreate_External_SSRFBlocked: verifies blocked URLs
(169.254.x.x, RFC-1918, loopback, wrong scheme) return 400.
- TestWorkspaceCreate_External_ValidURLAccepted: verifies localhost
passes when SSRF checks are disabled.
Additionally fixes:
- drift_sweeper.go: rename SourceResolver interface → PluginResolver
to avoid redeclaration conflict with source.go's type.
- restart_signals.go: convert rewriteForDocker to a method on
*WorkspaceHandler so tests can override it without package-level
function mutation.
- org_external.go: fix spurious append() call in clone args.
- delegation_test.go: remove pre-existing duplicate closing brace.
- admin_plugin_drift.go: remove unused "context" import.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Molecule AI Core-BE
66e00cb3b7