shuaiplus
293f5ce196
fix: preserve vault fields and align cipher compatibility
...
Preserve linked and unknown encrypted fields in Web edits, reject stale and concurrent saves, and support official bulk delete and restore methods while retaining legacy routes.
Add 20 offline compatibility regressions and update undici to 8.10.2. Verified 51 tests, TypeScript checks, locale validation, Web build and Worker deployment dry run. The unpatched braces advisory remains visible.
2026-10-05 14:25:06 +08:00
shuaiplus
5f71cb388c
fix: improve authentication reliability and account compatibility
...
Resolve bugs in internal authentication handling and improve consistency across supported account flows.
Maintain compatibility with existing accounts while preserving user data and established client behavior.
Validation: TypeScript checks, production build, and Worker packaging checks passed.
2026-10-04 15:57:29 +08:00
KiritoXDone
a72592e76e
fix(cipher): clear omitted notes on full update ( #363 )
...
Treat omitted nullable cipher fields as cleared during full updates so stale encrypted notes are not restored by merge fallback.
Fixes #362
2026-08-30 01:57:41 +08:00
Chius
e63f9663e8
security: prevent websocket JWT leakage through URL query tokens ( #349 )
...
* security: prevent websocket JWT query authentication
* fix: harden websocket connection tickets
* fix: expire unused websocket tickets
2026-08-30 01:56:31 +08:00
shuaiplus
652952379b
fix: stop accepting backup blob credentials from the URL
2026-07-26 16:00:39 +08:00
shuaiplus
a0128908e1
fix: align API responses with Bitwarden 2026.7 clients
2026-07-25 21:25:51 +08:00
shuaiplus
299eda597f
fix(auth): align API keys and exclude device trust backups
2026-07-13 17:41:00 +08:00
shuaiplus
19de8d6e57
fix(auth): require complete password change key data
2026-07-13 17:02:59 +08:00
shuaiplus
573451c52f
feat(yubico): refactor Yubico credential management and enhance settings UI
2026-07-13 13:05:04 +08:00
shuaiplus
b731a014f1
fix(auth): prevent unexpected session logout
2026-07-13 02:11:12 +08:00
shuaiplus
fa611dc843
fix: require master password for admin and wipe-device actions
...
Gate invite management, user ban/delete, and delete-all-devices behind
masterPasswordHash verification, matching backup step-up auth. The web UI
prompts for the master password in the shared confirm dialog.
2026-07-12 20:43:27 +08:00
shuaiplus
14dff8ee6a
feat: disable new-device verification and update related logic across services
2026-07-10 13:00:32 +08:00
shuaiplus
04cb475935
feat: enhance date formatting in PublicSendPage and SendsPage components
2026-07-08 19:31:11 +08:00
shuaiplus
cc4a830be8
Harden backup and download token flows
2026-07-06 19:06:24 +08:00
shuaiplus
c6438747e3
Harden 2FA disable and website icon privacy
2026-07-06 18:45:54 +08:00
shuaiplus
5c8f01be59
Harden backup blob and remote endpoint handling
2026-07-06 18:17:55 +08:00
shuaiplus
7ac6ae50bb
Harden auth requests and backup endpoints
2026-07-06 18:04:23 +08:00
shuaiplus
51428461a8
fix: cap multipart backup and upload requests
2026-07-06 15:38:59 +08:00
shuaiplus
23c53bd1af
fix: validate anonymous notification hub requests
2026-07-06 15:38:52 +08:00
shuaiplus
ae168bea31
fix rate limit reset bypasses
2026-07-06 14:24:01 +08:00
shuaiplus
00e0ec0892
fix(backup): redact destination secrets in settings
2026-07-06 13:50:49 +08:00
shuaiplus
2df43ccdb0
fix(auth): revoke current access token session
2026-07-06 13:49:06 +08:00
shuaiplus
56b301f2d1
fix: align fill assist compatibility
2026-07-06 02:09:28 +08:00
shuaiplus
f0e523376c
fix: add admin auth request compatibility
2026-07-06 01:35:26 +08:00
shuaiplus
8b2f98b847
fix: add Bitwarden device registration endpoints
