peter bacef11e33 fix(auth): address second-round review findings ...

- OAuth-cancel feedback now keys on the live session, not link_uid: ANY
  signed-in cancel (add-another-account via /auth/login, link, or upgrade)
  redirects to /?oauth=cancelled and gets a neutral "Google sign-in was
  cancelled" toast — the add-account path set no marker and was silent, and
  the shared ?link= message wrongly called an upgrade "account linking"
- drop 127.0.0.1 from the dev OAuth host allowlist: only the localhost
  callbacks are registered in the Google console, so a 127.0.0.1 origin now
  falls back to the fixed callback instead of a redirect_uri_mismatch
- Welcome: extract the shared goResend handler (banner CTA + sign-in link) and
  merge the two adjacent signin-only blocks

2026-07-23 01:24:34 +02:00

..

alembic

fix(downloads): make shared files iOS-playable + default to 720p

2026-07-22 01:19:31 +02:00

app

fix(auth): address second-round review findings

2026-07-23 01:24:34 +02:00

tests

fix(auth): address second-round review findings

2026-07-23 01:24:34 +02:00

alembic.ini

feat: M1 foundation — compose stack, FastAPI, Google OAuth, encrypted tokens

2026-06-11 01:01:37 +02:00

Dockerfile

feat: M1 foundation — compose stack, FastAPI, Google OAuth, encrypted tokens

2026-06-11 01:01:37 +02:00

Dockerfile.test

test(backend): pure-logic pytest harness, run in an isolated test image

2026-07-21 03:29:24 +02:00

entrypoint.sh

harden(auth): SA3 review follow-ups — IPv6-mapped match + no-proxy-headers guardrail

2026-07-12 03:49:08 +02:00

log_config.json

chore: rename remaining subfeed references to siftlode

2026-06-21 06:53:12 +02:00

pytest.ini

test(backend): pure-logic pytest harness, run in an isolated test image

2026-07-21 03:29:24 +02:00

requirements-dev.txt

test(backend): pin the traversal guard against a string-prefix bypass

2026-07-21 03:36:42 +02:00

requirements.txt

feat(downloads): Deno JS runtime + web/android clients to complete the POT setup

2026-07-03 22:46:32 +02:00

ruff.toml

chore(hygiene): Phase 4 guardrails — noUnusedLocals/Parameters + dead-code sweep

2026-07-12 02:15:52 +02:00