Claude d88a116fbc fix: security hardening on synced upstream codebase ... Applied security fixes to the latest upstream (usememos/memos): - Remove hardcoded JWT secret ("usememos") in demo mode; always use instance secret key - Enforce DisallowPasswordAuth for all roles including admins (was only blocking regular users) - Add minimum password length validation (8 chars) on CreateUser and UpdateUser password change - Restrict CORS to same-origin in production (was allowing all origins on both gateway and connect) - Add HTTP client timeout (10s) to OAuth2 identity provider - Remove PII logging of OAuth2 user info claims https://claude.ai/code/session_018iYDVMmBxJLWBvqugc6tNe		2026-03-15 16:51:53 +00:00
..
test	perf: batch load memo relations when listing memos (#5692)	2026-03-07 11:19:19 +08:00
acl_config.go	fix: allow guests to view public memo comments	2026-01-11 22:35:12 +08:00
acl_config_test.go	refactor: user auth improvements (#5360)	2025-12-18 18:15:51 +08:00
activity_service.go	feat: implement ListActivities pagination (#5468)	2026-03-04 19:08:47 +08:00
attachment_exif_test.go	feat: implement EXIF metadata stripping for image uploads	2026-01-26 22:18:44 +08:00
attachment_service.go	fix: correct typos in comments, error messages, and identifiers (#5704)	2026-03-08 18:40:17 +08:00
auth_service.go	fix: security hardening on synced upstream codebase	2026-03-15 16:51:53 +00:00
auth_service_client_info_test.go	refactor: remove deprecated Sessions and AccessTokens settings	2025-12-19 08:35:57 +08:00
common.go	refactor: migrate HOST roles to ADMIN	2026-01-20 23:38:30 +08:00
connect_handler.go	refactor: migrate to connect-rpc (#5338)	2025-12-11 19:49:07 +08:00
connect_interceptors.go	refactor: consolidate duplicated auth logic into auth package	2026-02-24 23:08:16 +08:00
connect_services.go	refactor: remove deprecated Sessions and AccessTokens settings	2025-12-19 08:35:57 +08:00
header_carrier.go	fix(backend): correct generic type parameter in withHeaderCarrier helper	2025-12-12 08:06:13 +08:00
health_service.go	refactor(store): remove deprecated migration_history table and backward compatibility code	2025-12-01 22:54:30 +08:00
idp_service.go	feat: replace auto-increment ID with UID for identity provider resource names (#5687)	2026-03-05 21:01:22 +08:00
instance_service.go	feat: update instance profile to use admin user instead of initialized flag	2026-01-28 23:27:53 +08:00
memo_attachment_service.go	fix(store): allow memo/attachment deletion when local file is missing	2026-02-23 10:26:40 +08:00
memo_relation_service.go	fix: replace echo.NewHTTPError with status.Errorf	2026-02-08 19:23:34 +08:00
memo_service.go	fix: restrict archived memo access to creator only (#5707)	2026-03-09 20:15:08 +08:00
memo_service_converter.go	perf: batch load memo relations when listing memos (#5692)	2026-03-07 11:19:19 +08:00
memo_service_filter.go	refactor: deprecate old filter	2025-07-22 21:25:57 +08:00
reaction_service.go	feat: add live refresh via Server-Sent Events (SSE) with visual indicator (#5638)	2026-03-03 22:56:12 +08:00
resource_name.go	feat: replace auto-increment ID with UID for identity provider resource names (#5687)	2026-03-05 21:01:22 +08:00
shortcut_service.go	fix: replace echo.NewHTTPError with status.Errorf	2026-02-08 19:23:34 +08:00
sse_handler.go	refactor(sse): move status indicator to avatar badge	2026-03-03 23:25:01 +08:00
sse_hub.go	refactor(sse): move status indicator to avatar badge	2026-03-03 23:25:01 +08:00
sse_hub_test.go	feat: add live refresh via Server-Sent Events (SSE) with visual indicator (#5638)	2026-03-03 22:56:12 +08:00
user_service.go	fix: security hardening on synced upstream codebase	2026-03-15 16:51:53 +00:00
user_service_stats.go	perf: optimize memory usage for statistics and image processing	2025-12-30 00:06:23 +08:00
v1.go	fix: security hardening on synced upstream codebase	2026-03-15 16:51:53 +00:00