curo1305andClaude Sonnet 4.6 c77b97b6d3 fix(fgp): add null-byte separator in HMAC input to prevent concatenation collision ...

Without a separator, UA='foobar'+AL='' and UA='foo'+AL='bar' produced the same
HMAC input, allowing a token fingerprint to match a different header split.
Fix: use '\x00' as separator between user_agent and accept_lang fields.

Regression test added: test_fgp_no_concatenation_collision (FGP-05).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-06-06 23:03:48 +02:00

..

__init__.py

chore: initial commit — existing single-user document scanner codebase

2026-05-22 08:53:28 +02:00

ai_config.py

feat(07-05): admin AI-config endpoints + load_provider_config_by_id + atomic is_active flip

2026-06-04 23:19:40 +02:00

audit.py

feat(phase-4): add write_audit_log() async helper (flush-not-commit, never-raises)

2026-05-25 18:33:31 +02:00

auth.py

fix(fgp): add null-byte separator in HMAC input to prevent concatenation collision

2026-06-06 23:03:48 +02:00

classifier.py

feat(07-03): classifier wired to load_provider_config + ai_config stub removed — D-04/D-06

2026-06-04 19:14:48 +02:00

cloud_cache.py

feat(05-02): implement cloud_cache.py and extend storage factory

2026-05-28 21:00:48 +02:00

email.py

feat(02-01): implement services/auth.py full auth service layer and email_tasks.py

2026-05-22 19:23:42 +02:00

extractor.py

feat(01-05): introduce celery_app + tasks/document_tasks + session-aware classifier

2026-05-22 09:45:33 +02:00

logging.py

feat(06-02): add structlog dependency + create services/logging.py

2026-06-03 18:44:37 +02:00

rate_limiting.py

feat(07.1): session revocation on privilege change — CR-01/CR-02/CR-03

2026-06-05 12:47:16 +02:00

storage.py

fix(07): add status field to _doc_to_dict + regression test

2026-06-05 09:30:03 +02:00