28 Commits

Include renames

Author	SHA1	Message	Date
bruno	a3973b981c	securite: #87 T6-T8 fin dette — deps qualifiées, semgrep, Secure auto, CORS	2026-09-27 12:43:31 -04:00
bruno	e9b7a317c1	fix: mfa/status 200 auth désactivée (garde anonymous) BUG-081 + clôture BUG-080/082/083	2026-09-27 10:35:33 -04:00
bruno	34fce932cb	securite: #87 T3 cookies Secure centralises + CORS atteste (defaut inchange)	2026-09-26 18:37:19 -04:00
bruno	7bee4a237d	ci: #87 T1 bandit et npm audit bloquants, 5 suites frontend au CI	2026-09-26 18:30:04 -04:00
bruno	d6cca2b1af	feat: #85 T10 persistance etat (verrous stores, ratelimit SQLite) et cloture refonte	2026-09-26 18:10:10 -04:00
bruno	33fe1a3439	feat: ordre naturel des sections Configurations et avatar utilisateur #113	2026-09-23 22:18:29 -04:00
bruno	aeb7516445	fix: activation WebAuthn impossible BUG-070 (rp_id/origines derives requete, challenges multiples)	2026-09-22 20:54:01 -04:00
bruno	60da957f13	fix: section Securite du compte incomplete BUG-068 (boutons theme, QR local, mot de passe, recovery WebAuthn)	2026-09-22 20:07:25 -04:00
bruno	eff74cabe0	feat: #107 configuration - gestion des clés API & MCP (création/révocation, expiration 1j/1mois/6mois/1an/sans fin, une clé pour API REST + serveur MCP, dernière utilisation, store sans secret persisté; fix révocation longue durée) + script token MCP	2026-09-22 14:48:51 -04:00
bruno	2e2a33cef3	fix: corrige 6 bugs mineurs (BUG-035 a BUG-040)	2026-09-17 20:05:08 -04:00
bruno	162a5b4acc	fix(security): consolidation & securite phase 1 (#84, BUG-021 a BUG-034) ... - sanitizer XSS serveur (markdown + page de partage) [BUG-021/022] - rate-limit/lockout MFA [BUG-023] - isolation vaults par segments [BUG-024] - caps regex ReDoS [BUG-025] - SSRF webhooks + secrets externalises [BUG-026] - rotation/revocation des jetons [BUG-027] - politique de mot de passe + invalidation sessions [BUG-028] - verrous users.json [BUG-029] - IP reelle dans les audits [BUG-030] - rate-limit par compte [BUG-031] - symlinks hors vault ignores [BUG-032] - recherche simple via inverted index [BUG-033] - token en memoire + cookie HttpOnly, CSP durcie [BUG-034] Tests: pytest 961 passed / 6 skipped, ruff 0, mypy 0, frontend vert.	2026-09-13 10:51:42 -04:00
bruno	9dce341bc8	feat(ai): durcissement phase F (#79) - rate limit, redaction, OpenAPI/MCP, E2E	2026-09-11 21:56:50 -04:00
bruno	240fd8586e	fix: corriger 33 erreurs mypy (CI bloquant) + lien README (BUG-003, BUG-004) ... BUG-003: annotations de types, gardes None sur get_user(), PdfReader: Any et import PROVIDERS manquant (bug latent main.py:4523). Etape mypy du CI rendue bloquante (etait advisory). BUG-004: lien README.md -> docs/CONTRIBUTING.md corrige (+ DELIVERY_WORKFLOW.md), arbre projet mis a jour, parite README.fr.md. Verifie: mypy 0 erreur, ruff OK, pytest 728 passed / 5 skipped, frontend OK, liens md OK.	2026-09-11 14:57:55 -04:00
bruno	aa3df74fc1	fix(mfa): /mfa/webauthn/options enumeration-safe (200 totp fallback au lieu de 400) + test	2026-09-08 00:48:20 -04:00
bruno	ab795ec9e0	feat(mfa): #64 WebAuthn complet — enregistrement/clé/verify login + gestion clés dans Sécurité (backend+frontend+i18n+tests)	2026-09-07 23:55:35 -04:00
bruno	83355a25c8	chore(lint): ruff --fix sur le backend (cleanup pré-existant) ... Réduit les erreurs ruff de 11 à 5 (toutes pré-existantes non auto-fixables) : - F401 imports inutilisés dans auth/mfa.py - I001 blocs d'imports non triés dans auth/router.py + main.py + pdf_reader.py Les 5 restantes sont dans bookslm/export/watcher (code pré-existant, hors scope). Vérifié : pytest full suite reste 492 passed, 5 skipped, 0 failed.	2026-09-07 09:01:40 -04:00
