v0.31.4

tools/checks/admin_panel_config_0314_ui_test.mjs

@@ -0,0 +1,52 @@
+// Test the real admin settings normalization helpers and visible form wiring;
+// source-level UI test only, not a Rust or browser integration test.
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import vm from 'node:vm';
+
+const js = fs.readFileSync('src/admin/web/settings.js','utf8');
+const html = fs.readFileSync('src/admin/web/index.html','utf8');
+const en = JSON.parse(fs.readFileSync('langs/en_US.json','utf8'));
+const pl = JSON.parse(fs.readFileSync('langs/pl_pl.json','utf8'));
+const api = JSON.parse(fs.readFileSync('src/admin/openapi.json','utf8'));
+const begin = js.indexOf('  function pinnedAdminHostname(value) {');
+const end = js.indexOf('  const normalizedRequestedTab', begin);
+assert(begin >= 0 && end > begin, 'real admin form normalization helpers must exist');
+const sandbox = vm.createContext({URL});
+vm.runInContext(js.slice(begin,end),sandbox);
+const normalize = (hosts, pin) => Array.from(vm.runInContext(
+  `additionalAdminHosts(${JSON.stringify(hosts)},${JSON.stringify(pin)})`,sandbox));
+
+const cases = [
+  {name:'empty form',hosts:[],pin:null,expected:[]},
+  {name:'simple single origin',hosts:[],pin:'https://panel.example.test',expected:[]},
+  {name:'0.31.4 repeated host',hosts:['panel.example.test'],pin:'https://panel.example.test',expected:[]},
+  {name:'case and trailing dot',hosts:['PANEL.Example.Test.',' other.example.test '],pin:'https://panel.example.test:8443',expected:['other.example.test']},
+  {name:'multiple additional names',hosts:['foo.example.test','panel.example.test','bar.example.test'],pin:'https://panel.example.test',expected:['foo.example.test','bar.example.test']},
+  {name:'pin changed',hosts:['other.example.test'],pin:'https://new.example.test',expected:['other.example.test']},
+  {name:'no pin means independent allowlist',hosts:['panel.example.test'],pin:'',expected:['panel.example.test']},
+  {name:'invalid URL delegates to server validation',hosts:['other.example.test'],pin:'not a url',expected:['other.example.test']},
+  {name:'blank host lines removed',hosts:['',' panel.example.test  ','  '],pin:null,expected:['panel.example.test']},
+];
+for (const item of cases) {
+  assert.deepEqual(normalize(item.hosts,item.pin),item.expected,item.name);
+}
+const admin = html.split('id="settings-page-administration"')[1].split('id="settings-page-system-info"')[0];
+for (const id of ['admin-public-origin','admin-extra-hosts-details','admin-hosts'])
+  assert(admin.includes(`id="${id}"`),`missing ${id}`);
+assert(admin.indexOf('id="admin-public-origin"') < admin.indexOf('id="admin-extra-hosts-details"'));
+assert(admin.includes('<details id="admin-extra-hosts-details">'));
+assert(js.includes('$("admin-extra-hosts-details").open = extraHosts.length > 0'));
+assert(js.includes('additionalAdminHosts(admin.allowed_hosts || [], admin.public_origin)'));
+assert(js.includes('allowed_hosts: additionalAdminHosts($("admin-hosts").value.split('));
+assert(!js.includes('allowed_hosts: $("admin-hosts").value.split('));
+for (const key of ['administrationHosts','administrationHostsAdvanced','administrationHostsHelp','administrationPublicOriginHelp']) {
+  assert.equal(typeof en.translations[key],'string'); assert.equal(typeof pl.translations[key],'string');
+  assert(en.translations[key].length > 15 && pl.translations[key].length > 15,key);
+}
+// Config contract remains compatible; the pin allows a host implicitly.
+const spec = api.components?.schemas || api.definitions;
+const specText=JSON.stringify(spec);
+assert(specText.includes('implicitly allowed'));
+assert(specText.includes('automatically allowed'));
+console.log(`PASS: ${cases.length} real settings-helper scenarios, HTML/wiring, locale parity and OpenAPI descriptions`);

