mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-05 14:52:09 +03:00
74a0585683
feat(#255): add Ollama Cloud provider (api.ollama.com/v1) - New registry entry 'ollama-cloud' (alias: ollamacloud) - OpenAI-compatible, Bearer API key auth - 7 pre-populated models: Gemma 3 27B, Llama 3.3 70B, Qwen3 72B, Devstral 24B, DeepSeek R2 671B, Phi 4 14B, Mistral Small 3.2 24B - passthroughModels: true for dynamic model names fix(#258): security hardening — all 9 findings addressed - [CRITICAL] db-backups/export: add isAuthRequired + isAuthenticated guard - [CRITICAL] db-backups/import: add isAuthRequired + isAuthenticated guard - [HIGH] oauth/cursor/auto-import: add isAuthRequired + isAuthenticated guard - [HIGH] oauth/kiro/auto-import: add isAuthRequired + isAuthenticated guard - [LOW x4] oauth/[provider]/[action]: replace === with safeEqual() using crypto.timingSafeEqual() for CWE-208 (timing-oracle attacks) on email and workspaceId comparisons across all 3 handler branches - [FALSE POSITIVE] Finding #1 (package.json 'reset-password' binary name) is not a hardcoded credential — no change needed Tests: 590/594 pass (4 pre-existing failures in combo-circuit-breaker)