n.siegfried
39b48055ff
Brings the Work Package Suite from a browser-local prototype to a multi-tenant, SQL-backed deployment hardened for customer IP. Auth & access control - Local username/password login (bcrypt + JWT in an HttpOnly cookie), admin-managed users, per-project membership, and project-scoped API access. - Admin console: change user roles, view the audit trail, manage settings. Security hardening - CSP / HSTS / X-Frame-Options / nosniff headers in nginx; Secure cookie via X-Forwarded-Proto; CSRF Origin check; attribute-safe output escaping. - Login lockout, token_version session revocation, stronger password policy, fail-closed secret loading, encrypted (AES-256) database backups. Persistence & schema - SOPs and Work Packages are now DB-backed and shared across users, written through a durable client sync outbox that queues offline edits. - Alembic migrations applied automatically on container start. New capabilities - Phase 2 dashboard (progress, gating, pagination, archive). - Phase 3 PWA "Field View" with offline caching and auth fallback. - WP owner assignment with OPTIONAL email notifications, OFF by default and toggled from the admin console. SMTP password is read only from the SMTP_PASSWORD env var (never stored); emails carry a WP number + deep link, never customer IP. Also: IBM Carbon restyle, Help section, and DEPLOYMENT.md brought up to date. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
17 lines
745 B
Plaintext
17 lines
745 B
Plaintext
# Pinned to exact versions for reproducible builds — no silent dependency drift
|
|
# on every `docker compose up --build`. To update: bump a version here on purpose,
|
|
# run `pip-audit` against the result, and test. For supply-chain integrity, the
|
|
# next step is a hashed lockfile (`pip-compile --generate-hashes` → install with
|
|
# `pip install --require-hashes`).
|
|
fastapi==0.138.1
|
|
uvicorn[standard]==0.49.0
|
|
gunicorn==26.0.0
|
|
sqlalchemy==2.0.51
|
|
alembic==1.18.5 # database migrations
|
|
psycopg[binary]==3.3.4
|
|
pydantic==2.13.4
|
|
python-dotenv==1.2.2
|
|
bcrypt==5.0.0 # password hashing
|
|
PyJWT==2.13.0 # signed session tokens
|
|
starlette==1.3.1 # pinned transitive (cookie / CORS handling — security-relevant)
|