20d3fbf594Merge pull request 'Audit and fix Swagger/OpenAPI accuracy; regenerate served spec' (#40) from docs/swagger-audit into mainColby Whitlock2026-07-05 04:33:36 +00:00
f8db61025bAudit and fix Swagger/OpenAPI accuracy; regenerate served specClaude2026-07-04 22:51:16 -05:00
2067028070Merge pull request 'Enforce TOTP second factor on SSO login (#31)' (#39) from bugfix/sso-totp-bypass-31 into mainColby Whitlock2026-07-05 03:34:49 +00:00
03e62b56adEnforce TOTP second factor on SSO login (#31)Claude2026-07-04 22:17:35 -05:00
15cf8ea286Merge pull request 'Fix SSO flow-token / session type confusion (#32)' (#38) from bugfix/sso-token-confusion-32 into mainColby Whitlock2026-07-05 02:56:31 +00:00
5f62eccdd8Fix SSO flow-token / session type confusion (#32)Claude2026-07-04 21:54:58 -05:00
e8a54d9ff7Merge pull request 'Implement web session/token revocation (#30)' (#37) from bugfix/session-revocation-30 into mainColby Whitlock2026-07-05 02:08:15 +00:00
933206a1b8Implement web session/token revocation (#30)Claude2026-07-04 21:06:50 -05:00
1cfb79f5aeMerge pull request 'Isolate internal bot-config route from the public listener (#33)' (#36) from bugfix/internal-token-endpoint-33 into mainColby Whitlock2026-07-04 22:50:05 +00:00
3ef84b41efMerge branch 'main' into bugfix/internal-token-endpoint-33Colby Whitlock2026-07-04 22:49:33 +00:00
5df943095dIsolate internal bot-config route from the public listener (#33)Claude2026-07-04 17:35:07 -05:00
bb5cc68c54Merge pull request 'Add Discord bot: moderation, filters, scheduling, roles, invites, site integration' (#29) from feature/discord-bot into mainColby Whitlock2026-07-04 21:19:41 +00:00
58852a5078Merge pull request 'Update README for today's security hardening and 2FA work' (#22) from docs/readme-refresh into mainColby Whitlock2026-07-03 06:09:53 +00:00
a82f839c61Update README for today's security hardening and 2FA workClaude2026-07-03 01:07:22 -05:00
05933f8d94Merge pull request 'Fail fast when JWT_SECRET is missing in production (closes#14)' (#21) from fix/jwt-secret-fail-fast into mainColby Whitlock2026-07-03 05:58:16 +00:00
073c010d72Fail fast when JWT_SECRET is missing in production (#14)Claude2026-07-03 00:55:07 -05:00
f305019c54Merge pull request 'Make the hero Moon image configurable (src/alt), backwards-compatible' (#20) from feature/configurable-moon-image into mainColby Whitlock2026-07-03 04:45:24 +00:00
7e8ffeee6fRaise hero upload soft-warning from 1 MB to 5 MBClaude2026-07-02 23:42:23 -05:00
6ab3e47d38Make the hero Moon image configurable via props.srcClaude2026-07-02 23:38:03 -05:00
ea46b5d346Merge pull request 'Admin login hardening: RBAC-safe controls, optional TOTP, bot-scoring + IP ban (closes#9)' (#19) from feature/admin-login-hardening into mainColby Whitlock2026-07-03 04:27:50 +00:00
ad9c556c9aMerge pull request 'Derive uploaded file extension from mimetype, not originalname (fixes#11)' (#18) from fix/upload-extension-xss into mainColby Whitlock2026-07-03 02:44:28 +00:00
e84835a0fbDerive uploaded file extension from mimetype, not originalname (#11)Claude2026-07-02 21:41:56 -05:00
d89cc7e691Merge pull request 'Validate and uniqueness-check username on user update (fixes#13)' (#17) from fix/username-validation-update into mainColby Whitlock2026-07-03 02:39:42 +00:00
43db509293Validate and uniqueness-check username on user update (#13)Claude2026-07-02 21:38:16 -05:00
6b04aa72c1Merge pull request 'Re-validate JWT against the DB in isLoggedIn (fixes#12)' (#16) from fix/stale-jwt-revalidation into mainColby Whitlock2026-07-03 02:32:07 +00:00
81318ae264Merge branch 'main' into fix/stale-jwt-revalidationColby Whitlock2026-07-03 02:31:59 +00:00
853224b578Merge pull request 'Enforce role-based authorization on admin-only routes (fixes#10)' (#15) from fix/role-authorization into mainColby Whitlock2026-07-03 02:31:06 +00:00
8ad18140d0Re-validate JWT against the DB in isLoggedIn (#12)Claude2026-07-02 21:16:43 -05:00
20d7150ab4Enforce role-based authorization on admin-only routes (#10)Claude2026-07-02 21:15:12 -05:00