null/BillTracker

Commit Graph

Author	SHA1	Message	Date
null	a9cdf846fe	v0.19.2: fix legacy DB migration login failure + security hardening CRITICAL fix: Users upgrading from pre-migration-tracking databases (now get 'invalid username/password' because schema_migrations table doesn't exist. Added handleLegacyDatabase() and reconcileLegacyMigrations() to detect and reconcile legacy DBs. Security fixes: - Path traversal: replaced sanitizePath() with ALLOWED_FILES allowlist - Public /about bypass: added admin route guard in App.jsx - Sensitive info exposure: expanded redactSensitiveContent() patterns - Error message path leaks: generic error messages only - Race condition: wrapped in db.transaction() in server.js - Password validation: INIT_REGULAR_PASS min 8 chars with process.exit(1) All verified by Bishop (build + runtime) and Private_Hudson (security).	2026-05-09 18:25:25 -05:00
null	6c7d481494	feat: add admin about page with security hardening - Add /api/about-admin endpoint (admin-only, path traversal protection, content redaction, error sanitization) - Add /admin/about route with RequireAuth admin guard - Add adminActionLimiter rate limiting on about-admin endpoint - Add rehype-sanitize XSS prevention in AboutPage.jsx - Add aboutAdmin API client endpoint - Create HISTORY.md with version bump convention (patch/minor/major) - Update Engineering Reference Manual with about-admin docs and security measures - Add INIT_REGULAR_USER/INIT_REGULAR_PASS env vars to docs - Update FUTURE.md with critical regular user env var item	2026-05-09 16:25:12 -05:00
null	d5057a6325	feat: add migration version tracking, update docs, add dev log - Added schema_migrations table for explicit version tracking (CRITICAL fix) - Refactored runMigrations() to use versioned migration objects - Added hasMigrationBeenApplied() and recordMigration() helpers - Migrations now skip already-applied versions and log progress - Updated FUTURE.md with migration system issues and criticality ratings - Updated Engineering_Reference_Manual.md with migration system docs - Added DEVELOPMENT_LOG.md for agent work tracking	2026-05-09 15:17:40 -05:00

Author

SHA1

Message

Date

null

a9cdf846fe

v0.19.2: fix legacy DB migration login failure + security hardening

CRITICAL fix: Users upgrading from pre-migration-tracking databases
(now get 'invalid username/password' because schema_migrations table
doesn't exist. Added handleLegacyDatabase() and
reconcileLegacyMigrations() to detect and reconcile legacy DBs.

Security fixes:
- Path traversal: replaced sanitizePath() with ALLOWED_FILES allowlist
- Public /about bypass: added admin route guard in App.jsx
- Sensitive info exposure: expanded redactSensitiveContent() patterns
- Error message path leaks: generic error messages only
- Race condition: wrapped in db.transaction() in server.js
- Password validation: INIT_REGULAR_PASS min 8 chars with process.exit(1)

All verified by Bishop (build + runtime) and Private_Hudson (security).

2026-05-09 18:25:25 -05:00

null

6c7d481494

feat: add admin about page with security hardening

- Add /api/about-admin endpoint (admin-only, path traversal protection, content redaction, error sanitization)
- Add /admin/about route with RequireAuth admin guard
- Add adminActionLimiter rate limiting on about-admin endpoint
- Add rehype-sanitize XSS prevention in AboutPage.jsx
- Add aboutAdmin API client endpoint
- Create HISTORY.md with version bump convention (patch/minor/major)
- Update Engineering Reference Manual with about-admin docs and security measures
- Add INIT_REGULAR_USER/INIT_REGULAR_PASS env vars to docs
- Update FUTURE.md with critical regular user env var item

2026-05-09 16:25:12 -05:00

null

d5057a6325

feat: add migration version tracking, update docs, add dev log

- Added schema_migrations table for explicit version tracking (CRITICAL fix)
- Refactored runMigrations() to use versioned migration objects
- Added hasMigrationBeenApplied() and recordMigration() helpers
- Migrations now skip already-applied versions and log progress
- Updated FUTURE.md with migration system issues and criticality ratings
- Updated Engineering_Reference_Manual.md with migration system docs
- Added DEVELOPMENT_LOG.md for agent work tracking

2026-05-09 15:17:40 -05:00

3 Commits