Siddharth Kumar Sah 432cc92471 feat: harden auth, security headers, SVG sanitization, and pipeline ownership ...

- Add password strength validation (8+ chars, uppercase, lowercase, number)
- Add username validation rules
- Optimize API key lookup with SHA-256 prefix (O(1) vs O(n) scan)
- Require password change on default admin first login
- Revoke API keys on password change
- Add session cleanup cron (hourly expired session purge)
- Add Permissions-Policy, HSTS, and CSP security headers in production
- Strengthen SVG sanitizer: block XInclude, foreignObject, processing
  instructions, javascript/data/file URI schemes
- Add userId ownership to pipelines with authorization checks
- Add keyPrefix column to api_keys table
- Update integration tests for new auth behavior

2026-03-24 21:38:06 +08:00

..

e2e

feat: extract auto-orient utility and expand test coverage

2026-03-24 20:37:14 +08:00

fixtures

chore: remove dead code, add test infrastructure, update docs

2026-03-23 11:46:45 +08:00

integration

feat: harden auth, security headers, SVG sanitization, and pipeline ownership

2026-03-24 21:38:06 +08:00

unit

feat: rewrite file-store with FileEntry model for multi-image support

2026-03-23 14:02:33 +08:00