1.23.0 — API-first Admin Security and verified fleet firewall state

2026-09-05

django-mojo 1.23.0 adds a dedicated Admin Security workspace and exact-host firewall verification without breaking established REST administration. Authorized users and validated per-user API keys retain their existing global permissions, group credentials get exact-group read access, legacy rules keep working, and administrators can inspect complete operational evidence. Fresh reauthentication is deployment-configured and off by default; only actual authentication secrets are hidden.

Added

• Dedicated Admin Security workspace and REST endpoints for cases, incidents, events, policies, IPSets, recommendations, action schemas, and firewall state. They add no CORS or request-origin restriction.
• Checked job execution targets one compatible runner per hostname and returns incarnation-correlated verified, partial, or unknown results.
• Optional governed policy actions provide atomic typed validation, server-owned markers, revision binding, and explicit activation while legacy policy APIs remain available.

Changed

• Interactive users and validated per-user UserAPIKey credentials use their existing global security permissions. Group API keys and group-scoped tokens can read only evidence belonging to their exact authenticated group.
• Authorized detail responses retain operational addresses, CIDRs, commands, handler paths, errors, metadata, and raw evidence. Large fields use bounded signed pagination; only authentication secrets are scrubbed.
• Security mutation freshness follows the deployment's FRESH_AUTH_WINDOW / FRESH_AUTH_ENFORCE policy and defaults to off. Proven machine credentials do not require interactive reauthentication.
• Firewall and IPSet state now records durable desired generations and exact-host observations. Incomplete delivery remains pending and is never reported as success.

Fixed

• Markerless legacy RuleSets and Rules retain permissioned generic REST CRUD and continue executing with their established regexes and handlers.
• RuleSet, recommendation, ticket, IPSet, and Assistant approvals reject stale revisions and preserve recoverable state after ambiguous dispatch.
• Policy reparenting and replacement now use consistent transactional locking, preventing stale revisions and direct-save replacement deadlocks.

Security

• Token refresh accepts only genuine refresh tokens; access, OAuth/MCP, per-user API-key, group-token, and account API-key credentials cannot be exchanged into ordinary bearer sessions.
• Governed policy markers are immutable and server-owned, and malformed reserved markers fail closed.
• Admin Security action audits retain non-secret server-authored credential provenance without exposing tokens or signing material.

Upgrade notes

• Apply migrations before serving traffic. Existing firewall-touched or whitelisted IP rows and legacy IPSets become pending because earlier best-effort broadcasts are not proof of current fleet state.
• Run at least one checked-protocol job engine on every intended hostname before relying on checked firewall actions, then synchronize pending IPSets and firewall state.
• Invalid or IPv6 firewall targets and malformed, reserved, oversized, or excessively large legacy IPSets are quarantined for operator repair; valid sibling rows continue reconciling.
• No RuleSet/Rule migration is required. Existing management clients may keep using the legacy-compatible endpoints and adopt governed actions only when they want the stronger workflow.