5 commits

Author	SHA1	Message	Date
oliver	329ae8501f	Ensure ne_collection_job.trigger_mode exists on existing DBs. ... Missing column broke ops task overview and collection queries when Alembic skipped legacy DDL; add always-on safety net plus migration. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-12 16:58:52 +08:00
oliver	b81e5869a6	Ship gated eye polish, fabric levels, and collection UI refresh. ... Topology MCP adds pull/compact/bundle/suggest-hubs with a no-template skill path; API gains fabric level and NE collection policy; web list pages get paging and denser collect/network workflows. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-12 16:13:05 +08:00
oliver	20c2fcd496	Harden auth with revocable sessions, cookies, and single-login default. ... Issue short-lived access JWTs backed by AuthSession rows, HttpOnly cookies with refresh rotation, idle timeout, session management UI, WebCRT ownership caps, and optional Redis login rate limits; new logins revoke other sessions by default. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-06 14:13:37 +08:00
oliver	57b3faf9fb	Move schema evolution to Alembic with auto-upgrade on API start. ... Extract shared brownfield patches, add the legacy revision, and default to upgrade-head plus skip of duplicate inline DDL (with legacy fallback if Alembic fails). Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-02 16:41:56 +08:00
oliver	633a9d55bd	Harden auth scopes, SQL/WebCRT gates, and per-install JWT secrets. ... Add capability RBAC, Alembic bootstrap, optional worker schedulers, and close public docs by default so lab installs stay usable without shared signing keys. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-02 16:24:34 +08:00