Rokojori
/
rokojori-auth
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
17 Commits 1 Branch 0 Tags 169 KiB
Commit Graph

17 Commits

Author SHA1 Message Date
Rokojori 9114e3376a auth: remove refresh-session redirect on expired token — fall through instead 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-17 23:48:31 +02:00
Rokojori 858e70f7bb Auth Update 2026-07-17 21:39:37 +02:00
Rokojori eb275c9669 Update Logger 7 2026-07-17 21:21:53 +02:00
Rokojori 77088d4ac1 Update Logger 4 2026-07-17 21:12:31 +02:00
Rokojori 7eff4020f9 Auth Polish 3 2026-07-17 21:11:37 +02:00
Rokojori f493783a53 Update Logger 2 2026-07-17 21:05:58 +02:00
Rokojori a7419f9084 Update Logger 2026-07-17 21:01:56 +02:00
Rokojori 08859255df Auth Polish 2026-07-17 20:34:36 +02:00
Rokojori d1445b7c77 Bug Fix 2026-07-17 14:07:17 +02:00
Rokojori c45ff3be45 Auth Updates TTL 2026-07-17 13:36:03 +02:00
Rokojori 253ca97fe8 Token Refresh 2026-07-16 19:07:24 +02:00
Rokojori 8d2469ddb6 Update TTL for Testing 2026-07-16 18:14:03 +02:00
Rokojori 815c4423ce Add requireAccess middleware, products admin route, and lookup-email endpoint 
- requireAccess.ts: flexible role+product access rules for per-service gating
- PATCH /api/admin/users/:id/products: superadmin can assign products to users
- POST /api/auth/lookup-email: server-to-server email→userId lookup via SERVICE_SECRET
- workspace/index.html: documented per-service access control design

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-15 07:06:39 +02:00
Rokojori 7ed9b9d7a2 auth: add GET /api/auth/logout?redirect= for browser-based logout links 
Mirrors the refresh-session pattern — clears cookies, invalidates refresh
token, and redirects to the given URL (falls back to /login.html).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-13 14:45:19 +02:00
Rokojori 61f15e1325 Added Workspace Docs 2026-07-13 13:42:50 +02:00
Rokojori 07aad6c69e auth: refresh token cookie, rate limiting, delete account, welcome email 
- trust proxy for correct IP behind nginx
- refresh token now set as httpOnly cookie alongside access token
- GET /api/auth/refresh-session for browser-based token refresh
- DELETE /api/auth/me with full cleanup of tokens and cookies
- rate limiting on login (10/15min) and register (5/hr)
- welcome email on registration (non-blocking)
- delete account UI on profile page with two-step confirm

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-13 12:33:39 +02:00
Rokojori d7eeaace01 Initial Commit 2026-07-13 05:48:45 +02:00