Latte f57c237bed fix: rate limit /token and /revoke, bucket IPv6 by /64 and warn about untrusted forwarded headers (SEC-08)

2026-10-14 17:29:12 +02:00

..

__init__.py

fix: cap and type-check the unauthenticated consent POST body (SEC-01)

2026-10-14 17:07:06 +02:00

helpers.py

fix: cap and type-check the unauthenticated consent POST body (SEC-01)

2026-10-14 17:07:06 +02:00

test_audit_fail_closed.py

fix: record the calling client and only schema-known names in audit entries (SEC-12, SEC-18)

2026-10-14 17:14:13 +02:00

test_audit_file.py

fix: create the audit log 0600 in a 0700 directory and refuse symlinks (SEC-11)

2026-10-14 17:18:29 +02:00

test_env_file.py

fix: load ./.env only when private and owned, add --env-file and AEGIS_ENV_FILE (SEC-04)

2026-10-14 17:22:29 +02:00

test_oauth_csrf.py

fix: require a matching Origin on consent and name the binding cookie per flow (SEC-17, SEC-19)

2026-10-14 17:26:52 +02:00

test_oauth_input_bounds.py

fix: cap and type-check the unauthenticated consent POST body (SEC-01)

2026-10-14 17:07:06 +02:00

test_oauth_redirects.py

fix: add OAUTH_REDIRECT_ALLOWLIST for client registration and waive the open default (SEC-05)

2026-10-14 17:24:41 +02:00

test_rate_limits.py

fix: rate limit /token and /revoke, bucket IPv6 by /64 and warn about untrusted forwarded headers (SEC-08)

2026-10-14 17:29:12 +02:00

test_secret_echo.py

fix: redact stored webhook authorization headers and other secret fields by key name (SEC-02)

2026-10-14 17:08:59 +02:00