mteehan/vacuum-wall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
66 Commits 1 Branch 0 Tags
a36505997673cc4cde27046deb95f26c2c3846e2
Commit Graph

10 Commits

Author SHA1 Message Date
mteehan a365059976 security: harden JWT auth with session binding, CSP headers, and sessionStorage 
- Reduce access_token_ttl from 900s to 300s (5 min) to shrink XSS exploit window
- Add session_id claim to JWT tokens tied to browser session (X-Session-Id header)
- Flask middleware validates session_id matches header on every request
- CSP headers: default-src/script-src 'self', no unsafe-inline/eval, frame-ancestors none
- X-Content-Type-Options: nosniff on all responses
- Move refresh token from localStorage to sessionStorage (tab-scoped, cleared on close)
- Timing-safe password verification (dummy Argon2id for unknown users)
- WebSocket auth also validates session_id header
- Add 5 session_id tests and 3 CSP header tests
 2026-07-24 03:09:07 +00:00
mteehan 56b200d233 feat: add auth subsystem with WebAuthn passkeys support 
New modules: lib/auth, lib/auth_users, lib/db, lib/db_sqlite, lib/password,
lib/webauthn, daemon/handlers/auth, scripts/bootstrap_auth, tests/test_auth

Frontend: webui/api/auth, hoover/components/auth, pages/login, passkeys, users

Updates: daemon/iface and server, lib/common and nginx, pyproject.toml deps,
install script, server.py, app.js, and websocket/api clients
 2026-07-24 01:21:39 +00:00
mteehan 2e49dec633 feat: auto-generate self-signed certs, hoover modal processing guard, refactor backends/proxy pages 2026-07-13 14:30:35 +00:00
mteehan 5135de0921 feat: add system config import, refactor install script and nginx auth 
- lib/system_import: new module to import system configs into JSON at daemon startup
- daemon/server.py: call import_all() during startup for config reconciliation
- daemon/handlers/nginx.py: simplify add_domain auth handling, remove duplicate code
- scripts/install.sh: replace inline Python setup with curl-based daemon API calls; apply IP forwarding at runtime
- hoover: bump internal asset versions to v=8
- pages: bump asset versions to v=9
 2026-07-08 02:20:28 +00:00
mteehan b4d13c4bd5 Add restart-services script to scripts/ directory 2026-07-02 14:39:35 +00:00
mteehan 20266e4a2f rename vendor files to put extension after version string 
Flask's send_file uses mimetypes.guess_type() which needs the file extension
at the end of the path. Previously files were named acme.sh-3.1.3 and
htm.js-3.1.1 — now acme-3.1.3.sh and htm-3.1.1.js.

Also: update-vendor.sh now owns ACME_HOME installation, removing duplicate
logic from install.sh.
 2026-07-02 04:01:52 +00:00
mteehan 8c13ad55ce Add update-vendor.sh symlink support, unify install.sh vendor flow 
- update-vendor.sh now creates webui/vendor symlinks (htm.js)
- install.sh calls update-vendor.sh after package install
- Add vendor/.empty and webui/vendor/.empty as directory placeholders in git
 2026-07-01 00:55:03 +00:00
mteehan 2f78102090 chore: cleanup pyproject, vendor script, and add restart-services.sh 2026-06-16 03:50:00 +00:00
mteehan 5ac69dfa7e refactor: move JS vendors to vendor/ with versioned filenames 
Vendor JS files to vendor/ with versioned names, symlinks in
webui/static/ select active version. Update update-vendor.sh and
AGENTS.md.
 2026-05-25 01:20:37 +00:00
mteehan f81be96e59 add: track shared modules, vendor scripts, and update gitignore 
- lib/common.py: shared run/load_json/save_json utilities
- webui/api/common.py: _ok/_error response helpers
- webui/static/htmx.min.js, json-enc.js: vendored frontend deps
- scripts/update-vendor.sh: frontend vendor updater
- vendor/acme.sh: bundled ACME client
- .gitignore: add .playwright-mcp/ and opencode.json.pwenv
 2026-05-25 01:13:34 +00:00