cjkas 97d8a90da8 fix: review findings on the token key ... - Load the token key in Web::startup(), before either web server starts, so no token can be made with the all-zero key; log a failed pref.begin(). - createAPIToken checks mbedtls' return codes. On a failure it leaves the token empty, which tokenMatches never accepts, instead of hex from uninitialised stack. - API_TOKEN_SIZE in ApiToken.h replaces the five char[65] buffers; the HMAC's description moves to createAPIToken, with the None form. - handleLogin builds the candidate token once and compares it once. - e2e: the serverId test skips on `secured` like its neighbours, names its values, and says it assumes the device sees this PC's address. - KNOWN_ISSUES keeps #81, which #108 removes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>		2026-10-27 20:39:08 +01:00
..
ApiRoutes.cpp	feat: remove the GitHub update	2026-10-22 21:28:23 +02:00
MqttCommands.cpp	refactor: split the transports into the modules GLOSSARY.md names	2026-10-16 13:47:56 +02:00
MqttCommands.h	refactor: split the transports into the modules GLOSSARY.md names	2026-10-16 13:47:56 +02:00
Web.cpp	fix: review findings on the token key	2026-10-27 20:39:08 +01:00
Web.h	fix: review findings on the token key	2026-10-27 20:39:08 +01:00
WebRoutes.h	feat: remove the GitHub update	2026-10-22 21:28:23 +02:00
WebUiRoutes.cpp	fix: review findings on the token key	2026-10-27 20:39:08 +01:00