xarmian e6f123a4c3 fix: address Codex review findings for PR #89 (iteration 2) ...

- Exempt /admin/plan from RequireAuth and CSRF middleware so the
  pad-cloud sidecar can call it with cloud_secret body auth
- Add X-CSRF-Token header to admin console PATCH requests
- Send plan_overrides as a JSON string (not parsed object) to match
  backend *string decoder expectation
- Restrict confirm-only account deletion to cloud mode to prevent
  password users from bypassing re-auth

Co-Authored-By: Claude <noreply@anthropic.com>

2026-04-13 00:54:21 +00:00

..

handlers_2fa.go

fix: address Codex review findings for TOTP 2FA

2026-04-08 21:36:48 +00:00

handlers_account.go

fix: address Codex review findings for PR #89 (iteration 2)

2026-04-13 00:54:21 +00:00

handlers_activity.go

feat: collection & item grants, guest access, share dialog (PLAN-407 Phase 3) (#87)

2026-04-11 14:46:24 -04:00

handlers_admin_users.go

fix: address review findings for PR #89 (iteration 1)

2026-04-13 00:24:36 +00:00

handlers_admin.go

feat: add API token rotation, expiry defaults, and scope enforcement

2026-04-08 18:00:43 +00:00

handlers_agent_roles.go

feat: collection & item grants, guest access, share dialog (PLAN-407 Phase 3) (#87)

2026-04-11 14:46:24 -04:00

handlers_audit.go

fix: address Codex review findings for backup and audit trail

2026-04-06 02:22:23 +00:00

handlers_auth_test.go

PHASE-12: Security Hardening for Pad Cloud (#67)

2026-04-05 10:26:00 -04:00

handlers_auth.go

feat: add cloud infrastructure for hosted Pad (PLAN-427)

2026-04-12 17:43:40 +00:00

handlers_changes.go

feat: collection & item grants, guest access, share dialog (PLAN-407 Phase 3) (#87)

2026-04-11 14:46:24 -04:00

handlers_cloud.go

fix: address review findings for PR #89 (iteration 1)

2026-04-13 00:24:36 +00:00

handlers_collections.go

fix: comprehensive collection visibility enforcement

2026-04-11 02:18:36 +00:00

handlers_comments.go

feat: collection & item grants, guest access, share dialog (PLAN-407 Phase 3) (#87)

2026-04-11 14:46:24 -04:00

handlers_convention_library.go

Initial release

2026-03-26 01:52:36 +00:00

handlers_dashboard_test.go

Rename Phases to Plans, clean up deprecated aliases (#71)

2026-04-07 14:55:23 -04:00

handlers_dashboard.go

feat: collection & item grants, guest access, share dialog (PLAN-407 Phase 3) (#87)

2026-04-11 14:46:24 -04:00

handlers_documents.go

feat: collection & item grants, guest access, share dialog (PLAN-407 Phase 3) (#87)

2026-04-11 14:46:24 -04:00

handlers_events_test.go

feat: implement SSE connection limits

2026-04-06 01:23:34 +00:00

handlers_events.go

feat: collection & item grants, guest access, share dialog (PLAN-407 Phase 3) (#87)

2026-04-11 14:46:24 -04:00

handlers_grants.go

feat: collection & item grants, guest access, share dialog (PLAN-407 Phase 3) (#87)

2026-04-11 14:46:24 -04:00

handlers_item_links_test.go

feat(lineage): surface derived closure for TASK-122 (#40)

2026-04-02 10:46:09 -04:00

handlers_item_links.go

feat: collection & item grants, guest access, share dialog (PLAN-407 Phase 3) (#87)

2026-04-11 14:46:24 -04:00

handlers_item_versions.go

feat: collection & item grants, guest access, share dialog (PLAN-407 Phase 3) (#87)

2026-04-11 14:46:24 -04:00

handlers_items_test.go

Rename Phases to Plans, clean up deprecated aliases (#71)

