With AUTH_DEV_AUTOLOGIN=<username>, every /api request without a valid
session runs as that existing, active user and skips the forced password
change. Unset keeps the normal login; unknown or deactivated users still
get 401, real sessions take precedence, the CSRF application header stays
mandatory and the API logs a warning at startup. The switch is not
limited to localhost because the development instance is reached from
other machines and through a reverse proxy (THREATMODEL D2/R15). It must
never be set on an instance with real project data.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Deploy auf cj-ki: Web-Container nur noch 127.0.0.1:3090, Caddy über das Docker-Netz,
COOKIE_SECURE=true geprüft.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Julian hat am 17.10.2026 bestaetigt: die Software laeuft nur im eigenen
Team, alle Nutzer sehen alle Projekte. Bevor Externe Konten bekommen, wird
Besitz/Freigabe pro Projekt eingefuehrt. R3 (ASVS-light B1/B2) damit nicht
anwendbar; idorGap-Kommentar und AGENTS.md verweisen auf D1.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
