Danny Avila 2b09879faf fix: require browser binding (CSRF/session) for failFlow on OAuth error ... hasActiveFlow only proves a PENDING flow exists, not that the caller is the same browser that initiated it. An attacker with a leaked state could force-fail the flow without any user binding. Require hasCsrf or hasSession before calling failFlow on the oauthError path.		2026-04-03 20:39:40 -04:00
..
controllers	🔁 fix: Pass recursionLimit to OpenAI-Compatible Agents API Endpoint (#12510)	2026-04-01 21:13:07 -04:00
middleware	🏗️ refactor: Remove Redundant Caching, Migrate Config Services to TypeScript (#12466)	2026-03-30 16:49:48 -04:00
routes	fix: require browser binding (CSRF/session) for failFlow on OAuth error	2026-04-03 20:39:40 -04:00
services	fix: require deleteTokens for client reuse, add missing import in MCP.js	2026-04-03 19:53:34 -04:00
utils	🏗️ refactor: Remove Redundant Caching, Migrate Config Services to TypeScript (#12466)	2026-03-30 16:49:48 -04:00
cleanup.js	🧹 refactor: Tighten Config Schema Typing and Remove Deprecated Fields (#12452)	2026-03-29 01:10:57 -04:00
experimental.js	⚖️ refactor: Split Config Route into Unauthenticated and Authenticated Paths (#12490)	2026-03-31 19:22:51 -04:00
index.js	⚖️ refactor: Split Config Route into Unauthenticated and Authenticated Paths (#12490)	2026-03-31 19:22:51 -04:00
index.spec.js	🚦 fix: 404 JSON Responses for Unmatched API Routes (#11976)	2026-02-27 22:49:54 -05:00
socialLogins.js	🔐 feat: Admin Auth Support for SAML and Social OAuth Providers (#12472)	2026-03-30 22:49:44 -04:00