Kyle Pope 0a8e163e47 Fix QA review findings: 2 critical, 3 warnings, 1 suggestion ...

C-01: Initialize config=None before conditional in auth/status to
prevent NameError on fresh instance (setup_required=True path)

C-02: Use generic "Authentication failed" on passkey lockout trigger
instead of leaking lockout state (consistent with F-02 remediation)

W-01: Add nginx rate limit for /api/auth/passkeys/passwordless
endpoints (enable accepts password — brute force protection)

W-02: Call record_successful_login in passkey unlock path to reset
failed_login_count (prevents unexpected lockout accumulation)

W-05: Auto-clear must_change_password on passkey login — user can't
provide old password in forced-change form after passkey auth

S-01: Pin webauthn to >=2.1.0,<3 (prevent major version breakage)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-03-18 02:27:16 +08:00

..

__init__.py

Initial commit

2026-02-15 16:13:41 +08:00

admin.py

feat(backend): Phase 1 passwordless login — migration, models, toggle endpoints, unlock, delete guard, admin controls

2026-03-18 00:15:39 +08:00

auth.py

Fix QA review findings: 2 critical, 3 warnings, 1 suggestion

2026-03-18 02:27:16 +08:00

calendars.py

Polish pass: action all remaining QA suggestions before merge

2026-03-17 05:28:34 +08:00

connections.py

Add collaborative project sharing, task assignments, and delta polling

2026-03-17 03:18:35 +08:00

dashboard.py

Remove unused get_accessible_calendar_ids import from dashboard

2026-03-16 20:43:35 +08:00

event_invitations.py

Add per-invitee can_modify toggle for event edit access

2026-03-17 00:59:36 +08:00

event_templates.py

M-01+M-03: Add input validation and extra=forbid to all request schemas

2026-02-27 15:43:55 +08:00

events.py

Fix QA and pentest findings for event invitations

2026-03-17 01:28:01 +08:00

locations.py

Rework Nominatim results: name as label, address as full street address

2026-03-17 15:58:20 +08:00

notifications.py

Address QA warnings W-02 through W-07

2026-03-05 23:55:11 +08:00

passkeys.py

Fix QA review findings: 2 critical, 3 warnings, 1 suggestion

2026-03-18 02:27:16 +08:00

people.py

Fix QA: IntegrityError handling, dict mutation, birthday sync, None guard

2026-03-04 09:05:46 +08:00

projects.py

Polish pass: action all remaining QA suggestions before merge

2026-03-17 05:28:34 +08:00

reminders.py

M-01+M-03: Add input validation and extra=forbid to all request schemas

2026-02-27 15:43:55 +08:00

settings.py

Action QA findings: refactor sync to accept resolved values

2026-03-07 06:13:21 +08:00

shared_calendars.py

Fix W-06 regression: preferred_name is on Settings, not User model

2026-03-06 23:49:49 +08:00

todos.py

M-01+M-03: Add input validation and extra=forbid to all request schemas

2026-02-27 15:43:55 +08:00

totp.py

Fix 3 pentest findings: lockout status disclosure, timing side-channel, XFF trust scope

2026-03-18 01:01:19 +08:00

weather.py

Fix QA review #2: W-03/W-04, S-01 through S-04

2026-02-27 05:41:16 +08:00