Merge branch 'main' into fix/sandbox-operations-manager-db

Author: uittenbroekrobbert

operations-manager/python/opi/core/task_handlers_project.py

@@ -102,12 +102,19 @@ async def handle_create_project(payload: dict, progress: Any) -> dict:
         )
 
         project_file_path = f"projects/{project_name}.yaml"
-        commit_message = f"Create project {project_name}"
+        commit_message = (
+            f"Create project {project_name}"
+            if payload.get("is_new_project", False)
+            else f"Update project {project_name}"
+        )
 
         # Project-create flow: refuse if the project file already exists.
         # Without this a tenant could pick another tenant's name and take
-        # over their project on the next reload.
-        if await git_connector_for_project_files.file_exists(project_file_path):
+        # over their project on the next reload. Edit/update flows that
+        # reuse this task type (modal-edit, component delete) MUST set
+        # is_new_project=False so legitimate overwrites still work.
+        is_new_project = payload.get("is_new_project", False)
+        if is_new_project and await git_connector_for_project_files.file_exists(project_file_path):
             error_msg = (
                 f"Project '{project_name}' bestaat al. "
                 f"Kies een andere projectnaam; een bestaand project kan niet "

operations-manager/python/opi/manager/database_manager.py

@@ -147,7 +147,7 @@ async def create_resources_for_deployment(
         progress_manager = self.project_manager.get_progress_manager()
         database_task = None
         if progress_manager:
-            database_task = progress_manager.add_task("Creating database resources")
+            database_task = progress_manager.add_task("Database klaarmaken")
 
         try:
             # Determine if using namespace-specific or shared database

operations-manager/python/opi/server.py

@@ -337,7 +337,19 @@ async def _log_unhandled_exceptions(request, exc):  # type: ignore[no-untyped-de
     app.add_middleware(CSRFMiddleware)
     app.add_middleware(AuthorizationMiddleware)
     app.add_middleware(MaintenanceMiddleware)
-    app.add_middleware(SessionMiddleware, secret_key=settings.SECRET_KEY)
+    # Harden the session cookie. same_site stays "lax" (not "strict") on
+    # purpose: the OIDC login flow returns to /auth/callback via a top-level
+    # cross-site GET redirect from Keycloak, and authlib needs its state cookie
+    # to survive that navigation. "strict" would drop the cookie on the
+    # callback and break login. "lax" still blocks cross-site POST/AJAX, and
+    # CSRFMiddleware (double-submit token + Origin/Referer check) is the real
+    # defense against the same-site sibling-subdomain tenant attacker.
+    app.add_middleware(
+        SessionMiddleware,
+        secret_key=settings.SECRET_KEY,
+        same_site="lax",
+        https_only=not settings.DEBUG,
+    )
     app.add_middleware(
         SecurityHeadersMiddleware,
         keycloak_url=settings.KEYCLOAK_URL,

operations-manager/python/opi/templates/dashboard.html.j2

@@ -40,7 +40,7 @@
             </c-layout-flow>
         </c-alert>
         {% elif health_counts.Healthy > 0 %}
-        <c-alert kind="success" heading="Alle {{ health_counts.Healthy }} project{{ 'en' if health_counts.Healthy != 1 }} {{ 'zijn' if health_counts.Healthy != 1 else 'is' }} gezond" maxWidth="lg" />
+        <c-alert kind="success" heading="{% if health_counts.Healthy == 1 %}Het project is gezond{% else %}Alle {{ health_counts.Healthy }} projecten zijn gezond{% endif %}" maxWidth="lg" />
         {% elif not argocd_available %}
         <c-alert kind="info" heading="Status informatie niet beschikbaar" content="ArgoCD is niet verbonden." maxWidth="lg" />
         {% endif %}

operations-manager/python/opi/templates/invite-register.html.j2

@@ -21,6 +21,7 @@
                     {# Registration Form Card #}
                     <c-card outline="true" padding="lg">
                         <form method="POST" action="/invite/{{ invite_key }}/register" autocomplete="off">
+                            <input type="hidden" name="csrf_token" value="{{ request.state.csrf_token }}">
                             <c-layout-flow gap="lg">
                                 <c-heading type="h1" textContent="{{ display_name }}" />
                                 <c-heading type="h2" textContent="{% if language == 'nl' %}Nieuw Account{% else %}New Account{% endif %}" />

operations-manager/python/opi/templates/tools.html.j2

@@ -151,7 +151,11 @@
 
                 try {
                     const endpoint = operation === 'encrypt' ? '/tools/encrypt' : '/tools/decrypt';
-                    const response = await fetch(endpoint, { method: 'POST', body: formData });
+                    const response = await fetch(endpoint, {
+                        method: 'POST',
+                        body: formData,
+                        headers: { 'X-CSRF-Token': "{{ request.state.csrf_token }}" },
+                    });
                     const data = await response.json();
                     if (data.success) { showSuccess(data.result); }
                     else { showError(data.error || 'Operation failed'); }

operations-manager/python/opi/templates/wizard/modal_wizard_review.html.j2

@@ -96,6 +96,7 @@
             <c-button kind="primary" label="{{ action_label }}"
                       showIcon="before" icon="publicatie"
                       hx-post="/projects/{{ project_name }}/modal-wizard/{{ flow_id }}/confirm{{ _token_qs }}"
+                      hx-headers="{&quot;X-CSRF-Token&quot;: &quot;{{ request.state.csrf_token }}&quot;}"
                       {% if wizard_token %}hx-include="#modal-wizard-confirm-token"{% endif %}
                       hx-target="#edit-section-inner" hx-swap="innerHTML" />
         </div>

operations-manager/python/opi/templates/wizard/modal_wizard_step.html.j2

@@ -49,6 +49,7 @@
     <form id="modal-wizard-form"
           autocomplete="off"
           hx-ext="json-enc"
+          hx-headers='{"X-CSRF-Token": "{{ request.state.csrf_token }}"}'
           hx-post="{{ _step_url_prefix }}{{ section.section_id }}{{ _token_qs }}"
           hx-target="#edit-section-inner"
           hx-swap="innerHTML">

operations-manager/python/opi/templates/wizard/wizard_review.html.j2

@@ -56,6 +56,7 @@
         <c-button kind="primary" label="Project aanmaken"
                   showIcon="before" icon="publicatie"
                   hx-post="/forms/wizard/{{ flow_id }}/submit"
+                  hx-headers="{&quot;X-CSRF-Token&quot;: &quot;{{ request.state.csrf_token }}&quot;}"
                   hx-target="#wizard-step-content"
                   hx-swap="innerHTML" />
     </div>

operations-manager/python/opi/templates/wizard/wizard_step.html.j2

@@ -49,6 +49,7 @@
     <form id="wizard-step-form"
           autocomplete="off"
           hx-ext="json-enc"
+          hx-headers='{"X-CSRF-Token": "{{ request.state.csrf_token }}"}'
           hx-post="/forms/wizard/{{ flow_id }}/step/{{ section.section_id }}"
           hx-target="#wizard-step-content"
           hx-swap="innerHTML">