GustavoandClaude Opus 5.5 161da90e02 feat: bind the GTI Fiscal SSO assertion to the browser (state/nonce) ...

/sso/fiscal now requires the state that GTI Fiscal creates when the flow
starts and signs it as the "nonce" claim; GTI Fiscal checks it against
its own one-time cookie. Without a valid state the panel sends the
browser to GTI Fiscal's /login, so the flow always starts there. This
prevents someone from pushing an assertion for their own account into
another person's browser (login CSRF).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-09-23 12:21:27 -03:00

..

db

feat: alternar_ativo em CLIENTE e limpar em LOG_PAINEL (camada de banco)

2026-08-20 10:49:43 -03:00

routers

feat: bind the GTI Fiscal SSO assertion to the browser (state/nonce)

2026-09-23 12:21:27 -03:00

static

fix: tabelas nao ficam mais espremidas no mobile (colunas quebrando letra por letra) - min-width em vez de width fixo, permitindo rolagem horizontal

2026-08-20 14:13:25 -03:00

templates

feat: single sign-on from the panel into GTI Fiscal

2026-09-23 08:35:35 -03:00

__init__.py

chore: scaffold painel-clientes-web

2026-08-13 09:39:28 -03:00

asset_versao.py

fix: adiciona cache-busting nos arquivos estaticos (css/js) para evitar layout desatualizado apos deploy

2026-08-20 13:52:07 -03:00

auth.py

fix: desativar/rebaixar funcionario nao revogava sessao ativa (ate 12h)

2026-08-13 21:18:58 -03:00

cnpj_lookup.py

feat: preenchimento automatico de dados do cliente a partir do CNPJ

2026-08-13 15:05:26 -03:00

csrf.py

feat: protecao CSRF (double-submit cookie) e paginacao da lista de clientes

2026-08-13 11:02:17 -03:00

gerador_chave.py

fix(seguranca): move algoritmo de geracao de chave do JS pro backend

2026-08-14 10:03:19 -03:00

main.py

feat: single sign-on from the panel into GTI Fiscal

2026-09-23 08:35:35 -03:00

n8n_client.py

fix: parametro correto da API de rows do n8n (limit, nao take)

2026-08-13 14:14:40 -03:00

normalize.py

fix: corrige achados da revisao final (DDI idempotente, mascara DDI 12/13 digitos, status DV, validacao no load, autofill dispara mascaras)

2026-08-14 12:31:20 -03:00

rate_limit.py

security: rate limit no login, cookies Secure condicional, security headers e deps com CVE

2026-08-15 11:17:41 -03:00

senha.py

feat: login individual por funcionario (cadastro, senha com hash, ativar/desativar)

2026-08-13 14:19:58 -03:00

session.py

feat: token de sessao assinado (app/session.py)

2026-08-13 20:25:18 -03:00

sso.py

feat: bind the GTI Fiscal SSO assertion to the browser (state/nonce)

2026-09-23 12:21:27 -03:00