3 Commits

Author	SHA1	Message	Date
Edouard Vanbelle	badf35f08f	chore: remove all executable attributes on non bash files	2026-04-01 23:14:42 +02:00
Dionisio	f2d35ca792	feat: auto-persist JWT secret, remove setup token requirement ... - JWT secret auto-generates and persists to <STORAGE_PATH>/.jwt_secret - Remove setup token: first admin setup is open until system initialized - Fix schema.sql: move CREATE EXTENSION pg_trgm/ltree to top - Update login UI and auth.js to remove setup token fields	2026-03-05 22:12:53 +01:00
Dionisio	d2c08d31ba	feat(security): HttpOnly cookies + CSP headers + CSRF double-submit protection ... - Migrate auth tokens from localStorage to HttpOnly SameSite=Lax cookies - Add cookie_auth.rs: helpers for setting/clearing auth + CSRF cookies - Update auth middleware: 3-method auth (Bearer → Basic → Cookie) - Add 5 security headers: CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy - Implement CSRF double-submit cookie pattern (csrf.rs middleware) - Set CSRF cookie on login/refresh/oidc-exchange, clear on logout - CookieAuthenticated marker skips CSRF for Bearer/Basic clients - Frontend: strip all localStorage token refs from 14 JS files - Frontend: csrf.js utility + all 52 mutating fetch/XHR calls protected - 121 tests passing, 0 warnings	2026-03-03 01:10:50 +01:00