ZdenekSrotyr 3205a8d300 fix: block /auth/token for OAuth-only users without password_hash ... Users without a password_hash (Google OAuth / magic-link accounts) could obtain a JWT by simply posting their email to /auth/token. Add an else clause that rejects such requests with 401, directing them to their configured auth provider. Update and extend tests accordingly.		2026-04-09 16:29:47 +02:00
..
api	fix: block DuckDB metadata functions and relative paths in query endpoint	2026-04-09 16:29:11 +02:00
auth	fix: block /auth/token for OAuth-only users without password_hash	2026-04-09 16:29:47 +02:00
web	fix: login page uses login_buttons format expected by template	2026-04-08 07:11:03 +02:00
__init__.py	feat: add FastAPI server with auth, RBAC, and all API endpoints	2026-03-27 15:19:18 +01:00
instance_config.py	feat: complete system — web UI, all API endpoints, governance, admin, CLI commands	2026-03-27 16:52:22 +01:00
main.py	feat: add graceful shutdown handler	2026-04-09 07:03:45 +02:00
utils.py	feat: add graceful shutdown handler	2026-04-09 07:03:45 +02:00