Andras Bacsai 13298591d8 fix(api): throttle API clients that keep failing and notify the token's team ...

- Return 429 after 30 failed (401/403/404) requests per minute for one
  token or IP, also for unknown API routes (API_FAILED_REQUEST_RATE_LIMIT)
- Notify the team once a day when a token reaches the limit
- Deduplicate ability_denied and scope_denied audit events for 5 minutes

2026-11-05 23:38:37 +01:00

..

AddServerTimingHeaders.php

feat(ui): Shadow UI redesign, domain management, and DNS autoconfigure (#11119)

2026-08-03 23:11:54 +02:00

ApiAbility.php

feat(access): add scoped grants for team members and API tokens (#12329)

2026-10-26 12:13:20 +01:00

ApiAllowed.php

chore: merge main into next (#12351)

2026-10-27 22:25:43 +01:00

ApiIpAllowed.php

chore: merge main into next (#12351)

2026-10-27 22:25:43 +01:00

ApiSensitiveData.php

…

Authenticate.php

…

CanAccessTerminal.php

feat(mcp): add REST-backed resource management tools (#12163)

2026-10-14 13:26:12 +02:00

CanCreateResources.php

feat(access): add scoped grants for team members and API tokens (#12329)

2026-10-26 12:13:20 +01:00

CanUpdateResource.php

feat(auth): authorize sqlite databases with the database policy

2026-09-24 19:03:42 +02:00

CheckForcePasswordReset.php

feat(mcp): add REST-backed resource management tools (#12163)

2026-10-14 13:26:12 +02:00

ConfigurePasskeys.php

feat(auth): add passkey sign-in

2026-10-13 04:01:40 +00:00

DecideWhatToDoWithUser.php

refactor(auth): remove OAuth re-authentication for destructive actions

2026-09-30 21:37:02 +02:00

EncryptCookies.php

…

EnsureMcpEnabled.php

…

EnsureTeamMcpEnabled.php

…

EnsureTeamWideAccess.php

fix(access): enforce member grants on more actions

2026-10-30 16:11:10 +01:00

EnsureTokenBelongsToCurrentTeamMember.php

feat(access): add scoped grants for team members and API tokens (#12329)

2026-10-26 12:13:20 +01:00

KeepConcurrentTeamSwitch.php

chore: merge main into release/v4.5 (#12192)

2026-10-18 23:43:20 +02:00

PreventRequestsDuringMaintenance.php

…

RedirectIfAuthenticated.php

feat(mcp): add REST-backed resource management tools (#12163)

2026-10-14 13:26:12 +02:00

RequirePassword.php

fix(auth): let OAuth-only users enable 2FA without a password confirmation

2026-10-02 16:01:10 +02:00

RequireTeamTwoFactor.php

chore: merge main into next (#12344)

2026-10-27 20:25:53 +01:00

ThrottleFailedApiRequests.php

fix(api): throttle API clients that keep failing and notify the token's team

2026-11-05 23:38:37 +01:00

TrimStrings.php

fix(env): keep the trailing newline of multiline environment variables

2026-11-03 20:30:59 +01:00

TrustProxies.php

…

UseSessionTeamApiToken.php

feat(canvas): add interactive resource views and team avatars (#12160)

2026-10-14 09:28:10 +02:00

ValidateSignature.php

…

VerifyCsrfToken.php

…