3 Commits

Author	SHA1	Message	Date
ryan	b7e5e811d1	fix(auth): register CAP scope, 400 on captcha, 403 for permission ... Navigating from login reused a send_email_code token on register. Captcha failure used 401 so the client stored /register as the post-login target and never left the page. Permission denials now return 403, and the API client no longer wipes the session on 401.	2026-09-02 18:26:22 +08:00
ryan	e0f2309520	feat(router): add whitelist mechanism for http driver and auth plugin ... - implement route whitelist registration and wildcard matching in RouterExtension - add cookie store session fallback when Redis is disabled in driver_http - actively register public auth endpoints to whitelist in auth plugin - update user handlers to persist session and clear cookie on logout - document router whitelist mechanism in AGENTS.md and new-api skill	2026-08-29 11:39:13 +08:00
ryan	f4975d6732	refactor(plugins): restructure admin and message_gateway into standard layered sub-packages	2026-08-28 22:33:26 +08:00