Repository navigation

Core improvements - #6

Merged

Vincent-Stragier merged 37 commits into

mainfrom

core-improvements

Aug 28, 2026

Commits on Aug 21, 2026

feat(config): make the displayed product name configurable
aloCetic
committed
1174257
refactor(server): load app modules before building the Tornado app
aloCetic
committed
878ee61
feat(auth): PYPLET_SESSION_TTL_DAYS — promote session TTL to config Param

Arthur LORIN
authored and
aloCetic
committed
6f9855b
feat(auth): Drive incremental consent + server-side token hooks

Arthur LORIN
authored and
aloCetic
committed
2b06e89
Test: declare pytest-asyncio in the test extra

authored and
Arthur LORIN
committed
b31cb2b
feat(auth): fail-closed startup policy and deny-by-default ACL

Arthur LORIN
authored and
aloCetic
committed
50fbfc1
feat(auth): Secure session cookie and a required persistent cookie secret

Arthur LORIN
authored and
aloCetic
committed
c9849ea
docs(auth): state the cookie-secret and session-TTL semantics

Arthur LORIN
authored and
aloCetic
committed
a27cf85
feat(auth): verify the OIDC id_token signature against the provider JWKS

Arthur LORIN
authored and
aloCetic
committed
f2352ee
feat(server): unauthenticated /healthz liveness route

Arthur LORIN
authored and
aloCetic
committed
03cbffb
feat(server): PYPLET_WS_MAX_MESSAGE_MB knob for the WebSocket frame size

Arthur LORIN
authored and
aloCetic
committed
fce2356
feat(server): Tornado production hardening — debug off, xheaders, check_origin

Arthur LORIN
authored and
Arthur LORIN
committed
c363c99
docs(readme): document the production-profile guards

Arthur LORIN
authored and
aloCetic
committed
292ffca
fix(tests): boot the e2e server anonymously on a free port

Arthur LORIN
authored and
aloCetic
committed
50d24f1
feat(server): routes() hook for app-declared Tornado handlers

Arthur LORIN
authored and
aloCetic
committed
1162fd6
feat(server): thread the WS-resolved login onto ServerWebSocket

Arthur LORIN
authored and
aloCetic
committed
e7bbaad
fix(server): restore permessage-deflate get_compression_options override

authored and
Arthur LORIN
committed
a1a8528
feat(server,client): boot splash during the Pyodide bootstrap

Arthur LORIN
authored and
aloCetic
committed
b6d4cc6
fix(client): self-heal a missing micropip at boot

Arthur LORIN
authored and
aloCetic
committed
54f5338

Commits on Aug 25, 2026

oauth: replace Google/Drive hardcoding with a provider registry

Arthur LORIN
authored and
Arthur LORIN
committed
19ab482
docs(oauth): drop the false "byte-for-byte" migration claim

Arthur LORIN
authored and
Arthur LORIN
committed
f9abcac
Merge branch 'degoogle/oauth-generic-providers' into 'core/client-boot'
aloCetic
committed
7671feb

Commits on Aug 26, 2026

Merge branch 'core/site-name' into 'main'
aloCetic
committed
caab537
Merge branch 'core/auth-fail-closed' into 'main'
aloCetic
committed
95fbd70
Merge branch 'core/prod-hardening' into 'main'
aloCetic
committed
33d1644
Merge branch 'core/server-hooks-ws' into 'main'
aloCetic
committed
fee9770
Merge branch 'core/client-boot' into 'main'
aloCetic
committed
1feb1a9
fix(security): confine app static route to per-app static/ dir (path traversal)

authored and
Arthur LORIN
committed
7128406
fix(security): handle HEAD in AppStaticFileHandler (regression from 6d94cdb)

authored and
Arthur LORIN
committed
7038885
fix(security): refuse symlink escapes from app static/ dirs

Arthur LORIN
authored and
Arthur LORIN
committed
59c0666
Merge branch 'core/app-static-confinement' into 'main'
aloCetic
committed
a585412
test(ws): pin permessage-deflate on the shared ServerWebSocket

Arthur LORIN
authored and
Arthur LORIN
committed
5d39681
Merge branch 'tests/ws-compression' into 'main'
aloCetic
committed
1497bcf
docs(readme): document the GitLab->GitHub one-way flow
aloCetic
committed
1c93a7f
Merge branch 'docs-repo-flow-direction' into 'main'
aloCetic
committed
553220e

Commits on Aug 28, 2026

fix(cli): stop freezing env-sourced config params on every `start`

Vincent-Stragier
and
claude
committed
34bf363
fix(config): stop config.__dict__ test restores from freezing params

Vincent-Stragier
and
claude
committed
a123c45