Repository navigation
Auth timing/enumeration hardening, admin ledger pagination, helmet, auth docs - #2046
Merged
yusuftomilola merged 2 commits intoOct 17, 2026
Conversation
…olled headers (DistinctCodes#1964, DistinctCodes#1963, DistinctCodes#1962, DistinctCodes#1961) auth: run a bcrypt comparison against a generated cost-12 dummy hash when the login email is unknown, so a miss costs the same as a known address with a wrong password and no longer leaks registration status by timing. Registration keeps its 409 by decision (an identical response needs an email-verification flow this codebase lacks yet); the rationale is documented in code and docs. (DistinctCodes#1964) docs: add backend/src/auth/README.md covering token lifetime, cookie vs bearer, the SameSite=Strict CSRF stance, role semantics (RolesGuard any-of), websocket handshake auth and the admin bootstrap procedure, with a sequence diagram; link it from the root README. (DistinctCodes#1963) credits: paginate GET /credits/admin/accounts with an opaque (createdAt, id) cursor and a hard 200-row cap, and replace the in-memory xlsx export with ExcelJS's streaming writer walking pages, capped at 100k rows. Limits documented in Swagger. (DistinctCodes#1962) main: replace the hand-rolled security-headers block with explicitly configured helmet(), relaxing the CSP only for /api/docs, and disable x-powered-by. Adds helmet to dependencies. (DistinctCodes#1961) Closes DistinctCodes#1964 Closes DistinctCodes#1963 Closes DistinctCodes#1962 Closes DistinctCodes#1961
|
@RennyThompson is attempting to deploy a commit to the naijabuz's projects Team on Vercel. A member of the Team first needs to authorize it. |
|
@RennyThompson Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
… hand-rolled headers, request-id handled by RequestContextMiddleware
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
AuthService.loginnow compares against a dummy bcrypt hash when the email is unknown, so response timing no longer reveals whether an account exists; registration behaviour for existing emails is documented and handled consistently.backend/src/auth/README.mddocumenting token lifetime, cookie vs bearer, CSRF stance (SameSite=Strict), role semantics andRolesGuardany-of matching, socket authentication, the admin bootstrap procedure and a sequence diagram; linked from the root README.GET /credits/admin/accountsand its export now takelimit/cursor pagination (max 200) and the xlsx export uses ExcelJS's streaming writer with a row cap, keeping memory flat regardless of tenant count; limits documented in Swagger.main.tswith explicitly configuredhelmet()(CSP relaxed only for/api/docs), disabledX-Powered-By, and added the dependency.Closes #1964
Closes #1963
Closes #1962
Closes #1961