4 Commits

Include renames

Author	SHA1	Message	Date
Thomas VincentandTheWitness	157a4458ae	fix(auth): reject malformed remember cookies (#7976) ... * fix(auth): reject malformed remember cookies Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * test: load cookie contracts lazily * test(cookie): fail clearly when contract markers move Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * fix(auth): align persistent credential lifecycle Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * test(auth): find cookie function boundaries robustly Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> Co-authored-by: TheWitness <thewitness@cacti.net>	2026-09-12 20:56:24 -04:00
Thomas VincentandTheWitness	e8ec3ca0ec	ci: consolidate pest coverage gate re-enable and validator constraint ratchet (#7516) ... * ci: consolidate coverage and validator quality gates * fix(audit): handle opening and multiline comments * style(tests): align shared Orb assertions * test(orb): require the configured runtime machine * revert(tests): leave macOS Orb integration out of scope * fix: Fix ci update * fix: Remove imagedestroy calls from merge conflict --------- Co-authored-by: TheWitness <thewitness@cacti.net>	2026-08-10 11:17:29 -04:00
Thomas Vincent	cbd711869c	test: run the Integration and HandOff suites in isolated processes (#7550)	2026-08-04 18:55:37 -07:00
3 people	61a542a670	fix(auth): correct auth system bugs (#7187) ... * fix(auth): correct auth system bugs Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * Address auth PR review findings Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * Guard remember cookie cache deletion Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * fix(auth): prevent remote agent lockout on FCrDNS failure and add regression tests Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * docs: update CHANGELOG for auth system correctness fixes Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * fix(auth): stop returning 2fa secret from verification Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * fix(auth): reject remote agent requests that fail forward-confirmed reverse DNS Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * ci: ignore phpstan function.alreadyNarrowedType identifier Clears the level 6 alreadyNarrowedType error on lib/data_query.php:2591 that develop currently emits, matching the sibling narrowing identifiers already ignored. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * docs: reword FCRDNS change as a refactor, not a security fix Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> Co-authored-by: TheWitness <thewitness@cacti.net> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-06-24 18:01:37 -04:00