4 Commits

Author	SHA1	Message	Date
null	f587d09d4a	style: apply Prettier across client + server (no behavior change) ... One-time repo-wide `prettier --write` (isolated commit so future diffs stay reviewable). Mechanical formatting only. Verified unchanged: typecheck + typecheck:server + check:server clean; server tests 232/232; client tests 50/50; Vite build succeeds. Co-Authored-By: Claude Opus 4.8 <[email protected]>	2026-07-06 14:23:53 -05:00
null	135bd98c6a	refactor(server): migrate middleware, workers, and db layer to TypeScript (.cts) ... - middleware/ (5): requireAuth, securityHeaders, errorFormatter, csrf, rateLimiter — fully typed against the shared http Req/Res/Next types. - workers/dailyWorker — fully typed. - db/ (4): database, subscriptionCatalogSeed, migrations/versionedMigrations, migrations/legacyReconcileMigrations — large dynamic schema/migration infra, converted with @ts-nocheck (typing deferred). All requires updated to .cts. Behavior-preserving. Verified: typecheck:server 0, check:server 0, suite 226/226. Co-Authored-By: Claude Opus 4.8 <[email protected]>	2026-07-06 11:34:08 -05:00
null	6746d42380	refactor(server): migrate 5 more services to TypeScript (.cts) ... webauthnService, cleanupService, backupService, bankSyncService, authService. Behavior-preserving. Verified: typecheck:server 0, check:server 0, suite 226/226. Co-Authored-By: Claude Opus 4.8 <[email protected]>	2026-07-06 11:06:05 -05:00
null	b3ce334987	test(security): lock in authService — password verify, hashed sessions, rotation (Phase 1) ... Pins the auth-core invariants: bcrypt password round-trip, wrong-password → bad_password (feeds lockout), unknown user → null (no enumeration); sessions stored HASHED (sha256), never the raw token; the session lifecycle (create/lookup/expire/rotate/invalidate/prune); and rotateSessionId enforcing ownership + killing the old session. Co-Authored-By: Claude Opus 4.8 <[email protected]>	2026-07-05 12:57:53 -05:00