Estrella Pan c7c709fa66 fix(security): harden auth, JWT, WebAuthn, and API endpoints ...

- Persist JWT secret to config/.jwt_secret (survives restarts)
- Change active_user from list to dict with timestamps
- Extract username from cookie token instead of list index
- Add SSRF protection (_validate_url) for setup test endpoints
- Mask sensitive config fields (password, api_key, token, secret)
- Add auth guards to notification test endpoints
- Fix path traversal in /posters endpoint using resolved path check
- Add CORS middleware with empty allow_origins
- WebAuthn: add challenge TTL (300s), max capacity (100), cleanup
- Remove hardcoded default password from User model
- Use timezone-aware datetime in passkey models
- Adapt unit tests for active_user dict and cookie-based auth

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-23 11:46:12 +01:00

..

.vscode

…

scripts

…

src

fix(security): harden auth, JWT, WebAuthn, and API endpoints

2026-02-23 11:46:12 +01:00

.pre-commit-config.yaml

…

dev.sh

…

pyproject.toml

test(e2e): add comprehensive E2E integration test suite

2026-02-23 11:44:03 +01:00

uv.lock

feat(mcp): add MCP server for LLM tool integration via SSE

2026-02-22 16:42:39 +01:00