till/managarten
1
0
Fork 0
mirror of https://github.com/Memo-2023/mana-monorepo.git synced 2026-05-21 09:36:42 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 5
2792 commits 34 branches 38 tags 146 MiB
Commit graph

4 commits

Author SHA1 Message Date
Till JS
3b7b6c9761 refactor(auth-ui): SessionManager i18n, shared userAgent util, a11y fixes 
- Add locale prop (de/en) to SessionManager with full English translations
- Extract duplicated parseUserAgent/getDeviceType to utils/userAgent.ts
- Fix hardcoded aria-label in SessionManager refresh button
- Add prefers-reduced-motion to PasskeyManager, TwoFactorSetup,
  SessionExpiredBanner

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-31 14:14:16 +02:00
Till JS
5fa773d400 refactor(auth-ui): unify dark mode to CSS variables + .dark class pattern 
Replace hardcoded colors and inconsistent dark mode patterns across
7 auth-ui components with semantic CSS variables (--theme-*).

- PasskeyManager: 24 :global(.dark) rules → CSS vars (kept semantic amber/red)
- TwoFactorSetup: flip from dark-default + :global(.light) → light-default + CSS vars
- ChangePassword: flip from :global(.light) → CSS vars, zero :global(.dark) rules
- SecurityOnboarding: flip from :global(.light) → CSS vars
- GuestWelcomeModal: convert @media prefers-color-scheme → :global(.dark) pattern
- SessionManager: replace hardcoded fallbacks with CSS vars
- AuditLog: replace all fallback patterns with CSS vars

Net: -451 lines / +180 lines of CSS

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-31 14:06:25 +02:00
Till JS
3b54d4d48e refactor(auth-ui): i18n, security fixes, type safety across auth components 
- Add locale prop (de/en) to PasswordStrength, ChangePassword,
  SecurityOnboarding, AuditLog, AuthGate tier screen
- Add 13 new i18n keys to LoginTranslations for 2FA, lockout, magic link
- Fix date formatting to use locale in AuditLog
- Rewrite ForgotPasswordPage to Tailwind (matching Login/Register)
- Fix HTML injection in ForgotPasswordPage (remove @html with email)
- Guard DEV credentials behind isDevMode check in LoginPage
- Extend AuthResult type with twoFactorRedirect and retryAfter
- Remove as any casts in LoginPage
- Replace scoped CSS with Tailwind in AuthGate tier-denied screen

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-31 13:41:53 +02:00
Till JS
0dfd603892 feat(auth): rate limit feedback, audit log UI, and E2E tests 
Rate-limiting feedback:
- LoginPage detects 429/account-locked errors and shows countdown timer
- Submit button disabled during cooldown period

Audit log:
- GET /auth/security-events endpoint (JWT-protected) in auth controller
- getSecurityEvents() in BetterAuthService + shared-auth client
- AuditLog component with event type labels, relative dates, UA parsing
- Integrated in ManaCore settings page

E2E tests (passkey-2fa.e2e-spec.ts):
- Passkey registration/authentication flow tests
- Auth guard enforcement (protected vs public endpoints)
- 2FA passthrough route existence tests
- Edge cases (cross-user access, missing fields, token shape)

CSRF note: Already covered by Better Auth (SameSite + HttpOnly +
Trusted Origins). Token refresh already has 4-retry + offline detection.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-26 21:58:56 +01:00