project_context_connector 1.1.0

Project Context Connector 1.1.0

This release focuses on security hardening, improved documentation, and enhanced configurability. All sites using CORS wildcard patterns should review the breaking change below.

Security Improvements

• Added custom access checker for signed route with proper Drupal access control integration and audit trail
• Enhanced CORS validation with scheme enforcement - prevents unintended cross-scheme origin matches
• Improved HMAC timestamp validation with sanity checks, leading zero rejection, and range validation (2000-2100)
• Added rate limiting for OPTIONS requests to prevent CORS probing attacks

New Features

• New configuration option: expose_database_version allows hiding database version for minimal information disclosure
• HTTP origin security warnings in admin form
• Comprehensive README with AI agent integration examples (Claude/ChatGPT, Slack bots, Python automation, MCP servers)
• Quick Start guide (5 minutes to production)
• Detailed troubleshooting section with common issues and solutions

Documentation

• README expanded from 150 to 700+ lines with security best practices, use cases, and integration guides
• SECURITY.md enhanced with threat model, secret management procedures, rotation workflows, and compliance considerations
• Added authentication methods comparison table
• Complete CHANGELOG with semantic versioning

Breaking Changes

IMPORTANT: CORS wildcard patterns now match ONLY subdomains, not the base domain itself.

• Before: *.example.com matched both example.com and sub.example.com
• After: *.example.com matches ONLY sub.example.com (not the base domain)
• Action Required: If you need both, add both patterns explicitly:
  • https://example.com
  • https://*.example.com

Upgrade Notes

• Clear caches after upgrade: drush cr
• Review CORS configuration if using wildcard patterns
• New expose_database_version setting defaults to true (maintains current behavior)
• Consider rotating HMAC secrets after upgrade (see SECURITY.md for procedures)

Full Changelog

See CHANGELOG.md for complete details.