2026-07-06 01:35:19 +08:00
shuaiplus
cde4555add
fix: return unsupported for email and kdf flows
2026-07-06 01:35:12 +08:00
shuaiplus
e376a840c2
fix: add device verification settings endpoints
2026-07-06 00:59:34 +08:00
shuaiplus
109593da90
feat: support Bitwarden extended cipher types
2026-07-06 00:44:17 +08:00
shuaiplus
d028b194e7
fix(admin): record audit clears and passkey 2fa status
2026-07-05 23:45:18 +08:00
shuaiplus
cf14704d99
fix(import): validate payloads and zip entries
2026-07-05 23:44:36 +08:00
shuaiplus
0cef6a04e9
fix(backup): verify remote deletes and validate archives
2026-07-05 23:44:25 +08:00
shuaiplus
8c481a1564
fix(send): refresh routes and gate file access
2026-07-05 23:44:07 +08:00
shuaiplus
d9a36fefe6
fix(security): harden auth and request limits
2026-07-05 23:43:49 +08:00
shuaiplus
94b5f3e975
Merge branch 'main' of https://github.com/shuaiplus/nodewarden
2026-07-05 15:17:00 +08:00
shuaiplus
e73ae3d5ea
feat: enhance two-factor authentication handling and UI improvements
2026-07-05 15:05:53 +08:00
shuaiplus
c019c93726
feat: add passkey-based two-factor authentication
2026-07-05 14:51:11 +08:00
shuaiplus
f63b745d05
feat: Add YubiKey OTP support and management features
...
- Implemented YubiKey OTP settings management in useAccountSecurityActions hook.
- Added API functions for retrieving, saving, and bootstrapping YubiKey OTP credentials.
- Enhanced authentication flow to support multiple two-factor providers, including YubiKey.
- Updated localization files to include new YubiKey-related strings in English, Spanish, Russian, and Chinese.
- Introduced new styles for YubiKey management UI components.
- Created utility functions for YubiKey OTP validation and credential handling.
2026-07-04 02:49:46 +08:00
rootphantomer
1ec6ed44a1
fix: reject plaintext FIDO2, SSH keys, and password history on import
...
Validate encrypted-string fields in validateCipherEncryptedFieldsForCompatibility
before they reach storage:
- FIDO2 credentials (12 fields: 8 required + 4 optional)
- SSH key (privateKey, publicKey, keyFingerprint/fingerprint)
- Password history (password per entry)
This closes a defense gap where plaintext in these positions was silently
accepted on import and later discarded at response time.
2026-07-02 17:36:06 +08:00
shuaiplus
60dd298dee
fix(security): harden jwt config and password rotation
2026-07-02 17:20:51 +08:00
shuaiplus
439683d350
fix(identity): add security stamp and invalidate user cache on token handling
2026-07-02 16:57:24 +08:00
shuaiplus
1545881eae
fix(auth): hash stored api keys
2026-07-02 16:27:20 +08:00
shuaiplus
baf569983d
fix(security): scope storage reads by user
2026-07-02 16:03:49 +08:00
shuaiplus
e4215b4025
feat: add fill-assist handlers and update device response type
2026-07-01 13:28:22 +08:00
shuaiplus
0d1bb196e2
feat: add functionality to delete invalid invites and update related components
2026-06-29 12:12:13 +08:00
shuaiplus
f82dcc3c17
feat: rename revokeInvite to deleteInvite and update related functionality
2026-06-29 11:47:05 +08:00
shuaiplus
82f968e51f
feat: add validFolderIds support for cipher responses and update folder handling in storage
2026-06-28 19:43:27 +08:00
shuaiplus
e9272ec29a
feat: enhance backup import functionality with locking mechanism and checksum support
2026-06-26 18:45:23 +08:00
shuaiplus
23b23f39b9
fix: require reauthentication for auth request approval
2026-06-24 01:44:50 +08:00
shuaiplus
a2a8f1c7b6
fix:Harden authentication and sensitive file handling
2026-06-24 01:44:50 +08:00
shuaiplus
850fe0f044
fix: two-phase invite consumption to prevent registration race condition
2026-06-24 01:44:50 +08:00
shuaiplus
KiritoXDone
Chius
shuaiplus
rootphantomer