pbwraith/gitea-saas-core
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Monetization core: shared billing (clients/ledger/holds/Stripe), factory intake (client repos + issue provisioning), eval farm intake/results, delivery receipts. Two front-ends, one billing core.
7 Commits 24 Branches 0 Tags 1.1 MiB
Python 99.6%
Dockerfile 0.4%
80958ef9b9
Go to file
Claude 80958ef9b9 gitea-saas-core#7: constant-time API-key check in authorized() (bounce fix) 
Replace the == string comparison at delivery.py:127 with
hmac.compare_digest so the shared secret never leaks through response
timing (repo convention: stripe_client.py:88, server.py:171). The
isinstance/empty guards run first so compare_digest's TypeError on
non-str input is never reached — unset config, None, and non-str keys
stay fail-closed False. Five direct authorized() tests added (16
delivery tests / 42 full suite green).
2026-08-25 06:40:41 -05:00
gitea_saas gitea-saas-core#7: constant-time API-key check in authorized() (bounce fix) 2026-08-25 06:40:41 -05:00
tests gitea-saas-core#7: constant-time API-key check in authorized() (bounce fix) 2026-08-25 06:40:41 -05:00
ARCHITECTURE.md architecture: intake-side gating (no dispatcher coupling) + review gate 2026-08-25 11:09:56 +02:00
pyproject.toml gitea-saas-core#1: billing ledger core (clients/ledger/holds, idempotent, fail-closed) 2026-08-25 04:16:35 -05:00
README.md Initial commit 2026-08-25 11:01:12 +02:00
requirements.txt gitea-saas-core#1: billing ledger core (clients/ledger/holds, idempotent, fail-closed) 2026-08-25 04:16:35 -05:00

README.md

gitea-saas-core

Monetization core: shared billing (clients/ledger/holds/Stripe), factory intake (client repos + issue provisioning), eval farm intake/results, delivery receipts. Two front-ends, one billing core.