ZdenekSrotyr 94c6b0f839 fix: require password verification when user has password_hash in /auth/token ... Previously the password check was gated on both user.password_hash and request.password being truthy, so an attacker could omit the password field (which defaults to "") and receive a valid JWT. Now any user with a stored hash must supply a non-empty password that passes argon2 verification. Adds six TestTokenEndpoint tests covering empty, missing, wrong, and correct password, plus no-hash user and unknown user cases.		2026-04-09 06:44:31 +02:00
..
providers	security: fix auth (argon2, cookie, JWT), CORS, session middleware, pyproject.toml	2026-04-08 12:08:52 +02:00
__init__.py	feat: add FastAPI server with auth, RBAC, and all API endpoints	2026-03-27 15:19:18 +01:00
dependencies.py	security: fix auth (argon2, cookie, JWT), CORS, session middleware, pyproject.toml	2026-04-08 12:08:52 +02:00
jwt.py	security: fix auth (argon2, cookie, JWT), CORS, session middleware, pyproject.toml	2026-04-08 12:08:52 +02:00
router.py	fix: require password verification when user has password_hash in /auth/token	2026-04-09 06:44:31 +02:00