Refactor authentication, upgrade dependencies, and improve security - #58
Merged
Conversation
… data to the api file
Bumps the all-dependencies group with 1 update: [oven-sh/setup-bun](https://github.com/oven-sh/setup-bun). Updates `oven-sh/setup-bun` from 2.1.3 to 2.2.0 - [Release notes](https://github.com/oven-sh/setup-bun/releases) - [Commits](oven-sh/setup-bun@ecf28dd...0c5077e) --- updated-dependencies: - dependency-name: oven-sh/setup-bun dependency-version: 2.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps the all-dependencies group with 1 update: [@nuxt/hints](https://github.com/nuxt/hints). Updates `@nuxt/hints` from 1.0.0 to 1.0.1 - [Release notes](https://github.com/nuxt/hints/releases) - [Commits](nuxt/hints@v1.0.0...v1.0.1) --- updated-dependencies: - dependency-name: "@nuxt/hints" dependency-version: 1.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
…kages Updates multiple development tools and dependencies to their latest versions: - Trunk linters: checkov (3.2.508→3.2.510), eslint (10.0.3→10.1.0), trufflehog (3.93.8→3.94.0) - Mise tools: bun (1.3.10→1.3.11), rust (1.93.0→1.94.0) - NPM packages: @tailwindcss/vite (4.2.1→4.2.2), eslint (10.0.3→10.1.0), tailwindcss (4.2.1→4.2.2), vue-router (5.0.3→5.0.4), drizzle-kit (0.31.9→0.31.10), nitropack (2.13.1→2.13.2), wrangler (4.73.0→4.76.0) - Adds @types/bun (1.3.11) as new dev dependency - Updates Cloudflare Workers runtime types (workerd 1.20260312.1→ 1.20260317.1) with new Stream binding API and WorkerLoader.load method Keeping dependencies up-to-date ensures access to latest bug fixes, security patches, and performance improvements while maintaining compatibility with the current Node.js and Bun runtime versions.
Update @nuxt/hints from 1.0.0 to 1.0.1 along with its transitive dependencies including devalue (5.6.3 -> 5.6.4), html-validate (10.11.1 -> 10.11.2), oxc-parser (0.117.0 -> 0.120.0), and vite-plugin-vue-tracer (1.2.0 -> 1.3.0). This ensures compatibility with the latest bug fixes and improvements in the Nuxt hints module and its ecosystem.
Keeping the wrangler dependency up to date ensures access to the latest features, bug fixes, and security patches for Cloudflare Workers development and deployment tooling.
The rust toolchain is no longer needed for this project's development environment, so it has been commented out to reduce unnecessary tool installations and speed up environment setup.
Move Cloudflare-specific type declarations from env.d.ts to a new shared/cloudflare.d.ts file and add D1Database type definition in insertSample.post.ts. This refactoring improves code organization by centralizing Cloudflare-related type definitions in a dedicated shared module, making them easier to maintain and reuse across the project. The D1Database type is temporarily defined as 'any' to resolve type errors until proper types are imported.
The D1Database type is already available from the Cloudflare Workers types package, making the local type definition redundant and unnecessary. Removing it reduces code duplication and relies on the official type definitions instead.
… and improve error handling 🐛 (login.vue): add prevent modifier to form submit to stop page reload 🔇 (login.vue): remove outdated comments about non-working logs ⬇️ (package.json): downgrade @nuxt/hints from 1.0.1 to 1.0.0 The login form now uses $fetch instead of useFetch for better control over the API call lifecycle. The form submit handler now properly prevents default form submission behavior to avoid page reloads. Error handling has been improved with more descriptive console.error messages. Removed await from console.log as it's unnecessary and cleaned up misleading comments about logging issues.
🗃️ Add password column to users table via migration The API endpoint is refactored from a Cloudflare Workers-style handler to a Nuxt defineEventHandler pattern, making it consistent with the framework's conventions. The implementation now properly uses the useDB utility and includes both insert and select operations with returned results. A new database migration adds a password field to the users table to support authentication functionality. The field is nullable to allow for gradual migration of existing user records.
The password field should be made non-nullable in production to ensure data integrity and security. This comment serves as a reminder for future implementation when moving to production environment.
…into rianovrv1/starting
Initialize a scripts directory to house future development and deployment scripts. The .keep file ensures the empty directory is tracked by git until actual script files are added.
