2 Commits

Author	SHA1	Message	Date
Jakub Zych	5f9353841b	feat(10-01): serve the embedded admin SPA at backend.uri with cookie login ... - backend.uri prefix (default /backend) mounts the admin API at {prefix}/api/v1 and the embedded SPA shell at {prefix} with an api/ JSON 404 fallback - cookie transport: an X-Requested-With login sets the HttpOnly summer_admin cookie and returns no token; the backend guard reads the cookie after Bearer - CSRF wrapper refuses cookie-only POST/PUT/DELETE without X-Requested-With - boardwalk package embeds boardwalk/dist, rewrites index.html once per prefix and sets cache and security headers - framework admin OpenAPI pipeline (swag, swagger2openapi, openapi-typescript) with prefix-relative paths and typed envelopes for the tracer routes - admin/ Vite SPA: login, plugin rail, section panel and read-only list through the openapi-fetch client typed by the generated schema	2026-09-27 15:21:48 +02:00
Jakub Zych	30bfd2d8d5	test(09-12): add the phase 9 security matrix ... - Guard isolation covers audience, secret, refresh, blacklist, and reset cutoff. - The mounted admin route table must carry the backend guard. - Fresh PostgreSQL migrate and rollback keep framework and plugin histories apart.	2026-09-27 03:01:54 +02:00