5 Commits

Author	SHA1	Message	Date
Dionisio	f2d35ca792	feat: auto-persist JWT secret, remove setup token requirement ... - JWT secret auto-generates and persists to <STORAGE_PATH>/.jwt_secret - Remove setup token: first admin setup is open until system initialized - Fix schema.sql: move CREATE EXTENSION pg_trgm/ltree to top - Update login UI and auth.js to remove setup token fields	2026-03-05 22:12:53 +01:00
Dionisio	d2c08d31ba	feat(security): HttpOnly cookies + CSP headers + CSRF double-submit protection ... - Migrate auth tokens from localStorage to HttpOnly SameSite=Lax cookies - Add cookie_auth.rs: helpers for setting/clearing auth + CSRF cookies - Update auth middleware: 3-method auth (Bearer → Basic → Cookie) - Add 5 security headers: CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy - Implement CSRF double-submit cookie pattern (csrf.rs middleware) - Set CSRF cookie on login/refresh/oidc-exchange, clear on logout - CookieAuthenticated marker skips CSRF for Bearer/Basic clients - Frontend: strip all localStorage token refs from 14 JS files - Frontend: csrf.js utility + all 52 mutating fetch/XHR calls protected - 121 tests passing, 0 warnings	2026-03-03 01:10:50 +01:00
Dionisio	4c98c5a657	style: apply cargo fmt to entire codebase ... Standardize code formatting across all 173 Rust source files using rustfmt. No functional changes - purely cosmetic. This establishes a consistent code style baseline for the project going forward.	2026-02-14 01:29:34 +01:00
Diocrafts	a82faa5eaf	refactoring hexagonal and clean architecture	2026-02-08 13:40:23 +01:00
root	fe19bc8505	Initial commit	2025-03-17 21:28:08 +01:00