coder-bot
3cb4d01073
Fix access token collision and cross-file username collision
...
- auth.py: _create_access_token had no jti claim, so two refreshes
within the same wall-clock second produced byte-identical access
tokens (same failure mode already fixed for refresh tokens earlier)
- test_refresh_endpoint.py: usernames (jwttoken, refreshuser, etc.)
collided with test_auth_endpoints.py's own test usernames once run
in the same pytest session against a shared DB with no per-test
isolation -- exactly how run_checkpoint_tests.py invokes pytest.
Namespaced this file's usernames with a refep_ prefix.
Full backend suite (63 tests) passes clean end-to-end against a real
Postgres with real migrations applied.
2026-08-19 22:15:55 +00:00
coder-bot
b3d2d71789
WIP checkpoint: Implement /auth/refresh endpoint
2026-08-19 21:58:48 +00:00
coder-bot
72f39bc547
WIP checkpoint: Address review feedback: Upgrade auth to RS256 signing, age-verification field, refresh-token sessions
2026-08-19 19:58:20 +00:00
architect-bot
758307bbee
WIP checkpoint: Address review feedback: Upgrade auth to RS256 signing, age-verification field, refresh-token sessions
2026-08-19 19:49:41 +00:00
coder-bot
478638d4ff
WIP checkpoint: Upgrade auth to RS256 signing, age-verification field, refresh-token sessions
2026-08-19 19:49:41 +00:00
coder-bot
7b074a01ed
WIP checkpoint: Upgrade auth to RS256 signing, age-verification field, refresh-token sessions
2026-08-19 19:49:41 +00:00
coder-bot
c68877239f
WIP checkpoint: Upgrade auth to RS256 signing, age-verification field, refresh-token sessions
2026-08-19 19:49:41 +00:00
coder-bot
ed6811a438
WIP checkpoint: Upgrade auth to RS256 signing, age-verification field, refresh-token sessions
2026-08-19 19:49:41 +00:00
architect-bot
073813f3e7
WIP checkpoint: US-1: Asset Import Pipeline — glTF upload endpoint with metadata extraction
2026-08-19 12:37:46 +00:00
architect-bot
54abe7ee96
WIP checkpoint: US-1: Asset Import Pipeline — glTF upload endpoint with metadata extraction
2026-08-19 12:32:06 +00:00
coder-bot
a7cf385d0d
WIP checkpoint: US-1: Asset Import Pipeline — glTF upload endpoint with metadata extraction
2026-08-19 12:31:05 +00:00
coder-bot
b5525665dd
WIP checkpoint: US-1: Asset Import Pipeline — glTF upload endpoint with metadata extraction
2026-08-19 12:31:05 +00:00
coder-bot
62889f39f1
WIP checkpoint: Enforce 18+ age gate at account registration
2026-08-18 15:32:16 +00:00
coder-bot
1d0222d980
WIP checkpoint: Enforce 18+ age gate at account registration
2026-08-18 15:28:25 +00:00
coder-bot
433d5d8f9f
WIP checkpoint: Enforce 18+ age gate at account registration
2026-08-18 15:28:25 +00:00
5d7c61029c
Fix remaining critical review issue: list_worlds visibility filter bypass
...
Requesting an explicit ?visibility=PRIVATE (or FRIENDS_ONLY) skipped the
ownership check entirely — any authenticated user could list every other
user's private worlds just by passing the filter. Only the no-filter
default path enforced ownership. Now the ownership check applies whenever
a non-PUBLIC visibility is requested, explicit or not.
Also fixed current_user: CurrentUser = Depends() in assets.py (redundant
empty Depends() on an already-Annotated dependency, inconsistent with
every other endpoint) to plain current_user: CurrentUser per the review
feedback, and reordered params since that made it a non-default arg
following a defaulted one (SyntaxError otherwise).
Verified: py_compile clean, full app imports and loads in a clean venv.
2026-08-18 00:14:37 +00:00
coder-bot
241fa9d0e0
WIP checkpoint: Address review feedback: Address review feedback: Scaffold FastAPI backend project structure
2026-08-17 23:42:56 +00:00
coder-bot
48a43c44a5
WIP checkpoint: Address review feedback: Scaffold FastAPI backend project structure
2026-08-17 23:38:24 +00:00
coder-bot
48dd177fa2
WIP checkpoint: Address review feedback: Scaffold FastAPI backend project structure
2026-08-17 23:36:31 +00:00
coder-bot
1f85ecc812
WIP checkpoint: Address review feedback: Scaffold FastAPI backend project structure
2026-08-17 23:34:54 +00:00
coder-bot
d7d77474f9
WIP checkpoint: Scaffold FastAPI backend project structure
2026-08-17 23:34:54 +00:00
coder-bot
2fe6d5dbf0
WIP checkpoint: Scaffold FastAPI backend project structure
2026-08-17 23:34:54 +00:00
coder-bot
534da614dd
WIP checkpoint: Scaffold FastAPI backend project structure
2026-08-17 23:34:54 +00:00
coder-bot
dc09f5ae37
WIP checkpoint: Scaffold FastAPI backend project structure
2026-08-17 23:34:54 +00:00
coder-bot
295c44522c
WIP checkpoint: Scaffold FastAPI backend project structure
2026-08-17 23:34:54 +00:00
coder-bot
33d2ef7f8a
WIP checkpoint: Scaffold FastAPI backend project structure
2026-08-17 23:34:54 +00:00
coder-bot
b51c90c360
WIP checkpoint: Scaffold FastAPI backend project structure
2026-08-17 23:34:54 +00:00
coder-bot
2b1786558a
Recovered orphaned WIP before switching to a new task
2026-08-17 23:34:54 +00:00
coder-bot
7a6658798f
Recovered orphaned WIP before switching to a new task
2026-08-17 23:34:54 +00:00
coder-bot
46a2ff672c
WIP checkpoint: Scaffold FastAPI backend project structure
2026-08-17 23:34:54 +00:00
coder-bot
f3c679faab
WIP checkpoint: Scaffold FastAPI backend project structure
2026-08-17 23:34:54 +00:00
architect-bot
5837fad5df
WIP checkpoint: Scaffold FastAPI backend project structure
2026-08-17 23:34:54 +00:00
agent-bot
f659fd4d2a
Recovered orphaned WIP before switching to a new task
2026-08-17 23:34:54 +00:00
agent-bot
fa6e9064dc
Recovered orphaned WIP before switching to a new task
2026-08-17 23:34:54 +00:00
agent-bot
3e030f8d45
WIP checkpoint: Scaffold FastAPI backend project structure
2026-08-17 23:34:54 +00:00
agent-bot
7594039fd0
WIP checkpoint: Scaffold FastAPI backend project structure
2026-08-17 23:34:54 +00:00
coder-bot
architect-bot
coder-bot
agent-bot