 Bernd Rodler
|
7e3034da8d
|
test: update recurrence expansion test + fix TS/Lint errors
|
2026-08-07 12:37:16 +02:00 |
|
|
Bernd Rodler
|
a622e3755b
|
fix: Phase 1 critical+high fixes (17/18 items)
CRITICAL fixes:
- C1: Error swallowing - throw TransportError on network failure in getEmails/searchEmails
- C2: Recurrence expansion ID delimiter changed from ':' to '::occurrence::'
- C3: Cross-account calendar event UID dedup after multi-account aggregation
- C4: Admin session token revocation via JTI blacklist on logout
- C6: FTS5 schema-drop - add warning log for automatic reindex trigger
- C7: Settings lock - gate updateSetting() with isSettingLocked() check
- C8: Offline push pause - add offline event handler that closes push transports
HIGH fixes:
- H1: Push handler - add ContactCard and FileNode branches
- H2: WS fallback - await state snapshot before reconcileAfterWebSocketFallback
- H3: Auth rate limiting - add checkUserAuthRateLimit to session and token routes
- H4: OAuth logs - strip access_token from error log context
- H7: Template XSS - apply DOMPurify to HTML template body on import
- H8: Secure cookie - derive from x-forwarded-proto, not NODE_ENV
- H9: bcrypt fix - remove bcrypt prefixes from isHashed() so scrypt-only
- H13: calendarTasksEnabled - apply admin gate at runtime in calendar page
- H14: Task mutations - add try/catch error handling to update/delete/toggle
- H18: autoSelectReplyIdentity default changed from false to true
Deferred: P1.3 (C5 auth localStorage encryption) - requires custom Zustand persist adapter.
|
2026-08-07 12:17:41 +02:00 |
|
|
Pascal DietrichandLinus Rath
|
b508551d02
|
feat: add sessionSecretFile and oauthClientSecretFile for JSON config
|
2026-05-31 00:14:38 +02:00 |
|
|
Linus Rath
|
63f2169ae7
|
fix: add OAUTH_ALLOW_PRIVATE_ENDPOINTS for split-DNS setups
|
2026-05-22 17:22:14 +02:00 |
|
|
Linus Rath
|
ecd0467ffa
|
fix: stop pulling node:dns into client bundle via OAuth discovery
|
2026-05-18 19:31:38 +02:00 |
|
|
Linus Rath
|
d3d79be64c
|
feat: multi-server JMAP support
|
2026-05-06 17:33:55 +02:00 |
|
|
Linus Rath
|
da103ff06f
|
feat: implement OAuth auto-setup functionality for Stalwart integration
|
2026-04-25 01:37:18 +02:00 |
|
|
Pascal DietrichandLinus Rath
|
f9052eb23f
|
feat: add SESSION_SECRET_FILE and OAUTH_CLIENT_SECRET_FILE env vars
|
2026-04-09 22:13:08 +02:00 |
|
|
Linus Rath
|
83a0a1e235
|
feat: add non-interactive SSO login flow for embedded/iframe deployments (closes #69)
|
2026-03-21 20:45:19 +01:00 |
|