giles b91a58f30a Exempt internal action/data requests from CSRF protection ...

Internal service-to-service POSTs (call_action) were blocked by CSRF
middleware since they have no session cookie. These requests are already
gated by X-Internal-Action/X-Internal-Data headers and only reachable
on the Docker overlay network.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-25 03:19:10 +00:00

..

app

Exempt internal action/data requests from CSRF protection

2026-02-25 03:19:10 +00:00

templates

Add Phase 5: link-card fragments, oEmbed endpoints, OG meta

2026-02-24 21:44:11 +00:00

__init__.py

Monorepo: consolidate 7 repos into one

2026-02-24 19:44:17 +00:00