0046b8d695
CC2 R5: defense-in-depth JWT + invite/reset token flows + audit
...
#1 JWT middleware:
- pgz_sport_api.py: starlette middleware require_jwt_on_admin runs before
every /api/admin/* route. Even routes that lack Depends(require_user)
cannot be reached without a valid Bearer token (verifies signature,
exp, typ='access', revocation via user_sessions). OPTIONS passes for CORS.
#2 Invitation flow:
- pgz_sport.user_action_tokens table (token_hash, user_id, kind, expires_at,
used_at, created_by, ip, meta). Single-use, raw token never persisted.
- POST /api/admin/users/{id}/invite — issues 'invite' token (TTL 7d),
marks must_change_pwd, revokes existing sessions, returns invite_link.
- GET /api/auth/setup-password?token=X — preflight (no consume).
- POST /api/auth/setup-password — consumes token, sets password, sets
email_verified=true.
#3 Password reset flow:
- POST /api/auth/forgot-password — generic 'ako račun postoji' response;
issues 'reset' token (TTL 2h) only for active users. Token returned in
response only on localhost or if PGZ_REVEAL_RESET_TOKEN=1.
- GET /api/auth/reset-password?token=X — preflight.
- POST /api/auth/reset-password — consumes token, sets new password,
revokes all active sessions.
#4 Audit coverage (auth events):
- login.ok, login.fail (with reason), login.locked, login.2fa_required,
login.2fa_fail, logout, auth.refresh, password.change, password.reset.ok,
password.reset.fail, password.forgot.issue, password.forgot.miss,
invite.consume.ok, invite.consume.fail, user.invite, user.create,
user.update, user.delete, user.role.change, user.suspend, user.unsuspend,
user.password.reset, 2fa.verify.ok, 2fa.verify.fail, 2fa.disable.
#5 Live tests: 41/41 across 6 demo users (incl. fresh invited+deleted user).
Phase 2 verifies 14 endpoints reject no-auth and accept valid Bearer.
2026-05-05 01:28:29 +02:00
64082d0642
CC1 R3B-P3 — geocoding precision (Crikvenica + OSM cross-check)
...
- New scripts/geocode_v3_osm.py: matches DB objekti against OSM Overpass sports facilities
- Applied 53 OSM updates, then reverted bad cross-city matches to hand-curated coords
- Crikvenica venues now precise (Gradska dvorana, SS Antun Barac, Stadion, Sport+ Centar)
- Atletska dvorana Luciano Sušanj fixed to Kantrida
- Skate park Delta, Boulder dvorana, Boćarski Podvežica reverted from wrong matches
- Google Places API not available (project disabled), Overpass + curated fallback used
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com >
2026-05-05 00:04:50 +02:00
Damir Radulić