2026-04-07 14:55:23 -04:00

handlers_items.go

feat: add cloud infrastructure for hosted Pad (PLAN-427)

2026-04-12 17:43:40 +00:00

handlers_members.go

feat: add cloud infrastructure for hosted Pad (PLAN-427)

2026-04-12 17:43:40 +00:00

handlers_playbook_library.go

Initial release

2026-03-26 01:52:36 +00:00

handlers_rbac_test.go

PHASE-12: Security Hardening for Pad Cloud (#67)

2026-04-05 10:26:00 -04:00

handlers_role_board.go

feat: collection & item grants, guest access, share dialog (PLAN-407 Phase 3) (#87)

2026-04-11 14:46:24 -04:00

handlers_search.go

feat: collection & item grants, guest access, share dialog (PLAN-407 Phase 3) (#87)

2026-04-11 14:46:24 -04:00

handlers_share_links.go

feat: share links with hardened security, anonymous access, and analytics (#88)

2026-04-11 16:40:18 -04:00

handlers_timeline.go

fix: comprehensive collection visibility enforcement

2026-04-11 02:18:36 +00:00

handlers_tokens.go

feat: add cloud infrastructure for hosted Pad (PLAN-427)

2026-04-12 17:43:40 +00:00

handlers_versions.go

feat: collection & item grants, guest access, share dialog (PLAN-407 Phase 3) (#87)

2026-04-11 14:46:24 -04:00

handlers_views.go

feat: collection & item grants, guest access, share dialog (PLAN-407 Phase 3) (#87)

2026-04-11 14:46:24 -04:00

handlers_webhooks.go

feat: add cloud infrastructure for hosted Pad (PLAN-427)

2026-04-12 17:43:40 +00:00

handlers_workspaces.go

feat: add cloud infrastructure for hosted Pad (PLAN-427)

2026-04-12 17:43:40 +00:00

item_lineage.go

fix: close remaining visibility bypass paths (round 5)

2026-04-11 03:02:14 +00:00

middleware_auth.go

fix: address Codex review findings for PR #89 (iteration 2)

2026-04-13 00:54:21 +00:00

middleware_csrf_test.go

PHASE-12: Security Hardening for Pad Cloud (#67)

2026-04-05 10:26:00 -04:00

middleware_csrf.go

fix: address Codex review findings for PR #89 (iteration 2)

2026-04-13 00:54:21 +00:00

middleware_logging.go

feat: add readiness probe and structured logging (TASK-161)

2026-04-05 15:02:54 +00:00

middleware_metrics_test.go

feat: add Prometheus metrics and /metrics endpoint

2026-04-06 01:13:40 +00:00

middleware_metrics.go

feat: add Prometheus metrics and /metrics endpoint

2026-04-06 01:13:40 +00:00

middleware_ratelimit_test.go

PHASE-12: Security Hardening for Pad Cloud (#67)

2026-04-05 10:26:00 -04:00

middleware_ratelimit.go

feat: add cloud infrastructure for hosted Pad (PLAN-427)

2026-04-12 17:43:40 +00:00

middleware_security_test.go

PHASE-12: Security Hardening for Pad Cloud (#67)

2026-04-05 10:26:00 -04:00

middleware_security.go

feat: session binding, nonce-based CSP, and auth hardening (#75)

2026-04-08 13:58:58 -04:00

server_test.go

feat: add cloud infrastructure for hosted Pad (PLAN-427)

2026-04-12 17:43:40 +00:00

server.go

feat: add cloud infrastructure for hosted Pad (PLAN-427)

2026-04-12 17:43:40 +00:00

token_scopes_test.go

fix: address Codex review findings for token rotation and scope enforcement

2026-04-08 18:50:08 +00:00

twofactor_challenge.go

fix: persist 2FA challenge key and prevent duplicate TOTP verification

2026-04-08 20:30:39 +00:00

username.go

feat: username validation, reserved words, and registration flow

2026-04-10 23:12:59 +00:00