Gan, Jimmy
1a37f34401
auth: Sprint 02 — auth hardening (Pydantic models, challenge binding, admin gates)
- Add max_length validation to LoginRequest (username 128, password 1024)
- Replace raw request.json() with Pydantic models in RBAC override/update endpoints
- Replace raw request.json() with Pydantic models in passkey register/login/delete
- Bind passkey challenges to session-bound challenge_id (prevents cross-session replay)
- Gate audit log and security log endpoints behind admin role
- Fix fragile opc_db.json.dumps() → import json directly
- Add COOKIE_SECURE=False startup warning (suppress with ALLOW_INSECURE_COOKIES)
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-03 13:45:42 +08:00
..
2026-05-03 13:45:42 +08:00
2026-05-03 13:35:57 +08:00
2026-04-10 01:00:49 +08:00
2026-02-19 21:40:34 +08:00
2026-02-21 11:05:00 +08:00
2026-05-03 13:31:25 +08:00
2026-05-03 13:31:25 +08:00
2026-04-10 01:00:49 +08:00
2026-04-08 10:31:34 +08:00