refactor: split main.py into helpers + route modules, harden security, add tests #5

Merged

elirtf merged 1 commit from fix/portal into main

2026-06-18 20:36:10 +00:00

elirtf commented

2026-06-18 20:36:04 +00:00

Owner

Split 2110-line main.py into helpers.py and 11 route modules in routes/
Fix temp password leak: show on dedicated invite_result page instead of flash cookie
Add threading.Lock to login throttle for thread safety
Harden cookies: httponly, secure, samesite on flash/selected_client/csrf
Add security headers middleware (XFO, XCTO, Referrer-Policy, X-XSS-Protection)
Fix form_int lstrip bug allowing multiple leading dashes
Standardize delete route audit ordering
Move lifecycle() from nested function to module level
Remove unused get_db() generator
Update Dockerfile: copy routes/ dir, proxy-headers for real client IP
Add security headers to Caddyfile
Add .env.example, ruff.toml, CI workflow, backup script
Add TOTP MFA support (pyotp, segno), account/audit templates
Replace python-jose with PyJWT
Upgrade password policy: requires upper+lower+digit, min 10 chars
Add pytest test suite (30 tests)
Add backup sidecar to docker-compose
Add Meraki integration to integrations.py
Update docs: README, INTEGRATIONS.md with current feature set
Remove stale avian/ directory

- Split 2110-line main.py into helpers.py and 11 route modules in routes/ - Fix temp password leak: show on dedicated invite_result page instead of flash cookie - Add threading.Lock to login throttle for thread safety - Harden cookies: httponly, secure, samesite on flash/selected_client/csrf - Add security headers middleware (XFO, XCTO, Referrer-Policy, X-XSS-Protection) - Fix form_int lstrip bug allowing multiple leading dashes - Standardize delete route audit ordering - Move lifecycle() from nested function to module level - Remove unused get_db() generator - Update Dockerfile: copy routes/ dir, proxy-headers for real client IP - Add security headers to Caddyfile - Add .env.example, ruff.toml, CI workflow, backup script - Add TOTP MFA support (pyotp, segno), account/audit templates - Replace python-jose with PyJWT - Upgrade password policy: requires upper+lower+digit, min 10 chars - Add pytest test suite (30 tests) - Add backup sidecar to docker-compose - Add Meraki integration to integrations.py - Update docs: README, INTEGRATIONS.md with current feature set - Remove stale avian/ directory

elirtf added 1 commit

2026-06-18 20:36:04 +00:00

refactor: split main.py into helpers + route modules, harden security, add tests

CI / lint-and-test (push) Has been cancelled

Details

CI / docker-build (push) Has been cancelled

Details

CI / lint-and-test (pull_request) Has been cancelled

Details

CI / docker-build (pull_request) Has been cancelled

Details

afc1f7f722

- Split 2110-line main.py into helpers.py and 11 route modules in routes/
- Fix temp password leak: show on dedicated invite_result page instead of flash cookie
- Add threading.Lock to login throttle for thread safety
- Harden cookies: httponly, secure, samesite on flash/selected_client/csrf
- Add security headers middleware (XFO, XCTO, Referrer-Policy, X-XSS-Protection)
- Fix form_int lstrip bug allowing multiple leading dashes
- Standardize delete route audit ordering
- Move lifecycle() from nested function to module level
- Remove unused get_db() generator
- Update Dockerfile: copy routes/ dir, proxy-headers for real client IP
- Add security headers to Caddyfile
- Add .env.example, ruff.toml, CI workflow, backup script
- Add TOTP MFA support (pyotp, segno), account/audit templates
- Replace python-jose with PyJWT
- Upgrade password policy: requires upper+lower+digit, min 10 chars
- Add pytest test suite (30 tests)
- Add backup sidecar to docker-compose
- Add Meraki integration to integrations.py
- Update docs: README, INTEGRATIONS.md with current feature set
- Remove stale avian/ directory