9016ce02e4
Off by default. Once a PIN is set in Settings -> System & backup, every non-GET /api/* request (plus GET /api/ammc/config) needs a signed 30-day HttpOnly cookie, which also closes the unauthenticated /api/update/run restart trigger. A 401 opens a PIN dialog and the pending save is retried after login. Reads stay open because the public overlay hydrates through GET /api/state. Optional RC_ADMIN_ALLOWED_CIDRS restricts the same routes by client address. The PIN hash and signing secret live in data/, outside the app_state blob, so they never leak through GET /api/state, exports or backups. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
25 lines
807 B
JavaScript
25 lines
807 B
JavaScript
import "./auth.test.js";
|
|
import "./driver_profile_logic.test.js";
|
|
import "./training_logic.test.js";
|
|
import "./public_training_profile.test.js";
|
|
import "./race_timing_logic.test.js";
|
|
import "./track_layouts_logic.test.js";
|
|
import "./race_day_logic.test.js";
|
|
import "./backup_service.test.js";
|
|
import "./judging_logic.test.js";
|
|
import "./session_control.test.js";
|
|
import "./runtime_persistence.test.js";
|
|
import "./audio_runtime.test.js";
|
|
import "./race_audio.test.js";
|
|
import "./decoder_runtime.test.js";
|
|
import "./csv_import.test.js";
|
|
import "./server_persistence.integration.test.js";
|
|
|
|
import "./training_views.test.js";
|
|
|
|
import "./session_replay.test.js";
|
|
import "./public_training_refresh.test.js";
|
|
import "./list_sorting.test.js";
|
|
import "./sync_status.test.js";
|
|
import "./decoder_diagnostics.test.js";
|