Kyle Pope d269742aa2 Fix pentest findings: setup 500 error + password reuse prevention ...

- L-01: Setup endpoint used scalar_one_or_none() on unbounded User
  query, throwing 500 MultipleResultsFound when >1 user exists.
  Replaced with select(func.count()) for a reliable check.
- L-02: Change-password allowed reusing the same password, defeating
  must_change_password enforcement. Added equality check before
  accepting the new password.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-28 02:42:00 +08:00

..

jobs

Fix QA review #2: W-03/W-04, S-01 through S-04

2026-02-27 05:41:16 +08:00

models

Add user profile fields + IAM search, email column, detail panel

2026-02-27 22:40:20 +08:00

routers

Fix pentest findings: setup 500 error + password reuse prevention

2026-02-28 02:42:00 +08:00

schemas

Add user profile fields + IAM search, email column, detail panel

2026-02-27 22:40:20 +08:00

services

L-03: Session 7-day sliding window with 30-day hard ceiling

2026-02-27 15:45:15 +08:00

__init__.py

Initial commit

2026-02-15 16:13:41 +08:00

config.py

L-03: Session 7-day sliding window with 30-day hard ceiling

2026-02-27 15:45:15 +08:00

database.py

Fix code review findings: security hardening and frontend fixes

2026-02-16 07:49:21 +08:00

main.py

H-01: Add global CSRF middleware for all mutating endpoints

2026-02-27 15:39:42 +08:00