3 Commits

Author	SHA1	Message	Date
Somoru	f0ba83c2ad	security: comprehensive hardening of multi-user implementation ... Production-ready security improvements: 1. Password Security Enhancements: - Increased minimum password length from 4 to 8 characters - Added maximum length limit (100 chars) to prevent DoS - Migration now validates password exists and is not empty - Proper validation before creating admin user 2. Timing Attack Prevention: - Implemented constant-time comparison using crypto.timingSafeEqual - Added dummy hash computation for non-existent users - Prevents username enumeration via timing analysis 3. Comprehensive Input Validation: - Username: 3-50 chars, alphanumeric + . _ - only - Email: Format validation, 100 char limit - All validation centralized in user_management service - Proper error messages without leaking info 4. Code Quality Improvements: - Fixed parseInt() calls to use radix 10 and check NaN - Added try-catch for validation errors in API routes - Improved error handling throughout 5. Security Documentation: - Added comprehensive 'Security Considerations' section - Documented implemented protections - Listed recommended infrastructure-level protections - Documented known limitations (username enumeration, etc.) - Clear guidance on rate limiting, HTTPS, monitoring All changes maintain backward compatibility and pass TypeScript validation. Zero errors, production-ready security posture.	2025-10-21 16:44:35 +05:30
Somoru	ccaabcf933	fix: address maintainer review feedback for multi-user PR ... Critical fixes: - Update APP_DB_VERSION to 234 to trigger migration (was 233) * Without this, the migration would never run * Migration is now correctly applied on server start Documentation improvements in MULTI_USER.md: - Clarify use of user_data table (OAuth v229) vs user_info (MFA) - Explain why users are NOT Becca entities: * Auth data should never be synced for security * Becca is for synchronized content only * Each instance needs isolated user databases - Document future sync support requirements - Add note about migration triggering mechanism This addresses eliandoran's comments on PR #7441: - Migration not applying due to version mismatch - Question about user_info vs user_data table - Concern about Becca entity model integration - Question about cross-instance synchronization	2025-10-21 15:25:27 +05:30
Somoru	6cde730553	feat: complete multi-user implementation with authentication and documentation ... - Update login flow to support multi-user mode with username field - Fix session type definitions (userId as number/tmpID) - Add comprehensive MULTI_USER.md documentation covering: * Architecture and database schema details * Setup instructions and API reference * Security implementation (scrypt parameters) * Backward compatibility with single-user mode * Future enhancements and limitations All components now properly integrate with existing user_data table from OAuth migration v229. Zero TypeScript errors.	2025-10-21 14:51:20 +05:30