graham/towerops
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
towerops/lib/towerops_web/controllers
History
Graham McIntire abfd44fd75 fix: 3 more high-severity bugs (H19, H20, H25) 
- H19: /api/v1/mobile/auth/qr/verify no longer returns user_email. Knowing
  a QR token now only tells the caller the token is valid; the email is
  only revealed by /complete which consumes the token.
- H20: CoverageWorker max_attempts dropped from 3 to 1. The fail/2 path
  already returns :ok and writes the failure onto the coverage record,
  so the 3-attempt retry policy was never reachable and was misleading.
- H25: ChecksController.create rejects device_ids that don't belong to
  the caller's organization (via ScopedResource.fetch). Without this an
  API token could attach service checks to devices in another tenant.

Also strip bug ID references from in-code comments (per feedback that
H/M/L numbers don't survive past their bugs.md removal); commit history
keeps the audit trail.
2026-05-12 11:32:20 -05:00
..
api fix: 3 more high-severity bugs (H19, H20, H25) 2026-05-12 11:32:20 -05:00
api_docs_html fix: API token access control, admin form crash, MIB validation, CSP dedup 2026-05-12 09:08:57 -05:00
error_html Add onboarding flow for new organizations 2026-02-16 10:14:45 -06:00
graphql_docs_html test: lift coverage to 78.42% and link Ansible collection in docs 2026-05-07 16:48:53 -05:00
page_html chore: migrate agent repo references from GitHub to Codeberg 2026-05-07 07:44:48 -05:00
user_confirmation_html i18n: wrap all user-facing strings in gettext() 2026-02-14 17:44:01 -06:00
user_registration_html ui: polish auth pages, core components, and visual consistency 2026-02-14 21:11:33 -06:00
user_reset_password_html test: lift coverage 78.42% → 79.59% with focused unit + integration tests 2026-05-07 18:40:43 -05:00
user_session_html fix: another Mix.env() call in device_live/index.ex 2026-03-09 14:59:41 -05:00
user_settings_html fix: netbox url field type, gaiia ipRange→block, remove unknown webhook log 2026-02-14 17:44:01 -06:00
user_sudo_html fix: netbox url field type, gaiia ipRange→block, remove unknown webhook log 2026-02-14 17:44:01 -06:00
admin_controller.ex fix: remaining bugs.md findings — Repo calls, process dict, CSS, rate limits, Oban, debug route 2026-05-11 19:34:18 -05:00
api_docs_controller.ex updates 2026-01-17 17:49:53 -06:00
api_docs_html.ex updates 2026-01-17 17:49:53 -06:00
debug_controller.ex add headers debug in prod 2026-02-01 10:54:13 -06:00
error_html.ex add error pages 2026-01-06 14:37:48 -06:00
error_json.ex security: implement comprehensive security audit fixes 2026-03-05 13:08:10 -06:00
graphql_docs_controller.ex feat: add GraphQL API with Absinthe, full schema, resolvers, and documentation 2026-02-14 11:28:57 -06:00
graphql_docs_html.ex feat: add GraphQL API with Absinthe, full schema, resolvers, and documentation 2026-02-14 11:28:57 -06:00
health_controller.ex fix: H12 cookie hardening + 5 low/medium bugs (L2, L5, L6, L8, L10, L11) 2026-05-12 11:22:47 -05:00
invitation_controller.ex i18n: wrap all user-facing strings in gettext() 2026-02-14 17:44:01 -06:00
page_controller.ex feat: add RFC 8288 Link response headers to homepage 2026-04-17 14:11:15 -05:00
page_html.ex init 2025-12-21 11:10:43 -06:00
sitemap_controller.ex feat: add /sitemap.xml and update robots.txt for agent discovery 2026-04-17 13:58:19 -05:00
user_confirmation_controller.ex dialyzer: fix all unmatched_return warnings (154 → 0) 2026-04-21 10:03:55 -05:00
user_confirmation_html.ex feat: require email verification before first login 2026-02-14 11:28:57 -06:00
user_registration_controller.ex dialyzer: fix all unmatched_return warnings (154 → 0) 2026-04-21 10:03:55 -05:00
user_registration_html.ex credo cleanup 2026-01-17 15:00:52 -06:00
user_reset_password_controller.ex test: lift coverage 78.42% → 79.59% with focused unit + integration tests 2026-05-07 18:40:43 -05:00
user_reset_password_html.ex forgot password flow 2026-01-31 17:03:22 -06:00
user_session_controller.ex fix: comprehensive security audit fixes (#108) 2026-03-22 10:10:27 -05:00
user_session_html.ex credo cleanup 2026-01-17 15:00:52 -06:00
user_settings_controller.ex i18n: wrap all user-facing strings in gettext() 2026-02-14 17:44:01 -06:00
user_settings_html.ex credo cleanup 2026-01-17 15:00:52 -06:00
user_sudo_controller.ex fix: address security and reliability findings from bugs.md review 2026-05-11 18:54:12 -05:00
user_sudo_html.ex feat: implement sudo mode MFA-only verification controller 2026-02-01 14:34:17 -06:00
well_known_controller.ex refactor: extract base_url helper and deduplicate OAuth metadata in WellKnownController 2026-04-17 14:09:02 -05:00