tools/checks/admin_public_origin_0314_config_sim.mjs

@@ -0,0 +1,210 @@
+// Reconstruct ONLY the RustProxy 0.31.4 administration Origin guard decision.
+// Real-source anchors guard against accidental model/source drift. This is NOT
+// a Rust server, not a browser, and not an HTTP/2 or TLS integration test.
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import http from 'node:http';
+import {fileURLToPath} from 'node:url';
+import path from 'node:path';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
+const read = p => fs.readFileSync(path.join(root, p), 'utf8');
+const source = {
+  settings: read('src/settings.rs') + read('src/settings/public_origin.rs'), access: read('src/admin/access.rs'),
+  session: read('src/admin/session.rs'), forwarding: read('src/forwarding.rs'),
+};
+for (const [part, tokens] of Object.entries({
+  settings: ['pub public_origin: Option<String>', 'fn normalize_public_admin_origin(public_origin: &str)', 'fn include_public_origin_host(&mut self)', 'fn explicitly_allowed_panel_host(&self, host: &str)', 'self.public_origin != active.public_origin'],
+  access: ['fn configured_admin_public_authority(', 'fn pinned_admin_proto_compatible(', 'hops > 8', 'scheme != "https"', 'trusted_admin_proxy(state, peer)'],
+  session: ['configured_admin_public_authority(&state, headers, peer, &raw_host, transport)', 'automation_credentials', 'pinned_origin_mismatch', '"origin_mismatch"', '"cross_site_fetch"'],
+  forwarding: ['self.trust_proto && self.trusted(ip)'],
+})) for (const token of tokens) assert(source[part].includes(token), `Source contract missing: ${part}/${token}`);
+
+const defaults = {host:'127.0.0.1:9090', 'x-forwarded-host':'panel.example.test',
+  'x-forwarded-proto':'https', 'sec-fetch-site':'same-origin'};
+const context = {listenIp:'127.0.0.1', listenPort:9090, tls:false,
+  peerTrusted:true, trustProto:true, publicOrigin:null, allowedHosts:['panel.example.test'],
+  automation:false};
+const normal = x => x.toLowerCase();
+function authority(value) {
+  if (typeof value !== 'string' || !value || value.includes('@') || value.includes(',') || value.includes('/')) return null;
+  try {
+    const parsed = new URL(`https://${value}/`);
+    if (parsed.username || parsed.password || parsed.hash || parsed.search || parsed.pathname !== '/') return null;
+    const host = parsed.hostname.toLowerCase();
+    return {host, port:parsed.port ? Number(parsed.port) : null};
+  } catch {return null;}
+}
+function sameAuthority(a,b,scheme) {
+  const left=authority(a), right=authority(b);
+  if (!left || !right) return false;
+  const defaultPort = scheme === 'https' ? 443 : 80;
+  return left.host===right.host && (left.port ?? defaultPort)===(right.port ?? defaultPort);
+}
+function hostAllowed(value, tls, cfg) {
+  const actual=authority(value);
+  if (!actual) return false;
+  const port=actual.port ?? (tls ? 443 : 80);
+  // Effective runtime/desired allowlist also includes the public origin host;
+  // only extra names are persisted in allowed_hosts.
+  const pinnedHost=cfg.publicOrigin ? new URL(cfg.publicOrigin).hostname.toLowerCase() : null;
+  return (actual.host===cfg.listenIp && port===cfg.listenPort)
+      || cfg.allowedHosts.includes(actual.host)
+      || actual.host===pinnedHost;
+}
+const map = raw => {
+  const headers=new Map();
+  for (let i=0;i<raw.length;i+=2) {
+    const name=normal(raw[i]);
+    headers.set(name,[...(headers.get(name)||[]),raw[i+1]]);
+  }
+  return headers;
+};
+const all = (headers,name) => headers.get(name)||[];
+const single = (headers,name) => all(headers,name).length===1 ? all(headers,name)[0] : null;
+function protoCompatible(headers) {
+  let hops=0;
+  for (const value of all(headers,'x-forwarded-proto')) {
+    for (const part of value.split(',')) {
+      hops++;
+      const scheme=part.trim();
+      if (hops>8 || (hops===1 && scheme!=='https') || !['http','https'].includes(scheme)) return false;
+    }
+  }
+  return true;
+}
+function originMatches(value,scheme,external) {
+  if (typeof value!=='string' || value.includes('#') || value.includes('@')) return false;
+  try {
+    const uri=new URL(value);
+    if (uri.protocol!==`${scheme}:` || uri.pathname!=='/' || uri.search || uri.hash || uri.username || uri.password) return false;
+    return sameAuthority(uri.host, external, scheme);
+  } catch {return false;}
+}
+function guard(headers,cfg) {
+  const rawHost=single(headers,'host');
+  if (!rawHost) return {status:403,reason:'invalid_host'};
+  let scheme=cfg.tls ? 'https' : 'http', external=rawHost;
+  // 0.31.4 public pin only behind a trusted last hop and only for panel traffic.
+  if (cfg.publicOrigin && cfg.peerTrusted && !cfg.automation) {
+    let pinned;
+    try { pinned=new URL(cfg.publicOrigin); } catch {return {status:403,reason:'pinned_origin_mismatch'};}
+    if (pinned.protocol!=='https:' || !hostAllowed(rawHost,cfg.tls,cfg) || !protoCompatible(headers))
+      return {status:403,reason:'pinned_origin_mismatch'};
+    const xfh=all(headers,'x-forwarded-host');
+    if (xfh.length>1 || xfh.length===1 && !sameAuthority(xfh[0],pinned.host,'https'))
+      return {status:403,reason:'pinned_origin_mismatch'};
+    scheme='https'; external=pinned.host;
+  } else {
+    if (!cfg.tls && cfg.peerTrusted && cfg.trustProto && all(headers,'x-forwarded-proto').length) {
+      const proto=single(headers,'x-forwarded-proto');
+      if (proto!=='https' && proto!=='http') return {status:403,reason:'external_scheme'};
+      scheme=proto;
+    }
+    if (cfg.peerTrusted && all(headers,'x-forwarded-host').length)
+      external=single(headers,'x-forwarded-host');
+    if (!hostAllowed(external,scheme==='https',cfg))
+      return {status:403,reason:'invalid_host'};
+  }
+  const originValues=all(headers,'origin');
+  if (originValues.length>1 || originValues.length===1 && !originMatches(originValues[0],scheme,external))
+    return {status:403,reason:'origin_mismatch'};
+  if (all(headers,'sec-fetch-site').includes('cross-site'))
+    return {status:403,reason:'cross_site_fetch'};
+  return {status:200,reason:'pass',scheme};
+}
+const cases=[];
+const add=(name,patch,opts,expected)=>cases.push({name,patch,opts,expected});
+const PIN={publicOrigin:'https://panel.example.test',allowedHosts:[]};
+add('legacy normal same-origin GET', {},{},'pass');
+add('no pin and no DNS allowlist rejects proxied host', {},{allowedHosts:[]},'invalid_host');
+add('legacy malformed multi-hop chain', {'x-forwarded-proto':'https, http'},{},'external_scheme');
