till/managarten
1
0
Fork 0
mirror of https://github.com/Memo-2023/mana-monorepo.git synced 2026-05-20 05:33:38 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 5
3904 commits 34 branches 38 tags 146 MiB
Commit graph

5 commits

Author SHA1 Message Date
Till JS
fdc1c0023a refactor(theme): migrate --theme-* tokens in shared-auth-ui 
Third naming convention uncovered: six shared-auth-ui components
(PasskeyManager, SessionManager, TwoFactorSetup, AuditLog,
ChangePassword, SecurityOnboarding) use --theme-muted, --theme-border,
etc. These tokens are not defined anywhere in the Mana theme system —
they only rendered because of inline raw-channel fallbacks, so they
never tracked the active theme variant.

Map to the canonical --color-* tokens:
  --theme-background       → --color-background
  --theme-border           → --color-border
  --theme-foreground       → --color-foreground
  --theme-muted            → --color-muted
  --theme-muted-foreground → --color-muted-foreground
  --theme-surface          → --color-surface

Visible on the Security tab in the unified settings page, where the
inner passkey/session/2FA/audit cards can now pick up theme changes.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-16 00:16:39 +02:00
Till JS
3b7b6c9761 refactor(auth-ui): SessionManager i18n, shared userAgent util, a11y fixes 
- Add locale prop (de/en) to SessionManager with full English translations
- Extract duplicated parseUserAgent/getDeviceType to utils/userAgent.ts
- Fix hardcoded aria-label in SessionManager refresh button
- Add prefers-reduced-motion to PasskeyManager, TwoFactorSetup,
  SessionExpiredBanner

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-31 14:14:16 +02:00
Till JS
5fa773d400 refactor(auth-ui): unify dark mode to CSS variables + .dark class pattern 
Replace hardcoded colors and inconsistent dark mode patterns across
7 auth-ui components with semantic CSS variables (--theme-*).

- PasskeyManager: 24 :global(.dark) rules → CSS vars (kept semantic amber/red)
- TwoFactorSetup: flip from dark-default + :global(.light) → light-default + CSS vars
- ChangePassword: flip from :global(.light) → CSS vars, zero :global(.dark) rules
- SecurityOnboarding: flip from :global(.light) → CSS vars
- GuestWelcomeModal: convert @media prefers-color-scheme → :global(.dark) pattern
- SessionManager: replace hardcoded fallbacks with CSS vars
- AuditLog: replace all fallback patterns with CSS vars

Net: -451 lines / +180 lines of CSS

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-31 14:06:25 +02:00
Till JS
3b54d4d48e refactor(auth-ui): i18n, security fixes, type safety across auth components 
- Add locale prop (de/en) to PasswordStrength, ChangePassword,
  SecurityOnboarding, AuditLog, AuthGate tier screen
- Add 13 new i18n keys to LoginTranslations for 2FA, lockout, magic link
- Fix date formatting to use locale in AuditLog
- Rewrite ForgotPasswordPage to Tailwind (matching Login/Register)
- Fix HTML injection in ForgotPasswordPage (remove @html with email)
- Guard DEV credentials behind isDevMode check in LoginPage
- Extend AuthResult type with twoFactorRedirect and retryAfter
- Remove as any casts in LoginPage
- Replace scoped CSS with Tailwind in AuthGate tier-denied screen

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-31 13:41:53 +02:00
Till JS
0dfd603892 feat(auth): rate limit feedback, audit log UI, and E2E tests 
Rate-limiting feedback:
- LoginPage detects 429/account-locked errors and shows countdown timer
- Submit button disabled during cooldown period

Audit log:
- GET /auth/security-events endpoint (JWT-protected) in auth controller
- getSecurityEvents() in BetterAuthService + shared-auth client
- AuditLog component with event type labels, relative dates, UA parsing
- Integrated in ManaCore settings page

E2E tests (passkey-2fa.e2e-spec.ts):
- Passkey registration/authentication flow tests
- Auth guard enforcement (protected vs public endpoints)
- 2FA passthrough route existence tests
- Edge cases (cross-user access, missing fields, token shape)

CSRF note: Already covered by Better Auth (SameSite + HttpOnly +
Trusted Origins). Token refresh already has 4-retry + offline detection.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-26 21:58:56 +01:00