6 Commits

Include renames

Author	SHA1	Message	Date
naeel	b6e8f31cc6	refactor: csp.js exports CSP_DIRECTIVES, helmet applies them in one call	2026-05-30 15:37:32 +03:00
naeel	695264e7b4	feat: CSP enabled via src/middleware/csp.js (unsafe-inline, blocks external/frame/object)	2026-05-30 15:36:22 +03:00
naeel	f4c9983612	feat: PG session store via connect-pg-simple (src/middleware/session.js)	2026-05-30 15:34:50 +03:00
naeel	a5170a062c	security: fix 7 vulnerabilities from Opus code review ... - [A01] /export: mount after auth.middleware, filter by company for non-admin - [A02] OIDC: verify issuer, audience, select key by kid; preload JWKS at startup - [A07] session fixation: session.regenerate() in POST /login, GET /callback, POST /dev-login - [A10] open redirect: safeReturn() helper validates returnTo (blocks //evil.com, https:// etc) - [A05] CSRF: getSessionIdentifier uses req.sessionID instead of dead req.cookies.jwt - [A05] fail-fast: reject default SESSION_SECRET / CSRF_SECRET in NODE_ENV=production - [A05] DEV_MODE=true blocked in production Tests: 68 PASS, 0 FAIL (was 50, added 18 new security-focused tests)	2026-05-30 15:25:57 +03:00
naeel	b25f346d97	refactor: шаг 3 — CSRF-инициализация вынесена в src/middleware/csrf.js	2026-05-30 13:37:08 +03:00
naeel	35210291d0	refactor: шаг 2 — лимитеры вынесены в src/middleware/rateLimit.js	2026-05-30 13:36:10 +03:00