5 Commits

Include renames

Author	SHA1	Message	Date
lyra	d2eb914637	fix: must-fix items for v1.0 release ... Security: - Add SecurityHeadersListener (X-Content-Type-Options, X-Frame-Options, CSP, Referrer-Policy, HSTS) - Replace document.write() with document.documentElement.innerHTML in login JS to avoid CSP violations - Add CSS escaping (|e('css')) to env color values in _style.html.twig - Document CSRF protection model: nonce serves as CSRF token for POST form path (single-use, server-generated, 120s TTL) - Reduce TOTP verification window from 10 periods (±5 min) to 1 (±30s) - Remove hardcoded APP_SECRET from bin/franken.sh (now uses env or generates random) - Remove backup code values from debug log output - Add .env to .gitignore Bug fixes: - Fix ->json access on possibly-null in LoginListener (uses null-safe operator ?->) - Fix validReturn() not checking false from parse_url (could cause TypeError on malformed URLs) - Add isHit() race condition check in AcceptListener and AllowListener - Add try/finally in Kernel::terminate() so parent::terminate() always runs even if persist() throws - Add input validation to GenerateBackupCodesCommand (reject count < 1) - Use Response::HTTP_INTERNAL_SERVER_ERROR constant in GetTotpTrait instead of literal 500 Docker/CI: - Explicitly install curl in Docker final image (needed for healthcheck) - Update workflow tag pattern to v*.*.* (standardize on v-prefix) - Extract version without v-prefix for Docker image tag - Remove stale develop branch from CI triggers - Fix publish.yaml git remote add to use set-url on re-runs Code quality: - Add declare(strict_types=1) to all interface files - Add #[AsCommand] attribute to GenerateBackupCodesCommand - Fix BackupCodeInterface default count to match implementation (10) - Lowercase host before TLD lookup in DomainManager - Expand TLD list with many missing multi-part TLDs (.com.au, .co.jp, .com.br, .co.kr, .com.tw, .co.za, etc.) to prevent open redirect vulnerabilities - Disable unused Symfony sessions in framework.yaml Tests: - Update DomainManagerTest for corrected TLD parsing (.com.au, .co.jp, .com.br now correctly recognized as multi-part) - Update GetTotpTraitTest for corrected error message - Update GenerateBackupCodesCommandTest: zero count now throws exception	2026-08-11 16:33:00 -04:00
lyra	cb378e20bc	chore: add php-cs-fixer with PSR-12 config and CI check ... - Add friendsofphp/php-cs-fixer to require-dev - Create .php-cs-fixer.dist.php configured for @PSR12 ruleset - Add php-cs-fixer dry-run step to CI pipeline - Auto-fix existing PSR-12 violations - Document code style tooling in readme.md	2026-08-11 08:30:05 -04:00
andrew	7cf7e04d17	extracted interfaces for services, to aid in creating tests	2026-06-05 15:15:21 -04:00
andrew	9114cfd96f	update to php 8.5, backup codes, etc. ... modified: Dockerfile modified: composer.json modified: composer.lock modified: config/packages/twig.yaml modified: config/services.yaml modified: docs/Caddyfile modified: docs/compose.yaml renamed: docs/env.example -> docs/example.env modified: public/index.php modified: readme.md modified: src/Command/GenerateBackupCodesCommand.php modified: src/ConfigBag.php modified: src/Data/Payload.php modified: src/Enum/Scope.php modified: src/Listener/AcceptListener.php modified: src/Listener/AllowListener.php modified: src/Listener/InterceptListener.php modified: src/Listener/LoginListener.php modified: src/MonitorCacheKeys.php modified: src/PersistCache.php modified: src/Service/BackupCodeManager.php modified: src/Service/DomainManager.php new file: src/Service/LoginManager.php modified: src/Trait/CookieNameTrait.php modified: src/Trait/GetTotpTrait.php modified: src/Trait/MakeNonceTrait.php modified: src/Trait/StringTrait.php modified: src/Utilities.php modified: templates/_script.html.twig modified: templates/_style.html.twig modified: templates/base.html.twig modified: templates/login.html.twig	2026-05-29 21:56:42 -04:00
andrew	43e9b7136e	auth subdomain tentatively complete. ... All domain logic moved into service.	2026-05-22 12:43:02 -04:00