…e Insert which will be used for Registration to make sure multiple of the same email dont make it into the system
# Conflicts: # .trunk/trunk.yaml # bun.lock # mise.toml # package.json # worker-configuration.d.ts
The select variable was assigned but never used, causing a linter warning. Prefixing it with an underscore indicates it's intentionally unused, suppressing the warning while keeping the query execution for testing purposes.
The argon2 package is added to handle secure password hashing in the application. Argon2 is a modern, memory-hard hashing algorithm that provides better security against brute-force attacks compared to older algorithms like bcrypt or SHA-based hashes. --- 🔧 Add vitest configuration file A new vitest.config.ts file is created to configure the test environment. The configuration excludes common directories that should not be scanned for tests, including node_modules, build outputs, framework-specific directories (.nuxt, .nitro, .wrangler), and end-to- end test directories. This improves test performance by preventing vitest from scanning unnecessary files.
An empty file named 'grass' has been added to the repository, likely as a placeholder for future development work or testing purposes.
The file was empty and served no purpose in the project, so it has been removed to keep the repository clean and organized.
Updates multiple dependencies including @nuxt/scripts (1.0.1 → 1.0.3), @unhead/vue (3.0.4 → 3.1.0), vue (3.5.32 → 3.5.33), vue-router (5.0.4 → 5.0.6), @types/bun (1.3.12 → 1.3.13), and wrangler (4.84.1 → 4.86.0). 🔧 Update trunk configuration and worker types Removes scripts/test.ts from trunk ignore paths, simplifies postinstall script by removing trunk-related commands, and updates worker-configuration.d.ts with new Cloudflare Workers runtime types including tracing support and new tail stream outcome types. ♻️ Refactor test script to use underscore-prefixed variables Renames unused imports and variables in scripts/test.ts to follow convention for intentionally unused code (_users, _db) to avoid linter warnings. Keeps dependencies up to date for security patches and new features. Streamlines the build process by removing unnecessary trunk installation steps from postinstall. The worker types update reflects changes in the Cloudflare Workers runtime API.
Bumps the all-dependencies group with 1 update: [trunk-io/trunk-action](https://github.com/trunk-io/trunk-action). Updates `trunk-io/trunk-action` from bf81325059d2534b31df5365182237788c5e0338 to 04ba50e7658c81db7356da96657e6e77f220bfa3 - [Release notes](https://github.com/trunk-io/trunk-action/releases) - [Commits](trunk-io/trunk-action@bf81325...04ba50e) --- updated-dependencies: - dependency-name: trunk-io/trunk-action dependency-version: 04ba50e7658c81db7356da96657e6e77f220bfa3 dependency-type: direct:production dependency-group: all-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
…/all-dependencies-323c954a6a Bump trunk-io/trunk-action from bf81325059d2534b31df5365182237788c5e0338 to 04ba50e7658c81db7356da96657e6e77f220bfa3 in the all-dependencies group
…e definitions Updates numerous dependencies across the project, including build tools, frontend libraries, and development utilities. Key upgrades include: * **Build Tools:** Upgrading the Trunk plugin reference and updating `mise.toml` and `package.json` for Bun, Node, and Python runtimes. * **Frontend:** Updating core dependencies like `@nuxt/content`, `tailwindcss`, `vue`, and `vue-router` to newer versions. * **Development:** Updating multiple linters (e.g., `checkov`, `eslint`, `markdownlint`) and tools (e.g., `playwright`, `npm-run-all2`) to ensure compatibility with current standards. * **Types:** Updating `worker-configuration.d.ts` to reflect the latest definitions for Cloudflare Workers, specifically enhancing `Artifacts` and `WorkflowInstance` types with better error handling and method signatures. These upgrades ensure the project uses the latest stable versions of its tooling and dependencies, improving stability and feature support.
Bumps the all-dependencies group with 1 update: [npm-run-all2](https://github.com/bcomnes/npm-run-all2). Updates `npm-run-all2` from 8.0.4 to 9.0.0 - [Release notes](https://github.com/bcomnes/npm-run-all2/releases) - [Changelog](https://github.com/bcomnes/npm-run-all2/blob/master/CHANGELOG.md) - [Commits](bcomnes/npm-run-all2@v8.0.4...v9.0.0) --- updated-dependencies: - dependency-name: npm-run-all2 dependency-version: 9.0.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: all-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
…ll-dependencies-ccf1213a75 Bump npm-run-all2 from 8.0.4 to 9.0.0 in the all-dependencies group
Updates the `vitest` dependency from `^4.1.6` to `^4.1.7` to ensure the use of the latest minor release, which typically includes bug fixes and minor improvements.
