Paul Nothaft c8eb334637 test(uploads): harden frontend map parser, drop dead getSafeFilename edit (codex review of #834) ...

- getFrontendExtensionMap now tolerates quoted keys and trailing comments
  and throws on any other unparsable map line, so future syntax drift fails
  loudly instead of silently dropping entries from the comparison.
- Revert the .dng/.heic/.heif addition to getSafeFilename: the helper has
  no callers, so the edit was dead code. Live validation paths already
  cover these formats.

2026-07-18 23:46:40 +02:00

..

__tests__

test(uploads): harden frontend map parser, drop dead getSafeFilename edit (codex review of #834)

2026-07-18 23:46:40 +02:00

assets/fonts

feat(crm): backend code — services + routes + utilities + tests

2026-05-26 18:18:51 +02:00

docs

…

migrations

fix(oidc): security + robustness hardening from codex review rounds 1-2

2026-07-16 09:41:48 +02:00

scripts

feat(auth): admin TOTP MFA — enrollment, login challenge, recovery, CLI reset

2026-07-03 11:33:38 +02:00

src

test(uploads): harden frontend map parser, drop dead getSafeFilename edit (codex review of #834)

2026-07-18 23:46:40 +02:00

.dockerignore

…

.env.example

feat(auth): admin TOTP MFA — enrollment, login challenge, recovery, CLI reset

2026-07-03 11:33:38 +02:00

.eslintrc.js

…

audit-backend.json

…

dependencies-backend.json

…

Dockerfile

feat(uploads): DNG / camera-RAW support via embedded-preview extraction (#821)

2026-07-17 21:51:21 +02:00

Dockerfile.dev

fix(uploads): RAW derivative key collision, watermark skip, dev exiftool (codex review of #833 round 2)

2026-07-17 22:50:24 +02:00

ecosystem.config.js

…

jest.config.js

…

jest.setup.js

…

knexfile.js

…

package-lock.json

feat(auth): OIDC SSO for admin users — phase 1 (#798)

2026-07-16 08:54:26 +02:00

package.json

chore(main): release 3.91.0-beta.0 (#835)

2026-07-18 18:52:51 +00:00

server.js

fix(security): remove unguarded legacy /api/events router (GHSA-4j34-x562-5vfq)

2026-07-17 09:16:51 +02:00

test-filter.js

…

wait-for-db.sh

feat: zero-config first run — in-browser admin bootstrap + auto-generated secrets

2026-07-01 14:49:18 +02:00