root
88525a3f9f
perf(db): WAL + synchronous=NORMAL + 8MB page cache for per-user dbs, throttled device last_seen writes
...
- openDb pragmas: journal_mode=WAL, synchronous=NORMAL, temp_store=MEMORY,
cache_size=-8000; 3000-record stress write throughput 9514ms -> 1241ms
(7.7x), single upsert ~0.3ms; read paths unchanged (<=22ms)
- authUser: devices.last_seen_at now written only when stale > 60s,
removing one write per authenticated request (write amplification)
2026-10-17 22:09:48 +08:00
root
17ab5f0390
security(review): fix invite bypass via smuggled seed flag, login rate limit, server-side logout, attachment preview XSS hardening
...
- /auth/register: strip client-supplied seed flag (PoC confirmed it bypassed
invite code, MAX_USERS quota AND first-user auto-admin, granting admin
without any credential); demo-rebuild internal path unaffected
- /auth/login: per-IP+username of 5 consecutive failures gets a 10-minute
cooldown against in-memory counter (brute-force guard)
- /auth/logout: new endpoint revokes the current Bearer token server-side;
frontend calls it (best-effort) before local clearToken on sidebar logout
- attachment docx/xlsx preview: sanitize generated HTML (strip scripts,
event handlers, dangerous protocols) before dangerouslySetInnerHTML
render, preventing token theft via malicious previewed documents
PoC suite: seed smuggling rejected, 429 on 6th login attempt, token dead
after logout, per-user isolation intact (403/401/404 as before);
integration 61/61 green
2026-10-17 21:18:55 +08:00
root
48aa5dc07f
feat(admin): account deletion wipes all remote/local data (blobs+sqlite+changes), invites mark holder_gone; UI: invite \u5df2\u9500\u6237 badge + filter
2026-10-17 17:04:37 +08:00
root
f075f45b7c
test: move demo-rebuild assertion to end of phase A (reseed invalidates earlier fixture)
2026-10-17 15:11:50 +08:00
root
216d18c843
fix: lazy DATA_DIR in sync db (multi-instance safe), demo never admin, first real user auto-promoted
2026-10-17 14:59:23 +08:00
root
b48c36fdb3
feat(admin): demo account rebuild button + user asset registry (photo keys cascade-deleted with user)
2026-10-17 13:59:18 +08:00
root
78bfe188b6
fix(admin): cascade delete user tokens; test invite cleanup
2026-10-17 13:40:45 +08:00
root
5452611a63
feat(admin): user management - list + high-risk delete with full cascade (lsky, user db, attachments, auth)
2026-10-17 13:37:15 +08:00
root
500d59ba58
fix: profile_upsert payload binding
2026-10-17 12:05:56 +08:00
root
a0aa77dfda
feat: filename-aware attachment download endpoint (Content-Disposition), preview download uses it (no popup flash)
2026-10-17 11:07:00 +08:00
root
c39a4c80d5
feat: delete remote images from Lsky when record/attachment is deleted (keys stored at upload, legacy URLs resolved via pathname)
2026-10-17 10:10:19 +08:00
root
fdf383a832
fix: trim LSKY env values and strip accidental Bearer prefix
2026-10-17 10:02:35 +08:00
root
10fa64b5c8
test: fix raw upload assertions
2026-10-17 09:57:43 +08:00
root
f24088f359
fix: add sync-lsky to admin route gate (404 on migrate call)
2026-10-17 09:35:04 +08:00
root
102a55d010
fix: lsky gateway reads links.url + strategy_id support (COS strategy verified end-to-end: https cos url, public access ok)
2026-10-17 09:26:06 +08:00
root
2bba3be08e
feat: Lsky/COS gateway - attachments upload direct to object storage (remote_url/remote_thumb), preview loads from COS, graceful local fallback
2026-10-17 01:16:59 +08:00
root
275a0313e1
perf+ui: gzip (api/static precompressed), immutable attachment cache, responsive dialogs/header, safe-area + dynamic theme-color, mobile tuning
2026-10-16 23:34:36 +08:00
root
4e342ee77c
fix: commit sw.js v3 source + invite_codes remark migration (both were missed by earlier pathspecs)
2026-10-16 20:03:22 +08:00
root
4b5ff5d840
fix: mount app/server as /app/app-server dir + smart loader (single-file shadow mount was unreliable)
2026-10-16 19:58:48 +08:00
root
c6087d49d7
feat: POST /admin/demo-seed — admin can trigger demo data seeding and see the raw error
2026-10-16 19:15:11 +08:00
root
a7de5e301a
fix: lazily seed demo data whenever demo user db first opens (self-heal if startup seeding failed)
2026-10-16 19:03:26 +08:00
root
4cb7ccbf15
fix: demo seed works with existing users (seed flag) + static INVITE_CODE registration path + mount backend src (zero-build updates)
2026-10-16 18:31:42 +08:00
root
6129c42890
feat: 内置演示账号 demo/demo1234 + 登录页一键填充 + 服务器地址修复
2026-10-16 17:59:00 +08:00
root
9d97384aaf
sync: 各端互通引擎就位 —— wire 应用/拉取（LWW+FK uuid 映射）接入 /sync/push|pull，桌面与网页同库
2026-10-16 15:46:51 +08:00
root
dc520bfac0
feat: 管理员账号体系 + 动态邀请码管理; 各端内置数据固定 uuid 对齐
2026-10-16 15:24:49 +08:00
root
547157aaa1
feat: Web 版上线 footpr.linyux.cn —— 登录页 + 按用户隔离的命令 API + 静态托管
2026-10-16 15:00:58 +08:00
root
42ca57abfd
feat: 足迹 Footprints 个人留痕系统
...
桌面应用(Tauri+React+SQLite)：时间线/记录/学年学科成绩梯度/统计/类型与字段模板/附件内容寻址/详情视图/PWA
同步服务端(sync-server)：多用户+邀请码/LWW推拉/seq游标/附件去重/Docker部署
多端同步地基：uuid v7/HLC混合逻辑时钟/软删除墓碑/sync_oplog，Node与Rust双端一致并通过自动化测试
2026-10-16 13:53:15 +08:00
root