jpmschweitzer/odysseus
1
0
Fork 0
mirror of https://github.com/pewdiepie-archdaemon/odysseus.git synced 2026-09-11 18:52:21 +02:00
Code Issues Packages Projects Releases Wiki Activity
2,090 Commits 18 Branches 0 Tags
fix/api-token-agent-authorization
Commit Graph
8 Commits
Author SHA1 Message Date
RaresKeY aee6655fbd security: fail closed on bearer endpoint credentials 2026-08-30 22:27:35 +00:00
RaresKeY e1da1264dc fix(security): close bearer auxiliary boundaries 2026-08-29 12:27:14 +00:00
RaresKeY 9150a453b4 fix(security): close API token agent authorization gaps 2026-08-28 18:07:40 +00:00
Tal.Yuan fb8c391a88 refactor(routes): move webhook domain into routes/webhook/ subpackage (#5781) 
Slice 2l of the route-domain reorganization (#4082/#4071). Moves
webhook_routes.py into routes/webhook/, leaving a backward-compat
sys.modules shim. Pure file reorganization, no behavior change.
One source-introspection test repointed (test_api_chat_security.py).
 2026-08-03 20:44:31 +02:00
Alexandre Teixeira 17df977794 test: add fire_and_forget to API chat webhook stub (#4383) 2026-06-16 03:15:14 +00:00
pewdiepie-archdaemon 06a0d3ce92 Reapply "Merge branch 'main' of github.com:pewdiepie-archdaemon/odysseus" 
This reverts commit 67bf3f6b78.
 2026-06-03 22:47:00 +09:00
pewdiepie-archdaemon 67bf3f6b78 Revert "Merge branch 'main' of github.com:pewdiepie-archdaemon/odysseus" 
This reverts commit 3a790b792b, reversing
changes made to 082aa4ee48.
 2026-06-03 22:46:19 +09:00
Alexandre Teixeira a24ed1ec6b Harden API-token chat endpoint selection 
Validate only token-supplied direct base_url values for API-token chat requests, while keeping admin-configured endpoints available for local/LAN providers.

Scope configured endpoint fallback selection to the API token owner, fail closed for unknown token owners, and preserve strict session ownership checks when resuming sessions from chat-scoped API tokens.

Add focused regression coverage for direct base_url SSRF rejection, configured endpoint fallback behavior, token-owner scoping, URL validation, and null-owner session/endpoint handling.
 2026-06-03 13:05:13 +01:00