Gan, Jimmy 1a37f34401 auth: Sprint 02 — auth hardening (Pydantic models, challenge binding, admin gates) ...

- Add max_length validation to LoginRequest (username 128, password 1024)
- Replace raw request.json() with Pydantic models in RBAC override/update endpoints
- Replace raw request.json() with Pydantic models in passkey register/login/delete
- Bind passkey challenges to session-bound challenge_id (prevents cross-session replay)
- Gate audit log and security log endpoints behind admin role
- Fix fragile opc_db.json.dumps() → import json directly
- Add COOKIE_SECURE=False startup warning (suppress with ALLOW_INSECURE_COOKIES)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

2026-05-03 13:45:42 +08:00

..

integration

auth: Sprint 02 — auth hardening (Pydantic models, challenge binding, admin gates)

2026-05-03 13:45:42 +08:00

unit

feat: comprehensive test infrastructure improvements

2026-04-08 00:21:32 +08:00

__init__.py

feat: add comprehensive unit and integration testing infrastructure

2026-03-30 11:11:39 +08:00

conftest.py

security: Sprint 00 — critical security fixes (OPC WS auth, Transmission creds, SECRET_KEY, passkey rate limit)

2026-05-03 13:31:25 +08:00

test_basic.py

feat: comprehensive test infrastructure improvements

2026-04-08 00:21:32 +08:00