mteehan e01574c67e auth: make session binding optional, enforce WebAuthn credential ownership ...

- Make session_id parameter optional in validate_token — only enforced when
  provided, allowing WebSocket auth which cannot carry custom headers
- Remove decode_token round-trip from daemon WS handler
- Override WebAuthn registration username from JWT user_ctx to prevent users
  from registering credentials under another user's account
- Frontend no longer sends username for WebAuthn registration
- Redirect to login on 401 after token refresh fails for POST requests
- Remove redundant auth session check from login page load
- Add tests for session_id semantics and WebAuthn ownership guard

2026-08-12 14:16:49 +00:00

..

handlers

auth: fix WS session_id extraction and track WebAuthn success/failure

2026-08-12 04:27:14 +00:00

__init__.py

refactor: introduce two-user daemon architecture with socket-based communication

2026-05-27 23:39:33 +00:00

__main__.py

refactor: introduce two-user daemon architecture with socket-based communication

2026-05-27 23:39:33 +00:00

client.py

docs: add comprehensive docstrings and inline comments

2026-07-13 17:26:45 +00:00

iface.py

Auth: rate limiter, WebAuthn domain awareness, misc fixes

2026-07-29 02:48:53 +00:00

server.py

auth: make session binding optional, enforce WebAuthn credential ownership

2026-08-12 14:16:49 +00:00