SCM BPA Report Tool for PAN-OS TSF Uploads

Hardening: HSTS + cross-origin isolation headers, download proxy no longer follows redirects, SCM upload URL is allowlist-checked, report filenames are RFC 5987 encoded, and rate limiting trusts only Cloudflare's connecting IP.

Token security: upload and download tokens now use a dedicated signing key (no R2 secret reuse) and distinct HMAC context prefixes, so a token for one purpose cannot be reused for the other.

Security controls now fail closed: if the rate-limit / download-token Durable Object binding is missing, the Worker returns 503 instead of silently skipping rate limiting and single-use token enforcement.

Security hardening: the public Worker no longer falls back to server-side PANW credentials (closes an open-proxy risk), and the local Node dev server was removed so development and production share one code path (worker.js, run locally via wrangler dev).

TSF config XML picker moved to an English modal shown after the archive scan, with found-file details in the dialog.

TSF uploads: choose .merged-running-config.xml (Panorama-managed) or running-config.xml (standalone / Panorama) with guidance in the upload form.

Removed browser direct upload to SCM GCS (not supported — no CORS). Production flow is browser → R2 → Worker → SCM only, avoiding orphan SCM jobs that consumed the 5 concurrent slots per TSG.

SCM concurrency guidance updated: 5 active jobs per TSG, ~30 minute stuck-job timeout, required upload headers, and no cancel API.

SCM active upload job limits (HTTP 429) now show a clear alert with plain-language status and log guidance.

Production uploads now go browser → SCM directly (no R2 hop). If CORS or network blocks the direct PUT, the tool falls back to extracting config XML from TSF and using the R2 path.

TSF uploads to SCM now stream reliably: the archive is sent with gzip transit encoding, chunked, and without re-compression.

Fixed large TSF uploads dropping mid-transfer by streaming the archive to SCM without re-compressing it, which previously exhausted the worker's memory limit.

Fixed TSF uploads to SCM by sending the archive with the same gzip transit encoding the direct-XML path uses, which the signed upload URL requires.

Fixed large TSF uploads failing with "Network connection lost" by sending the archive to SCM with a fixed Content-Length instead of chunked streaming.

TSF archives are now passed straight to SCM, which decompresses them and auto-selects the correct config (merged-running-config for Panorama-managed firewalls, running-config for standalone). This is the most accurate path and removes browser-side config guessing. Uploading a config XML directly still works.

Added cache-busting for frontend assets so browsers load the latest TSF config selection fix instead of a stale cached app.js.

Fixed a bug where some TSF archives uploaded the wrong config XML (for example, a small HA remote stub instead of the full merged running config). BPA jobs could complete but return incomplete report JSON. The tool now scores all XML candidates and selects the best match.

Security hardening: local server binds to loopback by default, download proxy host allowlist, decompression size limits, and stronger upload-session token signing. Removed unused legacy upload code. CI now runs syntax checks before deploy.

Adopted semantic versioning, added GitHub Actions deployment, and rewrote project documentation. Browser extracts config XML from TSF and uploads directly to R2 so Worker memory is not used for large archives.

Introduced in-browser TSF streaming extraction, R2 direct upload, signed report download proxy, rate limiting, and automatic Bearer token flow for SCM Posture BPA.