fix: validate control panel runtime paths

central/app/web.py

@@ -10,7 +10,7 @@ from sqlalchemy import select
 from .config import settings
 from .control_plane import dashboard_summary, list_blockers, list_installations, list_jobs, list_panel_events
 from .human_auth import create_session, current_session, require_csrf, verify_password
-from .models import AdminUser, Installation, Agent
+from .models import AdminUser, Installation, Agent, Job
 from .jobs import create_job
 from .audit import record_audit
 
@@ -23,7 +23,8 @@ def router(session_factory):
         return current_session(request, session)
 
     def render(request, template, context=None, status_code=200):
-        return templates.TemplateResponse(template, {"request": request, **(context or {})}, status_code=status_code)
+        values = {"request": request, "csrf_token": request.cookies.get("gti_csrf", ""), **(context or {})}
+        return templates.TemplateResponse(request=request, name=template, context=values, status_code=status_code)
 
     @routes.get("/login", response_class=HTMLResponse)
     def login_page(request: Request):
@@ -43,10 +44,12 @@ def router(session_factory):
         return response
 
     @routes.post("/logout")
-    def logout(request: Request):
+    async def logout(request: Request):
         with session_factory() as session:
             web_session, admin = current_session(request, session)
             if web_session:
+                values = await form_values(request)
+                require_csrf(web_session, values.get("csrf_token"))
                 session.delete(web_session); session.commit()
         response = RedirectResponse("/login", status_code=303)
         response.delete_cookie(settings.web_cookie_name); response.delete_cookie("gti_csrf")
@@ -99,7 +102,8 @@ def router(session_factory):
             agent = session.get(Agent, agent_id)
             installation = session.scalar(select(Installation).where(Installation.agent_id == agent_id))
             if not agent or not installation: return HTMLResponse("Agent not found", status_code=404)
-            job = create_job(session, agent, "REPROCESS_ALL", {})
+            existing = next((candidate for candidate in session.scalars(select(Job).where(Job.agent_id == agent.id, Job.kind == "REPROCESS_ALL", Job.status == "PENDING")).all() if candidate.payload == {}), None)
+            job = existing or create_job(session, agent, "REPROCESS_ALL", {})
             record_audit(session, admin_user_id=admin.id, tenant_id=installation.tenant_id, action="REPROCESS_ALL", target_type="installation", target_id=installation.installation_id, context={"job_id": job.id})
             session.commit()
             return RedirectResponse(f"/agents/{agent_id}?tab=jobs", status_code=303)