SyslogSolution/denya-onecare

T

root 3ae1062d65 P0 security batch: admin-only user mgmt, unified role model, login rate limiting, webhook secret, security headers, pagination caps

- Remove POST /api/auth/register (404); no sign-up UI; users are admin-managed
- Add admin-only POST/PATCH/DELETE /api/auth/users (forced canonical roles,
  self-lockout + reference guards)
- Unify role model in app/core/roles.py; reject unknown roles at creation and
  at login/JWT validation; startup normalizes unambiguous legacy aliases
- Login rate limiting ~5 fails/15 min per IP+email -> 429 (in-process, tunable)
- WhatsApp webhook requires X-Webhook-Secret; fail-closed when env unset;
  GET handshake uses constant-time verify token (403 on mismatch)
- GET /api/whatsapp/mock-log now requires auth
- Security headers middleware: X-Frame-Options DENY, nosniff, CSP on HTML,
  HSTS behind TLS
- Pagination: limit alias for page_size, hard cap enforced, both -> 422

2026-09-08 10:36:16 +00:00

feat: backdated reported date for old active tickets

2026-08-03 09:40:23 +00:00

P0 security batch: admin-only user mgmt, unified role model, login rate limiting, webhook secret, security headers, pagination caps

2026-09-08 10:36:16 +00:00

P0 security batch: admin-only user mgmt, unified role model, login rate limiting, webhook secret, security headers, pagination caps

2026-09-08 10:36:16 +00:00

.env.example

P0 security batch: admin-only user mgmt, unified role model, login rate limiting, webhook secret, security headers, pagination caps

2026-09-08 10:36:16 +00:00

.gitignore

fix(dashboard): paginate CEO dashboard ticket fetch to respect API cap

2026-07-31 09:53:35 +00:00

AGENTS.md

P0 security batch: admin-only user mgmt, unified role model, login rate limiting, webhook secret, security headers, pagination caps

2026-09-08 10:36:16 +00:00

alembic.ini

feat: Sprint 1 foundation - FastAPI scaffold, DB schema, auth, seed data, mock WhatsApp, Docker

2026-07-23 12:04:14 +00:00

apartment_mapping.json

fix: include Penthouse rows (PH1E-/PH1W-/PH2E-/PH2W-) in apartment mapping — parser had skipped them

2026-08-26 23:44:30 +00:00

CLAUDE.md

P0 security batch: admin-only user mgmt, unified role model, login rate limiting, webhook secret, security headers, pagination caps

2026-09-08 10:36:16 +00:00

docker-compose.yml

fix: P0 hardening — fail-closed SECRET_KEY, locked CORS, role-safe registration (HARDENING.md P0.1/P0.2/P0.3)

2026-09-02 23:59:21 +00:00

Dockerfile

fix: COPY apartment_mapping.json into image (was missing -> built-in fallback used)

2026-08-26 21:29:55 +00:00

HARDENING.md

docs: production hardening & review checklist for demo->prod transition

2026-08-03 08:05:26 +00:00

PRD.md

no-mistakes(document): Docs synced for Cancelled status; lint cleaned

2026-08-02 14:37:37 +00:00

pyproject.toml

no-mistakes(review): Add pytest pythonpath config so tests resolve app imports

2026-07-31 10:18:52 +00:00

README.md

Initial commit

2026-07-19 19:51:30 +00:00

README.md

denya-onecare

Denya OneCare - Centralized issue tracking for Pavilion Accra. FastAPI + SQLite + Alpine.js + Twilio.