2 Commits

Include renames

Author	SHA1	Message	Date
arkonandClaude Opus 4.6	746004c461	feat: implement QR code authentication for tunnel access ... Adds ephemeral single-use QR tokens for passwordless tunnel login. Scanning the QR auto-authenticates; bare tunnel URL requires Basic Auth. Backend: - TunnelManager: 60s token rotation, 90s grace, rejection-sampled 6-char base62 short codes, Map-based O(1) lookup, SVG caching, global rate limit - Auth middleware: /q/ bypass, separate qrAuthFailures counter, enhanced AuthSessionRecord with device context (ip, ua, createdAt, method) - Routes: GET /q/:code (consume + cookie + redirect), POST /api/tunnel/qr/ regenerate, POST /api/auth/revoke, updated GET /api/tunnel/qr with cache - SSE: tunnel:qrRotated, tunnel:qrRegenerated, tunnel:qrAuthUsed events - Audit: qr_auth lifecycle log entries Frontend: - Auto-refresh QR via inline SVG in SSE (fallback fetch if absent) - 60s countdown indicator on QR badge - Regenerate QR button - QRLjacking detection toast with [Revoke All] action button (10s duration) - showToast enhanced with optional duration and action button support Fixes: - /api/logout now invalidates server-side session token (was only clearing browser cookie, leaving token valid for replay) Tests: 20 new tests in test/qr-auth.test.ts covering token lifecycle, bias check, rate limiting, SVG caching, and full server integration. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-01 06:05:26 +01:00
arkonandClaude Opus 4.6	f44f0a912f	refactor: split app.js into focused frontend modules (phase 5) ... Extract 8 modules from the 15K-line app.js monolith: - constants.js: shared constants, timing, escapeHtml(), extractSyncSegments() - mobile-handlers.js: MobileDetection, KeyboardHandler, SwipeHandler - voice-input.js: DeepgramProvider, VoiceInput - notification-manager.js: NotificationManager class - keyboard-accessory.js: KeyboardAccessoryBar, FocusTrap - api-client.js: _api(), _apiJson(), _apiPost(), _apiDelete() helpers - subagent-windows.js: 13 subagent window methods (open, close, drag, lines) - vendor/xterm-zerolag-input.js: IIFE build replacing inlined copy app.js reduced from ~15,200 to ~11,500 lines. All modules use global scope with <script defer> ordering. Prototype extensions use Object.assign(CodemanApp.prototype, {...}) pattern. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-01 04:57:37 +01:00