overseer 42a205b4bd Admin auth: constant-time panel-token comparison in require_admin ...

Fixes review finding P2: require_admin compared the Bearer credential
against config.panel_token with Python ==, which short-circuits and is
not constant-time. Compare with secrets.compare_digest on UTF-8 bytes
instead — the same pattern require_panel_token already uses for this
exact secret — keeping the truthiness guard on config.panel_token and
the same 403 rejection detail and behaviour.

2026-09-23 00:55:15 -04:00

..

__init__.py

FastAPI skeleton: health, OpenAPI, core wiring (task 042dfc5c)

2026-09-21 16:13:41 -04:00

app.py

Admin auth: Authentik JWT validation (#156)

2026-09-23 00:37:30 -04:00

auth.py

Admin auth: constant-time panel-token comparison in require_admin

2026-09-23 00:55:15 -04:00

config.py

Admin auth: Authentik JWT validation (#156)

2026-09-23 00:37:30 -04:00

database.py

FastAPI skeleton: health, OpenAPI, core wiring (task 042dfc5c)

2026-09-21 16:13:41 -04:00

dependencies.py

Panel plane: service-token auth and snapshot route (#152)

2026-09-22 22:23:16 -04:00

events.py

SSE endpoint and the quest-completed transition (#154)

2026-09-22 23:08:03 -04:00

nestquest_core.py

SSE endpoint and the quest-completed transition (#154)

2026-09-22 23:08:03 -04:00

routes_admin.py

Admin routes: require_admin gates nestquest-admins group, refuses panel token

2026-09-23 00:44:38 -04:00

routes_panel.py

SSE: publish uncompleted, child-day-complete and missed (#155)

2026-09-22 23:25:06 -04:00

transitions.py

SSE: publish uncompleted, child-day-complete and missed (#155)

2026-09-22 23:25:06 -04:00