matt/central
1
0
Fork 0
mirror of https://github.com/zvx-echo6/central.git synced 2026-05-22 02:24:38 +02:00
Code Issues Projects Releases Packages Wiki Activity
central/sql/migrations
History
Matt Johnson c317c9ab01 fix(csrf): replace fastapi-csrf-protect with session-bound CSRF 
Fixes CSRF race condition where every GET rotated the CSRF token,
causing POST failures when users had multiple tabs or slow connections.

Changes:
- Remove fastapi-csrf-protect dependency
- Add session-bound CSRF tokens stored in config.sessions table
- Add pre-auth CSRF for unauthenticated routes (/login, /setup/operator)
- Add csrf.py module for pre-auth token generation/validation
- Update routes to use new CSRF token handling
- Add migration 013 to add csrf_token column to sessions

The session-bound approach ensures CSRF tokens remain stable for the
duration of a session, eliminating the race condition.

Note: Route tests (test_wizard.py, test_adapters.py, etc.) need
refactoring to mock get_settings() instead of CsrfProtect dependency.
Core auth/CSRF handler tests pass (74 tests).

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-05-18 03:16:37 +00:00
..
001_create_config_schema.sql chore: normalize line endings to LF 2026-05-16 22:26:12 +00:00
002_add_updated_at_trigger_and_index.sql feat(db): add migration 002 for updated_at trigger and enabled index 2026-05-16 01:36:30 +00:00
003_add_streams_table.sql chore: normalize line endings to LF 2026-05-16 22:26:12 +00:00
004_nws_states_to_bbox.sql chore: normalize line endings to LF 2026-05-16 22:26:12 +00:00
005_add_firms_adapter.sql feat(schema): add FIRMS adapter and CENTRAL_FIRE stream 2026-05-16 19:58:20 +00:00
006_add_usgs_quake_adapter.sql feat(schema): add USGS quake adapter and CENTRAL_QUAKE stream 2026-05-16 20:51:28 +00:00
007_add_config_system.sql feat(gui): add auth core, setup gate, and first-run operator creation 2026-05-17 05:30:49 +00:00
008_add_operators.sql feat(gui): add auth core, setup gate, and first-run operator creation 2026-05-17 05:30:49 +00:00
009_add_sessions.sql feat(gui): add auth core, setup gate, and first-run operator creation 2026-05-17 05:30:49 +00:00
010_add_audit_log.sql feat(gui): add auth core, setup gate, and first-run operator creation 2026-05-17 05:30:49 +00:00
011_events_add_adapter_column.sql feat(schema): add adapter column to events, drop source 2026-05-17 16:09:59 +00:00
013_add_session_csrf_token.sql fix(csrf): replace fastapi-csrf-protect with session-bound CSRF 2026-05-18 03:16:37 +00:00