Patrick/medassist-ng
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
175 Commits 16 Branches 64 Tags
a2905bb8c7fb5d30fe6d9adecca65aaa37e07d68
Commit Graph

8 Commits

Author SHA1 Message Date
Daniel Volz 6b54ecef4f chore: add CodeQL config to suppress rate-limit false positives 
Rate limiting IS implemented via @fastify/rate-limit plugin:
- Global: 100 req/min (index.ts)
- Auth routes: 5-10 req/min via config.rateLimit option

CodeQL doesn't recognize Fastify's plugin-based rate limiting pattern.
 2025-12-30 12:46:05 +01:00
Daniel Volz b8d5647980 security: add rate limiting to remaining auth routes 2025-12-30 12:42:42 +01:00
Daniel Volz cb1810586d security: fix CodeQL vulnerabilities (SSRF, XSS, rate limiting) 
- Add URL validation to prevent SSRF attacks on notification endpoints
  - Block private IPs (10.x, 172.16-31.x, 192.168.x, 169.254.x)
  - Block localhost and internal hostnames
  - Only allow HTTP/HTTPS protocols
- Add HTML escaping for medication names in email templates (XSS)
- Add stricter rate limiting for auth routes (5 req/15min for login/register)
- Add SSRF protection tests (405 tests total)
 2025-12-30 11:52:00 +01:00
Daniel Volz 5ad260a465 feat(auth, oidc): add user avatar URL to auth response and update redirect URLs to use frontend URL 2025-12-28 02:08:34 +01:00
Daniel Volz bd5c864e84 feat: add user avatar functionality and update related routes 
- Implemented avatar upload and deletion in the Auth context.
- Updated UserProfile component to handle avatar display and actions.
- Modified backend routes to return anonymous user ID when auth is disabled.
- Added avatar_url column to users table in the database.
- Enhanced UI for user menu and profile modal to support avatar display.
- Updated translations for new avatar-related strings.
- Improved stock status calculation for medications in the planner.
 2025-12-28 00:43:45 +01:00
Daniel Volz cfb8494be3 feat(auth): add 'remember me' functionality and token refresh logic 2025-12-27 21:59:21 +01:00
Daniel Volz a7f9f90db4 feat(auth): implement user authentication and profile management 
- Added authentication context and provider to manage user state.
- Created login and registration forms with validation and error handling.
- Implemented user profile component for updating user information and changing passwords.
- Introduced user settings in the database for notification preferences.
- Updated translations for authentication-related strings in English and German.
- Enhanced styles for authentication components and user profile.
- Added middleware for optional and required authentication checks.
 2025-12-26 19:57:35 +01:00
Daniel Volz 47f8494795 Initial commit 2025-12-19 13:09:53 +01:00