security: require verified email for admin + harden sessions

Browse Source

Admin (email allowlist) is now gated on a verified email and re-evaluated per
request instead of trusting a frozen cookie flag; session max_age cut to 8h.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

...

This commit is contained in:

Chris Farhood

2026-07-07 10:39:05 -04:00

parent 67f631ac50

commit ecf4df88d3

3 changed files with 49 additions and 5 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

.coverage

BIN

Binary file not shown.