bruno	83063d3a18	feat(auth): v2.1.0 - MFA TOTP avec QR code, recovery codes ... - backend/auth/mfa.py: TOTP (pyotp), recovery codes SHA-256 - Login flow: mfa_required → totp/verify → token (ou recovery) - 6 nouveaux endpoints /api/auth/mfa/* - Frontend: QR code setup, 6-digit auto-submit, recovery codes - Settings: section Sécurité avec enable/disable MFA - CSS: mfa-challenge, setup-card, recovery-list, badges - i18n: 36 nouvelles clés EN/FR - pyotp ajouté aux dépendances - 30 tests (TOTP, recovery, API endpoints, login flow) - 439 tests passent au total	2026-09-06 18:42:32 -04:00
bruno	1673531b43	fix: resolve all CI lint and security issues ... - ruff: 602→0 errors (428 auto-fixed, pyproject.toml ignores for FastAPI patterns) - bandit: skip B310 (urllib for vault file access is intentional) - Fixed SIM118 (dict.keys()→dict), PERF102, SIM113, SIM117 - Created pyproject.toml with ruff + bandit config - 285 tests still pass	2026-07-24 10:38:44 -04:00
bruno	2de9f91671	feat: server-side language preference — survives clear site data ... Problem: language preference stored only in localStorage, lost on 'clear site data'. French users with browser lang=fr always got French UI even when profile was English. Solution: - Backend: add 'language' field to user profile (default 'fr') - Backend: PATCH /api/auth/me to update language preference - Frontend: initI18n() priority: server > localStorage > navigator > 'fr' - Frontend: initAuth() runs before initI18n() so server check works - Frontend: profile Save persists language to server via PATCH Verified: tabs show English after server profile set to 'en'	2026-06-21 10:29:51 -04:00
bruno	83279b536f	fix: logout supprime access_token cookie + bouton toujours visible ... - Backend: delete_cookie access_token (/) + refresh_token - Logout ne requiert plus auth (graceful si token expire) - Bouton Deconnexion toujours visible dans le menu	2026-06-16 12:43:50 -04:00
bruno	1a14927f36	fix: resolve all 28 mypy type errors + re-enable coverage in CI	2026-05-28 12:57:30 -04:00
bruno	6fc43e2485	fix: ruff lint errors + bandit false positives + pip-audit non-blocking	2026-05-28 12:41:31 -04:00
bruno	2469026c1d	fix: login endpoint - request variable shadowing Starlette Request ... The login() function used 'request: LoginRequest' which shadowed FastAPI's Starlette Request object. Request.client was accessed on the LoginRequest Pydantic model instead of the HTTP request, causing AttributeError: 'LoginRequest' object has no attribute 'client'. Fix: rename the Pydantic parameter to 'body' and add explicit 'request: Request' for IP extraction and rate limiting.	2026-05-27 21:16:11 -04:00
bruno	ed2bb4f7fb	Add missing imports and clear backlink index ... Resolve build index regression causing stale backlink data on reindex.	2026-05-26 10:35:22 -04:00
bruno	482937fb30	Add audit logging, rate limiting, secret redactor, and backlinks ... Implement several security and feature improvements across the backend and frontend: - New IP-based rate limiter for authentication endpoints - New audit logging system for sensitive operations - New secret redactor to mask sensitive patterns in rendered content - Configurable token TTL and IGNORED_DIRS via environment variables - Add backlink index and API endpoint - Add preview tab support with single/double-click behavior in tree - Add file backup before write/delete operations	2026-05-26 10:27:00 -04:00
bruno	0bbd793e97	feat: Implement core Python FastAPI backend for user authentication, vault management, and file operations.	2026-03-27 10:11:43 -04:00
bruno	46e054f5dd	feat: Introduce core backend application with authentication API and a new popout HTML page.	2026-03-24 09:51:38 -04:00
bruno	190f47f134	feat: Introduce a comprehensive authentication system, including user management, JWT handling, and initial frontend components with Docker support.	2026-03-23 15:44:37 -04:00