3 Commits

Include renames

Author	SHA1	Message	Date
lyra	d2eb914637	fix: must-fix items for v1.0 release ... Security: - Add SecurityHeadersListener (X-Content-Type-Options, X-Frame-Options, CSP, Referrer-Policy, HSTS) - Replace document.write() with document.documentElement.innerHTML in login JS to avoid CSP violations - Add CSS escaping (|e('css')) to env color values in _style.html.twig - Document CSRF protection model: nonce serves as CSRF token for POST form path (single-use, server-generated, 120s TTL) - Reduce TOTP verification window from 10 periods (±5 min) to 1 (±30s) - Remove hardcoded APP_SECRET from bin/franken.sh (now uses env or generates random) - Remove backup code values from debug log output - Add .env to .gitignore Bug fixes: - Fix ->json access on possibly-null in LoginListener (uses null-safe operator ?->) - Fix validReturn() not checking false from parse_url (could cause TypeError on malformed URLs) - Add isHit() race condition check in AcceptListener and AllowListener - Add try/finally in Kernel::terminate() so parent::terminate() always runs even if persist() throws - Add input validation to GenerateBackupCodesCommand (reject count < 1) - Use Response::HTTP_INTERNAL_SERVER_ERROR constant in GetTotpTrait instead of literal 500 Docker/CI: - Explicitly install curl in Docker final image (needed for healthcheck) - Update workflow tag pattern to v*.*.* (standardize on v-prefix) - Extract version without v-prefix for Docker image tag - Remove stale develop branch from CI triggers - Fix publish.yaml git remote add to use set-url on re-runs Code quality: - Add declare(strict_types=1) to all interface files - Add #[AsCommand] attribute to GenerateBackupCodesCommand - Fix BackupCodeInterface default count to match implementation (10) - Lowercase host before TLD lookup in DomainManager - Expand TLD list with many missing multi-part TLDs (.com.au, .co.jp, .com.br, .co.kr, .com.tw, .co.za, etc.) to prevent open redirect vulnerabilities - Disable unused Symfony sessions in framework.yaml Tests: - Update DomainManagerTest for corrected TLD parsing (.com.au, .co.jp, .com.br now correctly recognized as multi-part) - Update GetTotpTraitTest for corrected error message - Update GenerateBackupCodesCommandTest: zero count now throws exception	2026-08-11 16:33:00 -04:00
lyra	cb378e20bc	chore: add php-cs-fixer with PSR-12 config and CI check ... - Add friendsofphp/php-cs-fixer to require-dev - Create .php-cs-fixer.dist.php configured for @PSR12 ruleset - Add php-cs-fixer dry-run step to CI pipeline - Auto-fix existing PSR-12 violations - Document code style tooling in readme.md	2026-08-11 08:30:05 -04:00
andrew	7cf7e04d17	extracted interfaces for services, to aid in creating tests	2026-06-05 15:15:21 -04:00