feat(security): use richdocuments.federation_allowlist system config for federation server validation#599

Merged

DeepDiver1975 merged 15 commits into

feat/federation-allowlist-config

May 18, 2026

Commits on May 12, 2026

fix(security): validate federation server against trusted-servers list
DeepDiver1975
committed
fix(security): wire TrustedServers injection for FederationService DI
DeepDiver1975
committed

Commits on May 15, 2026

docs: add design spec for federation allowlist via system config
DeepDiver1975
committed
docs: add implementation plan for federation allowlist via system config
DeepDiver1975
committed
docs: add pre-PR code style gate task to federation allowlist plan
DeepDiver1975
committed
feat(security): replace TrustedServers with richdocuments.federation_allowlist system config

DeepDiver1975
and
claude
committed
fix: simplify FederationService DI — inject IConfig directly
DeepDiver1975
committed
chore: ignore docs/superpowers planning artifacts

DeepDiver1975
and
claude
committed
feat(security): use domain-only entries in federation_allowlist config

DeepDiver1975
and
claude
committed
fix: add (string) cast on preg_replace, drop redundant test, note path-prefix limitation

DeepDiver1975
and
claude
committed
refactor: remove explicit FederationService DI registration

DeepDiver1975
and
claude
committed