security: harden plugin auth surface and frontend SDKs - #40

Merged

juicycleff merged 13 commits into

mainfrom

security-hardening-and-store-conformance

Aug 11, 2026

Commits on Aug 5, 2026

fix(plugins): require auth on plugin admin and management routes
juicycleff
committed
d787dfd
fix(ui): validate post-auth redirect targets
juicycleff
committed
526cd3d
fix(ui/nextjs): forward client identity and harden proxy responses
juicycleff
committed
74c6d9e
fix(plugins): close magic-link token confusion and phone OTP brute-force
juicycleff
committed
8db7bba
fix(oauth2): bind codes to client, redirect_uri, scope, and PKCE
juicycleff
committed
970ff61
fix(mfa): require step-up to disable, accept recovery codes, cap ticket attempts
juicycleff
committed
2f5d320
fix: propagate plugin init failures, honour per-method session TTLs, harden IP and single-use
juicycleff
committed
350973a
chore: gitignore .claude workspace
juicycleff
committed
a95aa5d
fix(ui): derive session expiry from the server, and let the server read stored sessions
juicycleff
committed
01ea416
fix(ui): fail closed when a session cannot be validated
juicycleff
committed
7d741cf
fix(ui): default tokens to memory, and bound wildcard path matching
juicycleff
committed
c76c599
chore(ui): add eslint to the workspace, and bound the refresh retry it found
juicycleff
committed
bdacdeb
refactor(middleware): return typed errors instead of hand-written envelopes
juicycleff
committed
466c583