Sync and data safety
- Autosave flushes on leaving a study or the tab; storage-full errors are reported
- Unsynced studies, deletes and ink are queued and retried when back online
- Deletes propagate across devices (with a "Keep it" undo) and no longer resurrect
- Server assigns study versions (no client-clock conflicts); "Combine both"
merges a conflicted study chunk by chunk
- Reading-plan progress made offline is merged, not overwritten; plans, ink and
marks are cleared from the device on sign-out
Security
- Block SSRF through the ntfy reminder URL; failure-only rate limiting per IP and
account; constant-time login; TOTP replay protection; input validation;
SESSION_SECRET required in production; admin user delete fixed
- Forgot password: one-time code sent to the account's ntfy topic
Features
- IQ Bible proxy (route allow-list, text-only caching per its terms): more
commentaries, lexicons, study aids, daily verse and devotional, plan calendar
export, narrations, podcast background
- Study templates, reading-plan catch-up, account export, daily database snapshots
Tests and tooling
- ESLint config; App tests split into src/test; tests for sync queues, library
hook, merge, templates, IQ Bible UI and reset form
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
There's no email infrastructure in this app, so a self-service
"forgot password" flow isn't feasible yet. Adds a "Reset Password"
button per user in the admin panel instead: generates a random
temporary password (shown once, for the admin to relay out-of-band),
overwrites the user's password hash, and signs them out of every
existing session so a stolen session can't outlive the reset.
Verified live: old password rejected after reset, new temporary
password logs in successfully.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Adds a full admin view (users + projects, with view/delete) gated
server-side by ADMIN_EMAIL in server/auth.js (defaults to the site
owner's account, overridable via env var for other deployments). The
gate is enforced on every /api/admin/* route, not just hidden in the
UI — verified a non-admin session gets 403 even when it hits the
endpoints directly. Deleting a user leaves their projects in place
(not cascade-deleted) so admin cleanup can't accidentally destroy
someone's study data.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Projects were previously global to anyone who could reach the server.
Adds email/password accounts with httpOnly cookie sessions, scopes
every project (both SQLite and localStorage) to the signed-in user,
and auto-claims pre-existing unowned projects for whoever registers
first. Also adds optional TOTP two-factor auth with backup codes,
managed from a new Account Settings page, since there's no
password-reset flow to fall back on otherwise.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
nmemmertandClaude Sonnet 5.5
nmemmertandClaude Sonnet 5