shuaiplus
a366acbac0
Revert redirect guard in backup uploader
2026-07-06 23:54:17 +08:00
shuaiplus
57c5ef9da6
Remove WEBSITE_ICONS_ENABLED and always enable website icons
2026-07-06 22:56:36 +08:00
shuaiplus
f532d3ace3
Preserve WebAuthn credential purpose in backups
2026-07-06 22:25:02 +08:00
shuaiplus
cc4a830be8
Harden backup and download token flows
2026-07-06 19:06:24 +08:00
shuaiplus
c6438747e3
Harden 2FA disable and website icon privacy
2026-07-06 18:45:54 +08:00
shuaiplus
5c8f01be59
Harden backup blob and remote endpoint handling
2026-07-06 18:17:55 +08:00
shuaiplus
7ac6ae50bb
Harden auth requests and backup endpoints
2026-07-06 18:04:23 +08:00
shuaiplus
ace00e8e74
Harden WebAuthn extension origins
2026-07-06 17:43:57 +08:00
shuaiplus
51428461a8
fix: cap multipart backup and upload requests
2026-07-06 15:38:59 +08:00
shuaiplus
23c53bd1af
fix: validate anonymous notification hub requests
2026-07-06 15:38:52 +08:00
shuaiplus
ae168bea31
fix rate limit reset bypasses
2026-07-06 14:24:01 +08:00
shuaiplus
00e0ec0892
fix(backup): redact destination secrets in settings
2026-07-06 13:50:49 +08:00
shuaiplus
2df43ccdb0
fix(auth): revoke current access token session
2026-07-06 13:49:06 +08:00
shuaiplus
fd46dffc34
fix: align push relay installation requests
2026-07-06 02:09:35 +08:00
shuaiplus
56b301f2d1
fix: align fill assist compatibility
2026-07-06 02:09:28 +08:00
shuaiplus
f0e523376c
fix: add admin auth request compatibility
2026-07-06 01:35:26 +08:00
shuaiplus
8b2f98b847
fix: add Bitwarden device registration endpoints
2026-07-06 01:35:19 +08:00
shuaiplus
cde4555add
fix: return unsupported for email and kdf flows
2026-07-06 01:35:12 +08:00
shuaiplus
e376a840c2
fix: add device verification settings endpoints
2026-07-06 00:59:34 +08:00
shuaiplus
109593da90
feat: support Bitwarden extended cipher types
2026-07-06 00:44:17 +08:00
shuaiplus
d028b194e7
fix(admin): record audit clears and passkey 2fa status
2026-07-05 23:45:18 +08:00
shuaiplus
cf14704d99
fix(import): validate payloads and zip entries
2026-07-05 23:44:36 +08:00
shuaiplus
0cef6a04e9
fix(backup): verify remote deletes and validate archives
2026-07-05 23:44:25 +08:00
shuaiplus
8c481a1564
fix(send): refresh routes and gate file access
2026-07-05 23:44:07 +08:00
shuaiplus
d9a36fefe6
fix(security): harden auth and request limits
2026-07-05 23:43:49 +08:00
shuaiplus
d8cc88d9c0
feat: add UUID normalization functions and enhance WebAuthn response handling
2026-07-05 15:37:02 +08:00
shuaiplus
94b5f3e975
Merge branch 'main' of https://github.com/shuaiplus/nodewarden
2026-07-05 15:17:00 +08:00
shuaiplus
e73ae3d5ea
feat: enhance two-factor authentication handling and UI improvements
2026-07-05 15:05:53 +08:00
shuaiplus
c019c93726
feat: add passkey-based two-factor authentication
2026-07-05 14:51:11 +08:00
shuaiplus
f63b745d05
feat: Add YubiKey OTP support and management features
...
- Implemented YubiKey OTP settings management in useAccountSecurityActions hook.
- Added API functions for retrieving, saving, and bootstrapping YubiKey OTP credentials.
- Enhanced authentication flow to support multiple two-factor providers, including YubiKey.
- Updated localization files to include new YubiKey-related strings in English, Spanish, Russian, and Chinese.
- Introduced new styles for YubiKey management UI components.
- Created utility functions for YubiKey OTP validation and credential handling.
2026-07-04 02:49:46 +08:00
rootphantomer and Shuai
1ec6ed44a1
fix: reject plaintext FIDO2, SSH keys, and password history on import
...
Validate encrypted-string fields in validateCipherEncryptedFieldsForCompatibility
before they reach storage:
- FIDO2 credentials (12 fields: 8 required + 4 optional)
- SSH key (privateKey, publicKey, keyFingerprint/fingerprint)
- Password history (password per entry)
This closes a defense gap where plaintext in these positions was silently
accepted on import and later discarded at response time.
2026-07-02 17:36:06 +08:00
shuaiplus
60dd298dee
fix(security): harden jwt config and password rotation
2026-07-02 17:20:51 +08:00
shuaiplus
439683d350
fix(identity): add security stamp and invalidate user cache on token handling
2026-07-02 16:57:24 +08:00
shuaiplus
1545881eae
fix(auth): hash stored api keys
2026-07-02 16:27:20 +08:00
shuaiplus
baf569983d
fix(security): scope storage reads by user
2026-07-02 16:03:49 +08:00
shuaiplus
e4215b4025
feat: add fill-assist handlers and update device response type
2026-07-01 13:28:22 +08:00
shuaiplus
0d1bb196e2
feat: add functionality to delete invalid invites and update related components
2026-06-29 12:12:13 +08:00
shuaiplus
f82dcc3c17
feat: rename revokeInvite to deleteInvite and update related functionality
2026-06-29 11:47:05 +08:00
shuaiplus
82f968e51f
feat: add validFolderIds support for cipher responses and update folder handling in storage
2026-06-28 19:43:27 +08:00
shuaiplus
31dcc76ee2
Merge branch 'main' of https://github.com/shuaiplus/nodewarden
2026-06-26 20:58:22 +08:00
soncms and Shuai
bf6ac7b405
Enable WebAuthn related origins support
2026-06-26 20:51:33 +08:00
shuaiplus
e9272ec29a
feat: enhance backup import functionality with locking mechanism and checksum support
2026-06-26 18:45:23 +08:00
shuaiplus and Shuai
23b23f39b9
fix: require reauthentication for auth request approval
2026-06-24 01:44:50 +08:00
shuaiplus and Shuai
a2a8f1c7b6
fix:Harden authentication and sensitive file handling
2026-06-24 01:44:50 +08:00
shuaiplus and Shuai
850fe0f044
fix: two-phase invite consumption to prevent registration race condition
2026-06-24 01:44:50 +08:00
shuaiplus and Shuai
7279668955
fix: address security issue
2026-06-24 01:44:50 +08:00
shuaiplus
79ed7c9f85
Add Bitwarden push relay support
2026-06-22 22:09:38 +08:00
shuaiplus
9a21504f40
Fix realtime sync notifications
2026-06-22 16:46:55 +08:00
shuaiplus
045b23fc47
Align web vault updates with resource sync
2026-06-21 18:16:44 +08:00
shuaiplus
42b765b113
Use resource sync notifications in the web client
2026-06-21 16:14:20 +08:00
shuaiplus
rootphantomerandShuai
soncmsandShuai