2 Commits

Include renames

Author	SHA1	Message	Date
sandrodachandClaude Opus 5.5	4cdbcbd6b5	fix(security): never sign tokens with a known JWT secret (FLAW-04) ... Without JWT_SECRET, or with one of the published placeholders, the server generates 32 random bytes once and keeps them in the data directory (jwt.secret, mode 0600), so tokens cannot be forged and logins survive restarts. Instances that ran on the old default log in once more. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-29 07:35:45 +01:00
sandrodach	48fe61fbce	feat(logging): integrate slog logging with env control and request/sync tracing ... - Configure structured slog logger in cmd/server/main.go via LOG_LEVEL and DEBUG env vars - Add HTTP API request logging middleware in internal/api/ with status and duration_ms - Add WebSocket join/leave, event reception, and debounced SQLite flush tracing in docroom - Document LOG_LEVEL and DEBUG settings in .env.example, compose.yaml, and docker-compose.yml	2026-10-26 22:12:51 +01:00