4 Commits

Include renames

Author	SHA1	Message	Date
lyra	af4d2a4ac7	docs: record Symfony 8.1 upgrade results, update stack references ... - Plan doc: mark Phases 0-3 + worker-mode state audit complete with verified results; resolve open questions (all src/ services are final readonly - no ResetInterface needed under kernel-reusing runner) - CHANGELOG: Unreleased entries for the 8.1 bump and the runtime/frankenphp-symfony removal (incl. FRANKENPHP_LOOP_MAX note) - ROADMAP: current stack now Symfony 8.1; webauthn research note updated - bin/dev.sh: correct stale PHP requirement comment	2026-09-07 22:46:22 -04:00
lyra	5563999525	feat: public rate-limited access for v1.1 ... Add PublicAccessListener (priority 84) that allows rate-limited unauthenticated access to configured public paths. Authenticated users bypass this listener entirely via AcceptListener/AllowListener. New components: - PublicPathMatcher service with wildcard path matching (* and **) and optional host-prefix scoping - PublicAccessListener applying per-IP rate limiting to public paths - Separate public_limiter compound rate limiter (burst + sustained) - publicRateLimitCache pool (APCu in prod, array in tests) New env vars: - PUBLIC_PATHS (comma-separated path patterns, empty = disabled) - PUBLIC_BURST_COUNT/PUBLIC_BURST_TIME (default 100/60s) - PUBLIC_UPPER_COUNT/PUBLIC_UPPER_TIME (default 500/3600s) Tests: 52 new tests (29 unit for PublicPathMatcher, 12 unit for PublicAccessListener, 11 functional for PublicAccessFlowTest). Total: 293 tests, 605 assertions, all passing. PHP CS Fixer: 0 of 63 files need fixing. Documentation: README, CHANGELOG, ROADMAP, Caddyfile, example.env all updated with public access configuration and examples.	2026-08-12 09:26:50 -04:00
lyra	b89070e985	fix: should-fix items for v1.0 release ... Documentation: - Create CHANGELOG.md with full version history (v0.0.1 through unreleased) - Rewrite README with comprehensive setup guide, configuration reference, architecture overview, security model, and feature list - Update ROADMAP.md: fix branch status table, mark completed security review items, update TOTP leeway description - Fix 'centeral' typo in docs/Caddyfile - Remove TODO comment from docs/compose.yaml - Add DESIGN_CONSIDERATIONS.md (design review document) Code quality: - Extract duplicated cookie name/domain logic into CookieNameTrait methods: sessionCookieName() and sessionCookieDomain() - Update AcceptListener, AllowListener, InterceptListener, and LoginManager to use the shared methods - Remove fragile cross-file coupling comment between LoginManager and InterceptListener Error handling: - Wrap cache operations in AcceptListener and AllowListener with try/catch to fail closed (don't authenticate on cache errors) - Log cache errors at error level instead of propagating as 500s - Early return pattern in AcceptListener and AllowListener for cleaner control flow	2026-08-11 16:35:27 -04:00
andrew	95ab77db2a	added roadmap for where we are aiming to take this project	2026-08-07 09:25:56 -04:00