Austin Pickett 082fae8058 fix(dashboard): cover whole prefix class — font URLs, native chooser, logout landing ...

Every root-absolute URL the server-rendered auth pages emit now honours
X-Forwarded-Prefix: @font-face url('/fonts/...') in both the login page
and the RFC 8252 native provider chooser, the chooser's data-prefix
injection, and the SPA logout navigation target. Empty-prefix output is
byte-identical to before.

2026-10-06 11:17:11 -04:00

..

__init__.py

…

audit.py

fix(dashboard-auth): rotate dashboard-auth.log at 5MB/3 backups

2026-10-06 11:10:45 -04:00

base.py

…

body_limit.py

fix(dashboard-auth): cap request bodies on the public auth routes

2026-10-05 12:51:22 -04:00

cookies.py

…

login_page.py

fix(dashboard): cover whole prefix class — font URLs, native chooser, logout landing

2026-10-06 11:17:11 -04:00

middleware.py

fix(dashboard): prepend X-Forwarded-Prefix in _safe_next_target() for post-login redirect

2026-10-06 11:17:11 -04:00

native_flow.py

…

prefix.py

…

public_paths.py

…

refresh_singleflight.py

…

registry.py

…

request_utils.py

fix(security): ignore spoofed XFF for dashboard login limits

2026-10-05 12:23:21 -04:00

routes.py

fix(dashboard): cover whole prefix class — font URLs, native chooser, logout landing

2026-10-06 11:17:11 -04:00

token_auth.py

…

ws_tickets.py

…