fix(security): close role escalation, music SSRF, and permission gaps

[raigon-pawa]

Full security audit of the codebase (permission enforcement, injection points, the role system, the music resolver, mention handling, workflows, dependencies). Five findings, all fixed here; one dependency advisory documented as upstream-blocked.

1. Role privilege escalation (high)

/selfrole add and /levelrole set accepted any role — including roles above the acting admin's own, or roles with Administrator/Manage Server — and the panel button would then grant them to anyone who clicked.

Fix: a _grantable_denial guard rejects roles that are ≥ the acting admin's top role, above the bot's top role, managed/integration roles, @everyone, and any role with moderation/management permissions (_ELEVATED mask). The button callback and on_level_up re-validate at grant time, so a role edited after being configured can't sneak through.

2. SSRF via /music play (high on a self-hosted box)

Any URL not matching a known site fell through to yt-dlp's Generic extractor, which fetches the URL directly — so /music play http://192.168.1.1/... made the bot fetch arbitrary LAN/internal URLs from the NAS.

Fix: pre-flight extractor matching rejects Generic-only URLs before any network I/O (checking after extraction would be too late). Search text is unaffected; known-site links are unaffected. Friendly error for direct links.

3. Missing server-side permission checks (medium)

default_permissions is only a UI default — server admins can override it per-command in Integration settings. moderation and /prefix already double-checked in code; /selfrole, /levelrole, /automod, /logging, and /welcome did not.

Fix: explicit has_permissions checks on every subcommand (existing error handlers already reply cleanly).

4. Reminder ping abuse (low)

Reminder text is user-controlled and replayed by the bot later, with user pings allowed — targeted ping-spam by proxy. Also unlimited pending reminders (DB growth + spam-at-fire).

Fix: delivery restricts allowed_mentions to the reminder's owner only; text capped at 500 chars; 25 pending reminders per user.

5. Workflow token scope (hardening)

CI and deploy workflows now declare least-privilege permissions (CI: contents: read; deploy: {} — it never uses the token).

Dependency audit

pip-audit: PyNaCl 1.5.0 → CVE-2025-69277 (fixed in 1.6.2), but discord.py 2.7.1 (latest) pins PyNaCl<1.6, so the fix can't be installed without overriding the library's constraint. Documented in the CHANGELOG; bump when discord.py relaxes the pin. No other known vulns in the dependency set.

Verified clean

Parameterized SQL throughout (no injection), no dangerous sinks (eval/subprocess/pickle), global allowed_mentions blocks @everyone/@roles, owner commands properly gated, AI cog has no tool use (prompt-injection blast radius ≈ nil), Docker already hardened.

Testing

• 21 → 23 tests: new SSRF-guard tests (internal IPs, link-local metadata address, direct file links rejected; YouTube/SoundCloud accepted).
• End-to-end check: _resolve("http://192.168.1.1/internal.mp3") raises before any fetch.
• ruff + ruff format + full suite green.

🤖 Generated with Claude Code