0c3a4b625f
Optional "Sign in with Google" with auto-provisioning, fully config-gated: without GOOGLE_CLIENT_ID/SECRET and OAUTH_REDIRECT_URL the routes 404 and the button is hidden, so deployments without SSO are unaffected. - migration 028: users.google_sub (unique) + email; password_hash nullable for OAuth-only accounts - src/auth/google-oauth.js: lazy google-auth-library, ID-token verify, GOOGLE_ALLOWED_DOMAIN enforcement, requires email_verified === true - auth routes: /auth/google (state-CSRF redirect), /auth/google/callback, /auth/google/enabled; reuses establishSession - web-ui: "Sign in with Google" on the login screen (shown only when enabled), friendly callback error handling - .env.example documents all new vars Security hardening (from review of this + the TOTP work): - resolveGoogleUser links ONLY by google_sub, never by email — a Google login can never seize a pre-existing local account (account-takeover fix) - a Google-linked account with TOTP still requires the second factor (ticket in session, /?mfa=1 step) instead of bypassing it - /login/totp now applies the per-IP login backoff - recovery-code consumption is atomic (WHERE used_at IS NULL + rowCount) - concurrent first-login race on google_sub is caught and re-resolved - tests: google-oauth config helpers + google-link takeover/dedup regression Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
32 lines
844 B
JSON
32 lines
844 B
JSON
{
|
|
"name": "wild-dragon-mam-api",
|
|
"version": "0.1.0",
|
|
"description": "Media Asset Management API for Wild Dragon",
|
|
"type": "module",
|
|
"main": "src/index.js",
|
|
"scripts": {
|
|
"start": "node src/index.js",
|
|
"dev": "node --watch src/index.js",
|
|
"test": "node --test $(find test -name '*.test.js' | sort)"
|
|
},
|
|
"dependencies": {
|
|
"express": "^4.18.2",
|
|
"pg": "^8.11.3",
|
|
"connect-pg-simple": "^9.0.1",
|
|
"express-session": "^1.17.3",
|
|
"cors": "^2.8.5",
|
|
"bcrypt": "^5.1.1",
|
|
"@aws-sdk/client-s3": "^3.500.0",
|
|
"@aws-sdk/s3-request-presigner": "^3.500.0",
|
|
"@aws-sdk/lib-storage": "^3.500.0",
|
|
"bullmq": "^5.5.0",
|
|
"multer": "^1.4.5-lts.1",
|
|
"uuid": "^9.0.1",
|
|
"dotenv": "^16.4.5",
|
|
"qrcode": "^1.5.4",
|
|
"google-auth-library": "^9.14.0"
|
|
},
|
|
"engines": {
|
|
"node": ">=22.0.0"
|
|
}
|
|
}
|