Paul Nothaft 85a60a2dc7 fix(security): invalidate tokens on password change, enforce session timeout, fix role update ...

- Set password_changed_at when changing password via adminAuth route so
  existing JWT tokens are rejected by the auth middleware check
- Enforce session timeout on first request with unseen tokens by checking
  token iat against configured timeout (prevents bypass after server restart)
- Convert camelCase roleId/isActive to snake_case role_id/is_active in
  frontend updateUser service (fixes silent role update failures)

Resolves GHSA-rqg3-47p5-vgwg

2026-03-16 22:36:52 +01:00

..

__tests__

Fix admin reference mode regressions

2025-10-02 23:39:17 +02:00

docs

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

migrations

Merge main into beta for release/beta-to-main

2026-03-11 20:12:52 +01:00

scripts

fix: resolve issues #194, #195, #196, #197

2026-02-22 22:34:44 +01:00

src

fix(security): invalidate tokens on password change, enforce session timeout, fix role update

2026-03-16 22:36:52 +01:00

.dockerignore

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

.env.example

docs: emphasize importance of STORAGE_PATH in env example

2026-01-17 15:48:24 +01:00

.eslintrc.js

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

audit-backend.json

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

dependencies-backend.json

Upgrade nodemailer to 7.0.7 (GHSA-mm7p-fcc7-pg87)

2025-10-13 21:11:38 +02:00

Dockerfile

fix(security): resolve Docker image CVEs for code scanning alerts

2026-03-02 23:06:15 +01:00

Dockerfile.dev

Fix security vulnerabilities detected by Trivy

2025-11-25 20:35:59 +00:00

ecosystem.config.js

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

init-production.sh

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

jest.config.js

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

jest.setup.js

feat: overhaul public landing page and backup tooling

2025-09-19 16:39:18 +02:00

knexfile.js

Fix PicPeak regressions and close #22 #24 #25 #26 #27 #28

2025-09-21 22:03:07 +02:00

package-lock.json

fix(security): resolve Docker image CVEs for code scanning alerts

2026-03-02 23:06:15 +01:00

package.json

chore(main): release 2.6.1

2026-03-11 19:48:05 +00:00

server.js

fix: video upload media type, select all, and dimension repair (#203, #220, #180)

2026-03-11 11:50:43 +01:00

test-filter.js

docs: fix deployment/admin routing and CORS guidance; add AGENTS.md; ignore AGENTS.md (refs #18)

2025-09-05 15:01:16 +02:00

wait-for-db.sh

fix(db): improve PostgreSQL connection check in wait-for-db.sh

2026-01-07 22:33:40 +01:00