6 Commits

Author	SHA1	Message	Date
diegosouzapw	46e5aa5522	refactor(api): consolidate auth routing and provider config handling ... Centralize optional API key capability checks so dashboard forms and provider schemas share the same rules, including keyless Pollinations support and cloud-agent batch testing mode. Also align auto-combo config on `routerStrategy`, keep legacy combo reads compatible, preserve MCP routes as management APIs, narrow `require-login` public access to readonly/bootstrap flows, and make cloud-agent CORS reflect the request origin for credentialed requests.	2026-05-13 03:47:40 -03:00
HomerOff	4ea2a96e13	fix(authz): classify /dashboard/onboarding as PUBLIC to unblock setup wizard (#2127) ... - Add exact-match guard for /dashboard/onboarding before the broad /dashboard prefix - Add setup_wizard and client_api_mcp to ClassificationReason union type - Update test to verify PUBLIC classification Co-authored-by: HomerOff <homeroff76@gmail.com>	2026-05-10 13:33:20 -03:00
diegosouzapw	c63c5d5008	fix: resolve MCP endpoint auth bypass (#1970) and finalize DB settings	2026-05-05 09:59:43 -03:00
Sergey Morozov	8077e9b62b	feat(settings): add request body limit setting (#1968) ... Integrated into release/v3.7.9	2026-05-05 09:12:35 -03:00
diegosouzapw	4b9c129e1c	fix: harden security scan findings	2026-05-02 04:51:38 -03:00
backryun	a16e47c593	fix(providers): refresh web client user agents (#1699) ... Integrated release/v3.7.2 changes — refreshed web client user agents, env docs, Gemini OAuth fix	2026-04-28 02:41:19 -03:00