6 Commits

Author	SHA1	Message	Date
null	80b3bcc17b	fix: HIGH+MEDIUM batch — 10 fixes (v0.24.0) ... HIGH: - Admin toggle-paid: removed cross-user admin branch, now requires ownership - Analytics crash: imported missing standardizeError - Export data loss: added cycle_type, cycle_day, bill_history_ranges to exports - Single-user lockout: removed unnecessary sessions join from getSingleModeUser MEDIUM: - Password rate limiter: scoped to change-password only, not all profile routes - Profile session invalidation: fixed req.sessionId → req.cookies[COOKIE_NAME] - CSRF default: httpOnly now defaults to false (matches SPA double-submit pattern) - CSRF password routes: removed csrfSkip for password change endpoints - Notification due-day: calendar day comparison instead of timestamp floor - Upcoming bills: clamped days to 1-365, default 30 for invalid input FUTURE.md: marked all 10 items as FIXED, bumped version refs HISTORY.md: added v0.24.0 entry	2026-05-10 15:25:47 -05:00
null	c4a3593241	v0.22.2: Session Token Rotation on Auth Events ... - invalidateOtherSessions() in authService.js: deletes all sessions except current - Password change (auth.js + profile.js) now invalidates all other sessions - Password change rotates current session ID (sets new cookie) - New POST /api/auth/logout-all endpoint (deletes all sessions + clears cookie) - Audit logging for logout.all and password.change - Added last_password_change_at to auth.js change-password for consistency - Hudson security audit: 6/6 PASS	2026-05-10 03:55:14 -05:00
null	7503a54f81	v0.20.6: Audit logging for critical operations ... - New audit_log table (migration v0.45) with indexes - logAudit() service with try/catch safety (never crashes app) - Audit events: login.success, login.failure, logout, password.change, role.change, csrf.failure, profile.update, profile.settings.update - All events include ip_address and user_agent - No passwords, tokens, or session IDs logged - Hudson security audit: 7/7 PASS	2026-05-10 00:03:12 -05:00
kaspa	4d1709aea3	push	2026-05-09 13:03:36 -05:00
_null	3228332e8c	push	2026-05-04 23:34:24 -05:00
_null	b9d1366d46	initial commit	2026-05-03 19:51:57 -05:00