fix(security): harden CSRF with Content-Type gate and expand E2E coverage (#2818)

Defense-in-depth over GET→POST alone: reject the three CORS-safelisted
simple-form Content-Types (x-www-form-urlencoded, multipart/form-data,
text/plain) on 16 no-body POST handlers (glob + legacy) to block
<form method=POST> CSRF that bypasses method-only gating. Move
comfyui_switch_version to a JSON body so the preflight requirement applies.
Split db_mode/policy/update/channel_url_list into GET(read) + POST(write).
Tighten do_fix (high → high+) and gate three previously-ungated config
setters at middle. Resynchronize openapi.yaml (27 paths, 30 operations,
ComfyUISwitchVersionParams as a shared $ref component). Add E2E harness
variants, Playwright config, CSRF/secgate suites, 39-endpoint coverage,
and a CHANGELOG.

Breaking: legacy per-op POST routes (install/uninstall/fix/disable/update/
reinstall/abort_current) are removed; callers already use queue/batch.
Legacy /manager/notice (v1) is removed; /v2/manager/notice is retained.

Reported-by: XlabAI Team of Tencent Xuanwu Lab
CVSS: 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H)

comfyui_manager/data_models/__init__.py

@@ -57,7 +57,7 @@ from .generated_models import (
     EnablePackParams,
     UpdateAllQueryParams,
     UpdateComfyUIQueryParams,
-    ComfyUISwitchVersionQueryParams,
+    ComfyUISwitchVersionParams,
     QueueStatus,
     ManagerMappings,
     ModelMetadata,
@@ -121,7 +121,7 @@ __all__ = [
     "EnablePackParams",
     "UpdateAllQueryParams",
     "UpdateComfyUIQueryParams",
-    "ComfyUISwitchVersionQueryParams",
+    "ComfyUISwitchVersionParams",
     "QueueStatus",
     "ManagerMappings",
     "ModelMetadata",

comfyui_manager/data_models/generated_models.py

@@ -1,6 +1,6 @@
 # generated by datamodel-codegen:
 #   filename:  openapi.yaml
-#   timestamp: 2025-07-31T04:52:26+00:00
+#   timestamp: 2026-04-19T04:33:23+00:00
 
 from __future__ import annotations
 
@@ -229,8 +229,8 @@ class UpdateComfyUIQueryParams(BaseModel):
     )
 
 
-class ComfyUISwitchVersionQueryParams(BaseModel):
-    ver: str = Field(..., description="Version to switch to")
+class ComfyUISwitchVersionParams(BaseModel):
+    ver: str = Field(..., description="Target ComfyUI version tag")
     client_id: str = Field(
         ..., description="Client identifier that initiated the request"
     )
@@ -502,6 +502,22 @@ class TaskHistoryItem(BaseModel):
     end_time: Optional[datetime] = Field(
         None, description="ISO timestamp when task execution ended"
     )
+    params: Optional[
+        Union[
+            InstallPackParams,
+            UpdatePackParams,
+            UpdateAllPacksParams,
+            UpdateComfyUIParams,
+            FixPackParams,
+            UninstallPackParams,
+            DisablePackParams,
+            EnablePackParams,
+            ModelMetadata,
+        ]
+    ] = Field(
+        None,
+        description="Original task parameters (mirrors QueueTaskItem.params); null if unavailable",
+    )
 
 
 class TaskStateMessage(BaseModel):