security: fix 6 vulnerabilities identified in SDLC audit

- fix(auth): enforce API key scopes in require_role/require_any_role;
  attach _api_key_scopes to user on API key auth; add require_scope()
  dependency — scopes were stored but never enforced (CWE-285)

- fix(sso): read SECURE_COOKIES env var for SSO cookie instead of
  hardcoded secure=False — SAML sessions now respect HTTPS config (CWE-614)

- fix(webhooks): SSRF prevention — validate webhook URLs against private
  and reserved CIDRs at creation/update time (CWE-918)

- fix(knowledge): restrict playbook/lesson create, update and restore
  to admin/red_lead/blue_lead roles — was open to any authenticated user (CWE-284)

- fix(alerts): restrict alert acknowledge/resolve/dismiss to admin/lead
  roles — any user could silence security alerts (CWE-284)

- security: delete get_admin_creds.py, check_auth.py, deploy.py scripts
  containing hardcoded root SSH credentials and production DB access;
  add scripts/.gitignore to prevent reintroduction (CWE-798)

backend/app/routers/knowledge.py

@@ -42,7 +42,7 @@ def list_playbooks(
 def create_playbook(
     body: PlaybookCreate,
     db: Session = Depends(get_db),
-    user=Depends(get_current_user),
+    user=Depends(require_any_role("admin", "red_lead", "blue_lead")),
 ):
     return pb_svc.create_playbook(db, body.model_dump(), user.id)
 
@@ -61,7 +61,7 @@ def update_playbook(
     playbook_id: UUID,
     body: PlaybookUpdate,
     db: Session = Depends(get_db),
-    user=Depends(get_current_user),
+    user=Depends(require_any_role("admin", "red_lead", "blue_lead")),
 ):
     return pb_svc.update_playbook(db, playbook_id, body.model_dump(exclude_unset=True), user.id)
 
@@ -91,7 +91,7 @@ def restore_version(
     playbook_id: UUID,
     version: int,
     db: Session = Depends(get_db),
-    user=Depends(get_current_user),
+    user=Depends(require_any_role("admin", "red_lead", "blue_lead")),
 ):
     """Roll the playbook back to a specific historical version."""
     return pb_svc.restore_version(db, playbook_id, version, user.id)
@@ -159,7 +159,7 @@ def list_lessons(
 def create_lesson(
     body: LessonLearnedCreate,
     db: Session = Depends(get_db),
-    user=Depends(get_current_user),
+    user=Depends(require_any_role("admin", "red_lead", "blue_lead")),
 ):
     return ll_svc.create_lesson_learned(db, body.model_dump(), user.id)
 
@@ -178,7 +178,7 @@ def update_lesson(
     lesson_id: UUID,
     body: LessonLearnedUpdate,
     db: Session = Depends(get_db),
-    user=Depends(get_current_user),
+    user=Depends(require_any_role("admin", "red_lead", "blue_lead")),
 ):
     return ll_svc.update_lesson_learned(
         db, lesson_id, body.model_dump(exclude_unset=True), user.id

backend/app/routers/operational_alerts.py

@@ -88,9 +88,9 @@ def get_alert(
 def acknowledge_alert(
     alert_id: UUID,
     db: Session = Depends(get_db),
-    current_user: User = Depends(get_current_user),
+    current_user: User = Depends(require_any_role("admin", "red_lead", "blue_lead")),
 ):
-    """Acknowledge an open alert."""
+    """Acknowledge an open alert (admin / lead roles only)."""
     return svc.acknowledge(db, alert_id, current_user.id)
 
 
@@ -98,9 +98,9 @@ def acknowledge_alert(
 def resolve_alert(
     alert_id: UUID,
     db: Session = Depends(get_db),
-    current_user: User = Depends(get_current_user),
+    current_user: User = Depends(require_any_role("admin", "red_lead", "blue_lead")),
 ):
-    """Mark an alert as resolved."""
+    """Mark an alert as resolved (admin / lead roles only)."""
     return svc.resolve(db, alert_id, current_user.id)
 
 
@@ -108,9 +108,9 @@ def resolve_alert(
 def dismiss_alert(
     alert_id: UUID,
     db: Session = Depends(get_db),
-    current_user: User = Depends(get_current_user),
+    current_user: User = Depends(require_any_role("admin", "red_lead", "blue_lead")),
 ):
-    """Dismiss an alert (won't re-fire until cooldown resets)."""
+    """Dismiss an alert (admin / lead roles only — won't re-fire until cooldown resets)."""
     return svc.dismiss(db, alert_id, current_user.id)
 
 

backend/app/routers/sso.py

@@ -1,5 +1,7 @@
 """Phase 14: SSO / SAML 2.0 router."""
 
+import os
+
 from fastapi import APIRouter, Depends, HTTPException, Request, Response, status
 from fastapi.responses import RedirectResponse
 from sqlalchemy.orm import Session
@@ -15,7 +17,19 @@ import app.services.sso_service as svc
 router = APIRouter(prefix="/sso", tags=["SSO"])
 
 _COOKIE_NAME = "aegis_token"
-_COOKIE_OPTS = {"httponly": True, "samesite": "lax", "secure": False}
+
+# Mirror the same SECURE_COOKIES logic used in the auth router so that
+# SAML-authenticated sessions respect the deployment's HTTPS configuration.
+_aegis_env = os.environ.get("AEGIS_ENV", "development").lower()
+_secure_cookie_env = os.environ.get("SECURE_COOKIES", "auto").lower()
+if _secure_cookie_env == "false":
+    _IS_HTTPS = False
+elif _secure_cookie_env == "true":
+    _IS_HTTPS = True
+else:  # "auto" — active only when AEGIS_ENV=production
+    _IS_HTTPS = _aegis_env == "production"
+
+_COOKIE_OPTS = {"httponly": True, "samesite": "lax", "secure": _IS_HTTPS}
 
 
 # ── Public ────────────────────────────────────────────────────────────────────