969b2d3d2f
style: apply ruff auto-fix
...
- Auto-formatted code with ruff format
- Applied ruff linting fixes with --fix
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-02-22 19:29:32 +00:00
1648d8c745
feat(api): configure CORS middleware for API endpoints
...
- Add CORSMiddleware (disabled by default, enabled via CORS_ENABLED=true)
- Add cors_enabled, cors_allowed_origins, cors_allow_credentials,
cors_allowed_methods, cors_allowed_headers settings to config.py
- Add parse_comma_separated_list validator for CORS list env vars
- Insert CORS middleware between SessionMiddleware and ProxyHeaders
so preflight runs before CSRF/auth but after proxy-header processing
- Document CORS env vars in .env.demo with rationale for proxy-first approach
- Mark CORS TODO as completed in SECURITY_AUDIT.md
- Add tests/test_cors.py with 12 unit and integration tests
Closes #175
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-22 19:26:39 +00:00
7a10f4a7c0
Initial plan
2026-02-22 19:16:34 +00:00
3522d9a5c0
chore(release): update build metadata files [skip ci]
2026-02-22 19:15:33 +00:00
5890eb5117
Merge pull request #349 from christianlouis/copilot/add-csrf-token-support
...
feat(auth): Implement CSRF token protection for state-changing operations
2026-02-22 20:15:12 +01:00
fde4199f5a
style: apply ruff auto-fix
...
- Auto-formatted code with ruff format
- Applied ruff linting fixes with --fix
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-02-22 16:32:30 +00:00
c54cbcbdd6
feat(auth): implement CSRF token protection for state-changing operations
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-22 16:27:37 +00:00
bb94eccd86
Initial plan
2026-02-22 16:16:12 +00:00
2e4acbef1b
chore(release): update build metadata files [skip ci]
2026-02-22 16:15:09 +00:00
8449d57fe5
Merge pull request #348 from christianlouis/copilot/add-input-validation-sanitization
2026-02-22 17:14:51 +01:00
8f1abf8cdd
style: apply ruff auto-fix
...
- Auto-formatted code with ruff format
- Applied ruff linting fixes with --fix
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-02-22 16:12:58 +00:00
3035802c16
feat(security): add comprehensive input validation and sanitization ( #172 )
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-22 16:02:00 +00:00
4870726385
Initial plan
2026-02-22 15:43:46 +00:00
786e9effef
chore(release): update build metadata files [skip ci]
2026-02-22 15:42:24 +00:00
29a3c63253
Merge pull request #347 from christianlouis/copilot/add-request-size-limits
2026-02-22 16:42:03 +01:00
77e777418c
style: apply ruff auto-fix
...
- Auto-formatted code with ruff format
- Applied ruff linting fixes with --fix
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-02-22 15:25:48 +00:00
ca27a0b687
feat(security): add request size limits to API endpoints
...
- Add RequestSizeLimitMiddleware that checks Content-Length header
before request body is read: non-multipart requests capped at
MAX_REQUEST_BODY_SIZE (default 1 MB), multipart uploads capped at
MAX_UPLOAD_SIZE (default 1 GB). Returns HTTP 413 on violation.
- Register middleware in app/main.py
- Add max_request_body_size setting to app/config.py
- Fix ui_upload in files.py to check Content-Length early and read
in 64 KB chunks (bounded memory usage), removing the post-write
os.path.getsize check
- Document MAX_REQUEST_BODY_SIZE in .env.demo and ConfigurationGuide.md
- Mark SECURITY_AUDIT.md item #4 as resolved
- Add 9 tests in test_request_size_limit.py
- Update test_upload_file_too_large to use patch.object instead of
the now-unused os.path.getsize mock
Closes #173
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-22 14:41:04 +00:00
c166bfa506
Initial plan
2026-02-22 14:25:41 +00:00
983869bd41
chore(release): update build metadata files [skip ci]
2026-02-22 14:25:34 +00:00
fdb6a05c0a
Merge pull request #345 from christianlouis/copilot/add-request-audit-logging
...
feat(security): Add request/audit logging with sensitive data masking
2026-02-22 15:25:11 +01:00
bdf0afd9bf
style: apply ruff auto-fix
...
