4 Commits

Author	SHA1	Message	Date
fuomag9	3a16d6e9b1	Replace next-auth with Better Auth, migrate DB columns to camelCase ... - Replace next-auth v5 beta with better-auth v1.6.2 (stable releases) - Add multi-provider OAuth support with admin UI configuration - New oauthProviders table with encrypted secrets (AES-256-GCM) - Env var bootstrap (OAUTH_*) syncs to DB, UI-created providers fully editable - OAuth provider REST API: GET/POST/PUT/DELETE /api/v1/oauth-providers - Settings page "Authentication Providers" section for admin management - Account linking uses new accounts table (multi-provider per user) - Username plugin for credentials sign-in (replaces email@localhost pattern) - bcrypt password compatibility (existing hashes work) - Database-backed sessions via Kysely adapter (bun:sqlite direct) - Configurable rate limiting via AUTH_RATE_LIMIT_* env vars - All DB columns migrated from snake_case to camelCase - All TypeScript types/models migrated to camelCase properties - Removed casing: "snake_case" from Drizzle config - Callback URL format: {baseUrl}/api/auth/oauth2/callback/{providerId} - package-lock.json removed and gitignored (using bun.lock) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-12 21:11:48 +02:00
fuomag9	bdd3019214	security: add same-origin CSRF check to state-changing user API routes ... Adds checkSameOrigin() helper in auth.ts that validates the Origin header against the Host header. If Origin is present and mismatched, returns 403. Applied to all 5 custom POST routes flagged in CPM-003 (NEXT-CSRF-001): - change-password, link-oauth-start, unlink-oauth, update-avatar, logout SameSite=Lax (NextAuth default) already blocks standard cross-site CSRF; this adds defense-in-depth against subdomain and misconfiguration scenarios. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-05 01:04:18 +01:00
fuomag9	90916bd709	various security fixes ... Sync secrets encrypted at rest Sync endpoint hardening Avatar upload SVG restriction	2026-01-25 11:27:14 +01:00
fuomag9	be21f46ad5	Added user tab and oauth2, streamlined readme	2025-12-28 15:14:56 +01:00