Skip to content

phsl / new-api

Go to a project
Switch branch/tag
  1. 06 Jul, 2026 6 commits
  3. 05 Jul, 2026 5 commits
    • fix(web): refine mobile user cards · 2281c9e3
      CaIon committed
    • test(user): cover self-service password update guard · 4a64b870 
      Pin down the checkUpdatePassword contract:

- changing a password requires the correct current password
- OAuth/passwordless accounts (empty password hash) cannot set a
  password through the self-service endpoint and must use the password
  reset flow instead
- setupLogin never writes back the password column

These guard against regressing the password-change path back into a
short-circuit that lets passwordless accounts set a password directly.
      CaIon committed
    • feat(session): support opt-in Secure session cookies · 56dbaab1 
      - add SESSION_COOKIE_SECURE / SESSION_COOKIE_TRUSTED_URL env vars with
  startup validation: enabling Secure requires at least one trusted
  HTTPS entry URL
- wire common.SessionCookieSecure into the session cookie store instead
  of a hardcoded Secure=false
- print a startup warning when Secure session cookies are disabled
- document the new settings in .env.example and docker-compose files

Secure stays off by default because many deployments front new-api with
plain-HTTP reverse proxies, where a hardcoded Secure default would break
logins entirely; enabling it safely depends on the deployment's TLS
setup, so it ships as an opt-in deployment-hardening flag.
      CaIon committed
    • fix(auth): allow read-only access for non-disabled tokens · 0d5995eb
      CaIon committed
    • fix(user): harden account email and password handling · 5fc35e28 
      - normalize emails (trim + lowercase) and enforce uniqueness across
  registration, OAuth auto-registration, and email binding
- serialize concurrent writers on the same normalized email within a
  transaction to avoid duplicate accounts
- resolve password reset to a single matching account and reject
  ambiguous or absent matches
- require an existing password before self-service password change and
  reject login for accounts without a usable password
      CaIon committed
  5. 04 Jul, 2026 9 commits
  7. 03 Jul, 2026 16 commits
  9. 02 Jul, 2026 4 commits