Fringg 5c55662e2c fix: comprehensive security and quality fixes from 7-agent review ...

Security:
- CORS: disable credentials when wildcard origin, restrict methods/headers
- Token replay: Redis-based id_token dedup with TTL matching expiry
- JWT secret: warn when falling back to BOT_TOKEN
- Rate limiting: add to legacy widget endpoint (was missing)
- Retry-After: add header to all 429 responses

Quality:
- Read OIDC CLIENT_ID from DB with env fallback (admin panel works)
- Consolidate db.commit() — flush mid-handler, single commit at end
- Move get_setting_value import to top-level

2026-03-07 03:27:00 +03:00

..

__init__.py

chore: add uv package manager and ruff linter configuration

2026-01-24 17:45:27 +03:00

button_styles_cache.py

refactor: complete structlog migration with contextvars, kwargs, and logging hardening

2026-02-16 09:18:12 +03:00

cache.py

fix: comprehensive security and quality fixes from 7-agent review

2026-03-07 03:27:00 +03:00

check_reg_process.py

chore: add uv package manager and ruff linter configuration

2026-01-24 17:45:27 +03:00

currency_converter.py

fix: complete datetime.utcnow() → datetime.now(UTC) migration

2026-02-17 04:45:40 +03:00

decorators.py

refactor: complete structlog migration with contextvars, kwargs, and logging hardening

2026-02-16 09:18:12 +03:00

formatters.py

fix: complete datetime.utcnow() → datetime.now(UTC) migration

2026-02-17 04:45:40 +03:00

log_handlers.py

refactor: complete structlog migration with contextvars, kwargs, and logging hardening

2026-02-16 09:18:12 +03:00

markdown_to_telegram.py

fix: close unclosed HTML tags when truncating version notification

2026-02-07 08:18:39 +03:00

message_patch.py

fix: suppress web page preview when logo mode is disabled

2026-02-23 15:55:53 +03:00

miniapp_buttons.py

fix: correct broadcast button deep-links for cabinet mode

2026-02-24 06:33:56 +03:00

pagination.py

chore: add uv package manager and ruff linter configuration

2026-01-24 17:45:27 +03:00

payment_logger.py

refactor: complete structlog migration with contextvars, kwargs, and logging hardening

2026-02-16 09:18:12 +03:00

payment_utils.py

fix: устранение race conditions и атомарность платёжной системы

2026-03-06 04:20:41 +03:00

photo_message.py

refactor: complete structlog migration with contextvars, kwargs, and logging hardening

2026-02-16 09:18:12 +03:00

price_display.py

fix: stack promo group + promo offer discounts in bot (matching cabinet)

2026-02-25 05:49:09 +03:00

pricing_utils.py

fix: complete datetime.utcnow() → datetime.now(UTC) migration

2026-02-17 04:45:40 +03:00

promo_offer.py

fix: complete datetime.utcnow() → datetime.now(UTC) migration

2026-02-17 04:45:40 +03:00

promo_rate_limiter.py

refactor: complete structlog migration with contextvars, kwargs, and logging hardening

2026-02-16 09:18:12 +03:00

security.py

refactor: replace universal_migration.py with Alembic

2026-02-18 08:10:20 +03:00

startup_timeline.py

refactor: improve log formatting — logger name prefix and table alignment

2026-02-16 18:33:40 +03:00

subscription_utils.py

fix: resolve sync 404 errors, user deletion FK constraint, and device limit not sent to RemnaWave

2026-02-25 11:53:49 +03:00

telegram_webapp.py

revert: remove signature pop from HMAC validation

2026-02-06 22:27:57 +03:00

timezone.py

fix: complete datetime.utcnow() → datetime.now(UTC) migration

2026-02-17 04:45:40 +03:00

user_utils.py

fix: промокоды — конвертация триалов, race condition, savepoints

2026-03-06 01:33:18 +03:00

validators.py

fix: flood control handling in pinned messages and XSS hardening in HTML sanitizer

2026-02-12 19:13:40 +03:00