Files
Phil Skentelbery d3c3e8dc6b feat(security): merge Phase 4b security hardening
Complete security hardening implementation including HTTPS enforcement,
security headers, rate limiting, and comprehensive security test suite.

Key features:
- HTTPS enforcement with HSTS support
- Security headers (CSP, X-Frame-Options, X-Content-Type-Options)
- Rate limiting for all critical endpoints
- Enhanced email template security
- 87% test coverage with security-specific tests

Architect approval: 9.5/10

Generated with Claude Code
Co-Authored-By: Claude <noreply@anthropic.com>
2025-11-20 18:28:50 -07:00
..

Project Standards

This directory contains all project-wide standards and conventions for the IndieAuth server implementation.

Standard Documents

Core Standards

Key Decisions

Technology Stack (Approved)

  • Language: Python 3.10+
  • Framework: FastAPI
  • Database: SQLite
  • Environment Management: uv (with direct execution model)
  • Testing: pytest with 80% minimum coverage
  • Code Quality: Black, Ruff, mypy

Development Workflow

  • Git: Trunk-based development on main branch
  • Environments: Direct execution via uv run (no activation)
  • Testing: TDD preferred, behavior-focused tests
  • Documentation: Comprehensive before implementation

Quick Reference

Daily Commands

# Run application
uv run uvicorn src.main:app --reload

# Run tests
uv run pytest

# Add dependency
uv pip install package
uv pip freeze > requirements.txt

# Code quality
uv run ruff check .
uv run mypy src

Standards Compliance

All code must:

  • Pass linting (Ruff)
  • Pass type checking (mypy)
  • Have 80%+ test coverage (90% for new code)
  • Follow PEP 8 and project conventions
  • Be documented with clear docstrings

Status

Standards Finalized: 2025-11-20

All foundational standards have been defined and documented. These standards form the basis for all implementation work on the IndieAuth server project.