3 Commits

Author	SHA1	Message	Date
serversdown	766f64f35f	refactor: final-review cleanup ... - delete dead magic-link helpers (resolve_token, ensure_project_client, mint_link_token, provision_preview_session) + now-unused datetime import - key brute-force lockout on link_token alone (IP term only enabled a source-IP-rotation bypass; behind the proxy all clients share one IP) - drop unused PORTAL_BASE_URL from the retired CLI - add WebSocket ownership tests (unauth + cross-project both close 1008)	2026-06-16 00:28:23 +00:00
serversdown	b8e4718318	fix: link project to its portal client (project.client_id) so the portal isn't empty ... Caught by adversarial review of the scope test: portal_client_for_project minted a dedicated client but never set project.client_id, so the client-scoped routes found no projects — every location 404'd, including the client's own (empty portal). Now links the project + adds a positive-case test.	2026-06-15 23:53:19 +00:00
serversdown	c3eb900b7e	test: portal session is isolated to its own project (404 on others) ... Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-15 23:48:08 +00:00