3 Commits

Author	SHA1	Message	Date
opencode	bcae59626f	feat(security): add CSRF protection for all state-changing API routes ... - Synchronizer token stored in session; GET /auth/csrf to obtain it - csrfProtection middleware requires X-CSRF-Token on non-safe methods - customFetch injects the header via setCsrfTokenGetter - toolrate boot loads token; reload after local login (session regenerate) - OpenAPI GET /auth/csrf + CsrfToken schema, orval regenerated	2026-08-03 10:30:13 +02:00
root	59badeaa48	feat: auth foundation, similar tools, costs, redundancy, anonymous voting	2026-07-29 21:59:29 +02:00
agent	1de22a6979	Initial commit	2026-05-14 20:25:38 +00:00