Viktor Barzin fbf6f11038 feat(tripit): #96 cutover — /api self-authenticates (remove forward-auth, add strip-auth-headers) ... ADR-0028 #96 (website half): /api drops Authentik forward-auth so the browser can carry a TripIt session cookie (the outpost 302'd cookie-only requests). The app self-authenticates (TripIt-session-first in get_current_user); no session -> 401 -> SPA landing. strip-auth-headers is REQUIRED now: with forward-auth gone, the hybrid forward-auth arm would otherwise trust a client-injected X-authentik-email — stripping inbound X-authentik-* closes that. /metrics split into its own still-gated ingress. Shell keeps Authentik bearers on tripit-api.* until #94; full AUTH_MODE collapse follows then. Verified live: no-session->401, valid TripIt cookie->200, injected header->401, Shell->200. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>		2026-06-19 08:27:39 +00:00
..
authentik.tf	fix(tripit): pin Authentik invalidation_flow literal (data source flakes null in CI under provider skew)	2026-06-19 08:10:25 +00:00
main.tf	feat(tripit): #96 cutover — /api self-authenticates (remove forward-auth, add strip-auth-headers)	2026-06-19 08:27:39 +00:00
terragrunt.hcl	fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip]	2026-06-09 08:45:33 +00:00