dev_agentandClaude Opus 5.5 e73ebe2f2f Sanitize OIDC discovery errors and require CSRF on HEAD and OPTIONS ...

F03-01: go-oidc embeds the provider's response body in its error for a
non-200 discovery response, which cmd/server logged at startup. Discovery
now runs through a status-recording transport and a non-200 response is
reported as "provider answered HTTP <status>" only; transport errors keep
their cause. A test with a sentinel body proves it reaches neither the
error nor the log.

F03-02: the CSRF middleware exempts only GET, so HEAD and OPTIONS under
/api/v1 without X-MealQuest-CSRF get 403 csrf, matching CONTEXT.MD.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-03 11:11:29 -04:00

..

auth

Sanitize OIDC discovery errors and require CSRF on HEAD and OPTIONS

2026-10-03 11:11:29 -04:00

config

Feature 03 task 5: Trusted proxy handling for forwarded headers (#23)

2026-10-03 11:05:33 -04:00

db

Feature 02 task 4: sqlc configuration and core queries (#13)

2026-10-03 09:15:40 -04:00

forwarded

Feature 03 task 5: Trusted proxy handling for forwarded headers (#23)

2026-10-03 11:05:33 -04:00

frontend

Feature 01 task 3: Embed the PWA build with SPA fallback (#4)

2026-10-02 22:47:01 -04:00

secureurl

Feature 03 task 1: OIDC login and callback against Authentik (#16)

2026-10-03 09:58:05 -04:00

server

Sanitize OIDC discovery errors and require CSRF on HEAD and OPTIONS

2026-10-03 11:11:29 -04:00

store

Feature 02 integration fix: repository coverage and boot-path tests (#15)

2026-10-03 09:27:22 -04:00