[vsilent]

Security fix for POST /api/admin/bake, found in a review on 2026-10-26.

Problem

• deployment_id was accepted for any deployment whose server is in the platform's Hetzner project. Quick Deploy buyers' servers live in the same project (124705).
• Sanitizing is destructive: it removes the SSH host keys and .env and resets the data volumes, then the box is snapshotted. A mistyped id, or a leaked ADMIN_JWT_SECRET, could wreck a paying customer's server and put their data into a snapshot served to later buyers.
• The old code accepted another user's box with 202; the new test shows it.
• Separately, the health probe followed redirects. The box decides where a redirect points, so the backend could be made to call an internal address (blind SSRF: only the status code leaks).

Change

• The deployment must belong to the caller, otherwise 403.
  • admin_service tokens (User.id = "admin_service") own no box and are refused.
  • bake_pipeline.py calls with the CLI token of the admin who deployed the build box, so it is unaffected.
• A deployment with a managed_usage row (Quick Deploy) is refused with 409, even when the caller made it.
• probe_health (moved to helpers/bake_job.rs) uses redirect::Policy::none(); a 3xx now fails the health check.

Tests, written failing first:

• tests/admin_bake.rs, now as a group_admin user who owns the box:
  • three new refusals, with no job recorded: another user's box, a Quick Deploy server, admin_service;
  • the existing cases still pass.
• Unit test the_health_probe_does_not_follow_a_redirect_off_the_box.
• Also green, against real Postgres: --lib (2303), quick_deploy_server_type, migration_boot_contract. clippy reports nothing in the changed files.

Note for Stage 5. An admin-ui "Bake" button must call with the admin's own token, not an admin_service JWT.

Merging with #310. Both PRs touch src/routes/admin_bake.rs, in different hunks.

🤖 Generated with Claude Code