+add('legacy duplicated XFP lines', {'x-forwarded-proto':['https','http']},{},'external_scheme');
+add('legacy explicit DNS host without pin', {'host':'other.example.test','x-forwarded-host':'other.example.test'},
+  {allowedHosts:['other.example.test']}, 'pass');
+add('legacy extra host without pin still denies unknown', {'host':'evil.example.test','x-forwarded-host':'evil.example.test'},
+  {allowedHosts:['other.example.test']}, 'invalid_host');
+add('pin: normal GET, persisted allowed_hosts empty', {},PIN,'pass');
+add('pin: public Host implicitly allowed', {'host':'panel.example.test'},PIN,'pass');
+add('pin: unknown Host still rejected', {'host':'unknown.example.test'},PIN,'pinned_origin_mismatch');
+add('pin: old 0.31.4 explicit hostname remains compatible', {}, {...PIN,allowedHosts:['panel.example.test']},'pass');
+add('pin: additional DNS host accepted only with matching forwarded public Host',
+  {'host':'other.example.test'}, {...PIN,allowedHosts:['other.example.test']},'pass');
+add('pin: changing public origin does not allow previous hostname',
+  {'host':'panel.example.test','x-forwarded-host':'new.example.test'},
+  {...PIN,publicOrigin:'https://new.example.test'},'pinned_origin_mismatch');
+add('pin: GET multi-hop https then http',{'x-forwarded-proto':'https, http'},PIN,'pass');
+add('pin: duplicate XFP lines',{'x-forwarded-proto':['https','http']},PIN,'pass');
+add('pin: 8-hop bounded chain',{'x-forwarded-proto':'https, http, http, http, http, http, http, http'},PIN,'pass');
+add('pin: 9-hop rejected',{'x-forwarded-proto':'https, http, http, http, http, http, http, http, http'},PIN,'pinned_origin_mismatch');
+add('pin: no XFP; public origin configured',{'x-forwarded-proto':null},PIN,'pass');
+add('pin: no XFH; internal Host still validated',{'x-forwarded-host':null,'origin':'https://panel.example.test'},PIN,'pass');
+add('pin: wrong XFH',{'x-forwarded-host':'attacker.example.test'},PIN,'pinned_origin_mismatch');
+add('pin: different allowed Host but wrong configured URL',{'x-forwarded-host':'panel.example.test:8443'},PIN,'pinned_origin_mismatch');
+add('pin: XFH userinfo rejected',{'x-forwarded-host':'attacker@panel.example.test'},PIN,'pinned_origin_mismatch');
+add('pin: duplicate XFH lines',{'x-forwarded-host':['panel.example.test','panel.example.test']},PIN,'pinned_origin_mismatch');
+add('pin: first hop downgraded HTTP',{'x-forwarded-proto':'http, https'},PIN,'pinned_origin_mismatch');
+add('pin: HTTP only',{'x-forwarded-proto':'http'},PIN,'pinned_origin_mismatch');
+add('pin: unrecognized protocol',{'x-forwarded-proto':'ftp, http'},PIN,'pinned_origin_mismatch');
+add('pin: empty protocol element',{'x-forwarded-proto':'https, '},PIN,'pinned_origin_mismatch');
+add('pin: invalid XFP capitalization',{'x-forwarded-proto':'HTTPS'},PIN,'pinned_origin_mismatch');
+add('pin: correct explicit browser Origin',{'origin':'https://panel.example.test','x-forwarded-proto':'https, http'},PIN,'pass');
+add('pin: correct explicit Origin with :443',{'origin':'https://panel.example.test:443'},PIN,'pass');
+add('pin: attacker Origin rejected',{'origin':'https://attacker.example.test'},PIN,'origin_mismatch');
+add('pin: Origin null rejected',{'origin':'null'},PIN,'origin_mismatch');
+add('pin: conflicting Origin port rejected',{'origin':'https://panel.example.test:8443'},PIN,'origin_mismatch');
+add('pin: cross-site API request rejected',{'sec-fetch-site':'cross-site'},PIN,'cross_site_fetch');
+add('pin: untrusted peer must not apply pin',{'x-forwarded-proto':'https, http','origin':'https://panel.example.test'}, {...PIN,peerTrusted:false},'origin_mismatch');
+add('pin: credential automation remains strict',{'x-forwarded-proto':'https, http'}, {...PIN,automation:true},'external_scheme');
+add('pin: Host cannot spoof unallowlisted identity',{'host':'attacker.example.test'},PIN,'pinned_origin_mismatch');
+add('pin: correct alt port 8443',{'x-forwarded-host':'panel.example.test:8443','origin':'https://panel.example.test:8443'}, {...PIN, publicOrigin:'https://panel.example.test:8443'},'pass');
+
+function encodedHeaders(patch) {
+  const merged={...defaults,...patch};
+  const result={};
+  for (const [key,value] of Object.entries(merged)) if (value!==null) result[key]=value;
+  return result;
+}
+const pending=[];
+const server=http.createServer((req,res)=>{
+  const item=pending.shift();
+  if (!item) return res.writeHead(500).end('no scenario');
+  const result=guard(map(req.rawHeaders),{...context,...item.opts});
+  res.writeHead(result.status, {'content-type':'application/json'}).end(JSON.stringify(result));
+});
+await new Promise(resolve=>server.listen(0,'127.0.0.1',resolve));
+async function request(item) {
+  pending.push(item);
+  return await new Promise((resolve,reject)=>{
+    const req=http.request({hostname:'127.0.0.1',port:server.address().port,path:'/api/auth/session',
+      agent:false,headers:encodedHeaders(item.patch)},res=>{
+      let data='';res.setEncoding('utf8');res.on('data',part=>data+=part);
+      res.on('end',()=>resolve(JSON.parse(data)));
+    });
+    req.on('error',reject);req.end();
+  });
+}
+try {
+  for (const item of cases) {
+    const result=await request(item);
+    assert.equal(result.reason,item.expected,item.name);
+    assert.equal(result.status,item.expected==='pass' ? 200:403,item.name);
+  }
+  const repeats=[];
+  for (const configured of [false,true]) {
+    for (let attempt=1;attempt<=12;attempt++) {
+      const malformed=attempt%4===0;
+      const result=await request({patch:{'x-forwarded-proto':malformed?'https, http':'https'},
+        opts:configured? PIN : {}});
+      assert.equal(result.status,configured?200:(malformed?403:200));
+      repeats.push({pin:configured,attempt,forwardedProto:malformed?'https, http':'https',status:result.status,reason:result.reason});
+    }
+  }
+  const summary={cases:cases.length,repeated:repeats.length,unconfigured403:repeats.filter(x=>!x.pin&&x.status===403).length,
+    pinned403:repeats.filter(x=>x.pin&&x.status===403).length};
+  const output={release:'0.31.4',classification:'Node.js HTTP simulation of admin guard, not compiled RustProxy',
+    assertions:cases.length+repeats.length,scenarios:cases.map(({name,expected})=>({name,expected})),repeats,summary};
+  if (process.argv[2]) fs.writeFileSync(process.argv[2],JSON.stringify(output,null,2)+'\n');
+  console.log(`PASS: ${output.assertions} HTTP-simulation assertions: ${summary.cases} cases + ${summary.repeated} resumes; `+
+    `403 with no pin ${summary.unconfigured403}/12, 403 with pin ${summary.pinned403}/12`);
+} finally {server.close();}

