mrhid6 069e7e7c61 fix(api): declare MFA routes session-only so the server boots ...

The MFA routes were missing from routeScopes and serverScopedRoutes, and both
boot assertions refused to start the server. They are deliberately not
reachable by API tokens, so they go in a new sessionOnlyRoutes set rather than
receiving a scope, and are declared exempt from server scoping.

Adds a test that registers the real routes and runs both boot assertions, so
an undeclared route fails CI instead of production startup.

2026-09-16 14:40:29 +00:00

..

docs

test(mfa): end-to-end coverage, OpenAPI and documentation

2026-09-16 14:18:39 +00:00

auth_providers.go

feat: Annotate SSO, channel, console, instance and licence routes

2026-08-12 15:22:48 +00:00

bootassert_test.go

fix(api): declare MFA routes session-only so the server boots

2026-09-16 14:40:29 +00:00

channels.go

feat: Hide secrets on api and channels

2026-08-14 12:23:36 +00:00

console.go

chore: replace em dashes with hyphens, add no-em-dash rule to CLAUDE.md

2026-09-10 09:18:55 +00:00

handlers.go

fix(mfa): wire up webauthn step-up routes

2026-09-16 09:44:41 +00:00

health.go

chore: replace em dashes with hyphens, add no-em-dash rule to CLAUDE.md

2026-09-10 09:18:55 +00:00

install_ps1.go

refactor: move the agent and its installer to vantage-agent

2026-09-08 09:00:22 +00:00

instance.go

feat(mfa): require_mfa policy, sign-in rate limit and MFA column

2026-09-16 09:14:16 +00:00

licence.go

chore: replace em dashes with hyphens, add no-em-dash rule to CLAUDE.md

2026-09-10 09:18:55 +00:00

mfa.go

feat(mfa): account MFA management, passkey registration and step-up

2026-09-16 09:08:24 +00:00

monitors.go

fix(security): scope workflow target and monitor runner validation to the caller's tags

2026-09-09 08:33:38 +00:00

openapi.go

feat: Publish an OpenAPI 3.1 document and a Scalar reference

2026-08-12 15:23:02 +00:00

patching_scope_test.go

feat: patching REST API, patching scope, run IDs from apply-updates and MCP

2026-09-15 09:31:51 +00:00

patching.go

fix(patching): final review fixes

2026-09-15 13:49:28 +00:00

publichost.go

fix: Fixed server install scripts

2026-07-22 12:59:05 +01:00

publicstatus.go

chore: replace em dashes with hyphens, add no-em-dash rule to CLAUDE.md

2026-09-10 09:18:55 +00:00

ratelimit_auth.go

feat(mfa): require_mfa policy, sign-in rate limit and MFA column

2026-09-16 09:14:16 +00:00

ratelimit.go

feat: Rate limit API token requests

2026-08-12 14:51:22 +00:00

runscope_test.go

chore: replace em dashes with hyphens, add no-em-dash rule to CLAUDE.md

2026-09-10 09:18:55 +00:00

scopes.go

fix(api): declare MFA routes session-only so the server boots

2026-09-16 14:40:29 +00:00

secrets.go

chore: replace em dashes with hyphens, add no-em-dash rule to CLAUDE.md

2026-09-10 09:18:55 +00:00

serverscope_test.go

fix(api): declare MFA routes session-only so the server boots

2026-09-16 14:40:29 +00:00

serverscope.go

fix(api): declare MFA routes session-only so the server boots

2026-09-16 14:40:29 +00:00

statuspages.go

chore: replace em dashes with hyphens, add no-em-dash rule to CLAUDE.md

2026-09-10 09:18:55 +00:00

tokens.go

chore: replace em dashes with hyphens, add no-em-dash rule to CLAUDE.md

2026-09-10 09:18:55 +00:00

trustedproxies.go

fix: resolve the public status page's tenant from a trusted X-Forwarded-Host

2026-08-25 09:04:47 +00:00

types.go

fix(patching): final review fixes

2026-09-15 13:49:28 +00:00

vulnerabilities.go

chore: replace em dashes with hyphens, add no-em-dash rule to CLAUDE.md

2026-09-10 09:18:55 +00:00

workflows.go

fix(security): scope package search, run documents, workloads and vulnerability reads to the token's tags

2026-09-09 08:36:04 +00:00

workloads.go

chore: replace em dashes with hyphens, add no-em-dash rule to CLAUDE.md

2026-09-10 09:18:55 +00:00