fix: exempt /metrics /healthz /readyz from auth; numeric UID in Dockerfile (#148)

* feat(connector): Stripe, Okta, Shopify, Mailchimp, OneDrive, QuickBooks, and RabbitMQ connectors

Adds 17 new connector actions across 7 services:
- stripe/create_charge, stripe/create_customer, stripe/create_refund
- okta/list_users, okta/create_user
- shopify/list_orders, shopify/list_products, shopify/create_order
- mailchimp/list_members, mailchimp/add_member
- onedrive/upload, sharepoint/list_items
- quickbooks/create_invoice, quickbooks/list_invoices
- rabbitmq/publish, rabbitmq/consume

Also adds parseJSONBody shared helper to tools.go and
github.com/rabbitmq/amqp091-go v1.11.0 as the AMQP protocol client.

Closes #94, #108, #109, #111, #112, #114, #115

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(connector): address Codex review comments on OneDrive and RabbitMQ

- OneDrive: remove url.PathEscape on filePath to preserve literal "/"
  separators in Graph API path templates (escaping produced %2F which
  resolved to a file literally named "documents%2Fhello.txt")
- RabbitMQ: ack each message inside the consume loop when auto_ack=false
  so messages are not requeued when the channel closes on return

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(connector): address CodeRabbit review on saas-connector batch

- rabbitmq: validate params before dialing (exchange/routing_key/body for
  publish, queue for consume) so invalid requests fail without a connection
- rabbitmq: use amqp.DialConfig with net.Dialer.DialContext so the dial
  respects context cancellation
- rabbitmq: default auto_ack=false (at-least-once); true opts into at-most-once
- onedrive: add escapePath helper to encode individual path segments without
  escaping "/" separators, so nested folders work with Graph path addressing
- onedrive_test: assert request URL path to catch future slash-escaping regressions
- quickbooks: reject where/order_by values that contain structural keywords
  (maxresults, startposition, orderby) to prevent clause injection
- shopify: extract shopifyAPIURL package-level helper, removing three identical
  apiURL methods
- go.mod: go mod tidy promotes amqp091-go from indirect to direct

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: exempt /metrics, /healthz, /readyz from auth; numeric UID in Dockerfile

- server: register /metrics, /healthz, and /readyz on a top-level mux so
  Kubernetes probes and Prometheus scrapers bypass API key auth entirely.
  All other routes fall through to the auth/rate-limit-wrapped apiMux.
- Dockerfile: create the mantle user with explicit -u 10001 -g 10001 and
  switch to USER 10001:10001 so kubelet can verify runAsNonRoot: true
  without a numeric runAsUser override in the Helm chart.

Closes #139
Closes #137

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(connector): Okta activate param, Mailchimp upsert endpoint

Okta: always pass ?activate=<bool> — omitting it when false causes Okta
to activate the user by default, triggering unintended provisioning side effects.

Mailchimp: switch add_member from POST /members to PUT /members/{hash}
(MD5 of lowercased email). The POST endpoint returns a duplicate-member
error on reruns; the PUT upsert endpoint is idempotent.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(connector): suppress gosec/CodeQL false positives on Mailchimp MD5

The Mailchimp subscriber hash is MD5(lowercase(email)) per Mailchimp's
own API specification — it is a lookup identifier, not a security hash.
Add inline suppression annotations for both gosec G401 and CodeQL
go/weak-sensitive-data-hashing to clarify the non-security intent.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(connector): correct gosec nosec placement for Mailchimp MD5

G501 fires on the import line and G401 on the call site — both need
their own same-line #nosec annotations. The combined //nolint+#nosec
format wasn't parsed correctly by gosec.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(connector): add CodeQL inline suppression for Mailchimp MD5

Add CodeQL[go/weak-sensitive-data-hashing] inline suppression alongside
the gosec #nosec annotation. The earlier attempt used lowercase 'codeql'
which GitHub Code Scanning does not recognize — the exact token is
'CodeQL[rule-id]' (capital C, Q, L).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(connector): CodeQL suppression for Mailchimp MD5 (standalone comment)

Use standalone // CodeQL[go/weak-sensitive-data-hashing] on the
preceding line as GitHub docs specify — no other text on that line.
Also add .github/codeql/codeql-config.yml as a fallback that excludes
the go/weak-sensitive-data-hashing query for the connector package.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(server): move /metrics behind auth to prevent workflow name leakage

Prometheus path labels include workflow names (via metricsMiddleware →
normalizePath). Serving /metrics on the unauthenticated top-level mux
let anyone enumerate workflow identifiers without credentials. Moved
/metrics to apiMux so it goes through the same auth middleware as all
other API routes. Health probes (/healthz, /readyz) remain on the
unauthenticated mux for Kubernetes probe access.

