171ef3e1c5
ConfigController::get and HeartbeatController::post verified HMAC but never checked nonce replay or timestamp freshness, so a captured signed request (e.g. a replayed heartbeat) could be replayed forever, masking a dead device. Inject NonceRepository (+Config) into both and add the same timestamp-window + nonce-remember checks IngestController already applies, after HMAC verification and before the response/side effect. |
||
|---|---|---|
| .. | ||
| docs | ||
| public | ||
| src | ||
| tests | ||
| .gitignore | ||
| composer.json | ||
| composer.lock | ||
| config.example.php | ||
| phpunit.xml | ||
| schema.sql | ||