varutasu 708ef45a96 feat(security): rate-limit search/upload/import + gate import routes (P0 #6 - closes last P0) ... Closes P0 #6 from PARTIAL to RESOLVED. 8/8 P0s now closed. Extends lib/rate-limit.js from single-class to 5 named limiters (auth/search/upload/generate/import). Atomically gates the 3 import routes (auth + admin-role check + rate limit) and fixes pages/admin/card-import.js's missing Bearer header in the same commit (architect's critical discovery: API gating alone would have broken the admin UI). Per Decision 1 Option A. 10 files +185/-23. Local: lint 128 baseline, vitest 21/21. CI: Playwright smoke 3/3 in 3.8s, forbidden-cors-headers pass, all gates green. PR #20 architect-commit 60b842e, implementer-commit 51a3a97. Brief 4's login.js + register.js byte-identical.		2026-05-24 22:59:59 -05:00
..
admin	fix(security): drop wildcard CORS + redundant OPTIONS from 24 API routes (P0 #5)	2026-05-24 20:41:38 -05:00
auth	fix(security): drop wildcard CORS + redundant OPTIONS from 24 API routes (P0 #5)	2026-05-24 20:41:38 -05:00
cards	feat(security): rate-limit search/upload/import + gate import routes (P0 #6 - closes last P0)	2026-05-24 22:59:59 -05:00
collections	fix(security): drop wildcard CORS + redundant OPTIONS from 24 API routes (P0 #5)	2026-05-24 20:41:38 -05:00
community	fix(security): drop wildcard CORS + redundant OPTIONS from 24 API routes (P0 #5)	2026-05-24 20:41:38 -05:00
config	✨ Major Scanner Improvements	2025-07-29 14:19:48 -05:00
decks	✨ Major Scanner Improvements	2025-07-29 14:19:48 -05:00
invite	fix(security): drop wildcard CORS + redundant OPTIONS from 24 API routes (P0 #5)	2026-05-24 20:41:38 -05:00
public	fix(security): drop wildcard CORS + redundant OPTIONS from 24 API routes (P0 #5)	2026-05-24 20:41:38 -05:00
user	feat(security): rate-limit search/upload/import + gate import routes (P0 #6 - closes last P0)	2026-05-24 22:59:59 -05:00
users	feat(security): rate-limit search/upload/import + gate import routes (P0 #6 - closes last P0)	2026-05-24 22:59:59 -05:00
auth-utils.js	fix(auth): centralize JWT secret + 24h TTL (Brief 1 of fix-auth-bypass)	2026-05-23 10:40:50 -05:00
collections.js	fix(security): drop wildcard CORS + redundant OPTIONS from 24 API routes (P0 #5)	2026-05-24 20:41:38 -05:00
decks.js	✨ Major Scanner Improvements	2025-07-29 14:19:48 -05:00
favorites.js	fix(security): drop wildcard CORS + redundant OPTIONS from 24 API routes (P0 #5)	2026-05-24 20:41:38 -05:00
health.js	Clean slate: Remove React traces and create pure Next.js setup	2025-07-23 09:32:31 -05:00
user-cards.js	✨ Major Scanner Improvements	2025-07-29 14:19:48 -05:00