4 Commits

Include renames

Author	SHA1	Message	Date
dev_agentandClaude Opus 5.5	15cc3c5ce4	Add CSRF protection and GET /api/v1/me ... RequireSession now stores the validated session in the request context (auth.WithSession / auth.SessionFrom); auth.ActorFrom derives the actor from it, so there is one context value. Every /api/v1 request other than GET, HEAD and OPTIONS must carry X-MealQuest-CSRF equal to the session's csrf_token (constant-time compare), else 403 {"error":{"code":"csrf"}}. The check runs after RequireSession, so unauthenticated requests still get 401. A session with no token is a 500, never a match against a missing header. GET /api/v1/me returns {name, email, household: {label: "Our kitchen"}, csrfToken} with Cache-Control: no-store. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-03 10:32:31 -04:00
dev_agent	b2201c5da1	Feature 03 task 3: Household group gate and auth middleware (#21) ... Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com> Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>	2026-10-03 10:30:07 -04:00
dev_agent	f0bdd0ef40	Feature 03 task 2: Server-side sessions, cookie and logout (#19) ... Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com> Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>	2026-10-03 10:20:14 -04:00
dev_agent	99c8f1625f	Feature 03 task 1: OIDC login and callback against Authentik (#16) ... Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com> Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>	2026-10-03 09:58:05 -04:00