curo1305andClaude Sonnet 4.6 c77b97b6d3 fix(fgp): add null-byte separator in HMAC input to prevent concatenation collision ...

Without a separator, UA='foobar'+AL='' and UA='foo'+AL='bar' produced the same
HMAC input, allowing a token fingerprint to match a different header split.
Fix: use '\x00' as separator between user_agent and accept_lang fields.

Regression test added: test_fgp_no_concatenation_collision (FGP-05).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-06-06 23:03:48 +02:00

..

__init__.py

chore: initial commit — existing single-user document scanner codebase

2026-05-22 08:53:28 +02:00

conftest.py

feat(07.4-02): update api/auth.py call sites, promote FGP tests, version bump 0.1.3

2026-06-06 22:12:57 +02:00

test_admin_ai_config.py

feat(07-05): admin AI-config endpoints + load_provider_config_by_id + atomic is_active flip

2026-06-04 23:19:40 +02:00

test_admin_api.py

security(07.2-03): add import time + user_nbf write to admin deactivation handler; promote stubs to PASSED

2026-06-06 00:02:27 +02:00

test_ai_config.py

feat(07-03): classifier wired to load_provider_config + ai_config stub removed — D-04/D-06

2026-06-04 19:14:48 +02:00

test_ai_providers.py

feat(07-03): AnthropicProvider singleton + output_config + truncation — D-03/D-07/D-12/D-13

2026-06-04 19:10:05 +02:00

test_alembic.py

test(03-01): add Wave 0 xfail stubs and shared fixtures for Phase 3

2026-05-23 13:42:37 +02:00

test_audit.py

fix(06): CR-07 update test to use event_type prefix instead of full type

2026-06-04 23:15:49 +02:00

test_auth_api.py

fix(07.2): add user_nbf write to password_reset_confirm — CR-02 gap closure

2026-06-06 00:11:41 +02:00

test_auth_deps.py

feat(07.4-02): update api/auth.py call sites, promote FGP tests, version bump 0.1.3

2026-06-06 22:12:57 +02:00

test_auth_es256.py

feat(07.3-03): backend remember_me — TTL split + cookie Max-Age + 3 promoted tests

2026-06-06 17:21:14 +02:00

test_auth_fgp.py

fix(fgp): add null-byte separator in HMAC input to prevent concatenation collision

2026-06-06 23:03:48 +02:00

test_auth_totp.py

feat(02-03): add TOTP setup/enable/disable, password reset, and frontend_url to config

2026-05-22 19:52:36 +02:00

test_classifier.py

feat(07-03): classifier wired to load_provider_config + ai_config stub removed — D-04/D-06

2026-06-04 19:14:48 +02:00

test_cloud_backends.py

test(05-03): add RED phase tests for GoogleDriveBackend and OneDriveBackend

2026-05-28 21:06:14 +02:00

test_cloud_utils.py

feat(05-02): implement cloud_utils.py — SSRF validation and HKDF credential encryption

2026-05-28 20:58:40 +02:00

test_cloud.py

feat(07.4-02): update api/auth.py call sites, promote FGP tests, version bump 0.1.3

2026-06-06 22:12:57 +02:00

test_constant_time_auth.py

test(phase-02): add Nyquist validation tests — fill SEC-05, AUTH-08, SEC-03 and frontend gaps

2026-05-31 12:04:21 +02:00

test_document_tasks.py

feat(07-04): Celery retry harness + _ClassificationError sentinel (D-09/D-10)

2026-06-04 23:08:16 +02:00

test_documents.py

feat(07.4-02): update api/auth.py call sites, promote FGP tests, version bump 0.1.3

2026-06-06 22:12:57 +02:00

test_extractor.py

chore: initial commit — existing single-user document scanner codebase

2026-05-22 08:53:28 +02:00

test_folders.py

feat(phase-4): complete UX redesign — FileManagerView, FolderTreeItem, test suite, and all Phase 4 fixes

2026-05-28 17:10:52 +02:00

test_health.py

feat(01-05): final cutover — delete data/, prune config.py, async-only tests

2026-05-22 09:53:39 +02:00

test_lmstudio.py

feat(phase-4): complete UX redesign — FileManagerView, FolderTreeItem, test suite, and all Phase 4 fixes

2026-05-28 17:10:52 +02:00

test_logging.py

feat(06-02): wire CorrelationIDMiddleware + config fields + promote 5 test stubs

2026-06-03 18:47:49 +02:00

test_quota.py

fix(phase-03): use UUID.hex in raw SQL to fix SQLite UUID format mismatch

2026-06-01 15:43:01 +02:00

test_rate_limiting.py

feat(06-05): trusted-proxy get_client_ip, per-account rate limiter, promote 8 xfail tests (D-11/D-12/D-13)

2026-06-04 18:27:49 +02:00

test_security_headers.py

feat(07.4-02): update api/auth.py call sites, promote FGP tests, version bump 0.1.3

2026-06-06 22:12:57 +02:00

test_security.py

test(phase-04): fill Nyquist validation gaps — FOLD-04, FOLD-05, SEC-08, SEC-09

2026-05-31 15:21:02 +02:00

test_settings.py

feat(03-04): retire flat-file settings; wire per-user AI config via DB lookup

2026-05-23 20:32:55 +02:00

test_shares.py

feat(06.2-02): backend — ShareCreate.permission field + PATCH /{share_id} endpoint

2026-05-31 15:04:53 +02:00

test_storage.py

test(phase-1): add Nyquist validation tests — STORE-07 concurrent put, fix confirm UUID

2026-05-30 18:56:58 +02:00

test_task1_models_config.py

test(07.3-01): Wave 0 Nyquist scaffold — 9 xfail stubs for ES256 + remember_me

2026-06-06 17:13:50 +02:00

test_task2_auth_service.py

feat(07.2-02): add jti UUID claim to create_access_token

2026-06-05 19:15:01 +02:00

test_topics.py

feat(03-03): wire get_current_user into /api/topics/*; add load_topics_for_user; POST /api/admin/topics

2026-05-23 20:15:44 +02:00

test_totp_replay.py

test(phase-02): add Nyquist validation tests — fill SEC-05, AUTH-08, SEC-03 and frontend gaps

2026-05-31 12:04:21 +02:00

test_webdav_backend.py

test(05-04): add failing RED tests for WebDAVBackend and NextcloudBackend

2026-05-28 21:07:18 +02:00