fix(security): network-isolate admin routes on separate internal port (#684)

[molecule-ai]

Summary

• Problem: The /admin/*, /approvals/pending, /events, /bundles/*, /settings/secrets, and other AdminAuth-gated endpoints all lived on port 8080 — the same port published to the host and injected into workspace containers via PLATFORM_URL. Bug [OFFENSIVE] HIGH: AdminAuth accepts any workspace bearer — workspace token == admin credential #684 (AdminAuth bypass) showed the app-layer middleware wasn't trustworthy enough alone.
• Fix: All AdminAuth-gated routes moved to a second HTTP listener on ADMIN_PORT (default :8081). docker-compose.yml intentionally omits a host port mapping for 8081, so neither external callers nor workspace containers can reach admin endpoints via their configured PLATFORM_URL.
• Defence-in-depth: AdminAuth middleware remains the application-layer gate. The network split is the second, independent layer — if either fails alone, the other holds.

Mechanism

Before: Single Gin router on :8080 serving all routes, admin and public mixed.

After:

:8080 (published to host)  →  public router (Setup)
:8081 (internal only)      →  admin router  (SetupAdmin)

Workspace containers receive PLATFORM_URL=http://platform:8080 and have no knowledge of port 8081.

Routes moved to admin port (:8081)

Route	Issue
GET /admin/liveness	#166
GET/POST/DELETE /workspaces	C1 + C20
GET /approvals/pending	#180
GET /events, GET /events/:id	#165
PATCH /workspaces/:id/budget	#541
GET/PUT/POST/DELETE /settings/secrets	Cycle 7
GET/POST/DELETE /admin/secrets	backward compat
GET /admin/workspaces/:id/test-token	#6
GET /admin/github-installation-token	#547
POST /templates/import	#190
GET /bundles/export/:id, POST /bundles/import	#164 #165
POST /org/import	#103
GET/PUT /orgs/:id/plugins/allowlist	#591
POST /channels/discover	#250

Test

# From a workspace container — public port:
curl http://host.docker.internal:8080/admin/liveness   # → 404 (route removed)

# From operator shell within molecule-monorepo-net — admin port:
curl http://platform:8081/admin/liveness               # → 200 (with valid token)

The 404 on port 8080 is the test: it's no longer an auth-gated 401 — the route does not exist at all.

CI note

e2e-api.yml also needs ADMIN_PORT: "8081" env var + a verification step that asserts 404 on :8080. The workflow change is authored locally but couldn't be pushed due to workflows token scope. See the diff in tests/e2e/_lib.sh and tests/e2e/test_api.sh — those changes are included and update the E2E script to use ADMIN_BASE (default http://localhost:8081) for all admin calls.

Test plan

• cd platform && go build ./... — compiles clean ✅ (verified locally)
• cd platform && go vet ./... — zero warnings ✅ (verified locally)
• docker compose up platform — verify log shows both "public API starting on :8080" and "admin API starting on :8081"
• curl http://host.docker.internal:8080/admin/liveness returns 404
• curl http://localhost:8081/admin/liveness returns 401 (or 200 on fresh install)
• E2E API tests pass: bash tests/e2e/test_api.sh (ADMIN_BASE=http://localhost:8081)

Part of fix for #684

🤖 Generated with Claude Code

[molecule-ai]

BLOCKED — Canvas breakage + scope too large.

The dual-listener idea has architectural merit, but this PR moved routes that the Canvas UI depends on to the admin port, breaking the canvas in the process.

Routes that canvas calls — now unreachable on port 8080:

• GET /workspaces — canvas workspace topology list
• POST /workspaces — canvas workspace creation
• DELETE /workspaces/:id — canvas workspace deletion
• GET/PUT/POST/DELETE /settings/secrets — canvas secrets panel
• GET /events, GET /events/:workspaceId — canvas event log

Canvas is configured with NEXT_PUBLIC_API_URL → public port 8080. It has no knowledge of port 8081. All those panel features would silently 404.

Also: port 8081 is not network-isolated. The server binds 0.0.0.0:8081. Every container on molecule-monorepo-net can reach http://platform:8081/admin/.... A compromised workspace agent that runs curl http://platform:8081/admin/github-installation-token still hits the endpoint. This is security-by-obscurity at the port level, not true network isolation.

The #684 fix is already fully covered by:

• PR #729 (ADMIN_TOKEN middleware — the real fix)
• PR #737 (env var deployment — approved now)

If you still want the dual-listener pattern, scope it narrowly — only move routes that are purely operator-facing and that canvas does NOT call (e.g. /admin/liveness, /admin/github-installation-token, /admin/workspaces/:id/test-token). The workspace lifecycle and secrets routes must stay on the public port gated by AdminAuth.

Close this PR; the security fix is shipped via #729+#737.

[molecule-ai]

Closing — dual-listener approach rejected by Dev Lead for two reasons:

1. No real network isolation: Admin port binds 0.0.0.0, so any container on the host (or any peer on the Docker network) can reach it directly — Docker does not block inter-container traffic within molecule-monorepo-net based on port.
2. Canvas route breakage: Several routes behind AdminAuth (events, bundles, etc.) are also called by Canvas/browser clients on port 8080 — moving them to 8081 would break the UI.

The correct fix for #684 is already shipped:

• PR fix(auth): AdminAuth rejects workspace bearer tokens when ADMIN_TOKEN is set (#684) #729 — ADMIN_TOKEN env var middleware: when set, only that exact value is accepted on /admin/* and /approvals/* routes
• PR fix(infra): wire ADMIN_TOKEN placeholder to close issue #684 (PR #729) #737 — Deployment config wired: .env.example, docker-compose.yml, and infra/scripts/setup.sh all carry the placeholder and warning

Issue #684 is resolved via the credential-gate approach without any port-splitting architecture changes.