7 Commits

Include renames

Author	SHA1	Message	Date
Lucas BergerandClaude Opus 4.8	b6490feff4	fix(19): satisfy CI fast-checks + secret scan ... Lint (eslint --max-warnings 0): - index.ts: disable no-unsafe-argument on the type-only Context mismatch when delegating to the OIDC handler inside the local-session skip wrapper - localAuth.ts: handleLogout is sync (no await) — drop async (require-await) - devBypass.ts: disable detect-possible-timing-attacks on the public well-known dev-placeholder string compare (not a secret comparison) - remove dead code / unused bindings flagged by no-unused-vars: makeTestApp (localSession.test), makeUnauthContext + BrowserContext import (login.spec), unused memberId (admin.test), unused txSelectCount counter (me.test) - localAuthMiddleware.test / me.test: fix unused + reflow-detached eslint-disable directives Format: prettier --write across the 20 Phase-19 files that were never formatted. Secret scan (gitleaks): allowlist two false positives — the synthetic >=32-char TEST_SECRET in localSession.test.ts, and .planning/ design prose (a generic-api-key regex hit on "credential atomically, 409-equivalent"). Neither is a real secret. Verified locally: format:check, lint, typecheck, md:lint, gitleaks (no leaks), PWA 266/266, API 452/452. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-17 23:05:15 -04:00
Lucas Berger	f02521dd02	fix(19): IN-03 evict stale loginAttempts entries to bound in-memory map growth	2026-06-17 20:35:43 -04:00
Lucas Berger	4cf2ad4bff	fix(19): WR-06 stop sliding the rate-limit cooldown window on rejected attempts	2026-06-17 20:31:07 -04:00
Lucas Berger	30ad25c026	fix(19): WR-03 make scrypt hashing async (threadpool) to avoid event-loop starvation DoS	2026-06-17 20:30:28 -04:00
Lucas Berger	b083cb7193	fix(19): CR-04 scope login lockout to username, add TTL auto-expiry + admin-reset unlock	2026-06-17 20:20:43 -04:00
Lucas Berger	c437f408bb	feat(19-03): implement POST /api/auth/local/login (rate-limit + lockout) + logout ... - Rate-limit: per-IP in-memory Map; 5 failures → 429, 10 → 423 (lockedOut) - Counter increments even on 429 so brute-force accumulates toward lockout - Timing-safe: DUMMY_HASH ensures verifyPassword runs for unknown usernames (T-19-12) - noEchoHook: Zod errors never echo submitted values (T-19-14) - Same 401 body for wrong-password and unknown-username (no enumeration) - POST+GET /local/logout clear the local-session cookie	2026-06-17 16:49:59 -04:00
Lucas Berger	be7a0aec90	feat(19-03): implement localAuthMiddleware, GET /api/auth/mode, and pre-auth route mounts ... - localAuthMiddleware: cookie→c.set('user') with Pitfall-1 guard (no-set on no-cookie path) - authMode: GET /api/auth/mode pre-auth endpoint (localEnabled:true, oidcEnabled from env+config) - localAuth: POST /api/auth/local/login (rate-limit + timing-safe), logout routes - index.ts: mount authModeRouter + localAuthRouter pre-auth; localAuthMiddleware after devAuthBypass; OIDC guard wrapped skip-when-user-set	2026-06-17 16:48:17 -04:00