shankar0123 11b145b641 Merge Fix 06 (HIGH A-6): strict UA/IP binding — close request-empty bypass in MED-16 ...

# Conflicts:
#	CHANGELOG.md
#	internal/api/handler/auth_session_oidc.go
#	internal/api/handler/auth_session_oidc_test.go

2026-05-11 11:19:04 +00:00

..

bootstrap

harden(auth): LOW + Nit batch — bootstrap audit, crypto/rand, XFF trust, CSRF check, protocol-prefix unify (Batch 1)

2026-05-10 22:26:12 +00:00

breakglass

harden(auth): LOW + Nit batch — bootstrap audit, crypto/rand, XFF trust, CSRF check, protocol-prefix unify (Batch 1)

2026-05-10 22:26:12 +00:00

oidc

Merge Fix 06 (HIGH A-6): strict UA/IP binding — close request-empty bypass in MED-16

2026-05-11 11:19:04 +00:00

session

harden(auth/cookies): __Host- prefix on all three auth cookies (MED-14, BREAKING)

2026-05-10 22:52:53 +00:00

user/domain

feat(auth): foundation for MED-11 — users.deactivated_at + 2 catalogue perms

2026-05-11 00:02:57 +00:00

apikey.go

auth-bundle-1 Phase 0: extract internal/auth/ from middleware package

2026-05-09 15:51:31 +00:00

context.go

auth-bundle-1 Phase 3 (primitive): RequirePermission middleware + demo-mode + protocol allowlist

2026-05-09 16:20:04 +00:00

keystore_test.go

auth-bundle-1 follow-on: close coverage gaps to clear Phase 12 floors

2026-05-10 02:04:36 +00:00

keystore.go

auth-bundle-1 Phase 6-7-8: bootstrap path + scope-down CLI + auditor-role split

2026-05-09 20:15:43 +00:00

middleware_test.go

auth-bundle-1 Phase 0: extract internal/auth/ from middleware package

2026-05-09 15:51:31 +00:00

middleware.go

auth-bundle-1 Phase 6-7-8: bootstrap path + scope-down CLI + auditor-role split

2026-05-09 20:15:43 +00:00

protocol_endpoints.go

harden(auth): LOW + Nit batch — bootstrap audit, crypto/rand, XFF trust, CSRF check, protocol-prefix unify (Batch 1)

2026-05-10 22:26:12 +00:00

require_permission_test.go

auth-bundle-1 Phase 3 (primitive): RequirePermission middleware + demo-mode + protocol allowlist

2026-05-09 16:20:04 +00:00

require_permission.go

auth-bundle-1 Phase 3 (primitive): RequirePermission middleware + demo-mode + protocol allowlist

2026-05-09 16:20:04 +00:00

rotation_test.go

auth-bundle-1 Phase 0: extract internal/auth/ from middleware package

2026-05-09 15:51:31 +00:00

testfixtures.go

auth-bundle-1 Phase 0: extract internal/auth/ from middleware package

2026-05-09 15:51:31 +00:00