pbwraith/gitea-saas-core
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Monetization core: shared billing (clients/ledger/holds/Stripe), factory intake (client repos + issue provisioning), eval farm intake/results, delivery receipts. Two front-ends, one billing core.
10 Commits 24 Branches 0 Tags 1.1 MiB
Python 99.6%
Dockerfile 0.4%
issue-4
Go to file
Claude ea674c2ff5 gitea-saas-core#4: constant-time API-key check via API_KEY_HEADER 
Addendum finding (bounce comment 9000): _authorized compared the shared
secret with ==, leaking a prefix-match timing signal. Use
hmac.compare_digest and read the header name from the shared
API_KEY_HEADER constant (defensive import; gitea_saas/config.py lands
with sibling auth PRs, fallback X-API-Key keeps this module importable
until then). Route comment updated to state the real discipline.
46 tests pass.
2026-08-25 11:36:52 -05:00
gitea_saas gitea-saas-core#4: constant-time API-key check via API_KEY_HEADER 2026-08-25 11:36:52 -05:00
tests gitea-saas-core#4: adapt to billing core client id rename (#16) after rebase 2026-08-25 11:15:40 -05:00
ARCHITECTURE.md architecture: intake-side gating (no dispatcher coupling) + review gate 2026-08-25 11:09:56 +02:00
pyproject.toml gitea-saas-core#1: billing ledger core (clients/ledger/holds, idempotent, fail-closed) 2026-08-25 04:16:35 -05:00
README.md Initial commit 2026-08-25 11:01:12 +02:00
requirements.txt gitea-saas-core#1: billing ledger core (clients/ledger/holds, idempotent, fail-closed) 2026-08-25 04:16:35 -05:00

README.md

gitea-saas-core

Monetization core: shared billing (clients/ledger/holds/Stripe), factory intake (client repos + issue provisioning), eval farm intake/results, delivery receipts. Two front-ends, one billing core.