3 Commits

Include renames

Author	SHA1	Message	Date
Chris CoutinhoandClaude Opus 4.5	2e7774654b	refactor(api): split management.py into domain-focused modules ... Split the monolithic management.py (1988 lines) into 4 focused modules: - management.py: Server status, user sessions, shared helpers (~520 lines) - passwords.py: App password provisioning for BasicAuth mode (~300 lines) - webhooks.py: Webhook registration management (~290 lines) - visualization.py: Search and PDF preview endpoints (~810 lines) Backward compatibility maintained via __init__.py re-exports. Updated test imports to use new module paths. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-26 21:28:18 +01:00
Chris CoutinhoandClaude Opus 4.5	f15baefe7e	feat: Add rate limiting and extract helpers for app password endpoints ... Security improvements: - Add in-memory rate limiter for app password provisioning (5 attempts/hour/user) - Returns 429 Too Many Requests with Retry-After header when limit exceeded - Rate limiting is per-user to prevent cross-user DoS Code quality improvements: - Extract _extract_basic_auth() helper to reduce duplication across 3 endpoints - Move base64, re imports to module level - Add APP_PASSWORD_PATTERN constant for regex validation - Add NEXTCLOUD_VALIDATION_TIMEOUT constant (10s) Test coverage: - Add test_provision_app_password_rate_limiting - Add test_rate_limiting_is_per_user - Add autouse fixture to clear rate limit state between tests - Total: 15 tests for management API endpoints Addresses reviewer feedback on PR #473. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-14 14:02:00 +01:00
Chris CoutinhoandClaude Opus 4.5	370c3ff444	test: Add comprehensive tests for app password storage and provisioning ... - Add 12 unit tests for RefreshTokenStorage app password methods - Basic CRUD operations (store, get, delete) - Encryption verification (passwords encrypted at rest) - Error handling (missing encryption key, wrong key) - Multi-user independence - Add 13 unit tests for Management API endpoints - POST /api/v1/users/{user_id}/app-password provisioning - GET /api/v1/users/{user_id}/app-password status - DELETE /api/v1/users/{user_id}/app-password deletion - Auth validation (BasicAuth, username matching) - Nextcloud credential validation - Rewrite 10 integration tests for new architecture - Remove AstrolabeClient/OAuth dependency - Use local RefreshTokenStorage for app passwords - Test BasicAuth and OAuth mode separation - Test NotProvisionedError scenarios Addresses reviewer feedback on PR #473 requiring test coverage. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-13 21:44:23 +01:00