Chris CoutinhoandClaude Opus 4.6 d06b862d24 fix: require bearer token on provision endpoints (open redirect mitigation) ...

Both /app/provision and /app/provision/status now require a valid
Nextcloud OIDC bearer token via the Authorization header, reusing the
existing validate_token_and_get_user pattern from the management API.

This eliminates the open redirect vulnerability (only authenticated
Astrolabe users can trigger the flow) and prevents unauthenticated
resource exhaustion via Login Flow v2 session creation.

The authenticated user_id from the token replaces the untrusted
user_id query parameter.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-03-31 17:09:37 +02:00

..

alembic

feat: add Docker Compose profiles and Login Flow v2 service

2026-02-27 20:33:54 +01:00

api

refactor: remove Smithery deployment mode

2026-03-22 20:15:47 +01:00

auth

fix: require bearer token on provision endpoints (open redirect mitigation)

2026-03-31 17:09:37 +02:00

client

fix: address PR review feedback (round 9)

2026-03-28 09:19:53 +01:00

controllers

fix: return all notes when search query is empty

2025-11-13 21:57:14 +01:00

document_processors

fix(mcp): Move all imports to the top of modules

2025-12-26 10:05:27 -06:00

embedding

fix(mcp): Move all imports to the top of modules

2025-12-26 10:05:27 -06:00

models

fix: address PR review feedback (round 9)

2026-03-28 09:19:53 +01:00

observability

refactor: enforce PLC0415 (import-outside-top-level) for source code

2026-02-20 08:04:50 +01:00

providers

fix: resolve all type checking errors (8 errors fixed)

2025-12-08 01:09:02 +01:00

search

refactor: enforce PLC0415 (import-outside-top-level) for source code

2026-02-20 08:04:50 +01:00

server

fix: address PR review feedback (round 9)

2026-03-28 09:19:53 +01:00

utils

feat: Add text processing background worker for telling client about progress

2025-10-25 19:52:45 +02:00

vector

fix: use app password auth for background sync in Login Flow mode

2026-03-30 00:55:31 +02:00

__init__.py

Initial commit

2025-05-04 23:24:55 +02:00

app.py

fix: address PR review round 3 — info disclosure, conditional routes, cleanup

2026-03-30 11:37:42 +02:00

cli.py

refactor: enforce PLC0415 (import-outside-top-level) for source code

2026-02-20 08:04:50 +01:00

config_validators.py

refactor: remove Smithery deployment mode

2026-03-22 20:15:47 +01:00

config.py

refactor: remove Smithery deployment mode

2026-03-22 20:15:47 +01:00

context.py

refactor: remove Smithery deployment mode

2026-03-22 20:15:47 +01:00

http.py

feat: add self-signed SSL certificate support for Nextcloud connections

2026-02-16 09:21:21 +01:00

migrations.py

refactor: enforce PLC0415 (import-outside-top-level) for source code

2026-02-20 08:04:50 +01:00