task: #3610501 Pre-1.0.0-alpha11 hardening: anonymous page-cache safety, task-signal guard, client https allowlist, and missing tests

Frank Mablyrequested to merge
issue/orchestra-3610501:3610501-pre-1.0.0-alpha11-hardening-anonymous into 1.x

Audit-driven pre-1.0.0-alpha11 hardening. One MR, each item with a test.

Security and correctness

  • Anonymous page cache serves a stale step. The dispatcher's step/comment pages set render max-age 0, which the dynamic page cache honors but core's internal page cache ignores, so an anonymous bearer-link visitor (the route's main audience) could be served a stale step: the #3609153 bug's other half. Adds no_cache to orchestra_interaction.step and .comment.
  • Task signal route: guarded-outcome bypass + uncaught 500. InteractionTaskController::signal() resumed any URL outcome, neither refusing a guarded outcome (the operation twin already does) nor catching the InvalidArgumentException a deconfigured outcome raises. Mirrors the operation controller.
  • CommentForm (the embedded decision for every review interaction) resumed without catching that same exception. Caught.
  • ContextMessages rendered an admin-configured label through Markup without escaping. Escaped before token replacement.
  • Client https was form-only. A config import could downgrade the OAuth credential channel to http. Adds a settings.php orchestra_client.allow_http_hosts allowlist (OR-ed with loopback) in a shared HttpsPolicy, re-checked at request time in the token provider and client so an import cannot bypass the form.

Tests

Client https + the new allowlist; stored-card cleanup on run end (a privacy path that was untested); interaction config-schema strict-save; the task-signal and CommentForm guards.

Docs and translation

Drop the retired HandlerUrlInterface, document ReviewInteractionBase, fix em-dashes, complete the French translations touched by recent features.

Full orchestra kernel suite (137 files) green locally; phpcs/cspell clean; phpstan adds no new errors.

Merge request reports