tools/checks/admin_public_origin_0314_sim.mjs

@@ -0,0 +1,196 @@
+// Reconstruct ONLY the RustProxy 0.31.4 administration Origin guard decision.
+// Real-source anchors guard against accidental model/source drift. This is NOT
+// a Rust server, not a browser, and not an HTTP/2 or TLS integration test.
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import http from 'node:http';
+import {fileURLToPath} from 'node:url';
+import path from 'node:path';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
+const read = p => fs.readFileSync(path.join(root, p), 'utf8');
+const source = {
+  settings: read('src/settings.rs') + read('src/settings/public_origin.rs'), access: read('src/admin/access.rs'),
+  session: read('src/admin/session.rs'), forwarding: read('src/forwarding.rs'),
+};
+for (const [part, tokens] of Object.entries({
+  settings: ['pub public_origin: Option<String>', 'fn include_public_origin_host(&mut self)', 'self.public_origin != active.public_origin'],
+  access: ['fn configured_admin_public_authority(', 'fn pinned_admin_proto_compatible(', 'hops > 8', 'scheme != "https"', 'trusted_admin_proxy(state, peer)'],
+  session: ['configured_admin_public_authority(&state, headers, peer, &raw_host, transport)', 'automation_credentials', 'pinned_origin_mismatch', '"origin_mismatch"', '"cross_site_fetch"'],
+  forwarding: ['self.trust_proto && self.trusted(ip)'],
+})) for (const token of tokens) assert(source[part].includes(token), `Source contract missing: ${part}/${token}`);
+
+const defaults = {host:'127.0.0.1:9090', 'x-forwarded-host':'panel.example.test',
+  'x-forwarded-proto':'https', 'sec-fetch-site':'same-origin'};
+const context = {listenIp:'127.0.0.1', listenPort:9090, tls:false,
+  peerTrusted:true, trustProto:true, publicOrigin:null, allowedHosts:['panel.example.test'],
+  automation:false};
+const normal = x => x.toLowerCase();
+function authority(value) {
+  if (typeof value !== 'string' || !value || value.includes('@') || value.includes(',') || value.includes('/')) return null;
+  try {
+    const parsed = new URL(`https://${value}/`);
+    if (parsed.username || parsed.password || parsed.hash || parsed.search || parsed.pathname !== '/') return null;
+    const host = parsed.hostname.toLowerCase();
+    return {host, port:parsed.port ? Number(parsed.port) : null};
+  } catch {return null;}
+}
+function sameAuthority(a,b,scheme) {
+  const left=authority(a), right=authority(b);
+  if (!left || !right) return false;
+  const defaultPort = scheme === 'https' ? 443 : 80;
+  return left.host===right.host && (left.port ?? defaultPort)===(right.port ?? defaultPort);
+}
+function hostAllowed(value, tls, cfg) {
+  const actual=authority(value);
+  if (!actual) return false;
+  const port=actual.port ?? (tls ? 443 : 80);
+  const pinnedHost=cfg.publicOrigin ? new URL(cfg.publicOrigin).hostname.toLowerCase() : null;
+  // The validated public panel hostname is derived at runtime.
+  return (actual.host===cfg.listenIp && port===cfg.listenPort)
+      || cfg.allowedHosts.includes(actual.host)
+      || actual.host===pinnedHost;
+}
+const map = raw => {
+  const headers=new Map();
+  for (let i=0;i<raw.length;i+=2) {
+    const name=normal(raw[i]);
+    headers.set(name,[...(headers.get(name)||[]),raw[i+1]]);
+  }
+  return headers;
+};
+const all = (headers,name) => headers.get(name)||[];
+const single = (headers,name) => all(headers,name).length===1 ? all(headers,name)[0] : null;
+function protoCompatible(headers) {
+  let hops=0;
+  for (const value of all(headers,'x-forwarded-proto')) {
+    for (const part of value.split(',')) {
+      hops++;
+      const scheme=part.trim();
+      if (hops>8 || (hops===1 && scheme!=='https') || !['http','https'].includes(scheme)) return false;
+    }
+  }
+  return true;
+}
+function originMatches(value,scheme,external) {
+  if (typeof value!=='string' || value.includes('#') || value.includes('@')) return false;
+  try {
+    const uri=new URL(value);
+    if (uri.protocol!==`${scheme}:` || uri.pathname!=='/' || uri.search || uri.hash || uri.username || uri.password) return false;
+    return sameAuthority(uri.host, external, scheme);
+  } catch {return false;}
+}
+function guard(headers,cfg) {
+  const rawHost=single(headers,'host');
+  if (!rawHost) return {status:403,reason:'invalid_host'};
+  let scheme=cfg.tls ? 'https' : 'http', external=rawHost;
+  // 0.31.4 public pin only behind a trusted last hop and only for panel traffic.
+  if (cfg.publicOrigin && cfg.peerTrusted && !cfg.automation) {
+    let pinned;
+    try { pinned=new URL(cfg.publicOrigin); } catch {return {status:403,reason:'pinned_origin_mismatch'};}
+    if (pinned.protocol!=='https:' || !hostAllowed(rawHost,cfg.tls,cfg) || !protoCompatible(headers))
+      return {status:403,reason:'pinned_origin_mismatch'};
+    const xfh=all(headers,'x-forwarded-host');
+    if (xfh.length>1 || xfh.length===1 && !sameAuthority(xfh[0],pinned.host,'https'))
+      return {status:403,reason:'pinned_origin_mismatch'};
+    scheme='https'; external=pinned.host;
+  } else {
+    if (!cfg.tls && cfg.peerTrusted && cfg.trustProto && all(headers,'x-forwarded-proto').length) {
+      const proto=single(headers,'x-forwarded-proto');
+      if (proto!=='https' && proto!=='http') return {status:403,reason:'external_scheme'};
+      scheme=proto;
+    }
+    if (cfg.peerTrusted && all(headers,'x-forwarded-host').length)
+      external=single(headers,'x-forwarded-host');
+    if (!hostAllowed(external,scheme==='https',cfg))
+      return {status:403,reason:'invalid_host'};
+  }
+  const originValues=all(headers,'origin');
+  if (originValues.length>1 || originValues.length===1 && !originMatches(originValues[0],scheme,external))
+    return {status:403,reason:'origin_mismatch'};
+  if (all(headers,'sec-fetch-site').includes('cross-site'))
+    return {status:403,reason:'cross_site_fetch'};
