jappel/leistungsbilanz-ts
1
0
Fork 1
Code Issues 5 Pull requests Projects Releases Packages Wiki Activity Actions 3
305 commits 1 branch 2 tags 7.4 MiB
Commit graph

4 commits

Author SHA1 Message Date
Julian Appel
084002bea9 Add AUTH_DEV_AUTOLOGIN to switch off the login on development instances 
With AUTH_DEV_AUTOLOGIN=<username>, every /api request without a valid
session runs as that existing, active user and skips the forced password
change. Unset keeps the normal login; unknown or deactivated users still
get 401, real sessions take precedence, the CSRF application header stays
mandatory and the API logs a warning at startup. The switch is not
limited to localhost because the development instance is reached from
other machines and through a reverse proxy (THREATMODEL D2/R15). It must
never be set on an instance with real project data.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-30 09:03:29 +01:00
Grovy311
0ee9e4dd38 docs(security): R6 behoben, LAN-Port 3090 geschlossen
Some checks failed
security-baseline / secrets (push) Has been cancelled
Details
security-baseline / node (push) Has been cancelled
Details
security-baseline / semgrep (push) Has been cancelled
Details
security-baseline / trivy (push) Has been cancelled
Details 
Deploy auf cj-ki: Web-Container nur noch 127.0.0.1:3090, Caddy über das Docker-Netz,
COOKIE_SECURE=true geprüft.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-17 13:13:18 +02:00
Grovy311
e51752f3e1 docs(security): Design-Entscheidung D1 (Projekte teamweit geteilt) eintragen
Some checks are pending
security-baseline / secrets (push) Waiting to run
Details
security-baseline / node (push) Waiting to run
Details
security-baseline / semgrep (push) Waiting to run
Details
security-baseline / trivy (push) Waiting to run
Details 
Julian hat am 17.10.2026 bestaetigt: die Software laeuft nur im eigenen
Team, alle Nutzer sehen alle Projekte. Bevor Externe Konten bekommen, wird
Besitz/Freigabe pro Projekt eingefuehrt. R3 (ASVS-light B1/B2) damit nicht
anwendbar; idorGap-Kommentar und AGENTS.md verweisen auf D1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-17 12:56:23 +02:00
Grovy311
1cf406d216 docs(security): Threat-Model anlegen, Entscheidung zu geteilten Projekten offen
Some checks are pending
security-baseline / secrets (push) Waiting to run
Details
security-baseline / node (push) Waiting to run
Details
security-baseline / semgrep (push) Waiting to run
Details
security-baseline / trivy (push) Waiting to run
Details 
docs/THREATMODEL.md (threat-model-light): System, Assets, Angreifer,
Vertrauensgrenzen, Risiken R1-R14 mit Beleg. R3 (ASVS-light B1/B2) bleibt
offen, bis Julian E1 (Projekte teamweit geteilt) bestaetigt. idorGap-
Kommentar und AGENTS.md verweisen darauf.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-17 12:40:43 +02:00