arkonandClaude Opus 4.6 18217268bf fix: extract QR auth magic numbers into named constants, add 16 security tests ...

Replace hardcoded per-IP rate limit (10) and cookie maxAge (86400) in
system-routes.ts with QR_AUTH_FAILURE_MAX and AUTH_SESSION_TTL_MS/1000
so both auth paths stay in sync if constants change.

Add 16 new tests: grace period boundary precision, base62 charset
validation, current+previous token during grace, stopTokenRotation
state cleanup, rate limit reset, consumed token eviction, full
end-to-end QR flow, per-IP 429, cookie attributes, concurrent race,
regenerate invalidation, URL encoding, path traversal, /q without
param, and session record method:qr.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-01 17:32:02 +01:00

..

ai-defaults.ts

refactor: consolidate ~70 scattered constants into 6 new config files (phase 6)

2026-03-01 13:19:16 +01:00

auth-config.ts

refactor: consolidate ~70 scattered constants into 6 new config files (phase 6)

2026-03-01 13:19:16 +01:00

buffer-limits.ts

chore: remove dead code and unused exports (-159 lines)

2026-02-28 02:01:21 +01:00

exec-timeout.ts

perf: implement phase 1-3 performance optimizations

2026-02-28 17:39:44 +01:00

map-limits.ts

refactor: consolidate ~70 scattered constants into 6 new config files (phase 6)

2026-03-01 13:19:16 +01:00

server-timing.ts

refactor: consolidate ~70 scattered constants into 6 new config files (phase 6)

2026-03-01 13:19:16 +01:00

team-config.ts

refactor: consolidate ~70 scattered constants into 6 new config files (phase 6)

2026-03-01 13:19:16 +01:00

terminal-limits.ts

refactor: consolidate ~70 scattered constants into 6 new config files (phase 6)

2026-03-01 13:19:16 +01:00

tunnel-config.ts

fix: extract QR auth magic numbers into named constants, add 16 security tests

2026-03-01 17:32:02 +01:00