Paul Nothaft b1d16670d5 fix: set JWT iat after password_changed_at to prevent token rejection (#263) ...

The new token issued after password change had iat (integer seconds)
that was <= password_changed_at (millisecond precision), causing the
auth middleware's "iat < passwordChangedTime" check to reject it
immediately. Set iat explicitly to 1 second after password_changed_at.

E2E tested: login → mandatory password change → dashboard loads
successfully with no redirect loop and no 401 errors.

2026-04-09 16:00:03 +02:00

..

__tests__

Fix admin reference mode regressions

2025-10-02 23:39:17 +02:00

docs

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

migrations

feat: sort photos by capture date with configurable default sort (#283)

2026-04-09 15:10:51 +02:00

scripts

fix: resolve issues #194, #195, #196, #197

2026-02-22 22:34:44 +01:00

src

fix: set JWT iat after password_changed_at to prevent token rejection (#263)

2026-04-09 16:00:03 +02:00

.dockerignore

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

.env.example

docs: emphasize importance of STORAGE_PATH in env example

2026-01-17 15:48:24 +01:00

.eslintrc.js

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

audit-backend.json

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

dependencies-backend.json

Upgrade nodemailer to 7.0.7 (GHSA-mm7p-fcc7-pg87)

2025-10-13 21:11:38 +02:00

Dockerfile

fix: pin npm upgrade to v10 in backend Dockerfile

2026-04-04 22:13:11 +02:00

Dockerfile.dev

Fix security vulnerabilities detected by Trivy

2025-11-25 20:35:59 +00:00

ecosystem.config.js

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

init-production.sh

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

jest.config.js

Initial commit - Project start (July 17, 2025)

2025-07-24 16:57:07 +02:00

jest.setup.js

feat: overhaul public landing page and backup tooling

2025-09-19 16:39:18 +02:00

knexfile.js

Fix PicPeak regressions and close #22 #24 #25 #26 #27 #28

2025-09-21 22:03:07 +02:00

package-lock.json

security: fix 20 dependency vulnerabilities (11 error, 7 warning, 2 note)

2026-04-08 09:04:06 +02:00

package.json

chore(beta): release 3.26.0-beta.0

2026-04-09 13:11:41 +00:00

server.js

fix: address Shannon security assessment findings (37 vulnerabilities) (#254)

2026-03-22 12:40:01 +01:00

test-filter.js

docs: fix deployment/admin routing and CORS guidance; add AGENTS.md; ignore AGENTS.md (refs #18)

2025-09-05 15:01:16 +02:00

wait-for-db.sh

fix(db): improve PostgreSQL connection check in wait-for-db.sh

2026-01-07 22:33:40 +01:00