patrick a870ac64a5 fix: Refresh-Endpoint bevorzugt Body-Token über Cookie (Token-Rotation Test) ...

Body-Token hat Vorrang wenn explizit angegeben — verhindert dass
httpx-Cookie-Jar im Test den alten Token mit dem neuen Cookie überschreibt.
Browser-Clients senden keinen Body, nutzen weiterhin Cookie.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-26 13:14:44 +02:00

..

__init__.py

Initial commit – TimeMaster Zeiterfassung & HR-Tool

2026-05-23 20:03:27 +02:00

absence_service.py

feat: Live-Stempel-Uhr, Break-UI, Balance-Widget, Approval-Queue + PDF-Export (WeasyPrint)

2026-05-24 11:59:32 +02:00

absence.py

feat: Live-Stempel-Uhr, Break-UI, Balance-Widget, Approval-Queue + PDF-Export (WeasyPrint)

2026-05-24 11:59:32 +02:00

absences.py

security: M-2 HttpOnly-Cookie + M-4 TrustedHost-Warning + M-5 TOTP-Lockout + M-7 zentraler get_client_ip()

2026-05-26 11:25:24 +02:00

audit.py

Initial commit – TimeMaster Zeiterfassung & HR-Tool

2026-05-23 20:03:27 +02:00

auth.py

fix: Refresh-Endpoint bevorzugt Body-Token über Cookie (Token-Rotation Test)

2026-05-26 13:14:44 +02:00

busylight.py

security: M-2 HttpOnly-Cookie + M-4 TrustedHost-Warning + M-5 TOTP-Lockout + M-7 zentraler get_client_ip()

2026-05-26 11:25:24 +02:00

caldav.py

fix(security): SSRF-Schutz für CalDAV-URLs

2026-05-24 12:39:59 +02:00

companies.py

security: H-1 settings-Whitelist + H-5 UUID-Guard + H-6 DNS-Pinning + H-7 Heartbeat-Timing

2026-05-26 11:35:18 +02:00

hours_payouts.py

security: M-2 HttpOnly-Cookie + M-4 TrustedHost-Warning + M-5 TOTP-Lockout + M-7 zentraler get_client_ip()

2026-05-26 11:25:24 +02:00

import_kimai.py

security: 9 Findings aus Security-Audit behoben (CRITICAL + HIGH + MEDIUM)

2026-05-24 19:45:09 +02:00

kiosk.py

feat: agent-02-kiosk Phase 2A - Auth endpoints (PIN/NFC/QR/List)

2026-05-24 12:49:09 +02:00

ldap.py

fix: router db.refresh() nach commit bricht RLS-Kontext

2026-05-23 22:34:48 +02:00

projects.py

fix: router db.refresh() nach commit bricht RLS-Kontext

2026-05-23 22:34:48 +02:00

reports.py

Initial commit – TimeMaster Zeiterfassung & HR-Tool

2026-05-23 20:03:27 +02:00

smtp.py

fix: router db.refresh() nach commit bricht RLS-Kontext

2026-05-23 22:34:48 +02:00

special_assignments.py

fix: require_role in special_assignments router ohne extra Depends() wrapping

2026-05-25 00:59:16 +02:00

time_entries.py

fix: router db.refresh() nach commit bricht RLS-Kontext

2026-05-23 22:34:48 +02:00

users.py

security: 9 Findings aus Security-Audit behoben (CRITICAL + HIGH + MEDIUM)

2026-05-24 19:45:09 +02:00