yiekheng b77a9d106d feat(web): middleware gates non-allowlisted paths on session cookie ...

Edge-runtime check via auth-cookie.verifySession. /api/* paths get a
401 (no body) when unauthenticated; pages get a 307 to /login with
the original path encoded into ?next=. Allowlist explicitly excludes
/api/events and /api/qr — both were unauthenticated in v1.1.0 and
let an unauthenticated client snoop the entire SSE event stream and
enumerate paired account QR codes.

2026-05-10 17:57:07 +08:00

..

bot

fix(bot): dedupe duplicate reminder.fire jobs (msg sent twice)

2026-05-10 16:41:11 +08:00

web

feat(web): middleware gates non-allowlisted paths on session cookie

2026-05-10 17:57:07 +08:00