+  return {status:200,reason:'pass',scheme};
+}
+const cases=[];
+const add=(name,patch,opts,expected)=>cases.push({name,patch,opts,expected});
+const PIN={publicOrigin:'https://panel.example.test',allowedHosts:[]};
+add('legacy normal same-origin GET', {},{},'pass');
+add('legacy malformed multi-hop chain', {'x-forwarded-proto':'https, http'},{},'external_scheme');
+add('legacy duplicated XFP lines', {'x-forwarded-proto':['https','http']},{},'external_scheme');
+add('pin: normal GET', {},PIN,'pass');
+add('pin: GET multi-hop https then http',{'x-forwarded-proto':'https, http'},PIN,'pass');
+add('pin: duplicate XFP lines',{'x-forwarded-proto':['https','http']},PIN,'pass');
+add('pin: 8-hop bounded chain',{'x-forwarded-proto':'https, http, http, http, http, http, http, http'},PIN,'pass');
+add('pin: 9-hop rejected',{'x-forwarded-proto':'https, http, http, http, http, http, http, http, http'},PIN,'pinned_origin_mismatch');
+add('pin: no XFP; public origin configured',{'x-forwarded-proto':null},PIN,'pass');
+add('pin: no XFH; internal Host still validated',{'x-forwarded-host':null,'origin':'https://panel.example.test'},PIN,'pass');
+add('pin: wrong XFH',{'x-forwarded-host':'attacker.example.test'},PIN,'pinned_origin_mismatch');
+add('pin: different allowed Host but wrong configured URL',{'x-forwarded-host':'panel.example.test:8443'},PIN,'pinned_origin_mismatch');
+add('pin: XFH userinfo rejected',{'x-forwarded-host':'attacker@panel.example.test'},PIN,'pinned_origin_mismatch');
+add('pin: duplicate XFH lines',{'x-forwarded-host':['panel.example.test','panel.example.test']},PIN,'pinned_origin_mismatch');
+add('pin: first hop downgraded HTTP',{'x-forwarded-proto':'http, https'},PIN,'pinned_origin_mismatch');
+add('pin: HTTP only',{'x-forwarded-proto':'http'},PIN,'pinned_origin_mismatch');
+add('pin: unrecognized protocol',{'x-forwarded-proto':'ftp, http'},PIN,'pinned_origin_mismatch');
+add('pin: empty protocol element',{'x-forwarded-proto':'https, '},PIN,'pinned_origin_mismatch');
+add('pin: invalid XFP capitalization',{'x-forwarded-proto':'HTTPS'},PIN,'pinned_origin_mismatch');
+add('pin: correct explicit browser Origin',{'origin':'https://panel.example.test','x-forwarded-proto':'https, http'},PIN,'pass');
+add('pin: correct explicit Origin with :443',{'origin':'https://panel.example.test:443'},PIN,'pass');
+add('pin: attacker Origin rejected',{'origin':'https://attacker.example.test'},PIN,'origin_mismatch');
+add('pin: Origin null rejected',{'origin':'null'},PIN,'origin_mismatch');
+add('pin: conflicting Origin port rejected',{'origin':'https://panel.example.test:8443'},PIN,'origin_mismatch');
+add('pin: cross-site API request rejected',{'sec-fetch-site':'cross-site'},PIN,'cross_site_fetch');
+add('pin: untrusted peer must not apply pin',{'x-forwarded-proto':'https, http','origin':'https://panel.example.test'}, {...PIN,peerTrusted:false},'origin_mismatch');
+add('pin: credential automation remains strict',{'x-forwarded-proto':'https, http'}, {...PIN,automation:true},'external_scheme');
+add('pin: Host cannot spoof unallowlisted identity',{'host':'attacker.example.test'},PIN,'pinned_origin_mismatch');
+add('pin: correct alt port 8443',{'x-forwarded-host':'panel.example.test:8443','origin':'https://panel.example.test:8443'}, {...PIN, publicOrigin:'https://panel.example.test:8443'},'pass');
+
+function encodedHeaders(patch) {
+  const merged={...defaults,...patch};
+  const result={};
+  for (const [key,value] of Object.entries(merged)) if (value!==null) result[key]=value;
+  return result;
+}
+const pending=[];
+const server=http.createServer((req,res)=>{
+  const item=pending.shift();
+  if (!item) return res.writeHead(500).end('no scenario');
+  const result=guard(map(req.rawHeaders),{...context,...item.opts});
+  res.writeHead(result.status, {'content-type':'application/json'}).end(JSON.stringify(result));
+});
+await new Promise(resolve=>server.listen(0,'127.0.0.1',resolve));
+async function request(item) {
+  pending.push(item);
+  return await new Promise((resolve,reject)=>{
+    const req=http.request({hostname:'127.0.0.1',port:server.address().port,path:'/api/auth/session',
+      agent:false,headers:encodedHeaders(item.patch)},res=>{
+      let data='';res.setEncoding('utf8');res.on('data',part=>data+=part);
+      res.on('end',()=>resolve(JSON.parse(data)));
+    });
+    req.on('error',reject);req.end();
+  });
+}
+try {
+  for (const item of cases) {
+    const result=await request(item);
+    assert.equal(result.reason,item.expected,item.name);
+    assert.equal(result.status,item.expected==='pass' ? 200:403,item.name);
+  }
+  const repeats=[];
+  for (const configured of [false,true]) {
+    for (let attempt=1;attempt<=12;attempt++) {
+      const malformed=attempt%4===0;
+      const result=await request({patch:{'x-forwarded-proto':malformed?'https, http':'https'},
+        opts:configured? PIN : {}});
+      assert.equal(result.status,configured?200:(malformed?403:200));
+      repeats.push({pin:configured,attempt,forwardedProto:malformed?'https, http':'https',status:result.status,reason:result.reason});
+    }
+  }
+  const summary={cases:cases.length,repeated:repeats.length,unconfigured403:repeats.filter(x=>!x.pin&&x.status===403).length,
+    pinned403:repeats.filter(x=>x.pin&&x.status===403).length};
+  const output={release:'0.31.4',classification:'Node.js HTTP simulation of admin guard, not compiled RustProxy',
+    assertions:cases.length+repeats.length,scenarios:cases.map(({name,expected})=>({name,expected})),repeats,summary};
+  if (process.argv[2]) fs.writeFileSync(process.argv[2],JSON.stringify(output,null,2)+'\n');
+  console.log(`PASS: ${output.assertions} HTTP-simulation assertions: ${summary.cases} cases + ${summary.repeated} resumes; `+
+    `403 with no pin ${summary.unconfigured403}/12, 403 with pin ${summary.pinned403}/12`);
+} finally {server.close();}

