cm_bot_v2

History

yiekheng 43db97aeaa fix(api): drop flask_cors from cm_api (CORS-A defense-in-depth)

api-server is internal-only after C5 (no host port in prod compose),
so the permissive 'CORS(app)' default never fires in normal operation.
Removing it eliminates a stale '*' Access-Control-Allow-Origin that
would become attack surface if a host port were ever accidentally
re-exposed.

Server-side fetches from web-view (legacy Flask) and web-next
(Next.js RSC) don't trigger CORS — that's a browser-only mechanism.

flask_cors stays in requirements.txt because cm_web_view.py still
imports it; both get removed in B4 when the legacy web-view retires.

2026-05-02 21:27:06 +08:00

__init__.py

Refactor Docker layout for Gitea publishing

2025-10-19 22:22:55 +08:00

bot_cli.py

fix(hal): set_security_pin_api returns dict; cm_telegram now correct

2026-05-02 17:37:50 +08:00

cm_api.py

fix(api): drop flask_cors from cm_api (CORS-A defense-in-depth)

2026-05-02 21:27:06 +08:00

cm_bot_hal.py

fix(hal): set_security_pin_api returns dict; cm_telegram now correct