feat: auth hardening Sprint 19 (v0.7.0)#135

Merged

BadgerOps merged 10 commits intomasterfrom

feat/auth-hardening

Feb 18, 2026

Commits on Feb 18, 2026

feat: auth-always default, remove CLOUDPAM_AUTH_ENABLED toggle

BadgerOps
and
claude
committed
fix: extract audit actor from auth context instead of hardcoding anonymous

BadgerOps
and
claude
committed
fix: prevent API key scope elevation — callers cannot grant higher privileges than their own role

BadgerOps
and
claude
committed
feat: trusted proxy configuration and login rate limiting

BadgerOps
and
claude
committed
security: remove bearer-as-session-token, harden password policy

BadgerOps
and
claude
committed
feat: security settings table, store interface, and API endpoint

BadgerOps
and
claude
committed
feat: session hardening and revoke-all-sessions API

BadgerOps
and
claude
committed
feat: CSRF protection middleware for session-authenticated requests

BadgerOps
and
claude
committed
feat: security settings UI page under Config > Security

BadgerOps
and
claude
committed
docs: update CLAUDE.md and CHANGELOG for v0.7.0 auth hardening

BadgerOps
and
claude
committed