derekc 50ee1f9fed Fix auth bypasses, race condition, stale connections, and unbounded query ...

- Block disabled accounts at login and unimpersonate (C4, C2)
- Catch IntegrityError on register commit to return 409 instead of 500 (C5)
- Stop _seed_admin from overwriting existing admin password on restart (C8)
- Cap public/stats query at 500 users to bound memory usage (C3)
- Rate-limit PUT /me/password at 5/minute (C6)
- Bump SQLAlchemy to 2.0.50 and aiomysql to 0.3.2; re-enable pool_pre_ping (C7)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-25 00:55:12 -07:00

..

__init__.py

Add initial project files

2026-03-24 19:11:00 -07:00

admin.py

Fix auth bypasses, race condition, stale connections, and unbounded query

2026-05-25 00:55:12 -07:00

auth.py

Fix auth bypasses, race condition, stale connections, and unbounded query

2026-05-25 00:55:12 -07:00

entries.py

Add bottle size, bourbon list modal, and stat improvements

2026-03-24 21:53:50 -07:00

public.py

Fix auth bypasses, race condition, stale connections, and unbounded query

2026-05-25 00:55:12 -07:00

users.py

Fix auth bypasses, race condition, stale connections, and unbounded query

2026-05-25 00:55:12 -07:00