3 Commits

Author	SHA1	Message	Date
hobokenchicken	57aec2c6b3	sec: hash tokens in DB, set Tauri CSP, escape quotes in XSS guard ... - Session and email verification/reset tokens stored as SHA-256 hash in DB (raw token stays client-side in cookie/email link) - Tauri CSP set: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self' wss: https: - escapeHtml now handles double and single quotes to prevent attribute-based XSS	2026-07-20 13:13:09 -04:00
hobokenchicken	eaf8d0d8fa	fix: use APP_URL for email links instead of host:port ... DUMPSTER_PORT=8080 (internal) was baked into email reset links, producing http://dumpster.dustin.coffee:8080/reset-password which doesn't resolve through Caddy. Added Config.AppURL() that reads APP_URL env var (set to https://dumpster.dustin.coffee on server), falls back to http://host:port for dev.	2026-06-30 15:59:55 -04:00
root	413c423ad1	feat: add SMTP email support and fix profile/permissions bugs	2026-06-30 19:29:08 +00:00