6 commits

Author	SHA1	Message	Date
DmitrL-dev	9b2b05dfce	fix: persistUser preserves tenant_id (prevents overwrite on login)	2026-03-24 12:10:40 +10:00
DmitrL-dev	62ecc1c7a3	sec: fix C4/C5/M4/M5 + domain migration to syntrex.pro ... C4: Remove localhost:9100 fallback from 27 dashboard files (use relative URLs) C5: JWT token_type differentiation (access vs refresh) - middleware rejects refresh as Bearer M4: Server-side registration gate via SOC_REGISTRATION_OPEN env var M5: HTML tag stripping on name/org_name fields (XSS prevention) Domain migration: - users.go: admin@syntrex.pro - zerotrust.go: SPIFFE trust domain - sbom.go: namespace URL - .env.production.example: all URLs updated - identity_test.go: test email	2026-03-24 11:49:33 +10:00
DmitrL-dev	4a1bd09a13	fix: loadFromDB missing email_verified column in SELECT/Scan	2026-03-24 10:55:44 +10:00
DmitrL-dev	4ce94e9c77	SEC: Fix 3 CRITICAL + 3 MEDIUM red team findings ... C1: Remove verification_code_dev from API response (CVSS 9.8) - Code now logged server-side only when email service not configured C2: Tenant isolation on /api/auth/users (CVSS 9.1) - HandleListUsers filters by claims.TenantID - TenantID added to User struct, DB migration, persistUser, loadFromDB C3: Include TenantID in JWT tokens (CVSS 8.8) - Login handler now uses Sign() with full Claims including TenantID - Enables downstream RBAC tenant filtering M1: nginx server_tokens off (hide version fingerprint) M2: syntrex.pro added to server_name M3: CORS multi-origin support (SOC_CORS_ORIGIN=origin1,origin2)	2026-03-24 10:32:50 +10:00
DmitrL-dev	4a0f17873a	fix: convert auth users/tenants SQL from SQLite to PostgreSQL (BOOLEAN, ON CONFLICT, params, TIMESTAMPTZ)	2026-03-23 20:11:59 +10:00
DmitrL-dev	41cbfd6e0a	Release prep: 54 engines, self-hosted signatures, i18n, dashboard updates	2026-03-23 16:45:40 +10:00