7 Commits

Include renames

Author	SHA1	Message	Date
lobo	a1763addce	feat(version): answer the build commit and time ... GET /api/version is public. CI passes GIT_SHA and BUILD_TIME as Docker build args; a local build answers dev.	2026-09-27 10:27:01 +02:00
lobo	4b2acef381	feat(steam): verify the Steam ID with Sign in through Steam ... The Steam ID is no longer typed in at registration or in the settings. A logged-in user links it through Steam OpenID 2.0: Auth checks the answer with Steam (check_authentication) and stores the ID as verified (V11 steam_id_verified). A one-time state plus a binding cookie tie the callback to the browser that started the link, so a foreign Steam login link cannot move someone's Steam ID into another account. Typed-in IDs from before stay unverified; a verified link from another account takes them away. DELETE /api/users/steam-link unlinks.	2026-09-26 11:20:04 +02:00
lobo	930e08e6dd	feat(login): cookie session with rotating refresh token ... The login token moves out of localStorage into an HttpOnly cookie (15 min), so a script on the page can no longer read it. A random refresh token (30 days, sliding) renews it; only its SHA-256 is stored. Each refresh replaces the token, and a replaced token that comes back revokes every token of that login. Unsafe requests need an X-TBP-Client or Authorization header, and CORS allows only the exact frontend origin. A missing or expired token now answers 401 instead of 403, so the frontend can refresh.	2026-09-25 13:45:04 +02:00
lobo	f3b6d67b5b	fix(security): hide health details and close Prometheus to the public ... /actuator/health showed database and disk details to anyone, and /actuator/prometheus was open. Only health stays public, as plain UP/DOWN for the Docker health check.	2026-09-24 10:26:53 +02:00
Andreas Dahm	9114eb096b	Changed from JWT token to public/privat key	2026-05-12 08:56:51 +02:00
lobo	20402eb7c4	Added new tests fixed some problem	2026-04-18 11:28:06 +02:00
lobo	03d5a011ae	Added lots of new stuff ... - extended the jwt and put userid into it - completed update settings - added settings also in me call	2026-04-11 12:07:27 +02:00