feb41f4514
Whitelisted emails enter the shared demo user via /auth/demo (lazily created, no OAuth token/scope), rate-limited per IP and answering uniformly so it can't be hammered as an enumeration oracle. Add a require_human dependency that blocks the demo account from quota-spending sync endpoints and the OAuth upgrade flow, and surface is_demo on /api/me. |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| admin.py | ||
| channels.py | ||
| feed.py | ||
| health.py | ||
| me.py | ||
| playlists.py | ||
| quota.py | ||
| sync.py | ||
| tags.py | ||
| version.py | ||