2 commits

Author	SHA1	Message	Date
Viktor Barzin	1ace45353a	Add API anti-abuse hardening: disable docs in prod, origin validator, exception handler ... - Disable OpenAPI docs/redoc/openapi.json when APP_ENV=production - Strip uvicorn Server header with --no-server-header in Dockerfile and docker-compose.yml - Add OriginValidatorMiddleware to reject state-changing requests from disallowed origins - Add global exception handler to prevent stack trace leakage on unhandled errors - Add tests for all new security features (OpenAPI, origin validation, exception handler, server header)	2026-02-08 20:06:46 +00:00
Viktor Barzin	492921424e	Add security regression tests for all hardening fixes ... - New: test_security_headers.py — verify all headers present, HSTS conditional on HTTPS - New: test_passkey_error_handling.py — generic vs user-facing error messages - New: test_poi_validation.py — field length and coordinate range constraints - Extend test_rate_limiter.py — client IP depth selection, in-memory fallback enforcement - Extend test_models.py — sqm range validation - Extend test_task_service.py — IDOR 404, ownership 200, traceback suppression in production	2026-02-08 19:42:53 +00:00