5 commits

Author	SHA1	Message	Date
Tal.Yuan	fb8c391a88	refactor(routes): move webhook domain into routes/webhook/ subpackage (#5781) ... Slice 2l of the route-domain reorganization (#4082/#4071). Moves webhook_routes.py into routes/webhook/, leaving a backward-compat sys.modules shim. Pure file reorganization, no behavior change. One source-introspection test repointed (test_api_chat_security.py).	2026-08-03 20:44:31 +02:00
Alexandre Teixeira	17df977794	test: add fire_and_forget to API chat webhook stub (#4383)	2026-06-16 03:15:14 +00:00
pewdiepie-archdaemon	06a0d3ce92	Reapply "Merge branch 'main' of github.com:pewdiepie-archdaemon/odysseus" ... This reverts commit 67bf3f6b78.	2026-06-03 22:47:00 +09:00
pewdiepie-archdaemon	67bf3f6b78	Revert "Merge branch 'main' of github.com:pewdiepie-archdaemon/odysseus" ... This reverts commit 3a790b792b, reversing changes made to 082aa4ee48.	2026-06-03 22:46:19 +09:00
Alexandre Teixeira	a24ed1ec6b	Harden API-token chat endpoint selection ... Validate only token-supplied direct base_url values for API-token chat requests, while keeping admin-configured endpoints available for local/LAN providers. Scope configured endpoint fallback selection to the API token owner, fail closed for unknown token owners, and preserve strict session ownership checks when resuming sessions from chat-scoped API tokens. Add focused regression coverage for direct base_url SSRF rejection, configured endpoint fallback behavior, token-owner scoping, URL validation, and null-owner session/endpoint handling.	2026-06-03 13:05:13 +01:00