Kyle Pope 581efa183a H-01: Add global CSRF middleware for all mutating endpoints ...

Replace the admin-only verify_xhr dependency with a pure ASGI
CSRFHeaderMiddleware that validates X-Requested-With: XMLHttpRequest
on all POST/PUT/PATCH/DELETE requests globally. Pre-auth endpoints
(login, setup, register, totp-verify, enforce-setup/confirm) are
exempt. This closes the CSRF gap where non-admin routes accepted
requests without origin validation.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-27 15:39:42 +08:00

..

__init__.py

Initial commit

2026-02-15 16:13:41 +08:00

admin.py

H-01: Add global CSRF middleware for all mutating endpoints

2026-02-27 15:39:42 +08:00

auth.py

Fix QA review #2: W-03/W-04, S-01 through S-04

2026-02-27 05:41:16 +08:00

calendars.py

Implement multi-user RBAC: database, auth, routing, admin API (Phases 1-6)

2026-02-26 19:06:25 +08:00

dashboard.py

Fix TS build errors and apply remaining QA fixes

2026-02-27 04:42:23 +08:00

event_templates.py

Implement multi-user RBAC: database, auth, routing, admin API (Phases 1-6)

2026-02-26 19:06:25 +08:00

events.py

Fix TS build errors and apply remaining QA fixes

2026-02-27 04:42:23 +08:00

locations.py

Implement multi-user RBAC: database, auth, routing, admin API (Phases 1-6)

2026-02-26 19:06:25 +08:00

people.py

Implement multi-user RBAC: database, auth, routing, admin API (Phases 1-6)

2026-02-26 19:06:25 +08:00

projects.py

Implement multi-user RBAC: database, auth, routing, admin API (Phases 1-6)

2026-02-26 19:06:25 +08:00

reminders.py

Implement multi-user RBAC: database, auth, routing, admin API (Phases 1-6)

2026-02-26 19:06:25 +08:00

settings.py

Add lock screen, auto-lock timeout, and login visual upgrade

2026-02-25 10:03:12 +08:00

todos.py

Fix TS build errors and apply remaining QA fixes

2026-02-27 04:42:23 +08:00

totp.py

Phase 8: Registration flow & MFA enforcement UI

2026-02-26 18:39:18 +08:00

weather.py

Fix QA review #2: W-03/W-04, S-01 through S-04

2026-02-27 05:41:16 +08:00