- Auto-formatted code with ruff format
- Applied ruff linting fixes with --fix
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-02-22 14:24:27 +00:00
c711e7e96e
chore(release): update build metadata files [skip ci]
2026-02-22 14:23:39 +00:00
393d3a2d3b
Merge pull request #346 from christianlouis/copilot/add-dependency-vulnerability-scanning
...
feat(ci): add pip-audit dependency vulnerability scanning to CI/CD
2026-02-22 15:23:20 +01:00
ca6a3beb3f
feat(security): add request/audit logging with sensitive data masking ( #170 )
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-21 21:21:29 +00:00
ac51f7206a
feat(ci): add pip-audit dependency vulnerability scanning to CI/CD
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-21 21:17:15 +00:00
a2658cb018
Initial plan
2026-02-21 21:12:54 +00:00
5f84cb73f6
Initial plan
2026-02-21 21:12:10 +00:00
98b9e627dd
chore(release): update build metadata files [skip ci]
2026-02-21 09:45:37 +00:00
925098b0a6
Merge pull request #344 from christianlouis/copilot/remove-automatic-production-push
...
ci: fix lint, drop webhook deploy, add ArgoCD GitOps preprod sync
2026-02-21 10:45:19 +01:00
895585c1e8
fix(ci): lint errors, remove webhook deploy, add ArgoCD GitOps k8s manifest update
...
- Fix ruff format: add blank line before nested function in app/views/filemanager.py
- Fix ruff format: use double-quote escaping in tests/test_config.py
- Remove deploy job (Portainer webhook) from ci.yml
- Add update-k8s-manifest job: after main-branch build, updates
apps/docuelevate/preprod/docuelevate-stack.yaml in christianlouis/k8s-cluster-state
with the new GHCR image tag (ghcr.io/christianlouis/docuelevate:main-<short-sha>)
using mikefarah/yq@v4.44 .6 and GH_PAT secret for cross-repo write access
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-21 09:40:52 +00:00
e4c50ce3c9
Initial plan
2026-02-21 09:35:36 +00:00
ad0405c5c2
chore(release): update build metadata files [skip ci]
2026-02-21 09:27:24 +00:00
2d97eb77dc
Merge pull request #343 from christianlouis/copilot/add-admin-file-manager
...
Admin File Manager, Menu Refactor, Dashboard Improvements & Kubernetes Env Var Quote Stripping
2026-02-21 10:27:06 +01:00
48443dc30a
fix(config): strip outer quotes from env var string values (Kubernetes compatibility)
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-21 09:23:39 +00:00
54736ea35a
feat(admin): enhance file manager with DB reconciliation view (filesystem/database/reconcile tabs)
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-21 09:20:59 +00:00
16e7b6478e
feat(admin): add admin-only file manager, admin menu, de-emphasize status, improve dashboard
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-21 09:15:27 +00:00
8813e4e8f3
Initial plan
2026-02-21 09:07:55 +00:00
1d9d67680f
chore(release): update build metadata files [skip ci]
2026-02-17 12:03:14 +00:00
47aa6fc3d4
Merge pull request #340 from christianlouis/copilot/fix-json-decode-error
...
fix(test): fix test_get_lgpl_license_not_found JSONDecodeError
2026-02-17 13:02:56 +01:00
e3cc489975
fix(test): fix test_get_lgpl_license_not_found JSONDecodeError
...
The test had two issues:
1. Too-broad mock: patching pathlib.Path.exists globally broke
Starlette/FastAPI internals. Now targets the specific module.
2. Wrong assertion: response.json() failed because the custom
HTTPException handler returns HTML for non-API routes, not JSON.
Updated to only assert on status code.
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-17 12:01:40 +00:00
af8963334e
Initial plan
2026-02-17 11:55:18 +00:00
34633d1661
chore(release): update build metadata files [skip ci]
2026-02-17 11:44:47 +00:00
fec309f225
Merge pull request #339 from christianlouis/copilot/fix-lint-checks-and-test-errors
...
fix: make log_task_progress resilient to DB errors and fix test assertions
2026-02-17 12:44:25 +01:00
886bcd3c9b
fix: include exc_info in log_task_progress debug message
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-17 11:41:56 +00:00
13a3c41482
fix: make log_task_progress resilient to DB errors and fix test assertions
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-17 11:40:34 +00:00
6c7f36cb3c
Initial plan
2026-02-17 11:21:08 +00:00
311701bffe
chore(release): update build metadata files [skip ci]
2026-02-17 11:17:45 +00:00
a7adea57c0
Merge pull request #338 from christianlouis/copilot/fix-test-errors
...
fix(tests): mock database access in S3 upload unit tests
2026-02-17 12:17:25 +01:00
3d3d68f7a7
fix(tests): mock log_task_progress in S3 upload tests
...
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com >
2026-02-17 04:35:00 +00:00
e7ae88457d
Initial plan
2026-02-17 04:25:13 +00:00
github-actions[bot]