4 Commits

Include renames

Author	SHA1	Message	Date
openhands	7f39ba4257	fix: harden SSO ticket flow and revoke tickets on logout ... Reuse the outstanding auth_ticket instead of minting a fresh one on every /client load, so reloading the page or opening a second tab no longer invalidates a game session that is still connecting. New tickets are minted with a guard against the previously-read value so concurrent launches converge on the same ticket. Revoke the auth_ticket when signing out (toolbar, header and sign-out everywhere) so a leaked ticket can no longer be replayed against the emulator, and prevent SSO leakage via referral by setting no-referrer on the client iframe. Strip all whitespace from the ticket prefix and build the launch URL through a tested helper that handles query strings, existing sso params and URL fragments correctly.	2026-08-29 20:54:06 +02:00
SimoandCursor	30b54e99e7	refactor(db): migrate app pages and APIs from Prisma facade to Drizzle (5) ... Co-authored-by: Cursor <[email protected]>	2026-08-01 14:15:39 +02:00
openhands	df38dccbf1	style: format code biome	2026-07-13 21:57:41 +02:00
Simo	ec2d46e583	Add byte-compatible Auth & SSO core primitives ... Pure, unit-tested primitives the AtomCMS->Next.js login must reproduce exactly (verified now with round-trip + known vectors; full end-to-end check deferred until a real DB + APP_KEY + live emulator are available): - password.ts: argon2id (m=65536,t=4,p=1 via hash-wasm) + bcrypt ($2y$ accepted) verify, and the md5->argon2id on-login upgrade gated by convert_passwords (mirrors RedirectIfTwoFactorAuthenticatable). - sso-ticket.ts: '{hotel_name without spaces}-{uuidv4}' written to auth_ticket + ip_current (mirrors User::ssoTicket()). - laravel-encrypter.ts: AES-256-CBC + HMAC-SHA256 payload compatible with Laravel encrypt()/encryptString (for existing 2FA secrets) incl. PHP string (de)serialization. - totp.ts: otplib Google2FA-compatible TOTP verify (SHA1/6/30). Libs: hash-wasm + bcryptjs + otplib (pure JS/WASM, no native build). 28 tests.	2026-06-27 16:00:25 +02:00