thandClaude Opus 4.7
d83de30d6d
Breaking wire-format change: dual-read (V1+V2) / single-write (V2) so existing user secrets, stored messages, and inter-tenant key keep working. Old clients and relays lose cross-version chat until both sides are upgraded. Relay - Switch clientEncrypt/masterEncrypt to AES-256-GCM with HKDF-derived per-ciphertext salts; keep CBC-V1 fallback on decrypt only. - On-bootstrap migration re-envelopes tenant secret_encrypted and the inter-tenant key to GCM-V2 (idempotent). - CORS: stop reflecting arbitrary Origin; allow own origin + optional RELAY_CORS_ORIGINS env allowlist; drop Access-Control-Allow-Credentials. - Generic error messages replace "no such user: <name>" enumeration. - Exception messages no longer echoed back; logged server-side. - Collab-lock max hold capped at 10min so a member can't grief-refresh forever. - Attachment filenames validated against hex.<ext> pattern. - Passwords min length 10; /api/account/password rate-limited. App / Electron client - Shared hyprcrdRelayEncrypt/Decrypt helpers (GCM-V2 write, V1 read). - Chat + collab-buckets plugins delegate to the shared helpers. - Poll + push + attachments migrated to the dual-format path. - /api/relay/settings GET returns has_key boolean; secret never echoed. - Setup endpoint now CSRF-checked. - SSRF: CURLOPT_PROTOCOLS restricted to HTTP(S) everywhere; bookmarks favicon fetch also blocks private/loopback/link-local. - Login / password-change rate limiter moved to DB-backed IP keying. - Passwords min length 10 throughout. - Zip import enforces per-file (25MB) and total (500MB) caps, extension allowlist, no-overwrite. - Verbose relay-push debug gated behind APP_DEBUG env. Version bumped to 2.0.0 (protocol-breaking). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
85 lines
1.5 KiB
JSON
85 lines
1.5 KiB
JSON
{
|
|
"name": "hyprcrd",
|
|
"version": "2.0.0",
|
|
"description": "hyprcrd — self-hosted card manager",
|
|
"main": "main.js",
|
|
"scripts": {
|
|
"start": "electron .",
|
|
"dist": "electron-builder"
|
|
},
|
|
"author": "th",
|
|
"license": "UNLICENSED",
|
|
"devDependencies": {
|
|
"electron": "^41.2.0",
|
|
"electron-builder": "^26.0.0"
|
|
},
|
|
"build": {
|
|
"appId": "com.hyprcrd.app",
|
|
"productName": "hyprcrd",
|
|
"files": [
|
|
"main.js",
|
|
"preload.js"
|
|
],
|
|
"extraResources": [
|
|
{
|
|
"from": "router.php",
|
|
"to": "router.php"
|
|
},
|
|
{
|
|
"from": "../public",
|
|
"to": "public",
|
|
"filter": [
|
|
"**/*"
|
|
]
|
|
},
|
|
{
|
|
"from": "../src",
|
|
"to": "src",
|
|
"filter": [
|
|
"**/*"
|
|
]
|
|
},
|
|
{
|
|
"from": "../config.php",
|
|
"to": "config.php"
|
|
},
|
|
{
|
|
"from": "../data",
|
|
"to": "data",
|
|
"filter": [
|
|
".gitkeep"
|
|
]
|
|
}
|
|
],
|
|
"mac": {
|
|
"target": "dmg",
|
|
"category": "public.app-category.productivity",
|
|
"extraResources": [
|
|
{
|
|
"from": "php-bin/darwin",
|
|
"to": "php-bin"
|
|
}
|
|
]
|
|
},
|
|
"win": {
|
|
"target": "nsis",
|
|
"extraResources": [
|
|
{
|
|
"from": "php-bin/win32",
|
|
"to": "php-bin"
|
|
}
|
|
]
|
|
},
|
|
"linux": {
|
|
"target": "AppImage",
|
|
"category": "Office",
|
|
"extraResources": [
|
|
{
|
|
"from": "php-bin/linux",
|
|
"to": "php-bin"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
}
|