feat: polling API, HMAC webhook signing, session-only keys, prod audio fix

Browse Source

- Add polling API (GET/POST /api/fights/poll) so bots don't need public URLs
- Add HMAC-SHA256 webhook signing (X-Botfights-Signature header)
- Stop auto-persisting nsec keys — session-only by default with opt-in "Remember on this device"
- Fix production TTS: add wav/mp3/ogg MIME types, /audio/* route, SPA blocklist
- Overhaul docs: mode selector (poll vs webhook), AI-first bot examples, security tab
- Fix duplicate sign-in buttons, login flow bugs

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

...

This commit is contained in:

Dorian

2026-03-09 18:34:22 +00:00

co-authored by Claude Opus 4.6

parent 150ce7447d

commit 95ed80335a

12 changed files with 1143 additions and 433 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

frontend/src/pages/DocsPage.vue

+689 -359

File diff suppressed because it is too large Load Diff