Graham McIntire 33daaf14f0 fix: return raw session token instead of hash in mobile QR login (#42) ... the complete_qr_login endpoint was returning session.token (the SHA256 hash stored in the database) instead of session.raw_token (the plaintext). this caused all subsequent API calls and WebSocket connections to fail with 401/REFUSED since the server would hash the already-hashed token. adds a regression test that verifies the returned token is usable for authenticated API requests. Reviewed-on: graham/towerops-web#42		2026-03-16 13:59:52 -05:00
..
v1	fix: input validation, SSRF, API hardening, and cookie security	2026-03-14 14:48:59 -05:00
account_data_controller.ex	security: implement comprehensive security audit fixes	2026-03-05 13:08:10 -06:00
error_helpers.ex	perf: disable Req retry for faster error tests	2026-03-10 16:19:31 -05:00
mobile_auth_controller.ex	fix: return raw session token instead of hash in mobile QR login (#42)	2026-03-16 13:59:52 -05:00
mobile_controller.ex	rename equipment to device	2026-01-17 14:48:46 -06:00