tools/checks/check_source.py

@@ -24,7 +24,7 @@ def read_docker_agent_source() -> str:
 
 preflight(root)
 manifest = tomllib.loads((root / "Cargo.toml").read_text())
-assert manifest["package"]["version"] == "0.31.3"
+assert manifest["package"]["version"] == "0.31.4"
 assert manifest["dependencies"]["quinn"]["version"] == "0.11.12"
 h3dep = manifest["dependencies"]["h3"]
 assert h3dep["package"] == "hpx-h3" and h3dep["version"] == "=2.5.20" and "quinn" in h3dep["features"]
@@ -32,14 +32,14 @@ assert "h3-quinn" not in manifest["dependencies"]
 lock_path = root / "Cargo.lock"
 if lock_path.exists():
     lock = lock_path.read_text()
-    assert 'name = "rust-proxy"\nversion = "0.31.3"' in lock
+    assert 'name = "rust-proxy"\nversion = "0.31.4"' in lock
     assert 'name = "systemstat"' in lock and 'name = "metrics-process"' in lock and 'name = "sysinfo"' in lock, "Cargo.lock must be resolver-generated after adding cross-platform statistics libraries"
 for release_doc, marker in {
-    "README.md": "# RustProxy 0.31.3",
-    "CHANGELOG.md": "## 0.31.3",
-    "ROADMAP.md": "## 0.31.3",
-    "AGENTS.md": "Current source version: 0.31.3.",
-    "docs/TEST_REPORT.md": "# Verification report - RustProxy 0.31.3",
+    "README.md": "# RustProxy 0.31.4",
+    "CHANGELOG.md": "## 0.31.4",
+    "ROADMAP.md": "## 0.31.4",
+    "AGENTS.md": "Current source version: 0.31.4.",
+    "docs/TEST_REPORT.md": "# Verification report - RustProxy 0.31.4",
 }.items():
     assert marker in (root / release_doc).read_text(), f"stale release identity in {release_doc}"
 assert tomllib.loads((root / "rust-toolchain.toml").read_text())["toolchain"]["channel"] == "stable"
@@ -285,7 +285,7 @@ assert 'Opt-in health decisions based on ordinary user traffic. Defaults to disa
 assert '"force_ssl"' in openapi and '"forward_client_ip"' in openapi
 assert '"backend_header"' in openapi and '"backend_timing_header"' in openapi
 assert '"StreamMetrics"' in openapi and '"streams"' in openapi
-for marker in ['"version": "0.31.3"', '"/api/traffic"', '"capture_user_agent"', '"capture_country"', '"hot_auto_trim_enabled"', '"hot_auto_trim_after_seconds"', '"hot_auto_trim_target_percent"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']:
+for marker in ['"version": "0.31.4"', '"/api/traffic"', '"capture_user_agent"', '"capture_country"', '"hot_auto_trim_enabled"', '"hot_auto_trim_after_seconds"', '"hot_auto_trim_target_percent"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']:
     assert marker in openapi, marker
 for marker in ['"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
     assert marker in openapi, marker
@@ -1394,7 +1394,7 @@ assert '"error_log" => {' not in admin_0241 and 'request("/api/config/error_log"
 assert '"error_log"' in openapi and 'logging, error_log, forwarding' not in openapi
 assert 'logging_section_persists_error_log_settings_atomically' in admin_0241 and 'error_log_is_not_a_standalone_configuration_section' in admin_0241
 assert 'location.pathname === "/logging"' in settings_js_0241
-assert '"RuntimeInformation"' in openapi and '"version": "0.31.3"' in openapi
+assert '"RuntimeInformation"' in openapi and '"version": "0.31.4"' in openapi
 
 # 0.24.1 compiler and hostname-cardinality regressions.
 tls_0241 = rust_source(root, "src/tls.rs")
@@ -1633,5 +1633,5 @@ for marker_0282 in [
 assert 'Zewnętrzne ścieżki plików' in (root / 'langs/pl_pl.json').read_text()
 assert 'setfacl -m u:rustproxy:--x /etc/ssl/' in (root / 'docs/V0.28.2_IMPLEMENTATION.md').read_text()
 
-print("PASS: 0.31.3 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, external-packaging/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v9 migrations.")
+print("PASS: 0.31.4 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, external-packaging/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v9 migrations.")
 print("NOT VERIFIED: Rust parsing, types, compilation, linking or runtime behavior. Run ./dev.sh test.")

tools/checks/dependency_upgrade_0312.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Check the 0.31.3 dependency/source migration; optionally require a resolved lock.
+"""Check the 0.31.4 dependency/source migration; optionally require a resolved lock.
 
 This is not a substitute for rustc, cargo metadata or runtime tests.
 """
@@ -14,7 +14,7 @@ parser = argparse.ArgumentParser()
 parser.add_argument('--require-lock', action='store_true', help='Require the post-upgrade Cargo.lock produced by cargo update')
 args = parser.parse_args()
 manifest = tomllib.loads((ROOT / 'Cargo.toml').read_text())
-assert manifest['package']['version'] == '0.31.3'
+assert manifest['package']['version'] == '0.31.4'
 assert manifest['package']['rust-version'] == '1.99'
 deps = manifest['dependencies']
 expected_requirements = {
@@ -78,4 +78,4 @@ if missing:
     print(f'PENDING: lockfile still requires cargo update ({details})')
 else:
     print('PASS: pinned key packages found in post-upgrade lock; cargo --locked verification is still required')
-print('PASS: 0.31.3 source dependency APIs, manifest, TLS features, toolchain images and Swagger pin (static only)')
+print('PASS: 0.31.4 source dependency APIs, manifest, TLS features, toolchain images and Swagger pin (static only)')

tools/checks/docs_check.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Rust-independent documentation/Reader consistency checks for the 0.31.3 release."""
+"""Rust-independent documentation/Reader consistency checks for the 0.31.4 release."""
 from pathlib import Path
 import re
 from rust_source import rust_source
@@ -29,6 +29,8 @@ required = [
     DOCS / "V0.25.2_AUDIT.md",
     DOCS / "V0.25.1_AUDIT.md",
     DOCS / "V0.25.0_AUDIT.md",
+    DOCS / "IMPLEMENTATION_0.31.4.md",
+    DOCS / "IMPLEMENTATION_0.31.3.md",
     DOCS / "IMPLEMENTATION_0.31.1.md",
     DOCS / "TEST_REPORT.md",
     DOCS / "CHANGELOG_TECHNICAL_ARCHIVE.md",
@@ -65,7 +67,7 @@ assert '"/docs/content.json"' in admin
 readme = (ROOT / "README.md").read_text(encoding="utf-8")
 roadmap = (ROOT / "ROADMAP.md").read_text(encoding="utf-8")
 changelog = (ROOT / "CHANGELOG.md").read_text(encoding="utf-8")
-assert readme.startswith("# RustProxy 0.31.3")
+assert readme.startswith("# RustProxy 0.31.4")
 assert "docs/WEB_SERVER.md" in readme and "docs/README.md" in readme
 assert readme.count("## What changed in ") == 1, "README duplicates historical release notes; use CHANGELOG/archive"
 assert "## Release history" in readme and "docs/ROADMAP_HISTORY.md" in readme

