Draco-Lunaris-Echo f58d7a6f17 fix(security): stop embedding JWT tokens in SSO callback redirect URL (#4) (#14) ...

Replaces URL-embedded JWT tokens with a single-use, 60-second handoff code that the SPA exchanges via server-to-server POST. The URL now contains only `?handoff=<code>` — no tokens are placed in the browser history, proxy access logs, or Referer header.

Backend: new SsoHandoff store (DashMap, 60s TTL, atomic DashMap::remove for single-use), POST /api/v1/auth/sso/handoff endpoint, 7 new tests.

Frontend: SsoCallbackPage rewritten to use useSearchParams + POST exchange, with history.replaceState to clear the handoff code from the address bar. Switched from window.location.search to useSearchParams() for test compatibility. New Vitest infrastructure (vitest, @testing-library/react, jsdom) and 6 new tests.

CI fix in ccba9e3: cargo fmt --all and added searchParams to useEffect dep array to satisfy CI's Rust Format and Frontend Lint checks.

Refs: closes #4

2026-06-03 06:28:08 -05:00

..

pm-agent-client

feat: populate os_family, os_name, arch, agent_version from health poller and enrollment

2026-05-21 00:09:57 +00:00

pm-auth

fix(security): harden IP allowlist against XFF bypass and spoofing (#3)

2026-06-02 18:06:43 -05:00

pm-ca

feat: populate os_family, os_name, arch, agent_version from health poller and enrollment

2026-05-21 00:09:57 +00:00

pm-core

fix(security): harden IP allowlist against XFF bypass and spoofing (#3)

2026-06-02 18:06:43 -05:00

pm-reports

feat: populate os_family, os_name, arch, agent_version from health poller and enrollment

2026-05-21 00:09:57 +00:00

pm-web

fix(security): stop embedding JWT tokens in SSO callback redirect URL (#4) (#14)

2026-06-03 06:28:08 -05:00

pm-worker

feat: populate os_family, os_name, arch, agent_version from health poller and enrollment

2026-05-21 00:09:57 +00:00