feat(admin): add CSRF protection to mutation endpoints#83

Merged

x3ek merged 6 commits into

mainfrom

feat/79-csrf-protection

May 23, 2026

Commits on May 23, 2026

feat(admin): add CSRF protection to mutation endpoints

x3ek
and
claude
committed
feat(admin): add GET /admin/csrf for JSON callers, use CSRF_SESSION_KEY constant

x3ek
and
claude
committed
refactor(auth): make CSRF dep resolve after auth so 401 fires before 403

x3ek
and
claude
committed
refactor(deps): consolidate is_htmx + fix stale test patch targets

x3ek
and
claude
committed
refactor(csrf): self-review pass — integration tests, generic error, polish

x3ek
and
claude
committed
feat(csrf): log rejection reason + rotation event for operability

x3ek
and
claude
committed