2 Commits

Include renames

Author	SHA1	Message	Date
Lucas Berger	8bd44b33c7	feat(02-01): dev-auth bypass middleware with production hard guard ... - Create apps/api/src/auth/devBypass.ts: devAuthBypass() middleware with NODE_ENV=production hard guard as first conditional (T-02-01 mitigation) - Exports DEV_USER const (id:1, color:COLOR_PALETTE[0]) for test reference - Mount devAuthBypass() before oidcAuthMiddleware on /api/* in index.ts - Add devBypass.test.ts: all three behavioral cases pass (production guard, unset-flag passthrough, active-injection) - Add DEV_AUTH_BYPASS to .env.example with production warning comment - Extend docs/deployment.md with dev-auth bypass section and production prohibition	2026-06-05 09:32:00 -04:00
Lucas Berger	6e74b3fc05	docs: capture D-14/D-15 (Gate 2 deferral + local-Newt test rig) + deployment runbook ... - docs/deployment.md: operator runbook — Mode A (local Newt test rig) vs Mode B (Unraid prod), Authelia client block, env reference, Pangolin SSE idle-timeout note, Gate 2 checklist. - ROADMAP: Phase 1 verification-status note (Gate 1 done, Gate 2 deferred); Phase 3 gains live AUTH + iOS standalone-PWA criterion; Phase 4 gains hard SSE-smoke entry gate (#1034). - PROJECT.md: D-14 (Gate 2 deferral split) + D-15 (local Newt rig); CAL-08 marked validated. - STATE: decisions/blockers updated to reflect deferral and dev-auth-bypass approach.	2026-06-04 11:55:31 -04:00