5 Commits

Include renames

Author	SHA1	Message	Date
codingetandClaude	aadc950e24	fix: scope apikey export to the caller for non-admins ... A non-admin's forced export filter includes co-resident *user* records so abode/resident data isn't left with dangling references, but the same `users` allowlist was also governing `apikey` records — leaking co-residents' apikey metadata (name/permissions/expiry, though not the secret token). Add a dedicated `apikeys` uid-allowlist to ExportFilter that scopes apikey records specifically, falling back to `users` when absent (so existing unfiltered/voluntary-narrowing behaviour and the round-trip are unchanged). computeForcedExportFilter now sets it to the caller alone (intersected with an apikey credential's restrict_users), so a non-admin can only ever export their own keys. Global admins (forced filter null) are unaffected. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-22 23:16:31 +00:00
codingetandClaude	ccb970f200	feat: add export/import streaming to the pluggable backends ... Add backend-agnostic data export/import over an NDJSON wire format, plus an inspect utility, exposed via three new CLIs and an HTTP export endpoint. - ExportImport types + filter helpers (kind/record scoping, hard-intersection of filters) in src/db/{types/ExportImport,export/filter}.ts - SqliteInterface implements Exportable + Importable: signal-checked async generator export (one query per table, per-record yield, trailing error sentinel on mid-stream failure) and a manually-driven import transaction that rolls back on any error/abort and never commits partial data - ApiInterface implements Exportable via its own fetch({signal}) - computeForcedExportFilter enforces non-global-admin scope (resided-in abodes + co-resident users, intersected with apikey restrict_*); GET /export intersects it with the caller's filter and wires an AbortController to the response socket - inspectExportStream reports kinds/counts from any stream without a db - abode-export / abode-import / abode-inspect CLIs (import is sqlite-only) - Secrets are not exported: imported users default to '#unset' passwords and apikeys are re-minted a token (ClientApikey view round-trips exactly) - test/tools/export-import.test.ts: round-trip, filter narrowing, forced-scope, export/import cancellation, in-process Koa endpoint, inspect Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-22 22:29:03 +00:00
codingetandCodex	31d4636dde	ci: add pull request quality gates ... Co-Authored-By: gpt-5.6-terra <noreply@openai.com>	2026-07-22 21:50:29 +00:00
codingetandClaude	73c4b169c5	fix(auth): invalidate session server-side on logout, not just the cookie ... /auth/logout previously only cleared the client's cookie, leaving the session token valid in the sessions table — a stolen cookie captured before logout would still work afterwards. Add BackendDbInterface#deleteSession (implemented in SqliteInterface) and call it from the logout route using the session token from the cookie. Caught by the new auth-http.test.ts integration test, updated to assert the session is actually invalidated. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-02 01:43:50 +00:00
codingetandClaude	da4e597f73	feat(tests): add unit and integration test suite (node:test) ... Adds 215 tests across three tiers using node:test + node:assert/strict (no new test framework dependencies): - test/tools/ — middleware and utility tests (token, hash, authenticate, jsonBody, convertError, validators) - test/shared/ — DbInterface/BackendDbInterface contract suites reusable across backends (users, abodes, residents, apikeys, sessions, auth) - test/backends/sqlite/ — SQLite-private tests (sql builder, WrappedDb, migrator) + shared suites via SqliteInterface - test/backends/api/ — ApiInterface unit tests + shared suites via a live Koa server backed by SQLite Also fixes four bugs uncovered by the tests: - ApiInterface: path params leaked into query string (slice(1) fix) - ApiInterface: calling res.json() on 204 No Content responses - SqliteInterface.updateResident: missing comma in SET clause - WrappedBetterSqlite3Db: readonly:undefined rejected by better-sqlite3 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-30 11:33:32 +00:00