fix(manager): only the Operator may hold a deployment's tunnel

[alongubkin]

Fixes ALIEN-1200: two authorization gaps in routes added for self-hosted Kubernetes installs. Neither has shipped in a release yet.

Tunnel connect checked the scope, not the role. GET /v1/tunnel/connect accepted any deployment-scoped token. Whoever holds that connection receives every request sent through the deployment's tunnels, including the caller's own Authorization header. So a deployment viewer, telemetry writer or remote-binding resolver could take over a deployment's tunnel traffic. It now also requires can_sync_deployment, the rule the Operator's sync already uses.

Chart and Operator image pulls skipped the capability refusal. proxy_pull routed charts/ and alien-operator before refuse_capability_pull, so image-repository-provisioning and sandbox-push credentials could pull them. They are now refused before any pull is routed.

The standalone manager's own token store only issues deployment-scoped tokens to Operators and issues neither capability role. So this matters wherever a custom AuthValidator issues those roles.

Testing. crates/alien-manager/tests/access_roles.rs runs the real tunnel and registry routes with a validator that issues each role:

• The Operator's own tunnel client dials the manager's tunnel route over TCP and gets a live connection for its deployment. Viewer, telemetry writer and binding resolver tokens get 403.
• Both capability roles get 403 DENIED on chart and Operator-image pulls. A project developer gets past the role check (404, since this manager serves neither).

The test was pushed first on its own. The review of that commit confirmed both access-denial checks fail without the fix.

🤖 Generated with Claude Code

[greptile-apps]

Confidence Score: 5/5

[Critical risk] Restricts tunnel access to deployment Operators only.

The PR appears safe to merge; no outstanding findings or new actionable issues remain.

Summary

The PR restricts deployment tunnels to callers authorized to sync the deployment and refuses capability-role pulls before chart and Operator-image routing. It adds route tests covering both restrictions and a live Operator tunnel connection.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  T[Tunnel connect] --> A[Authenticate and load deployment]
  A --> S{May sync deployment?}
  S -->|No| F[403 Forbidden]
  S -->|Yes| W[WebSocket upgrade]
  P[Registry pull] --> V[Validate OCI path]
  V --> C{Capability role?}
  C -->|Yes| D[403 DENIED]
  C -->|No| R[Route chart, Operator image, or upstream pull]

Loading

_{Reviews (3) · Last reviewed commit: "fix(manager): validate the pull path bef..."}

[alongubkin]

@greptileai review

[alongubkin]

@greptileai review