fix(security): MagicAI model-fetch SSRF + role permission escalation - #689

Summary

Two high-severity findings from a full-project security audit, both fixed with minimal, backward-compatible patches.

1. Privilege escalation via role editing (broken access control)

RoleController::store/update wrote the submitted permissions[] verbatim; RoleForm::authorize() blocked only promotion to all. A delegated role manager (custom role holding settings.roles.edit) could edit its own role to grant permissions it did not hold → vertical privilege escalation.

Fix: RoleForm::authorize() now also rejects any permission the acting admin does not itself hold — mirroring the guard already in UserController::roleAssignmentError(). Adds the cannot-grant-unheld-permissions message across all 33 locales.

2. SSRF in MagicAI model discovery

fetchModels validated the submitted api_url with SafeWebhookUrl, then fetched it with a bare Guzzle client that follows redirects and re-resolves DNS. A validated public URL could pivot to an internal host (cloud metadata / RFC1918) via a 30x redirect or DNS rebinding.

Fix: the user-supplied fetches (Custom / Azure / Ollama) now merge SafeWebhookUrl::httpOptions($url) — IP-pinning + no redirect following — matching the already-hardened runtime AiApiClient. Fixed-host provider branches are unchanged.

Backward compatibility

• Full-access admins and admins granting only permissions they hold are unaffected; only the escalation path now returns 403.
• Legitimate remote AI providers don't redirect to internal IPs, so model discovery keeps working; only redirect-to-internal / rebind is blocked.

Tests

• Settings/RolePermissionEscalationTest — self-escalation, other-role escalation, promote-to-all all forbidden; held-permission edit allowed.
• MagicAI/FetchModelsSsrfTest — validated URL still follows a redirect on a bare client (repro); SafeWebhookUrl::httpOptions blocks it (fix primitive).

Verification

pint, phpstan (level 2), pest, and unopim:translations:check (418/418) all passed on identical code in the working checkout. CI runs the full suite on this clean branch.