admin/0pt
5
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases Wiki Activity
1,245 Commits 35 Branches 0 Tags
d3feb0d50ab4fc45779b79349d025fd35c7dc521
Commit Graph
4 Commits
Author SHA1 Message Date
admin 3d2fc6f913 fix(recovery): restore source removed by production documentation merge 2026-11-10 03:42:10 +01:00
admin a4189333af docs(production): standardiserad produktionsberedskap och gap-analys 
Lägger docs/production-readiness.md och siax/production-gaps.json enligt SIAX Master Definition of Done. Underlag: git-, kod- och live-evidens 2026-11-11. Nivån är evidensbaserad, inte ett leveransgodkännande.
 2026-11-10 03:07:36 +01:00
admin 023406c9b6 feat(auth): Zitadel OIDC login for the portal
CI (SIAX Cloud) / integration (push) Skipped
Details
CI (SIAX Cloud) / sonar (push) Skipped
Details
masterplan-lock / check (push) Successful in 3s
Details
CI (SIAX Cloud) / sonar (pull_request) Skipped
Details
masterplan-lock / check (pull_request) Successful in 5s
Details
Security Scan (SIAX Cloud) / security (push) Successful in 14s
Details
CI (SIAX Cloud) / security (push) Successful in 21s
Details
Security Scan (SIAX Cloud) / security (pull_request) Successful in 19s
Details
CI (SIAX Cloud) / security (pull_request) Successful in 23s
Details
CI (SIAX Cloud) / integration (pull_request) Successful in 28s
Details
CI (SIAX Cloud) / quality (push) Successful in 48s
Details
CI (SIAX Cloud) / quality (pull_request) Successful in 45s
Details 
The portal had no way to obtain a verified principal: /api/0pt/* requires a
Bearer token, but the browser only had the dev-only HMAC cookie.

- GET /api/auth/login: Authorization Code + PKCE against Zitadel.
- GET /api/auth/callback: code exchange, id_token verification (issuer,
  audience, nonce) and a signed session cookie with sub + tenant.
- middleware accepts the signed session as a verified principal; Bearer wins.
- dev login POST is refused in production.
- Sign-in link in the portal shell.
 2026-11-02 15:48:02 +01:00
adminandClaude Opus 4.8 ba96566c14 feat(infra): payments (Stripe), auth scaffold, engine bridge, embeds, .env.example 
Env-guarded so build stays green: /api/payments/[order_id]/deposit+release + /api/webhooks/stripe (lazy Stripe, 50/50 escrow, 501 until keys); /api/auth login|me|logout (HMAC signed-session scaffold, guarded dev login); lib/engine bridges edge->FastAPI (estimates defers to ENGINE_URL when set); components/embed for NocoDB/Metabase signed URLs; .env.example full inventory. tsc 0, build green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-06-24 21:19:29 +02:00