Prometheus scrapers must now supply an API key.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Michael McNees <mmcnees@Michaels-MacBook-Pro.local>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: 3 people

.github/codeql/codeql-config.yml

@@ -0,0 +1,7 @@
+name: "Mantle CodeQL config"
+
+query-filters:
+  - exclude:
+      id: go/weak-sensitive-data-hashing
+      paths:
+        - packages/engine/internal/connector/**

packages/engine/Dockerfile

@@ -26,8 +26,8 @@ RUN CGO_ENABLED=0 GOOS=linux go build \
 FROM alpine:3.21
 
 RUN apk add --no-cache ca-certificates tzdata \
-    && addgroup -S mantle \
-    && adduser -S -G mantle -h /home/mantle -s /bin/sh mantle
+    && addgroup -S -g 10001 mantle \
+    && adduser -S -u 10001 -G mantle -h /home/mantle -s /bin/sh mantle
 
 COPY --from=builder /mantle /usr/local/bin/mantle
 
@@ -39,7 +39,7 @@ EXPOSE 8080
 HEALTHCHECK --interval=10s --timeout=3s --start-period=5s --retries=3 \
     CMD wget -qO- http://localhost:8080/healthz || exit 1
 
-USER mantle
+USER 10001:10001
 WORKDIR /home/mantle
 
 ENTRYPOINT ["mantle"]

packages/engine/internal/connector/mailchimp.go

@@ -3,6 +3,8 @@ package connector
 import (
 	"bytes"
 	"context"
+	"crypto/md5" // #nosec G501 -- Mailchimp API requires MD5(lowercase(email)) as subscriber hash; not a security primitive
+	"encoding/hex"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -122,8 +124,12 @@ func (c *MailchimpAddMemberConnector) Execute(ctx context.Context, params map[st
 		return nil, fmt.Errorf("mailchimp/add_member: marshaling request: %w", err)
 	}
 
-	req, err := http.NewRequestWithContext(ctx, "POST",
-		c.apiURL(dc, fmt.Sprintf("/lists/%s/members", listID)),
+	// CodeQL[go/weak-sensitive-data-hashing]
+	hash := md5.Sum([]byte(strings.ToLower(email))) // #nosec G401 G501 -- Mailchimp API mandates MD5(lowercase(email)) as subscriber hash
+	subscriberHash := hex.EncodeToString(hash[:])
+
+	req, err := http.NewRequestWithContext(ctx, "PUT",
+		c.apiURL(dc, fmt.Sprintf("/lists/%s/members/%s", listID, subscriberHash)),
 		bytes.NewReader(reqJSON),
 	)
 	if err != nil {

packages/engine/internal/connector/mailchimp_test.go

@@ -73,8 +73,10 @@ func TestMailchimpListMembersConnector_InvalidAPIKeyFormat(t *testing.T) {
 }
 
 func TestMailchimpAddMemberConnector_AddsMember(t *testing.T) {
+	// md5("bob@example.com") = 4b9bb80620f03eb3719e0a061c14283d
+	const wantPath = "/3.0/lists/list1/members/4b9bb80620f03eb3719e0a061c14283d"
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Method != "POST" || r.URL.Path != "/3.0/lists/list1/members" {
+		if r.Method != "PUT" || r.URL.Path != wantPath {
 			t.Errorf("unexpected %s %s", r.Method, r.URL.Path)
 		}
 		var body map[string]any

packages/engine/internal/connector/okta.go

@@ -121,10 +121,7 @@ func (c *OktaCreateUserConnector) Execute(ctx context.Context, params map[string
 		return nil, fmt.Errorf("okta/create_user: marshaling request: %w", err)
 	}
 
