2 Commits

Author	SHA1	Message	Date
r-dev	b342d0e50a	fix(security) : harden auth, session, document access and health endpoint ... - Remove orphaned PUBLIC_ACCESS rule for deleted /api/test route - Remove JWT login firewall (app is session-based only) - Set APP_SECRET placeholder (real value must be in .env.local) - Remove JWT env vars from .env - Add session regeneration on login (prevent session fixation) - Remove Document.path from API serialization groups (prevent path leak) - Restrict health check details to ROLE_ADMIN (anonymes get status only) - Add path traversal guard in DocumentStorageService - Convert CreateProfileCommand password to interactive hidden prompt - Restrict Profile Get endpoint to ROLE_ADMIN - Change api firewall to stateless: false (matches session-based auth) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-08 13:42:09 +01:00
Matthieu	e922b14419	feat(api) : add /api/health endpoint for monitoring ... - Returns status, version, timestamp, PHP version, DB latency and memory usage - Accessible without authentication (PUBLIC_ACCESS) - Returns 200 when healthy, 503 when degraded (DB down)	2026-03-06 09:51:09 +01:00