Marcel 103d454e14 fix(rate-limit): only trust X-Forwarded-For from known reverse proxies ...

Without this guard any client could send X-Forwarded-For: <spoofed-ip>
and bypass per-IP rate limiting entirely.

Also switches expireAfterWrite → expireAfterAccess so the 1-minute
window starts at first request, not last, and fixes the .gitignore
entry that accidentally merged **/test-results/ and .worktrees/ into
one broken pattern.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-19 01:20:11 +02:00

..

.mvn/wrapper

build: add mvn properties

2026-03-17 13:33:02 +00:00

api_tests

restructure: flatten workspace nesting, move devcontainer to root

2026-03-15 11:47:58 +01:00

src

fix(rate-limit): only trust X-Forwarded-For from known reverse proxies

2026-04-19 01:20:11 +02:00

.dockerignore

devops(backend): add .dockerignore to exclude target/ from build context

2026-04-15 11:33:03 +02:00

.gitignore

restructure: flatten workspace nesting, move devcontainer to root

2026-03-15 11:47:58 +01:00

Dockerfile

devops(backend): pin eclipse-temurin tags, skip test compilation, document jar glob

2026-04-15 11:33:03 +02:00

HELP.md

restructure: flatten workspace nesting, move devcontainer to root

2026-03-15 11:47:58 +01:00

mvnw

restructure: flatten workspace nesting, move devcontainer to root

2026-03-15 11:47:58 +01:00

mvnw.cmd

build: add mvn properties

2026-03-17 13:33:02 +00:00

pom.xml

feat(invites): implement invite-based self-service registration backend

2026-04-19 00:42:43 +02:00