feat(analytics): HMAC bearer auth #35776

Open

swicken wants to merge 21 commits into

mainfrom

feat/analytics-hmac-auth

Commits on May 19, 2026

feat(analytics): HMAC auth + tenant provisioning save flow
Scott Work
committed
refactor(analytics): unify proxy auth on HMAC token, drop DOT_ANALYTICS_PASSWORD
Scott Work
committed
chore: import optional justfile.local for dev overlays
Scott Work
committed
fix(analytics): clear admin password on exchange failure
Scott Work
committed
ui(analytics): warn against manually editing the auth token field
Scott Work
committed
test(analytics): cover ContentAnalyticsAppListener failure paths
Scott Work
committed
fix(analytics): proxy hardening — path allowlist, timeout, omit empty bearer
Scott Work
committed
review: drop reflection, allowlist cleanup, blank-body guard, envvar conflict
Scott Work
committed
fix(analytics): restrict GET proxy to administrators
Scott Work
committed
fix(analytics): defensive guards from third-round review
Scott Work
committed
fix(analytics): round-four review — content-type, null-safety, site resolution, health
Scott Work
committed
refactor(analytics): strip defensive code that doesn't pull weight
Scott Work
committed
fix(analytics): round-five review — project dedup, siteId fail-fast, save-failure notify, drop empty-POST Content-Type
Scott Work
committed
fix(analytics): round-six review — null-safe monitor probe, helper tests, javadoc
Scott Work
committed
fix(analytics): round-seven review — health timeout, null-body, allowlist gap
Scott Work
committed

Commits on May 20, 2026

Commits on May 21, 2026