2 Commits

Include renames

Author	SHA1	Message	Date
DorianandClaude Opus 4.6	9de47fd760	test: add timing attack tests for bot-auth and use timingSafeEqual ... Replace manual XOR loop with Node's native crypto.timingSafeEqual for constant-time secret comparison. Add tests verifying identical error messages for wrong secrets and <1ms response time variance across 100 requests. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-13 09:26:39 +00:00
DorianandClaude Opus 4.6	95ed80335a	feat: polling API, HMAC webhook signing, session-only keys, prod audio fix ... - Add polling API (GET/POST /api/fights/poll) so bots don't need public URLs - Add HMAC-SHA256 webhook signing (X-Botfights-Signature header) - Stop auto-persisting nsec keys — session-only by default with opt-in "Remember on this device" - Fix production TTS: add wav/mp3/ogg MIME types, /audio/* route, SPA blocklist - Overhaul docs: mode selector (poll vs webhook), AI-first bot examples, security tab - Fix duplicate sign-in buttons, login flow bugs Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-09 18:34:22 +00:00