A ashkan@beigi.net 0b362bbd0b Harden: gate /api/export behind an admin token (closed by default) ... /api/export returns every subscriber's Ki/OPc and was reachable unauthenticated by any WiFi client (and directly, since Flask binds 0.0.0.0). It now requires server.admin_token via the X-Admin-Token header (constant-time compare) and is disabled entirely when no token is configured. Add admin_token to config.yaml.example. Tests: +2 (disabled/401/200); 86 pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>			2026-07-01 22:01:59 +00:00
..
core_adapters		Harden: fix bare-filename db path crash, configurable APN	2026-07-01 06:13:26 +00:00
__init__.py		Add Phase-1 eSIM provisioning implementation	2026-07-01 05:56:31 +00:00
app.py		Harden: gate /api/export behind an admin token (closed by default)	2026-07-01 22:01:59 +00:00
database.py		Harden: concurrency safety (db lock timeout, cache lock, retry, portal)	2026-07-01 06:16:25 +00:00
models.py		Add Phase-1 eSIM provisioning implementation	2026-07-01 05:56:31 +00:00
profile_generator.py		Phase 2: real 3GPP profile encodings + changelog	2026-07-01 06:03:48 +00:00
utils.py		Harden: fix bare-filename db path crash, configurable APN	2026-07-01 06:13:26 +00:00