tools/checks/panel_cache_http_0310_ui_test.mjs

@@ -77,13 +77,22 @@ const bindSettingsForm = (id, handler) => handlers.set(id, handler);
 const adminStart = administration.indexOf('bindSettingsForm("administration-form", next => {');
 const adminEnd = administration.indexOf('bindSettingsForm("tls-policy-form",', adminStart);
 assert(adminStart > 0 && adminEnd > adminStart);
-runInNewContext(administration.slice(adminStart, adminEnd), {
-  $: field, bindSettingsForm, latestStatus: { administration: { listen_locked: false } },
+// Use the shipped helper in the extracted callback environment as well.
+const hostHelperStart = administration.indexOf('  function pinnedAdminHostname(value) {');
+const hostHelperEnd = administration.indexOf('  const normalizedRequestedTab', hostHelperStart);
+assert(hostHelperStart > 0 && hostHelperEnd > hostHelperStart);
+runInNewContext(administration.slice(hostHelperStart, hostHelperEnd) + administration.slice(adminStart, adminEnd), {
+  $: field, bindSettingsForm, latestStatus: { administration: { listen_locked: false } }, URL,
 });
 const adminNext = {};
 handlers.get('administration-form')(adminNext);
 assert.deepEqual(JSON.parse(JSON.stringify(adminNext.administration.panel_compression)),
   { zstd: true, br: true, gzip: true });
+field('admin-public-origin').value = 'https://panel.example.test';
+field('admin-hosts').value = 'panel.example.test\nother.example.test';
+const pinnedNext = {};
+handlers.get('administration-form')(pinnedNext);
+assert.deepEqual(JSON.parse(JSON.stringify(pinnedNext.administration.allowed_hosts)), ['other.example.test']);
 field('admin-compression-br').checked = false;
 field('admin-compression-zstd').checked = false;
 const offNext = {};

tools/checks/preflight.py

@@ -75,10 +75,10 @@ def check(root: Path, repair_known: bool = False) -> list[str]:
             raise ValueError(f"Conflicting Rust modules: {flat.relative_to(root)} and {module.relative_to(root)}")
     for path in ["src/auth/mod.rs", "src/auth/store.rs", "src/backup/snapshot.rs", "src/upstream.rs", "src/tls.rs", "src/config/internal_routing.rs", "src/proxy/websocket.rs", "src/proxy/error_fallback.rs", "src/cache/mod.rs", "src/cache/model.rs", "src/cache/lifecycle.rs", "src/cache/cold.rs", "src/cache/dashboard.rs", "src/cache/tickets.rs", "src/cache/lookup.rs", "src/cache/policy.rs", "src/cache/fill.rs", "src/cache/tests.rs", "src/settings.rs", "src/compression.rs", "src/diagnostics.rs", "src/traffic.rs", "src/system_stats/mod.rs", "src/system_stats/linux.rs", "src/vhost.rs", "src/vhost/error_fallback.rs", "src/web_server/mod.rs", "src/web_server/config.rs", "src/web_server/filesystem.rs", "src/web_server/security.rs", "src/web_server/response.rs", "src/web_server/request.rs", "src/web_server/routing.rs", "src/web_server/fastcgi.rs", "src/web_server/htaccess.rs", "src/web_server/serve.rs", "src/web_server/tests.rs", "src/balance.rs", "src/security.rs", "src/admin/web/vhosts/core.js", "src/admin/web/vhosts/health.js", "src/admin/web/vhosts/editor.js", "src/admin/web/vhosts/render.js", "src/admin/web/web-server.js", "src/admin/web/streams.js", "src/admin/web/host404.js", "src/admin/web/app/core.js", "src/admin/web/app/session-resume.js", "src/admin/web/app/preferences.js", "src/admin/web/app/config-history.js", "src/admin/web/app/runtime.js", "src/admin/web/app/settings.js", "src/admin/web/management.js", "src/admin/web/drafts.js", "src/pages.rs", "tools/dev/mock_server.py", "tools/dev/mock_auth.py", "src/forwarding.rs", "src/tinyauth.rs", "src/http3.rs", "src/stream.rs", "src/admin/web/integrations.js", "src/admin/web/traffic-panel.js", "src/prometheus.rs", "src/admin/web/settings.js", "src/admin/web/docker.js", "src/docker.rs", "docker-agent/main.go", "docker-agent/model.go", "docker-agent/docker.go", "docker-agent/network.go", "docker-agent/certificate.go", "docker-agent/server.go", "docker-agent/main_test.go", "docker-agent/rustproxy-docker-agent.service", "docker-agent/install.sh", "docs/DOCKER_DISCOVERY.md", "docs/WEB_SERVER.md", "docs/PHP_FPM.md", "docs/README.md", "docs/TODO.md", "docs/V0.25.5_AUDIT.md", "docs/V0.25.4_AUDIT.md", "docs/V0.25.3_AUDIT.md", "docs/V0.25.2_AUDIT.md", "docs/CHANGELOG_TECHNICAL_ARCHIVE.md", "docs/ROADMAP_HISTORY.md", "tools/checks/docs_check.py", "tools/checks/web_server_contracts.py", "tools/checks/rust_source.py", "tools/checks/rust_module_contracts.py", "tools/checks/source_module_contracts.py", "scripts/runtime/acme_provider.py", "src/basic_auth.rs", "scripts/deploy/deploy.py", "scripts/deploy/deploy_core.py", "scripts/deploy/deploy_runtime.py", "scripts/migration/migrate_npm.py", "scripts/migration/migrate_npm_core.py", "scripts/migration/migrate_npm_api.py", "docs/NPM_MIGRATION.md", "docs/STREAMS.md", "install.sh", "install-debian13.sh", "update.sh", "build.rs", "scripts/build/swagger_assets.py", "src/admin/documentation.rs", "src/admin/openapi.json", "langs/en_US.json", "langs/pl_pl.json", "Dockerfile", ".dockerignore", "docs/CONTAINER.md", "docs/PROMETHEUS.md", "docs/NOT_FOUND_HOSTS.md", "grafana/rustproxy-overview.json"]:
         if not (root / path).is_file():
-            raise ValueError(f"Incomplete RustProxy 0.31.3 source tree: missing {path}")
+            raise ValueError(f"Incomplete RustProxy 0.31.4 source tree: missing {path}")
     text = (root / "src/lib.rs").read_text(encoding="utf-8")
     if '#[path = "auth/mod.rs"]' not in text:
-        raise ValueError("src/lib.rs is not the 0.31.3 entry point; extract the complete package, not individual files.")
+        raise ValueError("src/lib.rs is not the 0.31.4 entry point; extract the complete package, not individual files.")
     return messages
 
