4 Commits

Include renames

Author	SHA1	Message	Date
lyra	5258e175a1	fix: never cache the login flow (stale pre-auth responses in Safari) ... The login page, failed logins, redirects, and rate-limit/error pages could be stored by the browser (Symfony's default 'no-cache, private' still permits storage — it only requires revalidation). Older Safari builds may then replay a stale pre-auth response on refresh, appearing to log the user back out, or show a previous session after logging in again. - SecurityHeadersListener: send strict anti-caching headers on non-2xx responses only (no-store/no-cache/must-revalidate/proxy-revalidate, max-age=0, s-maxage=0 + Pragma, Expires, Surrogate-Control, Vary: *). 2xx grants (already-authenticated / public access) are consumed by Caddy's forward_auth check and never reach the browser, and protected services' own cache headers must stay untouched. - templates/_script.html.twig: fetch() with cache: 'no-store'; follow redirects with location.replace() to keep the login page out of history and the back-forward cache. - docs/Caddyfile: reusable (preauth_no_store) snippet imported into every forward_auth block, using header_down so the guarantee holds at the edge (verified: replaces conflicting upstream values, leaves service responses alone). - tests: unit coverage for the listener and functional coverage for the full HTTP kernel (login/failure/redirect/rate-limit not cacheable; 200 grants untouched); asserts the rendered page carries the JS changes. - readme/CHANGELOG updates.	2026-09-14 19:31:44 -04:00
lyra	5563999525	feat: public rate-limited access for v1.1 ... Add PublicAccessListener (priority 84) that allows rate-limited unauthenticated access to configured public paths. Authenticated users bypass this listener entirely via AcceptListener/AllowListener. New components: - PublicPathMatcher service with wildcard path matching (* and **) and optional host-prefix scoping - PublicAccessListener applying per-IP rate limiting to public paths - Separate public_limiter compound rate limiter (burst + sustained) - publicRateLimitCache pool (APCu in prod, array in tests) New env vars: - PUBLIC_PATHS (comma-separated path patterns, empty = disabled) - PUBLIC_BURST_COUNT/PUBLIC_BURST_TIME (default 100/60s) - PUBLIC_UPPER_COUNT/PUBLIC_UPPER_TIME (default 500/3600s) Tests: 52 new tests (29 unit for PublicPathMatcher, 12 unit for PublicAccessListener, 11 functional for PublicAccessFlowTest). Total: 293 tests, 605 assertions, all passing. PHP CS Fixer: 0 of 63 files need fixing. Documentation: README, CHANGELOG, ROADMAP, Caddyfile, example.env all updated with public access configuration and examples.	2026-08-12 09:26:50 -04:00
lyra	cb378e20bc	chore: add php-cs-fixer with PSR-12 config and CI check ... - Add friendsofphp/php-cs-fixer to require-dev - Create .php-cs-fixer.dist.php configured for @PSR12 ruleset - Add php-cs-fixer dry-run step to CI pipeline - Auto-fix existing PSR-12 violations - Document code style tooling in readme.md	2026-08-11 08:30:05 -04:00
lyra	6c5a7c98e8	Fix failing functional tests and add test infrastructure ... - Add TestKernel that removes the kernel.reset tag from nonceCache, rateLimitCache, sessionCache and sessionStorage pools so in-memory state survives across requests within a single test (mirroring APCu persistence in production) - Add config/packages/test/ with array cache adapters and test session config - Set fixed TOTP secret (JBSWY3DPEHPK3PXP) and high rate limits in phpunit.dist.xml and .env.test so functional tests can compute valid codes and are not rate-limited - Make Kernel non-final so TestKernel can extend it - Fix testFailedLoginWithSpentNonceIsRejected and testConsumedBackupCodeCannotBeReused: clear the CookieJar between sub-requests so a session cookie set by a prior successful login does not auto-authenticate the next request via AcceptListener before the nonce/backup-code path is exercised	2026-08-06 06:07:14 -04:00