Claus Lohmar b4222077b1 fix(auth): judge the passkey nudge by the configured origin ... REVIEW-001 (M0) L7c: shouldNudge trusted the request Host, so a reverse proxy that rewrites Host wrongly suppressed (or enabled) the nudge. Prefer the configured server.base_url host (Deps.BaseURL) and fall back to the request Host only when it is unset. Wire the secure session-cookie name through SessionCookieNameFor so the `__Host-` prefix (L1s) is used consistently by the flows.		2026-10-14 11:29:58 +00:00
..
audit	feat(core): add the store, identity plumbing and the door (SPEC-003/004)	2026-10-14 10:53:51 +00:00
auth	fix(auth): judge the passkey nudge by the configured origin	2026-10-14 11:29:58 +00:00
config	feat(core): add the store, identity plumbing and the door (SPEC-003/004)	2026-10-14 10:53:51 +00:00
httpx	fix(security): harden httpx — XFF hops, __Host- cookie, isolation headers	2026-10-14 11:29:52 +00:00
mail	feat(core): add the store, identity plumbing and the door (SPEC-003/004)	2026-10-14 10:53:51 +00:00
middleware	feat(core): add the store, identity plumbing and the door (SPEC-003/004)	2026-10-14 10:53:51 +00:00
module	feat(module): add the module registry, discovery and the home module (SPEC-008)	2026-10-14 10:53:57 +00:00
recovery	feat(recovery): add the admin recovery flow (SPEC-007)	2026-10-14 10:53:53 +00:00
routing	feat(routing): add the pure routing model (SPEC-002)	2026-10-14 10:53:48 +00:00
server	feat(core): add the store, identity plumbing and the door (SPEC-003/004)	2026-10-14 10:53:51 +00:00
setup	feat(setup): add the /setup bootstrap wizard (SPEC-005)	2026-10-14 10:53:53 +00:00
store	feat(core): add the store, identity plumbing and the door (SPEC-003/004)	2026-10-14 10:53:51 +00:00
users	feat(core): add the store, identity plumbing and the door (SPEC-003/004)	2026-10-14 10:53:51 +00:00
web	feat(web): add the web shell and the PWA (SPEC-009)	2026-10-14 10:53:57 +00:00