Lucas WintherandClaude Opus 5.5 5f7d54b805 fix(server): token actor, login CSRF, 415, cookie decoding, admin invites, production default ...

- API writes pass token:<name> for Bearer requests and "user" for sessions.
- X-Requested-With: sttracker on every non-Bearer write, login and register included.
- JSON-body routes reject non-JSON content types with 415.
- A malformed stt_session cookie counts as no cookie (401), not 500.
- DELETE me/tokens/:id is 404 for unknown or foreign ids; admin/invites is admin-only.
- Bun.serve development mode only with NODE_ENV=development or --hot.
- OpenAPI documents multipart fields.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

2026-10-30 21:30:43 +01:00

..

src

fix(server): token actor, login CSRF, 415, cookie decoding, admin invites, production default

2026-10-30 21:30:43 +01:00

test

fix(server): token actor, login CSRF, 415, cookie decoding, admin invites, production default

2026-10-30 21:30:43 +01:00

package.json

chore: workspace package stubs with approved dependencies

2026-10-30 15:30:49 +01:00