admin/0pt - 0pt - Gitea: Git with a cup of tea

5 Commits

Include renames

Author	SHA1	Message	Date
admin	3d2fc6f913	fix(recovery): restore source removed by production documentation merge	2026-11-10 03:42:10 +01:00
admin	a4189333af	docs(production): standardiserad produktionsberedskap och gap-analys Lägger docs/production-readiness.md och siax/production-gaps.json enligt SIAX Master Definition of Done. Underlag: git-, kod- och live-evidens 2026-11-11. Nivån är evidensbaserad, inte ett leveransgodkännande.	2026-11-10 03:07:36 +01:00
admin	bd1c20edb2	feat: add guarded document workbench foundations CI (SIAX Cloud) / integration (push) Skipped Details CI (SIAX Cloud) / sonar (push) Skipped Details masterplan-lock / check (push) Successful in 5s Details Security Scan (SIAX Cloud) / security (push) Successful in 15s Details CI (SIAX Cloud) / security (push) Successful in 16s Details CI (SIAX Cloud) / sonar (pull_request) Skipped Details masterplan-lock / check (pull_request) Successful in 7s Details Security Scan (SIAX Cloud) / security (pull_request) Successful in 21s Details CI (SIAX Cloud) / security (pull_request) Successful in 25s Details CI (SIAX Cloud) / quality (push) Successful in 1m17s Details CI (SIAX Cloud) / integration (pull_request) Successful in 54s Details CI (SIAX Cloud) / quality (pull_request) Successful in 1m7s Details	2026-11-02 01:26:36 +01:00
Claude (SIAX platform session)	1c1e2cb649	fix(auth): make the AUTH_ENFORCE default fail-closed on /api/0pt/* CI (SIAX Cloud) / quality (push) Successful in 42s Details CI (SIAX Cloud) / security (pull_request) Successful in 22s Details CI (SIAX Cloud) / quality (pull_request) Successful in 42s Details CI (SIAX Cloud) / security (push) Successful in 23s Details The auth seam read `process.env.AUTH_ENFORCE === 'true'`, so an absent env var meant NO authentication: any fresh container, local run, DR restore or redeploy that dropped the variable served /api/0pt/* anonymously, taking the tenant from the caller-supplied X-Tenant-Id header. 0pt.app is deployed and was answering anonymously (verified: an invalid Bearer token plus an arbitrary X-Tenant-Id returned 200), so this was a live hole, not latent. * authEnforced() now returns true unless AUTH_ENFORCE is explicitly "false" (trimmed, case-insensitive). Unset/empty/misspelled => ENFORCED. * assertAuthConfigSafe() throws AuthMisconfigurationError when NODE_ENV=production and enforcement resolved off, naming AUTH_ENFORCE. It runs at middleware module load (startup) and on the env-driven request path, so a production instance can neither boot nor serve a single unauthenticated request with auth switched off. * .env.example no longer teaches AUTH_ENFORCE=false; README's Deploy section states the fail-closed posture (no DEPLOY.md in this repo). * 7 new tests, incl. the regression case: with AUTH_ENFORCE unset and no `enforce` option, an unauthenticated request is rejected with 401. No test was inverted or deleted -- none asserted the open default; the three enforce:false cases now describe the explicit local-dev escape hatch. Tests: 121 passed / 1 skipped before, 128 passed / 1 skipped after. Typecheck and build clean; advisory lint unchanged (16 pre-existing problems). Scope: auth default only. The matcher still covers /api/0pt/* alone, and the handlers still take tenant_id from the query/body rather than the verified principal -- both described in the PR body, neither fixed here.	2026-07-27 13:28:24 +02:00
SIAX Foundation BotandClaude Opus 4.8	1d76d50f3d	feat(auth,foundation): Wave 2 flag-gated Zitadel JWT verify + validation + eslint + tests CI (SIAX Cloud) / security (push) Failing after 28s Details CI (SIAX Cloud) / quality (push) Failing after 44s Details CI (SIAX Cloud) / quality (pull_request) Failing after 33s Details CI (SIAX Cloud) / security (pull_request) Failing after 26s Details Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-25 14:32:34 +02:00