jappel/leistungsbilanz-ts
1
0
Fork 1
Code Issues 6 Pull requests Projects Releases Packages Wiki Activity Actions

Harden authentication and put filter toggle and fields in one row

Browse source 
Security: per-username login throttling, constant-time unknown-user check,
Sec-Fetch-Site CSRF guard for writes, session rotation on login and
password change, absolute session lifetime, sessions ended on reset and
deactivation, last-admin protection, input length caps, ASCII usernames,
clickjacking headers. Covered by tests/authentication.test.ts.

Filter panel: toggle, fields and count share one row to save space.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Grovy311 2026-09-28 21:30:30 +02:00
parent 8d2948cdb1
commit 5073d9342a
18 changed files with 683 additions and 81 deletions
Download patch file Download diff file Expand all files Collapse all files

13
src/shared/validation/auth.schemas.ts
View file

@ -1,15 +1,20 @@
import { z } from "zod";
// Upper bounds keep a huge request body from being fed into scrypt.
export const MAX_USERNAME_LENGTH = 100;
export const MAX_PASSWORD_LENGTH = 200;
export const MIN_PASSWORD_LENGTH = 8;
export const loginSchema = z
.object({
username: z.string().trim().min(1),
password: z.string().min(1),
username: z.string().trim().min(1).max(MAX_USERNAME_LENGTH),
password: z.string().min(1).max(MAX_PASSWORD_LENGTH),
})
.strict();
export const changePasswordSchema = z
.object({
currentPassword: z.string().min(1),
newPassword: z.string().min(8).max(200),
currentPassword: z.string().min(1).max(MAX_PASSWORD_LENGTH),
newPassword: z.string().min(MIN_PASSWORD_LENGTH).max(MAX_PASSWORD_LENGTH),
})
.strict();