peter/siftlode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
siftlode/backend/app
History
npeter83 776fb38b9b harden(auth): SA3 review follow-ups — IPv6-mapped match + no-proxy-headers guardrail 
Post-review hardening (both fail-safe, not bugs):
- _client_ip normalizes IPs via ipaddress and unwraps IPv4-mapped IPv6, so a plain
  TRUSTED_PROXY_IPS=10.10.0.1 also matches a peer surfaced as ::ffff:10.10.0.1 (a
  Docker/IPv6 self-host footgun that would otherwise silently collapse everyone into
  one rate-limit bucket).
- entrypoint.sh + _client_ip docstring: explicit warning never to add uvicorn
  --proxy-headers, which would rewrite request.client from the forgeable XFF and defeat
  the trust check.
2026-07-12 03:49:08 +02:00
..
downloads Merge branch 'dev' into chore/code-hygiene 2026-07-11 16:22:39 +02:00
plex Plex backend pass (#9): watch_sync bugs + backend dedup 2026-07-11 23:48:35 +02:00
routes fix(auth): address SA4 review findings (WS epoch check, commit ordering, verify guard) 2026-07-12 03:07:13 +02:00
static chore: rebrand Subfeed -> Siftlode 2026-06-14 04:40:22 +02:00
sync chore(hygiene): Phase 4 guardrails — noUnusedLocals/Parameters + dead-code sweep 2026-07-12 02:15:52 +02:00
youtube fix(auth): security hardening — token encryption, timing, adoption + isolation 2026-07-11 21:26:39 +02:00
__init__.py feat: M1 foundation — compose stack, FastAPI, Google OAuth, encrypted tokens 2026-06-11 01:01:37 +02:00
auth.py harden(auth): SA3 review follow-ups — IPv6-mapped match + no-proxy-headers guardrail 2026-07-12 03:49:08 +02:00
config.py feat(auth): SA3 — trusted-proxy X-Forwarded-For for rate limiting 2026-07-12 03:42:41 +02:00
db.py fix(plex): image proxy no longer exhausts the DB connection pool 2026-07-06 07:14:28 +02:00
email.py chore: rename remaining subfeed references to siftlode 2026-06-21 06:53:12 +02:00
main.py feat(share): rich link previews (Open Graph) for /watch pages 2026-07-07 20:19:30 +02:00
models.py feat(auth): SA4 — server-side session revocation via per-user session epoch 2026-07-12 03:00:16 +02:00
notifications.py feat(notifications): durable per-user inbox (P1) + maintenance schema 2026-06-18 03:20:17 +02:00
progress.py feat(scheduler): admin run-now/run-all triggers + live progress + completion notices 2026-06-18 04:01:10 +02:00
quota.py feat(channels): channel-explore backend — about metadata, ephemeral provenance, cleanup 2026-06-30 02:52:44 +02:00
ratelimit.py feat(demo): demo-account schema + reusable rate limiter 2026-06-16 09:17:14 +02:00
realtime.py feat(messages): end-to-end encrypted real-time direct messaging backend 2026-06-25 22:05:35 +02:00
scheduler.py chore(scheduler): dedup token-user query + drop pointless rss lambda 2026-07-11 19:44:53 +02:00
security.py fix(auth): security hardening — token encryption, timing, adoption + isolation 2026-07-11 21:26:39 +02:00
state.py refactor(auth): centralize token hashing, email validation & admin gating 2026-06-26 03:15:36 +02:00
sysconfig.py feat(plex): Phase A — one-time Plex→Siftlode watch-state import 2026-07-09 14:42:18 +02:00
titles.py feat(titles): normalize video titles for display (feed, search, downloads) 2026-07-03 03:00:08 +02:00
utils.py refactor(auth): centralize token hashing, email validation & admin gating 2026-06-26 03:15:36 +02:00
worker.py fix(config): honor DB-overridable download layout + retention (env-vs-DB drift) 2026-07-11 19:44:53 +02:00