-	endpoint := c.apiURL(domain, "/api/v1/users")
-	if activate {
-		endpoint += "?activate=true"
-	}
+	endpoint := fmt.Sprintf("%s?activate=%v", c.apiURL(domain, "/api/v1/users"), activate)
 
 	req, err := http.NewRequestWithContext(ctx, "POST", endpoint, bytes.NewReader(reqJSON))
 	if err != nil {

packages/engine/internal/connector/okta_test.go

@@ -78,6 +78,9 @@ func TestOktaCreateUserConnector_CreatesUser(t *testing.T) {
 		if r.Method != "POST" {
 			t.Errorf("expected POST, got %s", r.Method)
 		}
+		if r.URL.Query().Get("activate") != "true" {
+			t.Errorf("expected activate=true, got %q", r.URL.Query().Get("activate"))
+		}
 		var body map[string]any
 		json.NewDecoder(r.Body).Decode(&body)
 		profile, _ := body["profile"].(map[string]any)
@@ -108,6 +111,31 @@ func TestOktaCreateUserConnector_CreatesUser(t *testing.T) {
 	}
 }
 
+func TestOktaCreateUserConnector_ActivateFalse(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Query().Get("activate") != "false" {
+			t.Errorf("expected activate=false, got %q", r.URL.Query().Get("activate"))
+		}
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		json.NewEncoder(w).Encode(map[string]any{"id": "00u2", "status": "STAGED"})
+	}))
+	defer srv.Close()
+
+	c := &OktaCreateUserConnector{baseURL: srv.URL}
+	out, err := c.Execute(t.Context(), map[string]any{
+		"_credential": map[string]string{"domain": "dev.okta.com", "token": "tok"},
+		"activate":    false,
+		"profile":     map[string]any{"login": "staged@example.com", "email": "staged@example.com"},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if out["id"] != "00u2" {
+		t.Errorf("expected id=00u2, got %v", out["id"])
+	}
+}
+
 func TestOktaCreateUserConnector_MissingProfile(t *testing.T) {
 	c := &OktaCreateUserConnector{baseURL: "http://unused"}
 	_, err := c.Execute(t.Context(), map[string]any{

packages/engine/internal/server/server.go

@@ -108,43 +108,43 @@ func metricsMiddleware(next http.Handler) http.Handler {
 // Start starts the HTTP server, cron scheduler, and webhook handler.
 // It blocks until the context is cancelled.
 func (s *Server) Start(ctx context.Context) error {
-	mux := http.NewServeMux()
-
-	// Prometheus metrics endpoint.
-	mux.Handle("/metrics", promhttp.Handler())
+	// apiMux holds all routes that require authentication (and rate limiting).
+	// Health and metrics endpoints are registered on the top-level mux below
+	// so that Kubernetes probes and Prometheus scrapes bypass auth entirely.
+	apiMux := http.NewServeMux()
 
 	// Git push webhook endpoint — registered before the generic /hooks/ prefix
 	// so the more-specific path is explicit (Go's ServeMux uses longest-prefix
 	// match regardless of registration order, but explicit ordering is clearer).
-	mux.Handle("/hooks/git/", &GitWebhookHandler{
+	apiMux.Handle("/hooks/git/", &GitWebhookHandler{
 		DB:     s.DB,
 		Store:  s.RepoStore,
 		Driver: s.GitDriver,
 	})
 
 	// Webhook endpoints.
-	mux.HandleFunc("/hooks/", s.webhooks.ServeHTTP)
+	apiMux.HandleFunc("/hooks/", s.webhooks.ServeHTTP)
 
 	// API endpoints.
-	mux.HandleFunc("POST /api/v1/run/{workflow}", s.handleRun)
-	mux.HandleFunc("POST /api/v1/cancel/{execution}", s.handleCancel)
-	mux.HandleFunc("GET /api/v1/executions", s.handleListExecutions)
-	mux.HandleFunc("GET /api/v1/executions/{id}", s.handleGetExecution)
+	apiMux.HandleFunc("POST /api/v1/run/{workflow}", s.handleRun)
+	apiMux.HandleFunc("POST /api/v1/cancel/{execution}", s.handleCancel)
+	apiMux.HandleFunc("GET /api/v1/executions", s.handleListExecutions)
+	apiMux.HandleFunc("GET /api/v1/executions/{id}", s.handleGetExecution)
 
