Hongming Wang 7c9192063d fix(security): #190 — gate POST /templates/import behind AdminAuth ... Closes #190 (HIGH). The route was registered on the root router with no auth middleware, letting any unauthenticated caller write arbitrary files into configsDir via a crafted template. Same vulnerability class as #164 (bundles/import) and path-traversal risk same as #103 (org/import). One-line gate via the existing wsAdmin pattern. Lazy-bootstrap fail-open preserved for fresh installs. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>		2026-04-15 11:00:49 -07:00
..
cmd	fix(platform): panic-recovering supervisor for every background goroutine (#92)	2026-04-14 20:34:18 -07:00
internal	fix(security): #190 — gate POST /templates/import behind AdminAuth	2026-04-15 11:00:49 -07:00
migrations	fix(schedules): backfill legacy rows to 'template' + extract import SQL const	2026-04-14 14:30:22 -07:00
Dockerfile	initial commit — Molecule AI platform	2026-04-13 11:55:37 -07:00
go.mod	initial commit — Molecule AI platform	2026-04-13 11:55:37 -07:00
go.sum	initial commit — Molecule AI platform	2026-04-13 11:55:37 -07:00