daddy/modbison
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
154 Commits 115 Branches 0 Tags
5c21e5051c358b8ffa4a0c2240260ef6d6e2920f
Commit Graph

36 Commits

Author SHA1 Message Date
coder-bot 3cb4d01073 Fix access token collision and cross-file username collision 
- auth.py: _create_access_token had no jti claim, so two refreshes
  within the same wall-clock second produced byte-identical access
  tokens (same failure mode already fixed for refresh tokens earlier)
- test_refresh_endpoint.py: usernames (jwttoken, refreshuser, etc.)
  collided with test_auth_endpoints.py's own test usernames once run
  in the same pytest session against a shared DB with no per-test
  isolation -- exactly how run_checkpoint_tests.py invokes pytest.
  Namespaced this file's usernames with a refep_ prefix.

Full backend suite (63 tests) passes clean end-to-end against a real
Postgres with real migrations applied.
 2026-08-19 22:15:55 +00:00
coder-bot b3d2d71789 WIP checkpoint: Implement /auth/refresh endpoint 2026-08-19 21:58:48 +00:00
coder-bot 72f39bc547 WIP checkpoint: Address review feedback: Upgrade auth to RS256 signing, age-verification field, refresh-token sessions 2026-08-19 19:58:20 +00:00
architect-bot 758307bbee WIP checkpoint: Address review feedback: Upgrade auth to RS256 signing, age-verification field, refresh-token sessions 2026-08-19 19:49:41 +00:00
coder-bot 478638d4ff WIP checkpoint: Upgrade auth to RS256 signing, age-verification field, refresh-token sessions 2026-08-19 19:49:41 +00:00
coder-bot 7b074a01ed WIP checkpoint: Upgrade auth to RS256 signing, age-verification field, refresh-token sessions 2026-08-19 19:49:41 +00:00
coder-bot c68877239f WIP checkpoint: Upgrade auth to RS256 signing, age-verification field, refresh-token sessions 2026-08-19 19:49:41 +00:00
coder-bot ed6811a438 WIP checkpoint: Upgrade auth to RS256 signing, age-verification field, refresh-token sessions 2026-08-19 19:49:41 +00:00
architect-bot 073813f3e7 WIP checkpoint: US-1: Asset Import Pipeline — glTF upload endpoint with metadata extraction 2026-08-19 12:37:46 +00:00
architect-bot 54abe7ee96 WIP checkpoint: US-1: Asset Import Pipeline — glTF upload endpoint with metadata extraction 2026-08-19 12:32:06 +00:00
coder-bot a7cf385d0d WIP checkpoint: US-1: Asset Import Pipeline — glTF upload endpoint with metadata extraction 2026-08-19 12:31:05 +00:00
coder-bot b5525665dd WIP checkpoint: US-1: Asset Import Pipeline — glTF upload endpoint with metadata extraction 2026-08-19 12:31:05 +00:00
coder-bot 62889f39f1 WIP checkpoint: Enforce 18+ age gate at account registration 2026-08-18 15:32:16 +00:00
coder-bot 1d0222d980 WIP checkpoint: Enforce 18+ age gate at account registration 2026-08-18 15:28:25 +00:00
coder-bot 433d5d8f9f WIP checkpoint: Enforce 18+ age gate at account registration 2026-08-18 15:28:25 +00:00
coder-bot 5d7c61029c Fix remaining critical review issue: list_worlds visibility filter bypass 
Requesting an explicit ?visibility=PRIVATE (or FRIENDS_ONLY) skipped the
ownership check entirely — any authenticated user could list every other
user's private worlds just by passing the filter. Only the no-filter
default path enforced ownership. Now the ownership check applies whenever
a non-PUBLIC visibility is requested, explicit or not.

Also fixed current_user: CurrentUser = Depends() in assets.py (redundant
empty Depends() on an already-Annotated dependency, inconsistent with
every other endpoint) to plain current_user: CurrentUser per the review
feedback, and reordered params since that made it a non-default arg
following a defaulted one (SyntaxError otherwise).

Verified: py_compile clean, full app imports and loads in a clean venv.
 2026-08-18 00:14:37 +00:00
coder-bot 241fa9d0e0 WIP checkpoint: Address review feedback: Address review feedback: Scaffold FastAPI backend project structure 2026-08-17 23:42:56 +00:00
coder-bot 48a43c44a5 WIP checkpoint: Address review feedback: Scaffold FastAPI backend project structure 2026-08-17 23:38:24 +00:00
coder-bot 48dd177fa2 WIP checkpoint: Address review feedback: Scaffold FastAPI backend project structure 2026-08-17 23:36:31 +00:00
coder-bot 1f85ecc812 WIP checkpoint: Address review feedback: Scaffold FastAPI backend project structure 2026-08-17 23:34:54 +00:00
coder-bot d7d77474f9 WIP checkpoint: Scaffold FastAPI backend project structure 2026-08-17 23:34:54 +00:00
coder-bot 2fe6d5dbf0 WIP checkpoint: Scaffold FastAPI backend project structure 2026-08-17 23:34:54 +00:00
coder-bot 534da614dd WIP checkpoint: Scaffold FastAPI backend project structure 2026-08-17 23:34:54 +00:00
coder-bot dc09f5ae37 WIP checkpoint: Scaffold FastAPI backend project structure 2026-08-17 23:34:54 +00:00
coder-bot 295c44522c WIP checkpoint: Scaffold FastAPI backend project structure 2026-08-17 23:34:54 +00:00
coder-bot 33d2ef7f8a WIP checkpoint: Scaffold FastAPI backend project structure 2026-08-17 23:34:54 +00:00
coder-bot b51c90c360 WIP checkpoint: Scaffold FastAPI backend project structure 2026-08-17 23:34:54 +00:00
coder-bot 2b1786558a Recovered orphaned WIP before switching to a new task 2026-08-17 23:34:54 +00:00
coder-bot 7a6658798f Recovered orphaned WIP before switching to a new task 2026-08-17 23:34:54 +00:00
coder-bot 46a2ff672c WIP checkpoint: Scaffold FastAPI backend project structure 2026-08-17 23:34:54 +00:00
coder-bot f3c679faab WIP checkpoint: Scaffold FastAPI backend project structure 2026-08-17 23:34:54 +00:00
architect-bot 5837fad5df WIP checkpoint: Scaffold FastAPI backend project structure 2026-08-17 23:34:54 +00:00
agent-bot f659fd4d2a Recovered orphaned WIP before switching to a new task 2026-08-17 23:34:54 +00:00
agent-bot fa6e9064dc Recovered orphaned WIP before switching to a new task 2026-08-17 23:34:54 +00:00
agent-bot 3e030f8d45 WIP checkpoint: Scaffold FastAPI backend project structure 2026-08-17 23:34:54 +00:00
agent-bot 7594039fd0 WIP checkpoint: Scaffold FastAPI backend project structure 2026-08-17 23:34:54 +00:00