 

tools/checks/release_smoke.py

@@ -135,7 +135,7 @@ def upgrade_smoke(tmp: Path) -> None:
     assert backup.is_dir()
     assert (backup / "src/obsolete.rs").is_file()
     assert not (target / "src/obsolete.rs").exists()
-    assert 'version = "0.31.3"' in (target / "Cargo.toml").read_text(encoding="utf-8")
+    assert 'version = "0.31.4"' in (target / "Cargo.toml").read_text(encoding="utf-8")
     assert (target / "data/keep.txt").read_text(encoding="utf-8") == "preserve\n"
     assert (target / ".env").read_text(encoding="utf-8") == "RUST_PROXY_DEMO=0\n"
     assert (target / "langs/site.json").is_file()
@@ -146,7 +146,7 @@ def upgrade_smoke(tmp: Path) -> None:
     assert (target / "docker-agent/certificate.go").is_file()
     assert (target / "docker-agent/server.go").is_file()
     manifest = json.loads((backup / "upgrade.json").read_text(encoding="utf-8"))
-    assert manifest["to_version"] == "0.31.3"
+    assert manifest["to_version"] == "0.31.4"
     assert manifest["removed_obsolete_runtime_state"] is True
     assert not legacy.exists()
     assert not (backup / "legacy-data").exists()
@@ -617,7 +617,7 @@ def source_contract_smoke() -> None:
         assert marker in admin, marker
     anonymous_block = admin.split("fn anonymous_allowed", 1)[1].split("const CERTIFICATE_API_KEY_HEADER", 1)[0]
     assert '"/api/status"' not in anonymous_block
-    assert '"RuntimeInformation"' in openapi_0241 and '"version": "0.31.3"' in openapi_0241
+    assert '"RuntimeInformation"' in openapi_0241 and '"version": "0.31.4"' in openapi_0241
     assert 'id="panel-logging"' not in html
     for marker in ['id="settings-tab-logging"', 'id="settings-page-logging"', 'id="logging-form"', 'id="error-log-form"']:
         assert marker in html, marker
@@ -1108,7 +1108,7 @@ def source_contract_smoke() -> None:
     assert '.managed-update' in main and "flush_hot_to_cold_for_update" in main
     openapi = (ROOT / "src/admin/openapi.json").read_text(encoding="utf-8")
     assert '"/api/config/history/restore"' in openapi
-    for marker in ['"version": "0.31.3"', '"memory_preset"', '"cold_preset"', '"memory_budget_bytes"', '"max_inflight"', '"preset"', '"session_days"', '"session_lifetime_seconds"', '"accept_local_listener_risk"', '"backend_header"', '"backend_timing_header"', '"cold_on_age"', '"match_type"', '"regex_insensitive"', '"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
+    for marker in ['"version": "0.31.4"', '"memory_preset"', '"cold_preset"', '"memory_budget_bytes"', '"max_inflight"', '"preset"', '"session_days"', '"session_lifetime_seconds"', '"accept_local_listener_risk"', '"backend_header"', '"backend_timing_header"', '"cold_on_age"', '"match_type"', '"regex_insensitive"', '"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
         assert marker in openapi, marker
     assert '"software_update"' in openapi and '"update_available"' in openapi
     for marker in ['"/api/certificates/deploy"', '"CertificateDeploy"', '"CertificateDeployResult"', '"/api/certificates/reload"']:
@@ -1313,7 +1313,7 @@ def main() -> None:
     source_contract_smoke()
     container_contract_smoke()
     grafana_contract_smoke()
-    print("PASS: 0.31.3 SQLite/schema-9/upgrade, local-response 404 hosts, Prometheus/Grafana diagnostics, external Debian-packaging separation, cache/dashboard/logging/Nagios, retained admin/H3/stream/TLS contracts and reproducible source archives.")
+    print("PASS: 0.31.4 SQLite/schema-9/upgrade, local-response 404 hosts, Prometheus/Grafana diagnostics, external Debian-packaging separation, cache/dashboard/logging/Nagios, retained admin/H3/stream/TLS contracts and reproducible source archives.")
 
 
 if __name__ == "__main__":

tools/checks/system_info_0301_ui_test.mjs

@@ -43,7 +43,7 @@ const code = js.slice(js.indexOf('    const runtime = latestStatus?.runtime || {
 const elements = new Map();
 const dollar = id => { if (!elements.has(id)) elements.set(id, { textContent: '' }); return elements.get(id); };
 const status = {
-  version: '0.31.3', uptime_seconds: 4201,
+  version: '0.31.4', uptime_seconds: 4201,
   runtime: {
     platform: 'Linux', operating_system: 'Debian GNU/Linux 13', kernel_version: '6.12.0', architecture: 'x86_64',
     statistics_source: 'systemstat+sysinfo', data_directory: '/var/lib/rustproxy', database_path: '/var/lib/rustproxy/config.sqlite3',
@@ -63,7 +63,7 @@ const context = {
 vm.runInNewContext(code, context);
 assert.equal(dollar('runtime-operating-system').textContent, 'Debian GNU/Linux 13');
 assert.equal(dollar('runtime-kernel-version').textContent, '6.12.0');
-assert.equal(dollar('runtime-version').textContent, '0.31.3');
+assert.equal(dollar('runtime-version').textContent, '0.31.4');
 assert.equal(dollar('runtime-logical-cpus').textContent, '8');
 assert.equal(dollar('runtime-cpu-usage').textContent, '17.2%');
 assert.equal(dollar('runtime-python').textContent, 'Available · 3.13.5');
@@ -124,4 +124,4 @@ for (const key of ['python_version','pip_version','certbot_version']) {
   assert.ok(runtimeSchema.properties.certificate_runtime.properties[key]);
   assert.equal(runtimeSchema.properties.certificate_runtime.properties[key].nullable, true);
 }
-console.log('PASS: 0.31.3 legend palette, About cleanup, system tab/navigation, read-only API schema and simulated status rendering.');
+console.log('PASS: 0.31.4 legend palette, About cleanup, system tab/navigation, read-only API schema and simulated status rendering.');

tools/dev/memory_load.py

@@ -54,7 +54,7 @@ def run_load(
     port = parsed.port or (443 if parsed.scheme == "https" else 80)
     tls = ssl._create_unverified_context() if insecure else ssl.create_default_context()
     connection_type = http.client.HTTPSConnection if parsed.scheme == "https" else http.client.HTTPConnection
-    headers = {"user-agent": "RustProxy-Memory-Stress/0.31.3", "accept": "*/*"}
+    headers = {"user-agent": "RustProxy-Memory-Stress/0.31.4", "accept": "*/*"}
     if host_header:
         headers["host"] = host_header