 	// Workflow definition endpoints.
-	mux.HandleFunc("GET /api/v1/workflows", s.handleListWorkflows)
-	mux.HandleFunc("GET /api/v1/workflows/{name}", s.handleGetWorkflow)
-	mux.HandleFunc("GET /api/v1/workflows/{name}/versions", s.handleListWorkflowVersions)
-	mux.HandleFunc("GET /api/v1/workflows/{name}/versions/{version}", s.handleGetWorkflowVersion)
+	apiMux.HandleFunc("GET /api/v1/workflows", s.handleListWorkflows)
+	apiMux.HandleFunc("GET /api/v1/workflows/{name}", s.handleGetWorkflow)
+	apiMux.HandleFunc("GET /api/v1/workflows/{name}/versions", s.handleListWorkflowVersions)
+	apiMux.HandleFunc("GET /api/v1/workflows/{name}/versions/{version}", s.handleGetWorkflowVersion)
 
 	// Budget endpoints.
-	mux.HandleFunc("GET /api/v1/budgets", s.handleListBudgets)
-	mux.HandleFunc("PUT /api/v1/budgets/{provider}", s.handleSetBudget)
-	mux.HandleFunc("DELETE /api/v1/budgets/{provider}", s.handleDeleteBudget)
-	mux.HandleFunc("GET /api/v1/budgets/usage", s.handleGetUsage)
+	apiMux.HandleFunc("GET /api/v1/budgets", s.handleListBudgets)
+	apiMux.HandleFunc("PUT /api/v1/budgets/{provider}", s.handleSetBudget)
+	apiMux.HandleFunc("DELETE /api/v1/budgets/{provider}", s.handleDeleteBudget)
+	apiMux.HandleFunc("GET /api/v1/budgets/usage", s.handleGetUsage)
 
 	// OpenAPI spec endpoint.
-	mux.HandleFunc("GET /api/v1/openapi.json", handleOpenAPISpec)
+	apiMux.HandleFunc("GET /api/v1/openapi.json", handleOpenAPISpec)
 
 	// Start distributed engine components (worker + reaper).
 	if cfg := config.FromContext(ctx); cfg != nil {
@@ -238,24 +238,32 @@ func (s *Server) Start(ctx context.Context) error {
 		go s.pollQueueDepth(ctx, cfg.Engine.ReaperInterval)
 	}
 
-	// Health endpoints. /readyz checks DB connectivity only; worker/reaper
-	// liveness is no longer gated here to avoid flapping between poll cycles.
-	mux.Handle("/healthz", health.HealthzHandler())
-	mux.Handle("/readyz", health.ReadyzHandler(s.DB))
-
-	// Wrap with metrics middleware (innermost, runs for every request).
-	handler := metricsMiddleware(mux)
+	// Wrap the API mux with metrics middleware, auth, and rate limiting.
+	apiHandler := metricsMiddleware(apiMux)
 	if s.AuthStore != nil {
 		if s.Auditor != nil {
-			handler = auth.AuthMiddleware(s.AuthStore, s.OIDCValidator, handler, s.Auditor)
+			apiHandler = auth.AuthMiddleware(s.AuthStore, s.OIDCValidator, apiHandler, s.Auditor)
 		} else {
-			handler = auth.AuthMiddleware(s.AuthStore, s.OIDCValidator, handler)
+			apiHandler = auth.AuthMiddleware(s.AuthStore, s.OIDCValidator, apiHandler)
 		}
 	}
-
-	// Apply rate limiting (after auth so rate limit keys can use API key prefix).
 	rl := NewRateLimiter(100, 200)
-	handler = rl.Middleware(handler)
+	apiHandler = rl.Middleware(apiHandler)
+
+	// Metrics behind auth — path labels include workflow names which are sensitive.
+	// Kubernetes probes bypass auth; Prometheus must be configured with an API key.
+	apiMux.Handle("/metrics", promhttp.Handler())
+
+	// Top-level mux: health probes bypass auth so Kubernetes can reach them
+	// without credentials. All other requests fall through to apiHandler.
+	mux := http.NewServeMux()
+	mux.Handle("/healthz", health.HealthzHandler())
+	// /readyz checks DB connectivity only; worker/reaper liveness is intentionally
+	// excluded to prevent flapping between poll cycles.
+	mux.Handle("/readyz", health.ReadyzHandler(s.DB))
+	mux.Handle("/", apiHandler)
+
+	handler := mux
 
 	s.httpServer = &http.Server{
 		Addr:              s.Address,