71ba0b95a5
Phase B addresses 7 high-severity gaps from the permissions audit: - B1: Enforce tree access check on session start via can_access_tree - B2: Replace all inline permission helpers with centralized permissions.py - B3: Fix require_engineer_or_admin to check is_team_admin before role - B4: Add is_active field on User with enforcement in get_current_active_user - B5: Add admin user management endpoints (list, get, role, team-admin, deactivate, activate) - B6: Add rate limiting on auth/invite endpoints via slowapi (disabled in DEBUG) - B7: Implement refresh token rotation with JTI-based revocation and meaningful logout Also reduces access token TTL from 15 to 5 minutes and updates CLAUDE.md with SaaS/MSP context for future planning sessions. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
27 lines
419 B
Plaintext
27 lines
419 B
Plaintext
# FastAPI and server
|
|
fastapi==0.109.2
|
|
uvicorn[standard]==0.27.1
|
|
|
|
# Database
|
|
sqlalchemy==2.0.25
|
|
asyncpg==0.29.0
|
|
psycopg2-binary==2.9.9
|
|
alembic==1.13.1
|
|
|
|
# Authentication
|
|
python-jose[cryptography]==3.3.0
|
|
passlib[bcrypt]==1.7.4
|
|
bcrypt==4.1.2
|
|
python-multipart==0.0.9
|
|
|
|
# Validation and settings
|
|
pydantic==2.6.1
|
|
pydantic-settings==2.1.0
|
|
email-validator==2.1.0
|
|
|
|
# Rate Limiting
|
|
slowapi==0.1.9
|
|
|
|
# Utilities
|
|
python-dotenv==1.0.1
|