4 Commits

Author	SHA1	Message	Date
fuomag9	77e354cd7c	feat: rewrite auth pages with shadcn ... Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-22 13:29:55 +01:00
fuomag9	73c90894b1	Handle wildcard proxy hosts and stabilize test coverage ... - accept wildcard proxy host domains like *.example.com with validation and normalization - make exact hosts win over overlapping wildcards in generated routes and TLS policies - add unit coverage for host-pattern priority and wildcard domain handling - add a single test:all entry point and clean up lint/typecheck issues so the suite runs cleanly - run mobile layout Playwright checks under both chromium and mobile-iphone	2026-03-14 01:03:34 +01:00
fuomag9	75044c8d9b	fix: harden security post-review (JWT exposure, rate limiter, token expiry, timing) ... - Raw JWT never sent to browser: page.tsx uses peekLinkingToken (read-only), client sends opaque linkingId, API calls retrieveLinkingToken server-side - link-account rate limiter now uses isRateLimited/registerFailedAttempt/ resetAttempts correctly (count only failures, reset on success) - linking_tokens gains expiresAt column (indexed) + opportunistic expiry purge on insert to prevent unbounded table growth - secureTokenCompare fixed: pad+slice to expected length so timing is constant regardless of submitted token length (no length leak) - autoLinkOAuth uses config.oauth.allowAutoLinking (boolean) instead of process.env truthy check that mishandles OAUTH_ALLOW_AUTO_LINKING=false - Add Permissions-Policy header; restore X-Frame-Options for legacy UAs Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-02-25 20:58:21 +01:00
fuomag9	be21f46ad5	Added user tab and oauth2, streamlined readme	2025-12-28 15:14:56 +01:00