curo1305andClaude Sonnet 4.6 3a6251ca23 fix(06): CR-04 add allowlist validation for default_storage_backend ...

Add _VALID_BACKENDS frozenset and validate body.backend before writing
to DB in PATCH /api/users/me/default-storage. Returns HTTP 422 for
any value not in the allowlist, preventing mass-assignment and logic
bypass via arbitrary string values.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-06-04 23:15:48 +02:00

..

ai

feat(07-03): AnthropicProvider singleton + output_config + truncation — D-03/D-07/D-12/D-13

2026-06-04 19:10:05 +02:00

api

fix(06): CR-04 add allowlist validation for default_storage_backend

2026-06-04 23:15:48 +02:00

db

feat(07-01): Alembic migration 0005 + SystemSettings ORM model

2026-06-04 18:46:11 +02:00

deps

feat(06-05): trusted-proxy get_client_ip, per-account rate limiter, promote 8 xfail tests (D-11/D-12/D-13)

2026-06-04 18:27:49 +02:00

load_tests

feat(06-03): implement Locust load test — self-bootstrap strategy, 4 tasks, SLA listener (D-04/D-05/D-06)

2026-06-03 18:48:47 +02:00

migrations

feat(07-01): Alembic migration 0005 + SystemSettings ORM model

2026-06-04 18:46:11 +02:00

services

feat(07-03): classifier wired to load_provider_config + ai_config stub removed — D-04/D-06

2026-06-04 19:14:48 +02:00

storage

refactor(backend): extract shared helper modules per architecture rules

2026-06-02 16:10:35 +02:00

tasks

feat(07-04): Celery retry harness + _ClassificationError sentinel (D-09/D-10)

2026-06-04 23:08:16 +02:00

tests

feat(07-04): POST /classify re-queues Celery, removes synchronous classify (D-11)

2026-06-04 23:10:49 +02:00

alembic.ini

chore: commit pending phase-3 work and add TEST_ACCOUNTS.md

2026-05-24 11:30:56 +02:00

celery_app.py

feat(phase-4-06): Celery daily audit export task + beat schedule (D-17)

2026-05-25 18:50:50 +02:00

config.py

feat(06-02): wire CorrelationIDMiddleware + config fields + promote 5 test stubs

2026-06-03 18:47:49 +02:00

Dockerfile

fix(06-06): patch OpenSSL CVE-2026-31789 — add apt-get upgrade to runtime Dockerfile stage

2026-06-04 19:13:05 +02:00

main.py

feat(07-01): services/ai_config.py HKDF helpers, ProviderConfig loader, env seed

2026-06-04 18:50:01 +02:00

pytest.ini

chore: initial commit — existing single-user document scanner codebase

2026-05-22 08:53:28 +02:00

requirements-dev.txt

feat(06-03): add backend/requirements-dev.txt with locust pin (D-04)

2026-06-03 18:47:43 +02:00

requirements.txt

feat(07-02): singleton OpenAIProvider + GenericOpenAIProvider + MAX_AI_CHARS removal

2026-06-04 18:58:19 +02:00