Claude 0a816fa881 fix(securite): lock down the two unauthenticated emergency endpoints ...

- POST /api/emergency-admin-reset accepted a fallback secret hardcoded in
  the repository, letting anyone who read the source reset the production
  admin account to admin/admin (EMERGENCY_SECRET is not set in the shipped
  docker-compose, so the fallback was live). The route now returns 404
  unless EMERGENCY_SECRET is explicitly configured, and invalid attempts
  are logged.
- POST /api/admin/emergency-migration ran database migrations with no
  authentication at all; it now requires an authenticated admin.

A sweep of the remaining API surface found no other unauthenticated
mutation or read routes beyond /api/health. .env.example documents
EMERGENCY_SECRET and ENCRYPTION_KEY.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FHdE9nEh8zHhQNGpCgrtYe

2026-08-14 16:21:40 +00:00

..

announcementStorage.ts

Fix error when updating announcements by adding missing get announcement functionality

2025-08-18 12:37:32 +00:00

backupService.ts

fix(backup): resolve real admin user ID instead of hardcoded 'system' for automatic backups

2026-02-10 09:41:12 +01:00

cache.ts

latest

2025-08-11 14:43:48 +00:00

createWebhookTable.ts

Ensure webhook BAP configuration table is created on startup

2025-09-03 14:05:06 +00:00

crypto.ts

feat(securite): encrypt SMTP passwords and NocoDB tokens at rest, log supplier mails

2026-08-14 16:02:55 +00:00

db.production.ts

Fix critical production issue with missing SAV ticket data and add emergency recovery

2025-08-14 09:33:19 +00:00

db.ts

fix(db): increase connection pool size and timeout to handle concurrent verifications

2026-01-13 16:54:26 +01:00

emailService.ts

feat(securite): encrypt SMTP passwords and NocoDB tokens at rest, log supplier mails

2026-08-14 16:02:55 +00:00

index.production.ts

fix(securite): lock down the two unauthenticated emergency endpoints

2026-08-14 16:21:40 +00:00

index.ts

perf: add missing indexes and remove N+1 queries

2026-08-14 11:55:49 +02:00

invoiceVerification.ts

Add total invoice amount for verification and delivery processing

2025-11-04 09:13:12 +00:00

localAuth.production.ts

Ensure daily automatic backups are performed upon user login

2025-09-02 17:54:11 +00:00

localAuth.ts

Ensure daily automatic backups are performed upon user login

2025-09-02 17:54:11 +00:00

maintenance.ts

perf: add missing indexes and remove N+1 queries

2026-08-14 11:55:49 +02:00

migrations.production.ts

feat(securite): encrypt SMTP passwords and NocoDB tokens at rest, log supplier mails

2026-08-14 16:02:55 +00:00

migrations.ts

feat(securite): encrypt SMTP passwords and NocoDB tokens at rest, log supplier mails

2026-08-14 16:02:55 +00:00

monitoring.ts

latest

2025-08-11 14:43:48 +00:00

nocodbService.ts

latest

2025-08-11 14:43:48 +00:00

permissions.ts

Improve invoice verification saving and update user permission handling

2025-08-13 15:06:14 +00:00

routes.ts

fix(securite): lock down the two unauthenticated emergency endpoints

2026-08-14 16:21:40 +00:00

sanitize.ts

feat(mails): send supplier document requests over each store's own SMTP

2026-08-14 15:25:00 +00:00

security.ts

feat(security): ameliorations securite - CSRF, sanitization validator.js, eval removal

2026-01-12 14:29:02 +01:00

storage.ts

feat(securite): encrypt SMTP passwords and NocoDB tokens at rest, log supplier mails

2026-08-14 16:02:55 +00:00

vite.ts

latest

2025-08-11 14:43:48 +00:00

weatherAutoConfig.ts

Restrict weather data access to administrators only

2025-08-15 08:14:23 +00:00

weatherService.ts

Update location lookup to use OpenStreetMap for better accuracy

2025-08-15 11:33:17 +00:00