website

RunicGateway/website

Fork 0

Commit Graph

Author	SHA1	Message	Date
Claude	a82f839c61	Update README for today's security hardening and 2FA work Several changes merged today were not reflected in the README. Bring it back in sync with main: - Security section: rewrite into Session/authorization, Login hardening, Uploads/input, and Platform groups — documents DB re-validation of the JWT per request (#12), role-based authorization (#10), optional TOTP 2FA (#9), login throttling + per-IP backoff, honeypot, bot-scoring/IP ban, and mimetype-derived upload extensions (#11) + username uniqueness checks on update (#13). - Environment variables: add TRUST_PROXY, DEBUG_TRUST_PROXY, TOTP_ISSUER, TOTP_CHALLENGE_TTL, and UPLOAD_DIR. - Routes/API tables: add /admin/account and the account/totp endpoints plus the login/totp second-factor step. - Tech stack + project structure: note TOTP (speakeasy/qrcode), the loginProtection/botScore middleware, the totp util, and the Account view. Docs-only; no code changes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-03 01:07:22 -05:00
whitlocktech	6f55c516c7	Document full-stack setup; fix dev proxy; drop stray temp script - README rewritten for the completed frontend: full setup/run instructions (Docker Compose, local dev with hot reload, prod build), pages/routes, API endpoints, and a consolidated environment-variable reference - Vite dev proxy now targets 127.0.0.1 (avoids the Windows IPv6-localhost pitfall where the SPA could not reach the IPv4-bound API) - Remove server/_setup.ps1 (a scratch script accidentally committed in the previous frontend commit) and gitignore _*.ps1 scratch files Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-27 02:14:44 -05:00
whitlocktech	eef79e2403	Initial commit: UOMysticmoon backend (Express + MariaDB + JWT) - Layered API (router -> controller -> model -> db), serverlinkr pattern - Public / auth / admin route groups; posts, wiki, settings, users, activity models - JWT httpOnly-cookie auth (Secure auto-detected: LAN HTTP + Pangolin HTTPS) - Site LIVE/MAINTENANCE mode with admin preview bypass - Dual file+console logging (info/warn/error/debug) + HTTP access logs - Docker Compose (app + MariaDB), schema.sql + seed, .env.example - Verified end-to-end against MariaDB (27/27 smoke checks) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-26 20:58:32 -05:00

Author

SHA1

Message

Date

Claude

a82f839c61

Update README for today's security hardening and 2FA work

Several changes merged today were not reflected in the README. Bring it
back in sync with main:

- Security section: rewrite into Session/authorization, Login hardening,
  Uploads/input, and Platform groups — documents DB re-validation of the
  JWT per request (#12), role-based authorization (#10), optional TOTP
  2FA (#9), login throttling + per-IP backoff, honeypot, bot-scoring/IP
  ban, and mimetype-derived upload extensions (#11) + username
  uniqueness checks on update (#13).
- Environment variables: add TRUST_PROXY, DEBUG_TRUST_PROXY, TOTP_ISSUER,
  TOTP_CHALLENGE_TTL, and UPLOAD_DIR.
- Routes/API tables: add /admin/account and the account/totp endpoints
  plus the login/totp second-factor step.
- Tech stack + project structure: note TOTP (speakeasy/qrcode), the
  loginProtection/botScore middleware, the totp util, and the Account view.

Docs-only; no code changes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-03 01:07:22 -05:00

whitlocktech

6f55c516c7

Document full-stack setup; fix dev proxy; drop stray temp script

- README rewritten for the completed frontend: full setup/run instructions
  (Docker Compose, local dev with hot reload, prod build), pages/routes,
  API endpoints, and a consolidated environment-variable reference
- Vite dev proxy now targets 127.0.0.1 (avoids the Windows IPv6-localhost
  pitfall where the SPA could not reach the IPv4-bound API)
- Remove server/_setup.ps1 (a scratch script accidentally committed in the
  previous frontend commit) and gitignore _*.ps1 scratch files

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-27 02:14:44 -05:00

whitlocktech

eef79e2403

Initial commit: UOMysticmoon backend (Express + MariaDB + JWT)

- Layered API (router -> controller -> model -> db), serverlinkr pattern
- Public / auth / admin route groups; posts, wiki, settings, users, activity models
- JWT httpOnly-cookie auth (Secure auto-detected: LAN HTTP + Pangolin HTTPS)
- Site LIVE/MAINTENANCE mode with admin preview bypass
- Dual file+console logging (info/warn/error/debug) + HTTP access logs
- Docker Compose (app + MariaDB), schema.sql + seed, .env.example
- Verified end-to-end against MariaDB (27/27 smoke checks)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-26 20:58:32 -05:00

3 Commits