Mondo Diaz
|
d61c7a71fb
|
Add project-level authorization checks
Authorization:
- Add AuthorizationService for checking project access
- Implement get_user_access_level() with admin, owner, and permission checks
- Add check_project_access() helper for route handlers
- Add grant_access() and revoke_access() methods
- Add ProjectAccessChecker dependency class
Routes:
- Add authorization checks to project CRUD (read, update, delete)
- Add authorization checks to package create
- Add authorization checks to upload endpoint (requires write)
- Add authorization checks to download endpoint (requires read)
- Add authorization checks to tag create
Tests:
- Fix pagination flakiness in test_list_projects
- Fix pagination flakiness in test_projects_search
- Add API key authentication to concurrent upload test
|
2026-01-08 16:20:42 -06:00 |
|
Mondo Diaz
|
b1c17e8ab7
|
Add security hardening and additional auth tests
Security improvements:
- Add password strength validation (min 8 characters)
- Invalidate all sessions on password change/reset
- Add timing-safe user lookup to prevent enumeration attacks
- Fix SQLAlchemy boolean comparisons (== True -> is_(True))
- Change default admin password to 'changeme123' (meets min length)
New tests (7 additional):
- Inactive user login attempt blocked
- Short password rejected on create/change/reset
- Duplicate username rejected (409)
- Non-owner API key deletion blocked (403)
- Sessions invalidated on password change
|
2026-01-08 15:37:53 -06:00 |
|
Mondo Diaz
|
2a68708a79
|
Add user authentication system with API key management (#50)
- Add User, Session, AuthSettings models with bcrypt password hashing
- Add auth endpoints: login, logout, change-password, me
- Add API key CRUD: create (orch_xxx format), list, revoke
- Add admin user management: list, create, update, reset-password
- Create default admin user on startup (admin/admin)
- Add frontend: Login page, API Keys page, Admin Users page
- Add AuthContext for session state management
- Add user menu to Layout header with login/logout/settings
- Add 15 integration tests for auth system
- Add migration 006_auth_tables.sql
|
2026-01-08 15:01:37 -06:00 |
|
Mondo Diaz
|
10d3694794
|
Add drag-and-drop upload component with chunked uploads and offline support
|
2026-01-08 11:59:32 -06:00 |
|
Mondo Diaz
|
35fda65d38
|
Add download verification with SHA256 checksum support (#26, #27, #28, #29)
|
2026-01-07 13:36:46 -06:00 |
|
Mondo Diaz
|
2f1891cf01
|
Metadata database tracks all uploads with project, package, tag, and timestamp queryable via API
|
2026-01-07 12:31:44 -06:00 |
|
Mondo Diaz
|
7e68baed08
|
Add ref_count management for deletions with atomic operations and error handling
|
2026-01-06 13:44:23 -06:00 |
|