The Settings -> Security toggles (Allow Remote Full Access, Allow HTTP Token Transport, Require Token For All Writes) were persisted in the DB but ignored by _check_write_access() and the bootstrap-token endpoint, which only read MAJOOR_* env vars. Remote LAN clients hit 'Write access is blocked' even with all toggles enabled.
- New security_prefs_snapshot module: thread-safe in-memory snapshot of persisted prefs, hydrated at ensure_security_bootstrap() and republished on every set_security_prefs(). Read synchronously by guards.
- security.py::_resolve_security_flag(pref_key, env_var, default): single read site, snapshot-first / env-fallback. Used for allow_remote_write, require_auth, allow_insecure_token_transport.
- _bootstrap_enabled() also returns True when allow_remote_write is set in the snapshot (UI consent for remote bootstrap).
- bootstrap-token / rotate-token accept plain HTTP transport when allow_insecure_token_transport is on.
- Friendlier defaults so first install works zero-config on LAN: allow_remote_write=True, allow_insecure_token_transport=True. Auto-generated API token still gates writes.
- Error messages updated to point users to Settings -> Security instead of only env vars.
- README rewritten to put the UI flow first; env vars as headless fallback.
- pyproject.toml: per-file ignore F401 for routes/core/security.py since it is the single import point that re-exports from sub-modules.
- Removed unnecessary imports from various test files to improve readability and maintainability.
- Added new settings for the Generated Feed display in the settingsFeed.js file.
- Introduced a new configuration file for Pyright type checking.
- Introduced runtime bootstrap helpers in `mjr_am_backend.features.runtime` for dependency initialization.
- Implemented `apply_startup_settings` to handle various startup configurations.
- Added search request normalization helpers in `mjr_am_backend.features.search` including `SearchRequestContext` and `parse_search_request` for better query handling.
- Created audit logging helpers in `mjr_am_backend.routes.core.audit_log` for state-changing route handlers.
- Developed a quality gate script in `scripts/run_quality_gate.py` to enforce code quality checks.
- Added comprehensive tests for audit routes, scan consistency, vendor routes, and code quality metrics.
- Removed unnecessary 'content' column from asset_metadata_fts table.
- Updated triggers for insert, delete, and update operations to reflect schema changes.
- Enhanced FTS repair logic to check for missing columns and outdated trigger patterns.
- Adjusted asset metadata reindexing to include the new metadata_text field.
- Simplified FTS reindexing logic in recovery process.
- Improved file rename conflict detection by removing unnecessary case sensitivity checks.
- Updated project metadata in pyproject.toml for clarity.
- Move token from local to session storage on client side
- Set httpOnly cookie for server-side token on bootstrap/rotate
- Add token validation and auto-sanitization
- Implement retry logic for failed operations
- Add input validation for collection names
- Update toast durations and error handling
- Introduced unit tests for SQLite facade helpers, including schema validation, query building, and async operations.
- Added integration tests for basic SQLite queries and transaction handling.
- Implemented additional tests for metadata extraction functions, focusing on dimension handling, EXIF data, and video metadata.
- Created tests for security core helpers, covering environment variable checks, IP validation, and CSRF protection.
- Included compatibility tests for route exports to ensure proper functionality.
refactor: Improve connection handling in Sqlite class with reset checks
feat: Enhance CSRF protection to accept forwarded host from trusted proxies
test: Add tests for CSRF handling with trusted proxies and incremental scan behavior
- Introduced fallback readers for metadata extraction when ExifTool/ffprobe are unavailable, utilizing Pillow and hachoir for images and media files respectively.
- Added settings for metadata fallback preferences, allowing users to toggle image and media fallback options.
- Implemented route collision logging to prevent overlapping API paths.
- Added middleware for authentication on sensitive routes, ensuring secure access.
- Updated API documentation to reflect new endpoints and settings.
- Enhanced unit tests for metadata handling, case sensitivity in file paths, and fallback mechanisms.
- Removed compatibility shims for shared modules, consolidating imports under mjr_am_shared.
Ewald