…ty posture This commit refactors the entire authentication flow, significantly improving security and modernizing the codebase. Key changes include: * **Security Enhancements:** Updates login and registration endpoints to prevent user enumeration by returning generic success/failure messages regardless of the user's existence. * **Hashing Upgrade:** Replaces the deprecated `argon2` library with `hash-wasm`, ensuring compatibility with Workers and modern environments. * **API Standardization:** Introduces a unified `ApiResponse` type across all API endpoints, providing consistent error handling and response structure. * **Endpoint Cleanup:** Renames the `/api/hello` endpoint to `/api/ping` and removes the obsolete `insertSample` API route. * **Type Safety:** Updates TypeScript configurations and introduces shared types for better code maintainability. * **Frontend Cleanup:** Minor adjustments to Vue components remove anti-idiomatic DOM manipulation, preparing the frontend for proper reactivity. The changes address critical security vulnerabilities and modernize the underlying infrastructure.
The `FIXES.md` file is removed as its contents are now obsolete. This file previously documented numerous technical debt items, security concerns, and architectural notes (e.g., `argon2` replacement, API endpoint changes, user enumeration risks, input validation requirements, and frontend anti-patterns). The issues documented are either resolved in the codebase, addressed in separate documentation, or are no longer relevant to the current state of the project. Removing this file cleans up the repository by eliminating outdated technical debt notes.
The CI workflow now explicitly sets up the Node.js environment using version 24. This ensures that the build process has the necessary runtime environment before running Bun, making the CI reliable and consistent.
Updates the default API endpoint from `/api/hello` to `/api/ping` across the application, including documentation, components, and server routes. Also refactors the Nuxt configuration by removing the `@nuxt/content` module and cleaning up the module list in `nuxt.config.ts`. This improves the project's dependency structure and maintainability.
Adds the `nuxt-auth-utils` module to manage authentication and session logic. The changes introduce the necessary utilities for handling user sessions and authentication flows. This requires updating the project configuration by: * Adding `nuxt-auth-utils` as a dependency in `package.json`. * Registering the module in `nuxt.config.ts`. * Updating the `.env.example` and `worker-configuration.d.ts` files to include the required `NUXT_SESSION_PASSWORD` environment variable, ensuring the application can securely initialize the session utilities.
♻️ (Multiple files): Refactor authentication logic and improve security posture An await was missing when I retested the web server functionality, fixed it and committed it to this branch
Finished Login page and register page
Bumps the all-dependencies group with 1 update: [actions/setup-node](https://github.com/actions/setup-node). Updates `actions/setup-node` from 670825a89dc0abd596e7a3abd0f5e3f6e5faf37c to ad1b57eb8159e2fd3cc753317dd4a4016287218f - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@670825a...ad1b57e) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: ad1b57eb8159e2fd3cc753317dd4a4016287218f dependency-type: direct:production dependency-group: all-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
…/all-dependencies-31d4ad5386 Bump actions/setup-node from 670825a89dc0abd596e7a3abd0f5e3f6e5faf37c to ad1b57eb8159e2fd3cc753317dd4a4016287218f in the all-dependencies group
…ndencies and linting configurations for better tooling The dependency versions are updated across `package.json` to newer minor/patch versions for ESLint, Vue, and Vitest, and related packages like `checkov`, `eslint`, `vue`, `vue-router`, `npm-run-all2`, `vitest`, and `wrangler`. Linting dependencies in `trunk.yaml` are also updated accordingly. This ensures the project uses up-to-date tooling for better stability and security.
Signed-off-by: dependabot[bot] <support@github.com>
…57) Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: syn <syn@syn.as>
Co-authored-by: syn <syn@syn.as>
Co-authored-by: syn <syn@syn.as>
Update Node.js to 24.16.0, Rust to 1.96.0, and various project dependencies including Nuxt, ESLint, and Tailwind. Regenerate Cloudflare Worker types to reflect the latest Wrangler and workerd updates.
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
affirm-staging | 559a0a7 | Jun 19 2026, 08:44 PM |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
… data to the api file