Fringg 1dfa78013c fix: migrate VK OAuth to VK ID OAuth 2.1 with PKCE ...

VK deprecated oauth.vk.com on Sep 30, 2025. Migrate to VK ID (id.vk.ru)
with mandatory PKCE S256 and device_id support.

- Rewrite VKProvider: new endpoints, PKCE code_verifier/challenge, user_info format
- Add prepare_auth_state() hook for provider-specific state (PKCE)
- Use atomic Redis GETDEL for OAuth state validation (prevent TOCTOU race)
- Add CacheService.getdel() method
- Check cache.set() result in generate_oauth_state
- Filter ephemeral keys (_prefix) from Redis storage
- Fix garbled log messages, use exc_info for tracebacks
- Add input validation (min_length, max_length on code/state)
- Generic error messages (no provider name leakage)

2026-03-02 04:10:01 +03:00

..

__init__.py

chore: add uv package manager and ruff linter configuration

2026-01-24 17:45:27 +03:00

button_styles_cache.py

refactor: complete structlog migration with contextvars, kwargs, and logging hardening

2026-02-16 09:18:12 +03:00

cache.py

fix: migrate VK OAuth to VK ID OAuth 2.1 with PKCE

2026-03-02 04:10:01 +03:00

check_reg_process.py

chore: add uv package manager and ruff linter configuration

2026-01-24 17:45:27 +03:00

currency_converter.py

fix: complete datetime.utcnow() → datetime.now(UTC) migration

2026-02-17 04:45:40 +03:00

decorators.py

refactor: complete structlog migration with contextvars, kwargs, and logging hardening

2026-02-16 09:18:12 +03:00

formatters.py

fix: complete datetime.utcnow() → datetime.now(UTC) migration

2026-02-17 04:45:40 +03:00

log_handlers.py

refactor: complete structlog migration with contextvars, kwargs, and logging hardening

2026-02-16 09:18:12 +03:00

markdown_to_telegram.py

fix: close unclosed HTML tags when truncating version notification

2026-02-07 08:18:39 +03:00

message_patch.py

fix: suppress web page preview when logo mode is disabled

2026-02-23 15:55:53 +03:00

miniapp_buttons.py

fix: correct broadcast button deep-links for cabinet mode

2026-02-24 06:33:56 +03:00

pagination.py

chore: add uv package manager and ruff linter configuration

2026-01-24 17:45:27 +03:00

payment_logger.py

refactor: complete structlog migration with contextvars, kwargs, and logging hardening

2026-02-16 09:18:12 +03:00

payment_utils.py

fix: add missing payment providers to payment_utils and fix {total_amount} formatting

2026-02-18 09:50:36 +03:00

photo_message.py

refactor: complete structlog migration with contextvars, kwargs, and logging hardening

2026-02-16 09:18:12 +03:00

price_display.py

fix: stack promo group + promo offer discounts in bot (matching cabinet)

2026-02-25 05:49:09 +03:00

pricing_utils.py

fix: complete datetime.utcnow() → datetime.now(UTC) migration

2026-02-17 04:45:40 +03:00

promo_offer.py

fix: complete datetime.utcnow() → datetime.now(UTC) migration

2026-02-17 04:45:40 +03:00

promo_rate_limiter.py

refactor: complete structlog migration with contextvars, kwargs, and logging hardening

2026-02-16 09:18:12 +03:00

security.py

refactor: replace universal_migration.py with Alembic

2026-02-18 08:10:20 +03:00

startup_timeline.py

refactor: improve log formatting — logger name prefix and table alignment

2026-02-16 18:33:40 +03:00

subscription_utils.py

fix: resolve sync 404 errors, user deletion FK constraint, and device limit not sent to RemnaWave

2026-02-25 11:53:49 +03:00

telegram_webapp.py

revert: remove signature pop from HMAC validation

2026-02-06 22:27:57 +03:00

timezone.py

fix: complete datetime.utcnow() → datetime.now(UTC) migration

2026-02-17 04:45:40 +03:00

user_utils.py

fix: eliminate referral system inconsistencies

2026-03-02 02:25:32 +03:00

validators.py

fix: flood control handling in pinned messages and XSS hardening in HTML sanitizer

2026-02-12 19:13:40 +03:00