- Add Token model with CRUD endpoints (/api/tokens, /auth/tokens)
- Support Basic auth with token:<secret> for built-in users
- Implement full NTLMv2 handshake for Windows WebDAV clients
- Add SSO token auth via check_permissions() proxy
- Hydrate request auth context from session or Authorization header
- Persist session cookie after successful Authorization-based login
- Add secure flag to session cookies based on request scheme
- Add frontend UserTokensModal for creating/revoking tokens
- Fix devserver to run workspace source via python -m cista
- Add tests for token CRUD and file auth (Basic, NTLM, session)
- Remove proactive WWW-Authenticate advertisement
- Add cista/fileserver.py: REST blueprint at /files with PUT upload,
DELETE, MKCOL, POST cp/mv (combined), GET/HEAD static serving
- Remove WS control handler and all ControlBase/Cmd protocol types
- Frontend: SelectionToolbar, FileExplorer, Gallery now POST to /files
instead of opening a control WebSocket per operation
- Remove controlUrl export from WS.ts
- Add tests: REST API, static streaming, path/escaping security
- Catch ValueError from filename.sanitize and return 400 Bad Request
Leo Vasanko