fix: add ownership checks across LiveViews and clean up compiler warnings

Add project ownership verification to 11 handle_event callbacks across
services, certificates, middleware, secrets, validation rules, rollouts,
and delivery LiveViews to prevent cross-project resource access. Also fix
~20 compiler warnings (unused aliases, variables, ungrouped clauses).

Author: raffaelschneider

lib/sentinel_cp/audit/chain_verifier.ex

@@ -236,7 +236,7 @@ defmodule SentinelCp.Audit.ChainVerifier do
     end
   end
 
-  defp verify_signature(digest, signature) do
+  defp verify_signature(digest, _signature) do
     signing_config = Application.get_env(:sentinel_cp, :bundle_signing, [])
 
     if signing_config[:public_key_path] do

lib/sentinel_cp/auth/sso.ex

@@ -12,7 +12,6 @@ defmodule SentinelCp.Auth.Sso do
   import Ecto.Query, warn: false
   alias SentinelCp.Repo
   alias SentinelCp.Auth.{OidcProvider, SamlProvider}
-  alias SentinelCp.Accounts
   alias SentinelCp.Accounts.User
   alias SentinelCp.Orgs
 
@@ -100,7 +99,8 @@ defmodule SentinelCp.Auth.Sso do
       :crypto.hash(:sha256, code_verifier)
       |> Base.url_encode64(padding: false)
 
-    client_secret = OidcProvider.decrypt_client_secret(provider)
+    # Decrypt now to validate configuration; secret used in token exchange step
+    _client_secret = OidcProvider.decrypt_client_secret(provider)
 
     redirect_uri = oidc_callback_url()
 

lib/sentinel_cp/config_export.ex

@@ -222,9 +222,10 @@ defmodule SentinelCp.ConfigExport do
   end
 
   defp maybe_add(map, _key, nil), do: map
+  defp maybe_add(map, key, value), do: Map.put(map, key, value)
+
   defp maybe_add(map, _key, value, default) when value == default, do: map
   defp maybe_add(map, key, value, _default), do: Map.put(map, key, value)
-  defp maybe_add(map, key, value), do: Map.put(map, key, value)
 
   ## Import helpers
 

lib/sentinel_cp/events/adapters/pagerduty.ex

@@ -24,7 +24,7 @@ defmodule SentinelCp.Events.Adapters.PagerDuty do
     }
   end
 
-  def deliver(routing_key, payload) do
+  def deliver(_routing_key, payload) do
     body = Jason.encode!(payload)
 
     case Req.post(@events_url,

lib/sentinel_cp/events/adapters/webhook.ex

@@ -29,7 +29,7 @@ defmodule SentinelCp.Events.Adapters.Webhook do
     end
   end
 
-  defp build_headers(body, nil) do
+  defp build_headers(_body, nil) do
     [{"content-type", "application/json"}]
   end
 

lib/sentinel_cp/nodes.ex

@@ -486,7 +486,7 @@ defmodule SentinelCp.Nodes do
   end
 
   defp handle_drift_detected(event) do
-    alias SentinelCp.{Events, Projects, Rollouts}
+    alias SentinelCp.{Projects, Rollouts}
     alias SentinelCp.Events, as: Notifications
     alias SentinelCp.Projects.Project
 
@@ -503,7 +503,7 @@ defmodule SentinelCp.Nodes do
   end
 
   defp handle_drift_resolved(event) do
-    alias SentinelCp.{Events, Projects}
+    alias SentinelCp.Projects
     alias SentinelCp.Events, as: Notifications
 
     with node when not is_nil(node) <- get_node(event.node_id),

lib/sentinel_cp/nodes/drift_worker.ex

@@ -14,7 +14,7 @@ defmodule SentinelCp.Nodes.DriftWorker do
   require Logger
 
   import Ecto.Query
-  alias SentinelCp.{Bundles, Events, Nodes, Projects, Repo}
+  alias SentinelCp.{Bundles, Nodes, Projects, Repo}
   alias SentinelCp.Events, as: Notifications
   alias SentinelCp.Bundles.Diff
   alias SentinelCp.Nodes.{DriftEvent, Node}

lib/sentinel_cp/rollouts.ex

@@ -21,7 +21,7 @@ defmodule SentinelCp.Rollouts do
   }
 
   alias SentinelCp.Rollouts.CanaryAnalysis
-  alias SentinelCp.{Bundles, Events, Nodes, Orgs, Projects}
+  alias SentinelCp.{Bundles, Nodes, Orgs, Projects}
   # Events module replaces Notifications with backward-compatible API
   alias SentinelCp.Events, as: Notifications
 

lib/sentinel_cp/rollouts/promotion_worker.ex

@@ -13,7 +13,6 @@ defmodule SentinelCp.Rollouts.PromotionWorker do
   alias SentinelCp.Projects.PromotionRule
   alias SentinelCp.Rollouts
   alias SentinelCp.Rollouts.Rollout
-  alias SentinelCp.Bundles
 
   require Logger
 

lib/sentinel_cp_web/controllers/api/audit_verification_controller.ex

@@ -3,14 +3,7 @@ defmodule SentinelCpWeb.Api.AuditVerificationController do
 
   alias SentinelCp.Audit.ChainVerifier
 
-  def verify(conn, params) do
-    opts =
-      if params["project_id"] do
-        [project_id: params["project_id"]]
-      else
-        []
-      end
-
+  def verify(conn, _params) do
     status = ChainVerifier.verification_status()
 
     chain_status =