igm/publisher-dashboard
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
56 Commits 2 Branches 0 Tags
786232e1b12af535ed1f3de1ccd10efd881dfb84
Commit Graph

11 Commits

Author SHA1 Message Date
RevIQ
786232e1b1 Merge branch 'workstream-k' 2026-01-09 17:03:07 +08:00
RevIQ
3eb44adf05 Fix TypeScript and lint errors 
- Add missing reqHeaders/resHeaders to webauthn test context
- Fix Session.id type from number to string in test
- Remove unnecessary Number() conversion in countOwners

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-09 17:01:22 +08:00
RevIQ
c0966365f3 Refactor admin procedures into separate files 
Extract admin procedures from router.ts into dedicated files under
procedures/admin/ with consolidated exports via _routes.ts. Adds shared
helper functions for response transformation and includes race condition
fixes via transaction-scoped existence checks.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-09 17:00:04 +08:00
RevIQ
9cf95095c3 Implement Workstream J: Org procedures (backend) 
Add complete organization management procedures:
- orgs.list, create, get, update, delete, leave
- orgs.members.list, updateRole, remove
- orgs.invites.list, create, cancel, accept
- orgs.sites.list

Key features:
- Role-based access control (owner > admin > member)
- Transaction-protected owner count checks to prevent race conditions
- Privilege escalation prevention (only owners can invite owners)
- Graceful constraint violation handling with friendly error messages
- Email sending for org invitations

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-09 16:50:29 +08:00
RevIQ
2d445cc47b Merge branch 'workstream-f1' 2026-01-09 16:31:58 +08:00
RevIQ
860d791125 Implement Workstream F1: me.get and me.setupProfile procedures 
- Add me.get procedure returning user profile with needsSetup flag
- Add me.setupProfile procedure for initial profile setup after signup
- Add nonEmptyString/optionalString schema helpers with tests
- Use Web Crypto API (SubtleCrypto) for Cloudflare Workers compatibility
- Use @formatjs/intl-durationformat for duration formatting
- Remove node:crypto dependency from crypto utilities

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-09 16:29:41 +08:00
RevIQ
9b898678c7 Refactor me.* procedures with code review fixes 
- Fix silent failures: add 404 NOT_FOUND for invalid resources in
  passkeysRename, revokeSession, trustDevice, untrustDevice
- Fix race condition in passkeysDelete using transaction
- Extract helper functions: requireDeviceFingerprint, defaultDeviceName
- Improve type safety in updateProfile with Kysely's Updateable<Users>
- Extract me.* procedures to separate files under procedures/me/
- Standardize naming to verb-first: listPasskeys, renamePasskey, deletePasskey

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-09 16:24:10 +08:00
RevIQ
617fa78046 Fix Session.id type and restore nested passkey routes 
- Change Session.id from number to string to match DB bigint type
- Restore me.passkeys.{list,rename,delete} nested route structure
- Remove unnecessary String() conversion in logout procedure
- Auto-formatted procedure files

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-09 15:44:45 +08:00
RevIQ
a4d1f28f3d Add typed context and middleware for oRPC procedures 
Use implement(contract).$context<APIContext>() for proper type safety
in all procedure handlers. Create authMiddleware and loginRequestMiddleware
using os.middleware() and apply with .use() on routes requiring auth.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-09 15:36:26 +08:00
RevIQ
829d365e80 Implement auth procedures with code review fixes 
Add complete auth backend (Workstream D):
- Auth middleware for session/API key authentication
- Signup with password or passkey (WebAuthn)
- Login flow with device trust and email confirmation
- Password reset and email verification
- Session management and logout

Utilities created:
- cookies.ts: Cookie helpers and configuration
- crypto.ts: Token generation and hashing
- password.ts: zxcvbn validation, argon2id hashing
- geo.ts: IP/location extraction from headers
- email.ts: Stubbed email sending
- session.ts: Session creation and device trust

Code review improvements applied:
- Use ORPCError instead of Error in procedures
- Add ast-grep rule to enforce ORPCError usage
- Remove error info leakage (generic messages)
- Optimize N+1 query with JOIN in login-password
- Extract signupWithPassword/signupWithPasskey for testability
- Add 15-minute WebAuthn challenge expiry check
- Strengthen CookieOptions type definitions

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-09 15:19:15 +08:00
RevIQ
93132d76c0 Add api-server and CLI applications 
- Create api-server with Bun.serve:
  - oRPC router with stub handlers for all procedures
  - Auth middleware placeholder
  - CORS configuration
- Create CLI tool with stricli:
  - bootstrap command for initial superuser creation
  - Placeholder commands for auth, user, org management

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-09 11:45:03 +08:00