4 Commits

Author	SHA1	Message	Date
Brendan Chen	f4eaf88495	feat(auth): add login_attempts schema, lockout config, dummy-hash helper ... Lays the foundation for brute-force defense: per-username attempt tracking table, configurable lockout/rate-limit thresholds, and a memoized dummy bcrypt hash so unknown-user paths can be timed identically to wrong-password paths in a later step. Adds @fastify/rate-limit dependency for upcoming per-IP rate-limit on login routes.	2026-05-03 03:26:46 -07:00
Brendan Chen	f27ba4922a	chore: patch dependency vulnerabilities via npm audit fix ... Resolves 7 advisories (1 critical, 3 high, 3 moderate) without package.json range changes: - fast-jwt: algorithm confusion, cache key collision, ReDoS - fastify: content-type validation bypass, host spoofing - @fastify/static: path traversal & encoded-separator route bypass - vite (dev only): WS file read, fs.deny bypass, .map traversal - postcss/picomatch/brace-expansion (transitive): XSS, ReDoS, DoS npm audit clean; 61 tests pass.	2026-05-03 03:06:47 -07:00
Brendan Chen	b6aa6211a9	Scaffold project and implement config, DB schema/queries ... - Set up package.json (ESM, scripts), tsconfig.json, vitest.config.ts - Install runtime and dev dependencies - Add CLAUDE.md with architecture notes and code quality rules - Config module with env var parsing and JWT_SECRET validation - DB schema: users + files tables with FK cascade - DB queries: createUser, getUserBy*, createFile, getFileById, getFilesByUserId, deleteFile - Tests for config, db/users, db/files (15 tests passing) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-03 15:48:21 -08:00
Brendan Chen	5902cc404a	Initial commit	2026-03-03 15:37:50 -08:00