RyderTech/nlcc-itinerary
1
0
Fork 0
Code Issues Pull Requests Packages Activity
168 Commits 1 Branch 0 Tags
47b4a14c4b1553c1e0b4b900509354bc569abef0
Commit Graph

30 Commits

Author SHA1 Message Date
Joshua Ryder
47b4a14c4b fix: Ensure email configuration from environment variables is properly used 
Fixed an issue where SMTP configuration would fall back to defaults despite
environment variables being set in docker-compose.yml. The email utility now
properly accesses runtime configuration by accepting the H3 event context.

Changes:
- Created getEmailConfig() helper with dual-strategy config access
- Pass event context from API handlers to email functions
- Added fallback to direct process.env access for reliability
- Added debug logging to diagnose configuration issues in production

This ensures Office365 and other SMTP providers work correctly when configured
via environment variables.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-11-05 18:11:13 -05:00
Joshua Ryder
2ff493d804 feat: Implement comprehensive security hardening 
Security Improvements:
- Auto-generate AUTH_SECRET and admin credentials on first launch
  - Cryptographically secure random generation
  - Stored in database for persistence
  - Logged once to container logs for admin retrieval

- Implement CSRF protection with double-submit cookie pattern
  - Three-way validation: cookie, header, and session database
  - Automatic client-side injection via plugin
  - Server middleware for automatic validation
  - Zero frontend code changes required

- Add session fixation prevention with automatic invalidation
  - Regenerate sessions on password changes
  - Keep current session active, invalidate others on profile password change
  - Invalidate ALL sessions on forgot-password reset
  - Invalidate ALL sessions on admin password reset

- Upgrade password reset codes to 8-char alphanumeric
  - Increased from 1M to 1.8 trillion combinations
  - Uses crypto.randomInt() for cryptographic randomness
  - Excluded confusing characters (I, O) for better UX
  - Case-insensitive verification

- Implement dual-layer account lockout
  - IP-based rate limiting (existing)
  - Per-account lockout: 10 attempts = 30 min lock
  - Automatic unlock after expiration
  - Admin manual unlock via UI
  - Visual status indicators in users table

Database Changes:
- Add csrf_token column to sessions table
- Add failed_login_attempts and locked_until columns to users table
- Add settings table for persistent AUTH_SECRET storage
- All migrations backward-compatible with try-catch

New Files:
- server/utils/csrf.ts - CSRF protection utilities
- server/middleware/csrf.ts - Automatic CSRF validation middleware
- plugins/csrf.client.ts - Automatic CSRF header injection
- server/api/users/unlock/[id].post.ts - Admin unlock endpoint

Modified Files:
- server/utils/database.ts - Core security functions and schema updates
- server/utils/email.ts - Enhanced reset code generation
- server/api/auth/login.post.ts - CSRF + account lockout logic
- server/api/auth/register.post.ts - CSRF token generation
- server/api/auth/logout.post.ts - CSRF cookie cleanup
- server/api/auth/reset-password.post.ts - Session invalidation
- server/api/auth/verify-reset-code.post.ts - Case-insensitive codes
- server/api/profile/update.put.ts - Session invalidation on password change
- server/api/users/password/[id].put.ts - Session invalidation on admin reset
- pages/users.vue - Lock status display and unlock functionality
- docker-compose.yml - Removed default credentials
- nuxt.config.ts - Support auto-generation

All changes follow OWASP best practices and are production-ready.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-11-05 17:36:31 -05:00
Joshua Ryder
66172e0baa Add sermon retention policy feature 
Implemented a configurable retention policy system for sermons with automatic cleanup:
- Added settings table to store retention policy configuration
- Created API endpoints for getting/setting retention policy
- Added Database Settings section to admin page with retention options (forever, 1-10 years)
- Implemented manual cleanup endpoint for on-demand deletion
- Added automated daily cleanup task via Nitro plugin
- Sermons are deleted based on their date field according to the retention policy

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-11-04 14:07:14 -05:00
Joshua Ryder
ffb72a7cbd database fix 2025-10-12 01:08:49 -04:00
Joshua Ryder
a505edcae7 created by for sermons 2025-10-12 01:01:01 -04:00
Joshua Ryder
329becfb08 security improvements 2025-10-07 13:39:53 -04:00
Joshua Ryder
2f505ad7e2 email formatting 2025-10-07 09:10:37 -04:00
Joshua Ryder
7fc1d79eeb Saving notes and username fixes 2025-10-07 08:58:38 -04:00
Joshua Ryder
c7b8735a90 Greeting fix 2025-10-06 18:56:26 -04:00
Joshua Ryder
49a88f6634 SSPR fix 2025-10-06 18:43:38 -04:00
Joshua Ryder
ee94b7aec1 SSPR fix 2025-10-06 18:39:18 -04:00
Joshua Ryder
c127ea35f6 Self-service password reset 2025-10-06 18:26:01 -04:00
Joshua Ryder
2dbd4f6ba0 Notes! 2025-10-06 17:20:26 -04:00
Joshua Ryder
a50791e74c User creation and management 2025-10-06 17:04:34 -04:00
Joshua Ryder
dfa857c131 encryption 2025-10-02 16:25:31 -04:00
Joshua Ryder
002302bb52 auth changes 2025-10-02 11:14:43 -04:00
Joshua Ryder
27fcedfcd5 Songs & dates 2025-10-02 08:59:05 -04:00
Joshua Ryder
f1e0ac0a93 Fix archive functionality: change default includeArchived to false 2025-10-02 00:00:51 -04:00
Joshua Ryder
4b47f56b30 Add archive functionality: database schema, API endpoint, and helper functions 2025-10-01 23:49:44 -04:00
Joshua Ryder
1b282c05fe Complete sermon itinerary application with Nuxt 3, SQLite, authentication, and Docker deployment 2025-10-01 22:15:01 -04:00
Joshua Ryder
793f395795 Starting over 2025-10-01 22:00:32 -04:00
Ryderjj89
2f3b427477 fix: Move generateSlug to admin page to prevent client-side bundling of server utils 2025-10-01 19:09:17 -04:00
Ryderjj89
4e66e03702 fix: Update database import path in server/utils/auth.ts 2025-10-01 19:07:54 -04:00
Ryderjj89
c83cf7dd82 fix: Rename database utility to .server.ts and update imports 2025-10-01 19:07:02 -04:00
Ryderjj89
1e48717285 Fix bcryptjs import in database.ts to use static import 2025-10-01 18:36:45 -04:00
Ryderjj89
64d2c7245e Fix bcrypt import in database.ts to use bcryptjs 2025-10-01 18:20:14 -04:00
Ryderjj89
55e5267ffa Update to Node 22, use bcryptjs for better compatibility 2025-10-01 18:12:41 -04:00
Ryderjj89
89c75564cf Add default admin user creation and fix modal overlay positioning 2025-09-29 20:21:55 -04:00
Ryderjj89
8b35f8cacf Fix modal visibility and database path issues for Docker deployment 2025-09-29 20:05:49 -04:00
Ryderjj89
c033410c2e Complete sermon management system with Nuxt 4, authentication, SQLite database, QR codes, and Docker deployment 2025-09-29 18:59:31 -04:00