2 commits

Author	SHA1	Message	Date
Scrum4Me Agent	aa1fd41bec	feat(security): rate-limit /api/flows/start, CSRF double-submit cookie, CSP headers ... - Rate-limit /api/flows/start to 10 req/min per user (in-memory, matches login pattern) - Add middleware.ts: validates x-csrf-token header against csrf_token cookie on all API POST requests; issues the cookie on GET if missing; sets CSP, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy on all responses - Add lib/csrf.ts: client-side apiFetch() wrapper that injects the CSRF header - Update all client components (login, useFlowRun, docker, caddy, git, systemd) to use apiFetch() for POST requests - Cookie config in login route already correct (NODE_ENV check, httpOnly, sameSite=strict) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-13 20:01:43 +02:00
Scrum4Me Agent	30f1b452a8	feat(caddy): /caddy page with config view and cert status table ... - app/caddy/page.tsx: server component fetches caddy_show_config (shiki-highlighted Caddyfile) and caddy_list_certs (parsed CertInfo[]) - app/caddy/_components/caddy-view.tsx: client component shows cert table (domain, issuer CN, notBefore, notAfter) with Valid/Expiring soon/Expired badges; auto-refreshes every 60 seconds Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-13 17:48:51 +02:00