2026-04-07 21:58:24 -04:00
|
|
|
{
|
|
|
|
|
"name": "wild-dragon-mam-api",
|
|
|
|
|
"version": "0.1.0",
|
|
|
|
|
"description": "Media Asset Management API for Wild Dragon",
|
2026-05-25 17:37:56 -04:00
|
|
|
"type": "module",
|
2026-04-07 21:58:24 -04:00
|
|
|
"main": "src/index.js",
|
|
|
|
|
"scripts": {
|
|
|
|
|
"start": "node src/index.js",
|
2026-05-27 13:38:46 -04:00
|
|
|
"dev": "node --watch src/index.js",
|
2026-05-27 13:54:12 -04:00
|
|
|
"test": "node --test $(find test -name '*.test.js' | sort)"
|
2026-04-07 21:58:24 -04:00
|
|
|
},
|
|
|
|
|
"dependencies": {
|
|
|
|
|
"express": "^4.18.2",
|
|
|
|
|
"pg": "^8.11.3",
|
|
|
|
|
"connect-pg-simple": "^9.0.1",
|
|
|
|
|
"express-session": "^1.17.3",
|
|
|
|
|
"cors": "^2.8.5",
|
2026-05-15 23:40:09 -04:00
|
|
|
"bcrypt": "^5.1.1",
|
2026-04-07 21:58:24 -04:00
|
|
|
"@aws-sdk/client-s3": "^3.500.0",
|
|
|
|
|
"@aws-sdk/s3-request-presigner": "^3.500.0",
|
|
|
|
|
"@aws-sdk/lib-storage": "^3.500.0",
|
|
|
|
|
"bullmq": "^5.5.0",
|
|
|
|
|
"multer": "^1.4.5-lts.1",
|
|
|
|
|
"uuid": "^9.0.1",
|
feat(mam-api,web-ui): TOTP two-factor authentication
Optional time-based 2FA on top of password login. TOTP core is hand-rolled
on node:crypto (RFC 6238) — no runtime dep — and verified against the RFC
test vectors.
- migration 027: users.totp_secret/totp_enabled + user_recovery_codes
- src/auth/totp.js: base32, secret gen, RFC 6238 verify, otpauth URI,
recovery codes
- src/auth/mfa-tickets.js: short-lived single-use tickets bridging the two
login steps (in-memory, single-instance like the rate-limiter)
- auth routes: /totp/setup, /totp/enable (returns recovery codes once),
/totp/disable (password-confirmed); login returns {mfa_required, ticket}
when enabled, /login/totp completes with a code or recovery code
- /auth/me and loadUser surface totp_enabled
- web-ui: login second-factor step; Settings -> Account TOTP enroll (QR +
manual secret + recovery codes + disable)
- qrcode added as an optional dep; setup degrades to manual entry if absent
- tests: totp unit (RFC vectors) + integration (enable/login/recovery/disable)
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-29 22:42:57 -04:00
|
|
|
"dotenv": "^16.4.5",
|
feat(mam-api,web-ui): Google OAuth (OIDC) sign-in
Optional "Sign in with Google" with auto-provisioning, fully config-gated:
without GOOGLE_CLIENT_ID/SECRET and OAUTH_REDIRECT_URL the routes 404 and the
button is hidden, so deployments without SSO are unaffected.
- migration 028: users.google_sub (unique) + email; password_hash nullable
for OAuth-only accounts
- src/auth/google-oauth.js: lazy google-auth-library, ID-token verify,
GOOGLE_ALLOWED_DOMAIN enforcement, requires email_verified === true
- auth routes: /auth/google (state-CSRF redirect), /auth/google/callback,
/auth/google/enabled; reuses establishSession
- web-ui: "Sign in with Google" on the login screen (shown only when enabled),
friendly callback error handling
- .env.example documents all new vars
Security hardening (from review of this + the TOTP work):
- resolveGoogleUser links ONLY by google_sub, never by email — a Google login
can never seize a pre-existing local account (account-takeover fix)
- a Google-linked account with TOTP still requires the second factor (ticket
in session, /?mfa=1 step) instead of bypassing it
- /login/totp now applies the per-IP login backoff
- recovery-code consumption is atomic (WHERE used_at IS NULL + rowCount)
- concurrent first-login race on google_sub is caught and re-resolved
- tests: google-oauth config helpers + google-link takeover/dedup regression
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-29 22:51:59 -04:00
|
|
|
"qrcode": "^1.5.4",
|
|
|
|
|
"google-auth-library": "^9.14.0"
|
2026-04-07 21:58:24 -04:00
|
|
|
},
|
|
|
|
|
"engines": {
|
|
|
|
|
"node": ">=22.0.0"
|
|
|
|
|
}
|
|
|
|
|
}
|
