2 Commits

Include renames

Author	SHA1	Message	Date
dev_agentandClaude Opus 5.5	e73ebe2f2f	Sanitize OIDC discovery errors and require CSRF on HEAD and OPTIONS ... F03-01: go-oidc embeds the provider's response body in its error for a non-200 discovery response, which cmd/server logged at startup. Discovery now runs through a status-recording transport and a non-200 response is reported as "provider answered HTTP <status>" only; transport errors keep their cause. A test with a sentinel body proves it reaches neither the error nor the log. F03-02: the CSRF middleware exempts only GET, so HEAD and OPTIONS under /api/v1 without X-MealQuest-CSRF get 403 csrf, matching CONTEXT.MD. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-03 11:11:29 -04:00
dev_agent	36b975ff5b	Feature 03 task 4: CSRF protection and GET /api/v1/me (#22) ... Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com> Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>	2026-10-03 10:51:26 -04:00