EpicNext-Cms

33 Commits 3 Branches 14 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
Simo	4eccd146ba	Default password hashing to bcrypt (fits varchar(64) users.password) Verified against the live AtomCMS DB: users.password is varchar(64), so argon2id (~97 chars) overflows the column and registration/upgrade fail with 'value too long'. bcrypt (60-char $2y$) fits and matches the existing accounts. hashPassword() now emits bcrypt by default; set PASSWORD_HASH=argon2id to opt back in (needs a widened column). verifyPassword() still accepts both, so existing logins keep working. Verified end-to-end against the live DB: bcrypt $2y$ login round-trips (correct=true, wrong=false). tsc 0, vitest 8/8 (password suite).	2026-06-28 16:26:33 +02:00
Simo	e668fa85ec	Add 2FA, email + password reset, and batch-7 pages Auth (hand-built on the auth core): - 2FA: User model gains two_factor_secret/recovery_codes/confirmed_at (+ idempotent MariaDB migration). authorize() requires a valid TOTP code when 2FA is confirmed (secret decrypted via Laravel APP_KEY, fail-closed). Two-step login (precheckLogin reveals the code field). /settings/2fa enable/confirm/disable flow. - Password reset: nodemailer email service; PasswordReset model + migration; /forgot (request, generic response) + /reset (token sha256 + 1h TTL, sets argon2id hash). Login links to forgot. Batch 7 (parallel agents): /admin/commandocentrum (RCON controls + emulator_errors), social write actions (friend request + guild forum new thread), /help/[category], /badges (public). env: APP_KEY, APP_URL, SMTP_*. Nav extended. Verified: tsc exit 0, vitest 48/48, next build exit 0 (64 page routes).	2026-06-28 14:25:19 +02:00
Simo	ec2d46e583	Add byte-compatible Auth & SSO core primitives Pure, unit-tested primitives the AtomCMS->Next.js login must reproduce exactly (verified now with round-trip + known vectors; full end-to-end check deferred until a real DB + APP_KEY + live emulator are available): - password.ts: argon2id (m=65536,t=4,p=1 via hash-wasm) + bcrypt ($2y$ accepted) verify, and the md5->argon2id on-login upgrade gated by convert_passwords (mirrors RedirectIfTwoFactorAuthenticatable). - sso-ticket.ts: '{hotel_name without spaces}-{uuidv4}' written to auth_ticket + ip_current (mirrors User::ssoTicket()). - laravel-encrypter.ts: AES-256-CBC + HMAC-SHA256 payload compatible with Laravel encrypt()/encryptString (for existing 2FA secrets) incl. PHP string (de)serialization. - totp.ts: otplib Google2FA-compatible TOTP verify (SHA1/6/30). Libs: hash-wasm + bcryptjs + otplib (pure JS/WASM, no native build). 28 tests.	2026-06-27 16:00:25 +02:00

Author

SHA1

Message

Date

Simo

4eccd146ba

Default password hashing to bcrypt (fits varchar(64) users.password)

Verified against the live AtomCMS DB: users.password is varchar(64), so
argon2id (~97 chars) overflows the column and registration/upgrade fail
with 'value too long'. bcrypt (60-char $2y$) fits and matches the
existing accounts. hashPassword() now emits bcrypt by default; set
PASSWORD_HASH=argon2id to opt back in (needs a widened column).
verifyPassword() still accepts both, so existing logins keep working.

Verified end-to-end against the live DB: bcrypt $2y$ login round-trips
(correct=true, wrong=false). tsc 0, vitest 8/8 (password suite).

2026-06-28 16:26:33 +02:00

Simo

e668fa85ec

Add 2FA, email + password reset, and batch-7 pages

Auth (hand-built on the auth core):
- 2FA: User model gains two_factor_secret/recovery_codes/confirmed_at (+ idempotent
  MariaDB migration). authorize() requires a valid TOTP code when 2FA is confirmed
  (secret decrypted via Laravel APP_KEY, fail-closed). Two-step login (precheckLogin
  reveals the code field). /settings/2fa enable/confirm/disable flow.
- Password reset: nodemailer email service; PasswordReset model + migration;
  /forgot (request, generic response) + /reset (token sha256 + 1h TTL, sets argon2id
  hash). Login links to forgot.

Batch 7 (parallel agents): /admin/commandocentrum (RCON controls + emulator_errors),
social write actions (friend request + guild forum new thread), /help/[category],
/badges (public). env: APP_KEY, APP_URL, SMTP_*. Nav extended.

Verified: tsc exit 0, vitest 48/48, next build exit 0 (64 page routes).

2026-06-28 14:25:19 +02:00

Simo

ec2d46e583

Add byte-compatible Auth & SSO core primitives

Pure, unit-tested primitives the AtomCMS->Next.js login must reproduce exactly
(verified now with round-trip + known vectors; full end-to-end check deferred
until a real DB + APP_KEY + live emulator are available):

- password.ts: argon2id (m=65536,t=4,p=1 via hash-wasm) + bcrypt ($2y$ accepted)
  verify, and the md5->argon2id on-login upgrade gated by convert_passwords
  (mirrors RedirectIfTwoFactorAuthenticatable).
- sso-ticket.ts: '{hotel_name without spaces}-{uuidv4}' written to auth_ticket +
  ip_current (mirrors User::ssoTicket()).
- laravel-encrypter.ts: AES-256-CBC + HMAC-SHA256 payload compatible with
  Laravel encrypt()/encryptString (for existing 2FA secrets) incl. PHP string
  (de)serialization.
- totp.ts: otplib Google2FA-compatible TOTP verify (SHA1/6/30).

Libs: hash-wasm + bcryptjs + otplib (pure JS/WASM, no native build). 28 tests.

2026-06-27 16:00:25 +02:00