naeel 8f9e0a96ad fix: reject client_id when allowedIds list is empty (no IAM, no JWT claims)

2026-06-11 20:18:55 +04:00

..

api

fix: reject client_id when allowedIds list is empty (no IAM, no JWT claims)

2026-06-11 20:18:55 +04:00

middleware

fix: CSRF 403 — читать токен из body (_csrf), cookieName без __Host- (v0.4.0)

2026-05-30 16:49:35 +03:00

routes

security: fix OIDC state check bypass + open redirect in login-token

2026-06-11 20:02:49 +04:00

auth.js

fix: X-Imp-* headers bridge UI→API impersonation + timezone GMT+4

2026-06-11 20:17:07 +04:00

config.js

fix: IAM_API_URL default to dev, document env selection

2026-06-06 12:00:27 +04:00

db.js

fix: add ALTER TABLE migration for impersonated_by column

2026-06-11 16:20:52 +04:00

queries.js

feat: double audit — impersonated_by in audit_log

2026-06-11 16:10:41 +04:00

validators.js

fix: 0.0.0.0/8 → blocked ranges + bump 0.5.23

2026-06-04 16:13:04 +03:00