Imugiii
35ead030b1
fix(auth): leurre anti-enumeration sur la demande de reset (parite timing/ecritures)
...
CI / php-lint (push) Successful in 22s
CI / php-lint (pull_request) Successful in 22s
CI / static-tests (pull_request) Successful in 36s
CI / auto-merge (push) Has been skipped
CI / auto-merge (pull_request) Successful in 6s
CI / secret-scan (push) Successful in 11s
CI / static-tests (push) Successful in 35s
CI / secret-scan (pull_request) Successful in 8s
PasswordResetService::requestReset repondait instantanement et sans ecriture sur
un email inconnu, alors que le chemin email-connu genere un token (random_bytes +
SHA-256), fait un UPDATE et envoie un mail : oracle de timing + de profil
d'ecritures revelant l'existence d'un compte. Le commit P2 #11 annoncait pourtant
une parite anti-enumeration PR-wide (vraie sur le login, pas sur le reset).
payEnumerationDecoy() reproduit le cout CPU et UNE ecriture du chemin connu, mais
sur id = 0 (aucune ligne, rien persiste) ; aucun mail. Meme pattern que le leurre
du login (UPDATE no-op sur id = 0). Tests unknown-email (service + controleur)
mis a jour : 1 ecriture leurre sur id=0, pas de mail. Suite 188 verte, PHPStan L6.
2026-06-16 12:02:19 +00:00
ad5203d3fc
feat(admin): throttle du PIN d action sensible par acteur (RG-T22) ( #18 )
CI / secret-scan (push) Successful in 8s
CI / php-lint (push) Successful in 20s
CI / static-tests (push) Successful in 32s
CI / auto-merge (push) Has been skipped
2026-06-16 00:06:33 +02:00
2756fb4080
feat(admin): CRUD produits avec PIN conditionnel et audit ( #17 )
CI / secret-scan (push) Successful in 12s
CI / php-lint (push) Successful in 22s
CI / static-tests (push) Successful in 36s
CI / auto-merge (push) Has been skipped
2026-06-15 22:35:50 +02:00
f63ac9873c
feat: PIN self-service P3 (/admin/profile/pin) ( #16 )
CI / secret-scan (push) Successful in 8s
CI / php-lint (push) Successful in 18s
CI / static-tests (push) Successful in 35s
CI / auto-merge (push) Has been skipped
2026-06-15 22:04:14 +02:00
8290ceabc4
feat: CRUD categories P3 (rendu serveur, garde + CSRF + validation) ( #15 )
CI / secret-scan (push) Successful in 7s
CI / php-lint (push) Successful in 18s
CI / static-tests (push) Successful in 27s
CI / auto-merge (push) Has been skipped
2026-06-15 21:45:31 +02:00
2bc22ab5c8
feat: shell back-office P3 (pages rendues serveur + garde) ( #14 )
CI / secret-scan (push) Successful in 7s
CI / php-lint (push) Successful in 16s
CI / static-tests (push) Successful in 30s
CI / auto-merge (push) Has been skipped
2026-06-15 21:25:06 +02:00
7c35f8e2dc
feat: PIN d action sensible P2 (PinVerifier RG-T13) ( #13 )
CI / secret-scan (push) Successful in 8s
CI / php-lint (push) Successful in 16s
CI / static-tests (push) Successful in 30s
CI / auto-merge (push) Has been skipped
2026-06-15 21:00:11 +02:00
f979a2339e
feat: RBAC P2 (autorisation par permission + garde de session + /api/me) ( #12 )
CI / secret-scan (push) Successful in 8s
CI / php-lint (push) Successful in 19s
CI / static-tests (push) Successful in 33s
CI / auto-merge (push) Has been skipped
2026-06-15 20:45:19 +02:00
1b0b20c12d
feat: authentification back-office P2 (login/logout/reset, throttle, audit) ( #11 )
CI / secret-scan (push) Successful in 7s
CI / php-lint (push) Successful in 17s
CI / static-tests (push) Successful in 32s
CI / auto-merge (push) Has been skipped
2026-06-15 20:18:59 +02:00
Imugiii
8c93b26ec0
feat(core): from-scratch PHP MVC skeleton (autoloader/config/PDO/router/front controller) + PHPUnit/PHPStan + composer-less CI
2026-06-15 14:13:49 +00:00
