4 Commits

Author	SHA1	Message	Date
Claude	d4c734737b	feat: role-based access via Zitadel project roles ... Replace the ALLOWED_USER_IDS sub-allowlist with a Zitadel project role check: tokens must carry the role from REQUIRED_ROLE (default "user") in the urn:zitadel:iam:org:project[:id]:roles claim. Roles are granted per account in Zitadel (project ClaudeDo), where access is now managed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-10 11:25:34 +00:00
Claude	94ee00b0ff	debug: gated auth diagnostics (AUTH_DEBUG) logging jwt claims on 401	2026-06-10 08:38:00 +00:00
Claude	285bac4308	feat: list + task endpoints and CORS, verified end-to-end	2026-06-10 07:58:51 +00:00
Claude	394bceca5f	feat: zitadel token auth middleware	2026-06-10 07:53:42 +00:00