Repository navigation

Security hygiene: JSON body helper, 403 for non-admin, RBAC validation, security headers - #1458

Merged

Tim020 merged 16 commits into

devfrom

feature/security-hygiene

Oct 20, 2026

Merged

Security hygiene: JSON body helper, 403 for non-admin, RBAC validation, security headers#1458
Tim020 merged 16 commits into
devfrom
feature/security-hygiene

Commits on Oct 19, 2026
- Harden WebSocket message handling and stop logging secrets
  
  Tim020
  and
  claude
  committed
  2b2d4a7
- Security hygiene: JSON body helper, 403 for non-admin, RBAC validation, settings allow-list, security headers
  
  Tim020
  and
  claude
  committed
  357b376
- Make log redaction setting authoritative and default it on
  
  Tim020
  and
  claude
  committed
  10c39b1
- Redistribute tests into modules mirroring the code under test
  
  Tim020
  and
  claude
  committed
  cad9f11
Commits on Oct 20, 2026
- Reduce cognitive complexity of REST body logging and WS session op dispatch
  
  Tim020
  and
  claude
  committed
  603542e
- Merge remote-tracking branch 'origin/feature/security-websocket' into feature/security-hygiene
  Tim020
  committed
  78d830e
- Merge remote-tracking branch 'origin/dev' into feature/security-hygiene
  Tim020
  committed
  5637276
- Merge dev; non-admin show delete now returns 403
  
  Tim020
  and
  claude
  committed
  1c91d98
- Address review: fix redaction crash on absent decorated path, log malformed WS frames per setting
  
  Tim020
  and
  claude
  committed
  abd282e
- Merge remote-tracking branch 'origin/feature/security-websocket' into feature/security-hygiene
  Tim020
  committed
  1298148
- Apply decorated redaction paths independently and only to dict/list bodies
  
  Tim020
  and
  claude
  committed
  47b5cef
- Merge remote-tracking branch 'origin/feature/security-websocket' into feature/security-hygiene
  Tim020
  committed
  4274ab3
- Test bare JSON string login body returns 400
  
  Tim020
  and
  claude
  committed
  bbfb0c4
- Merge remote-tracking branch 'origin/dev' into feature/security-hygiene
  Tim020
  committed
  05ff95c
- Share RBAC grant/revoke request handling to remove duplication
  
  Tim020
  and
  claude
  committed
  6616d4f
- Send security headers on static routes; tighten user settings allow-list test
  
  Tim020
  and
  claude
  committed
  dc2d203

Commits

Commits on Oct 19, 2026

Commits on Oct 20, 2026