davideandClaude Sonnet 5 31bc9a327f Compare admin token as UTF-8 bytes to avoid TypeError on non-ASCII input (B-46) ...

secrets.compare_digest raises TypeError instead of returning False when a
str argument contains non-ASCII characters, turning a bad admin token into
an unhandled 500 instead of the expected 403. Encode both sides before
comparing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-07-27 16:17:40 +02:00

..

__init__.py

Scaffold project layout, DB schema and settings

2026-07-21 10:25:23 +02:00

test_admin.py

Compare admin token as UTF-8 bytes to avoid TypeError on non-ASCII input (B-46)

2026-07-27 16:17:40 +02:00

test_api_timeutil.py

Stamp UTC on naive API timestamps before serializing (B-35)

2026-07-27 12:20:22 +02:00

test_auth.py

Throttle login and registration with exponential backoff (B-33)

2026-07-27 11:51:26 +02:00

test_balance.py

Show pending-inclusive balance and per-player round outcome reliably

2026-07-23 10:09:12 +02:00

test_bets.py

Let the system recover from a broadcast that never confirms

2026-07-27 00:31:24 +02:00

test_broadcast.py

Restructure bump_fee into three phases, drop float fee math (B-40)

2026-07-27 15:14:58 +02:00

test_caddyfile_security_headers.py

Add baseline HTTP security headers in Caddy (B-43)

2026-07-27 15:44:47 +02:00

test_client_ip.py

Cap SSE subscribers per client IP instead of only globally (B-38)

2026-07-27 14:44:15 +02:00

test_config.py

Refuse to start half-configured, and keep failures machine-readable

2026-07-27 00:34:33 +02:00

test_confirmation.py

Check confirmation/existence via scripthash history, not verbose replies (B-41)

2026-07-27 15:27:58 +02:00

test_db_base.py

Run SQLite in WAL mode with a busy_timeout (B-39)

2026-07-27 14:53:22 +02:00

test_deposit_reconcile.py

Add a periodic deposit reconciler, and stop losing subscribe tasks (B-30)

2026-07-27 10:35:23 +02:00

test_deposits.py

Corroborate an external spend before marking a UTXO gone (B-29)

2026-07-27 10:25:07 +02:00

test_docs_disabled.py

Disable Swagger/ReDoc/OpenAPI JSON by default (B-42)

2026-07-27 15:34:49 +02:00

test_docs_no_bare_uvicorn.py

Align README and running-the-server.md with the Docker-only policy (B-44)

2026-07-27 16:04:24 +02:00

test_draw.py

Validate Electrum headers and corroborate the draw's block (B-28)

2026-07-27 10:07:21 +02:00

test_electrum_client.py

Survive a dropped Electrum connection, and fall back to other servers

2026-07-27 00:34:59 +02:00

test_electrum_listener.py

Resubscribe concurrently and in the background on reconnect (B-31)

2026-07-27 10:44:23 +02:00

test_hd.py

Add wallet key derivation and PSBT building

2026-07-21 10:25:29 +02:00

test_payout_builder.py

Add wallet key derivation and PSBT building

2026-07-21 10:25:29 +02:00

test_pending_address.py

Check confirmation/existence via scripthash history, not verbose replies (B-41)

2026-07-27 15:27:58 +02:00

test_psbt_builder.py

Leave dust-sized change to the fee instead of creating it

2026-07-27 00:31:41 +02:00

test_reconcile.py

Check confirmation/existence via scripthash history, not verbose replies (B-41)

2026-07-27 15:27:58 +02:00

test_round_events.py

Cap SSE subscribers per client IP instead of only globally (B-38)

2026-07-27 14:44:15 +02:00

test_rounds_route.py

Make a stalled draw wait observable (B-36)

2026-07-27 14:12:27 +02:00

test_rounds_service.py

Fix the round-open race, the advertised jackpot, and payout error handling

2026-07-27 00:32:22 +02:00

test_scheduler.py

Make a stalled draw wait observable (B-36)

2026-07-27 14:12:27 +02:00

test_scripthash.py

Add Electrum SPV client and address listener

2026-07-21 10:25:38 +02:00

test_security.py

Invalidate existing sessions on password change/reset (B-34)

2026-07-27 12:02:23 +02:00

test_users.py

Stamp UTC on naive API timestamps before serializing (B-35)

2026-07-27 12:20:22 +02:00

test_withdrawals.py

Distinguish a pending-only balance from a truly insufficient one (B-37)

2026-07-27 14:23:00 +02:00