shuaiplus
299eda597f
fix(auth): align API keys and exclude device trust backups
2026-07-13 17:41:00 +08:00
shuaiplus
19de8d6e57
fix(auth): require complete password change key data
2026-07-13 17:02:59 +08:00
shuaiplus
573451c52f
feat(yubico): refactor Yubico credential management and enhance settings UI
2026-07-13 13:05:04 +08:00
shuaiplus
b731a014f1
fix(auth): prevent unexpected session logout
2026-07-13 02:11:12 +08:00
shuaiplus
fa611dc843
fix: require master password for admin and wipe-device actions
...
Gate invite management, user ban/delete, and delete-all-devices behind
masterPasswordHash verification, matching backup step-up auth. The web UI
prompts for the master password in the shared confirm dialog.
2026-07-12 20:43:27 +08:00
shuaiplus
14dff8ee6a
feat: disable new-device verification and update related logic across services
2026-07-10 13:00:32 +08:00
shuaiplus
04cb475935
feat: enhance date formatting in PublicSendPage and SendsPage components
2026-07-08 19:31:11 +08:00
shuaiplus
cc4a830be8
Harden backup and download token flows
2026-07-06 19:06:24 +08:00
shuaiplus
c6438747e3
Harden 2FA disable and website icon privacy
2026-07-06 18:45:54 +08:00
shuaiplus
5c8f01be59
Harden backup blob and remote endpoint handling
2026-07-06 18:17:55 +08:00
shuaiplus
7ac6ae50bb
Harden auth requests and backup endpoints
2026-07-06 18:04:23 +08:00
shuaiplus
51428461a8
fix: cap multipart backup and upload requests
2026-07-06 15:38:59 +08:00
shuaiplus
23c53bd1af
fix: validate anonymous notification hub requests
2026-07-06 15:38:52 +08:00
shuaiplus
ae168bea31
fix rate limit reset bypasses
2026-07-06 14:24:01 +08:00
shuaiplus
00e0ec0892
fix(backup): redact destination secrets in settings
2026-07-06 13:50:49 +08:00
shuaiplus
2df43ccdb0
fix(auth): revoke current access token session
2026-07-06 13:49:06 +08:00
shuaiplus
56b301f2d1
fix: align fill assist compatibility
2026-07-06 02:09:28 +08:00
shuaiplus
f0e523376c
fix: add admin auth request compatibility
2026-07-06 01:35:26 +08:00
shuaiplus
8b2f98b847
fix: add Bitwarden device registration endpoints
2026-07-06 01:35:19 +08:00
shuaiplus
cde4555add
fix: return unsupported for email and kdf flows
2026-07-06 01:35:12 +08:00
shuaiplus
e376a840c2
fix: add device verification settings endpoints
2026-07-06 00:59:34 +08:00
shuaiplus
109593da90
feat: support Bitwarden extended cipher types
2026-07-06 00:44:17 +08:00
shuaiplus
d028b194e7
fix(admin): record audit clears and passkey 2fa status
2026-07-05 23:45:18 +08:00
shuaiplus
cf14704d99
fix(import): validate payloads and zip entries
2026-07-05 23:44:36 +08:00
shuaiplus
0cef6a04e9
fix(backup): verify remote deletes and validate archives
2026-07-05 23:44:25 +08:00
shuaiplus
8c481a1564
fix(send): refresh routes and gate file access
2026-07-05 23:44:07 +08:00
shuaiplus
d9a36fefe6
fix(security): harden auth and request limits
2026-07-05 23:43:49 +08:00
shuaiplus
94b5f3e975
Merge branch 'main' of https://github.com/shuaiplus/nodewarden
2026-07-05 15:17:00 +08:00
shuaiplus
e73ae3d5ea
feat: enhance two-factor authentication handling and UI improvements
2026-07-05 15:05:53 +08:00
shuaiplus
c019c93726
feat: add passkey-based two-factor authentication
2026-07-05 14:51:11 +08:00
shuaiplus
f63b745d05
feat: Add YubiKey OTP support and management features
...
- Implemented YubiKey OTP settings management in useAccountSecurityActions hook.
- Added API functions for retrieving, saving, and bootstrapping YubiKey OTP credentials.
- Enhanced authentication flow to support multiple two-factor providers, including YubiKey.
- Updated localization files to include new YubiKey-related strings in English, Spanish, Russian, and Chinese.
- Introduced new styles for YubiKey management UI components.
- Created utility functions for YubiKey OTP validation and credential handling.
2026-07-04 02:49:46 +08:00
rootphantomer and Shuai
1ec6ed44a1
fix: reject plaintext FIDO2, SSH keys, and password history on import
...
Validate encrypted-string fields in validateCipherEncryptedFieldsForCompatibility
before they reach storage:
- FIDO2 credentials (12 fields: 8 required + 4 optional)
- SSH key (privateKey, publicKey, keyFingerprint/fingerprint)
- Password history (password per entry)
This closes a defense gap where plaintext in these positions was silently
accepted on import and later discarded at response time.
2026-07-02 17:36:06 +08:00
shuaiplus
60dd298dee
fix(security): harden jwt config and password rotation
2026-07-02 17:20:51 +08:00
shuaiplus
439683d350
fix(identity): add security stamp and invalidate user cache on token handling
2026-07-02 16:57:24 +08:00
shuaiplus
1545881eae
fix(auth): hash stored api keys
2026-07-02 16:27:20 +08:00
shuaiplus
baf569983d
fix(security): scope storage reads by user
2026-07-02 16:03:49 +08:00
shuaiplus
e4215b4025
feat: add fill-assist handlers and update device response type
2026-07-01 13:28:22 +08:00
shuaiplus
0d1bb196e2
feat: add functionality to delete invalid invites and update related components
2026-06-29 12:12:13 +08:00
shuaiplus
f82dcc3c17
feat: rename revokeInvite to deleteInvite and update related functionality
2026-06-29 11:47:05 +08:00
shuaiplus
82f968e51f
feat: add validFolderIds support for cipher responses and update folder handling in storage
2026-06-28 19:43:27 +08:00
shuaiplus
e9272ec29a
feat: enhance backup import functionality with locking mechanism and checksum support
2026-06-26 18:45:23 +08:00
shuaiplus and Shuai
23b23f39b9
fix: require reauthentication for auth request approval
2026-06-24 01:44:50 +08:00
shuaiplus and Shuai
a2a8f1c7b6
fix:Harden authentication and sensitive file handling
2026-06-24 01:44:50 +08:00
shuaiplus and Shuai
850fe0f044
fix: two-phase invite consumption to prevent registration race condition
2026-06-24 01:44:50 +08:00
shuaiplus and Shuai
7279668955
fix: address security issue
2026-06-24 01:44:50 +08:00
shuaiplus
79ed7c9f85
Add Bitwarden push relay support
2026-06-22 22:09:38 +08:00
shuaiplus
045b23fc47
Align web vault updates with resource sync
2026-06-21 18:16:44 +08:00
shuaiplus
42b765b113
Use resource sync notifications in the web client
2026-06-21 16:14:20 +08:00
shuaiplus
f9fe53285f
Preserve stored cipher permission flags in responses
2026-06-21 15:46:37 +08:00
shuaiplus
46ba8b9950
Emit cipher update notifications for attachment changes
2026-06-21 15:42:09 +08:00
shuaiplus
shuaiplus
rootphantomerandShuai