Authentication, authorization & hardening
View All TagsGET /api/v1/green/summary, /green/budgets and /green/report were
registered without the session middleware that every other signal route uses.
On an install with authentication enabled, all three answered 200 to a
caller with no session at all.
Two questions an operator asks in the first week — where is my telemetry actually stored? and what can this role do? — now have a screen each.
v0.4.0 finishes the account lifecycle you started in v0.2: users can now be edited, reset and deleted from the UI, and anyone can change their own password. Reviewing that surface turned up three ways to get into an account that shouldn't have worked — all three are closed. Alongside them, an install that silently lost its schema migration now heals itself.