Update README for today's security hardening and 2FA work #22

wtclaude · 2026-07-03T06:07:45Z

wtclaude commented

2026-07-03 06:07:45 +00:00

Summary

Several changes merged today weren't reflected in the README. This brings it back in sync with main (docs-only, no code changes).

What changed

Security section - rewritten from a single paragraph into grouped subsections so today's hardening is actually discoverable:

Session & authorization - JWT re-validated against the DB on every admin request so a demoted/deleted user loses access immediately (#12); role-based authorization via requireRole on admin-only endpoints (#10).
Login hardening - optional per-user TOTP 2FA with the non-session stage:'totp' challenge flow (#9); express-slow-down + hard rate cap + per-IP exponential backoff; login honeypot; bot-scoring + automatic IP ban.
Uploads & input - upload extension derived from validated mimetype, not client filename (#11); username validated + uniqueness-checked on update (#13).

Environment variables - added the vars that shipped with the hardening but were undocumented: TRUST_PROXY, DEBUG_TRUST_PROXY, TOTP_ISSUER, TOTP_CHALLENGE_TTL, plus UPLOAD_DIR.

Routes & API tables - added /admin/account (self-service 2FA), the account / account/totp/* admin endpoints, and the login/totp second-factor step.

Tech stack & project structure - noted optional TOTP (speakeasy + qrcode), the new loginProtection / botScore middleware, the totp util, and the Account admin view.

Verification

Cross-checked every added item against the merged code:

Env vars against .env.example and server/.env.example.
Endpoints against server/src/router/v1/admin/admin.routes.js and auth/auth.routes.js.
Library names (speakeasy, qrcode, express-slow-down) against server/package.json.
The Account view against client/src/App.jsx and routes/admin/views/AccountAdmin.jsx.

Docs-only - no runtime impact.

?? Generated with Claude Code

## Summary Several changes merged today weren't reflected in the README. This brings it back in sync with `main` (docs-only, no code changes). ## What changed **Security section** - rewritten from a single paragraph into grouped subsections so today's hardening is actually discoverable: - **Session & authorization** - JWT re-validated against the DB on every admin request so a demoted/deleted user loses access immediately ([#12](https://gitea.whitlocktech.com/UOM/website/issues/12)); role-based authorization via `requireRole` on admin-only endpoints ([#10](https://gitea.whitlocktech.com/UOM/website/issues/10)). - **Login hardening** - optional per-user TOTP 2FA with the non-session `stage:'totp'` challenge flow ([#9](https://gitea.whitlocktech.com/UOM/website/issues/9)); `express-slow-down` + hard rate cap + per-IP exponential backoff; login honeypot; bot-scoring + automatic IP ban. - **Uploads & input** - upload extension derived from validated mimetype, not client filename ([#11](https://gitea.whitlocktech.com/UOM/website/issues/11)); username validated + uniqueness-checked on update ([#13](https://gitea.whitlocktech.com/UOM/website/issues/13)). **Environment variables** - added the vars that shipped with the hardening but were undocumented: `TRUST_PROXY`, `DEBUG_TRUST_PROXY`, `TOTP_ISSUER`, `TOTP_CHALLENGE_TTL`, plus `UPLOAD_DIR`. **Routes & API tables** - added `/admin/account` (self-service 2FA), the `account` / `account/totp/*` admin endpoints, and the `login/totp` second-factor step. **Tech stack & project structure** - noted optional TOTP (`speakeasy` + `qrcode`), the new `loginProtection` / `botScore` middleware, the `totp` util, and the `Account` admin view. ## Verification Cross-checked every added item against the merged code: - Env vars against `.env.example` and `server/.env.example`. - Endpoints against `server/src/router/v1/admin/admin.routes.js` and `auth/auth.routes.js`. - Library names (`speakeasy`, `qrcode`, `express-slow-down`) against `server/package.json`. - The `Account` view against `client/src/App.jsx` and `routes/admin/views/AccountAdmin.jsx`. Docs-only - no runtime impact. ?? Generated with [Claude Code](https://claude.com/claude-code)

wtclaude added 1 commit 2026-07-03 06:07:47 +00:00

Update README for today's security hardening and 2FA work a82f839c61

Several changes merged today were not reflected in the README. Bring it
back in sync with main:

- Security section: rewrite into Session/authorization, Login hardening,
  Uploads/input, and Platform groups — documents DB re-validation of the
  JWT per request (#12), role-based authorization (#10), optional TOTP
  2FA (#9), login throttling + per-IP backoff, honeypot, bot-scoring/IP
  ban, and mimetype-derived upload extensions (#11) + username
  uniqueness checks on update (#13).
- Environment variables: add TRUST_PROXY, DEBUG_TRUST_PROXY, TOTP_ISSUER,
  TOTP_CHALLENGE_TTL, and UPLOAD_DIR.
- Routes/API tables: add /admin/account and the account/totp endpoints
  plus the login/totp second-factor step.
- Tech stack + project structure: note TOTP (speakeasy/qrcode), the
  loginProtection/botScore middleware, the totp util, and the Account view.

Docs-only; no code changes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

whitlocktech approved these changes 2026-07-03 06:09:35 +00:00

whitlocktech added 1 commit 2026-07-03 06:09:46 +00:00

Merge branch 'main' into docs/readme-refresh cd678e75ce

whitlocktech merged commit 58852a5078 into main

2026-07-03 06:09:56 +00:00

whitlocktech referenced this issue from a commit

2026-07-03 06:09:57 +00:00

Merge pull request 'Update README for today's security hardening and 2FA work' (#22) from docs/readme-refresh into main

whitlocktech deleted branch docs/readme-refresh

2026-07-03 06:09:57 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: RunicGateway/website#22