Commit Graph
8 Commits
Author SHA1 Message Date
nmemmertandClaude Sonnet 5.5 8a796964b9 Security & hardening pass: scrypt password hashing, persisted admin sessions, upvote/analytics rate limits, dependency fixes, healthcheck, lint cleanup; v2.10.0
Publish Container / build (push) Successful in 17m3s
- Study passwords: salted scrypt; legacy SHA-256 hashes verified and upgraded on login
- Admin sessions persisted (hashed tokens) so deploys no longer log the admin out
- Upvotes: rate limit + one per client per question, approved questions only; rate limit on analytics play/event
- npm audit: 46 -> 4 vulnerabilities (tiptap bumped to 3.31.4)
- Untrack per-user data (study users/notes/progress/etc.) from git
- Dockerfile HEALTHCHECK; node --test suite for password hashing
- Fix email template cards remounting (lost input focus) on each keystroke
- Lint: 34 errors -> 0

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-10-09 08:45:39 -04:00
nmemmertandClaude Sonnet 5 60b23b0fba Remove stale agent worktree and ignore .claude/worktrees going forward
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-28 12:17:03 -04:00
nmemmertandClaude Sonnet 5 841e754e16 Add student account self-service security features and discoverability fixes; v2.1.0
Adds forgot/reset password, signup email verification, sign-out-of-all-devices,
note-usage and certificate display in account settings, and password-changed
security emails. Fixes study sessions being lost on server restart by
persisting them to disk, and fixes sanitizeStudyUsers silently dropping the
new pending-token fields on load. Also surfaces the lesson discussion board
in the main site nav, trims the sign-in page for returning users, and renames
colossiansStudy.tsx/colossiansStudyData.ts to studyPages.tsx/legacyColossiansData.ts
now that the study system covers more than Colossians.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-09-24 09:21:54 -04:00
nmemmert 1551599305 Beta: TOTP 2FA, admin asset manager, resource page redesign, rate limiting, and security hardening 2026-05-04 13:56:04 -04:00
nmemmert 5562db992b Ignore generated runtime data files 2026-04-16 08:37:32 -04:00
nmemmert 738cc2a412 Add persistent admin analytics, backup restore workflow, and tabbed admin UI 2026-04-12 13:12:03 -04:00
nmemmert 8f165afcc9 feat: site-wide Swing Music player, persistent storage, mobile UX polish
- SiteWideMusicDock component at app level; persists across all routes
- Dock + player merged into single expandable panel
- Remove non-functional Hide button; one Minimize/Open control
- Swing Music label and action button on same row
- Mobile: dock z-index above player, larger touch target on iPad
- entrypoint.sh: seeds admin-content.json only on first boot/fresh volume
- Dockerfile: seed in /app/data-seed; live data in /app/data (volume)
- shell-with-music-bar padding on project and admin pages
2026-03-19 16:05:16 -04:00
Nate Emmert 695f124afe Set up Siteforge container deployment and registry publishing 2026-03-17 15:15:33 -04:00