6 Commits

Include renames

Author	SHA1	Message	Date
lyra	d2eb914637	fix: must-fix items for v1.0 release ... Security: - Add SecurityHeadersListener (X-Content-Type-Options, X-Frame-Options, CSP, Referrer-Policy, HSTS) - Replace document.write() with document.documentElement.innerHTML in login JS to avoid CSP violations - Add CSS escaping (|e('css')) to env color values in _style.html.twig - Document CSRF protection model: nonce serves as CSRF token for POST form path (single-use, server-generated, 120s TTL) - Reduce TOTP verification window from 10 periods (±5 min) to 1 (±30s) - Remove hardcoded APP_SECRET from bin/franken.sh (now uses env or generates random) - Remove backup code values from debug log output - Add .env to .gitignore Bug fixes: - Fix ->json access on possibly-null in LoginListener (uses null-safe operator ?->) - Fix validReturn() not checking false from parse_url (could cause TypeError on malformed URLs) - Add isHit() race condition check in AcceptListener and AllowListener - Add try/finally in Kernel::terminate() so parent::terminate() always runs even if persist() throws - Add input validation to GenerateBackupCodesCommand (reject count < 1) - Use Response::HTTP_INTERNAL_SERVER_ERROR constant in GetTotpTrait instead of literal 500 Docker/CI: - Explicitly install curl in Docker final image (needed for healthcheck) - Update workflow tag pattern to v*.*.* (standardize on v-prefix) - Extract version without v-prefix for Docker image tag - Remove stale develop branch from CI triggers - Fix publish.yaml git remote add to use set-url on re-runs Code quality: - Add declare(strict_types=1) to all interface files - Add #[AsCommand] attribute to GenerateBackupCodesCommand - Fix BackupCodeInterface default count to match implementation (10) - Lowercase host before TLD lookup in DomainManager - Expand TLD list with many missing multi-part TLDs (.com.au, .co.jp, .com.br, .co.kr, .com.tw, .co.za, etc.) to prevent open redirect vulnerabilities - Disable unused Symfony sessions in framework.yaml Tests: - Update DomainManagerTest for corrected TLD parsing (.com.au, .co.jp, .com.br now correctly recognized as multi-part) - Update GetTotpTraitTest for corrected error message - Update GenerateBackupCodesCommandTest: zero count now throws exception	2026-08-11 16:33:00 -04:00
lyra	6b5a711fa9	Fix docs, add .dockerignore, fix base64url padding, fix typo ... - Add .dockerignore to exclude .git, vendor, var, tests, docs, .env and other non-build files from Docker context - Fix broken base64url padding in src/Data/Payload.php: str_pad was a no-op because the length argument was always < string length. Replaced with correct str_repeat approach - Fix typo in bin/franken.sh: digtialadapt → digitaladapt - Add comment to bin/franken.sh noting it's a dev utility - Remove config/reference.php from git tracking (auto-generated file) and add to .gitignore - Fix readme.md: env.example → example.env (matches actual filename)	2026-08-10 18:55:19 -04:00
andrew	1c4c289d81	massive rewrite to switch to using listeners instead of controller, header for login payload instead of get request, removed icon system, asset system, was able to remove all the domain processing, enhanced cookie security, and more.	2025-12-23 11:24:47 -05:00
andrew	b36aabb8a3	WIP: nearly done switching to using header instead of url parameters	2025-12-18 19:20:50 -05:00
andrew	a73d039e10	removed maker-bundle, switching to apcu	2025-12-16 22:34:57 -05:00
andrew	102b9f3e78	Full code refactor to Symfony7.4 with FrankenPHP ... Includes significant breaking changes. Default port and transportation changed to http via port 80 Names of environment variables have changed.	2025-12-15 12:30:14 -05:00