librtmp2-server-panel 0.1.3

Fixed

• Failed stream deletions now surface API errors to operators instead of only
  reporting that deletion started; failures are also logged with the affected
  stream ID for incident response and troubleshooting.
• The Docker image now runs Gunicorn with a threaded worker model and a 60-second
  timeout so a draining stream deletion cannot monopolize the panel's only
  request worker.
• _detect_worker_count() also parses -w / --workers from the gunicorn
  process command line (sys.argv), not only GUNICORN_CMD_ARGS and env
  vars, so the multi-worker memory:// guard cannot be bypassed via
  gunicorn --workers N app:app or attached forms such as -w2 / -w=2.
• /streams/<id>/stats.json now applies both a per-IP cap (300/min) and a
  per-stream cap (25/min); unauthenticated redirects and invalid stream IDs
  are exempt from the per-stream bucket so login redirects and junk paths
  do not pollute the rate-limit store.
• Startup rejects RATELIMIT_STORAGE_URI=memory:// when multiple Gunicorn
  workers are configured (WEB_CONCURRENCY, GUNICORN_WORKERS, or
  GUNICORN_CMD_ARGS), preventing per-worker login rate-limit bypass.
• Docker Compose now passes ALLOW_INSECURE_NO_LOGIN through to the panel
  container.

Security

• Panel sessions are now tracked with server-side tokens, so copied signed
  session cookies are invalidated immediately on logout or a subsequent login
  and only the latest session for an account remains active.
• Redis session-backend failures now fail closed and are logged. A failed login
  persistence attempt returns a controlled HTTP 503 without destroying an
  existing valid session, and session revocation uses an atomic compare-and-delete
  operation to avoid concurrent login/logout races.
• REQUIRE_LOGIN=False requires ALLOW_INSECURE_NO_LOGIN=1 at startup,
  closing an accidental open-admin footgun.
• Panel session lifetime capped at 8 hours (PERMANENT_SESSION_LIFETIME).

Changed

• Stats rate-limit decorators run after authentication checks via
  exempt_when, so unauthenticated polling does not consume login or
  per-stream buckets.
• Intentional CSRF disabling in isolated tests is annotated for SonarCloud
  S4502 so the security rating reflects production code rather than test-only
  configuration.