maxibase 1.0.0 → 1.1.0

package/layers/base/server/api/files/[...path].get.ts

@@ -5,19 +5,26 @@ const querySchema = z.object({
     .enum(['true', 'false'])
     .transform((v) => v === 'true')
     .optional(),
-  maxAge: z.coerce.number().optional(),
-  serverCache: z.string().optional(),
-  expireIn: z.coerce.number().optional(),
+  maxAge: z.coerce.number().int().min(0).optional(),
+  // only-if-cached is left out, fetch throws on it outside same-origin mode
+  serverCache: z.enum(['default', 'no-store', 'reload', 'no-cache', 'force-cache']).optional(),
+  // S3 refuses to presign a URL for longer than 7 days
+  expireIn: z.coerce.number().int().positive().max(604800).optional(),
   redirect: z
     .enum(['true', 'false'])
     .transform((v) => v === 'true')
     .optional(),
 })
 
-export default defineEventHandler((event) => {
+export default defineEventHandler(async (event) => {
   const path = event.context.params?.path || ''
-  const query = getQuery(event)
-  const { isPrivate = false, maxAge, serverCache, expireIn, redirect } = querySchema.parse(query)
+  const {
+    isPrivate = false,
+    maxAge,
+    serverCache,
+    expireIn,
+    redirect,
+  } = await getValidatedQuery(event, querySchema.parse)
 
   let cache = `public, max-age=${maxAge || 31536000}`
   if (maxAge === 0) {
@@ -26,12 +33,14 @@ export default defineEventHandler((event) => {
     cache = `private, max-age=${maxAge || 3600}`
   }
   setHeader(event, 'Cache-Control', cache)
-  return getFile(
-    event,
-    decodeURIComponent(path),
-    isPrivate,
-    serverCache as RequestCache,
-    expireIn,
-    redirect,
-  )
+  return getFile(event, decodePath(path), isPrivate, serverCache, expireIn, redirect)
 })
+
+// h3 decodes the path but keeps %25 encoded, so a % in a name needs this second pass
+function decodePath(path: string) {
+  try {
+    return decodeURIComponent(path)
+  } catch {
+    throw createError({ status: 400, message: 'Invalid path' }) // a % not followed by hex
+  }
+}

package/layers/base/server/api/files/chunk.post.ts

@@ -1,5 +1,26 @@
+import { z } from 'zod'
+
+const partsSchema = z.array(
+  z.object({
+    ETag: z.string().optional(), // absent on local uploads
+    PartNumber: z.number().int().positive(),
+  }),
+)
+
+function invalidChunkUpload() {
+  return createError({ status: 400, message: 'Invalid chunk upload' })
+}
+
+export function parseParts(value?: string) {
+  try {
+    return partsSchema.parse(JSON.parse(value || '[]'))
+  } catch {
+    throw invalidChunkUpload()
+  }
+}
+
 export default defineEventHandler(async (event) => {
-  const body = await readMultipartFormData(event)
+  const body = await readUploadBody(event, Number(useRuntimeConfig().public.files.chunkSize) || 1)
   if (!body) throw createError({ status: 400, message: 'No data' })
 
   const get = (name: string) =>
@@ -15,11 +36,11 @@ export default defineEventHandler(async (event) => {
   const type = get('type') || 'application/octet-stream'
   const path = get('path') || 'files'
   const isPrivate = get('isPrivate') !== 'false'
-  const parts = get('parts') ? JSON.parse(get('parts') || '[]') : []
+  const parts = parseParts(get('parts'))
   const chunkPart = body.find((p) => p.name === 'chunk')
 
-  if (isNaN(chunkIndex) || isNaN(totalChunks) || !filename || !chunkPart) {
-    throw createError({ status: 400, message: 'Invalid chunk upload' })
+  if (!Number.isInteger(chunkIndex) || !Number.isInteger(totalChunks) || !filename || !chunkPart) {
+    throw invalidChunkUpload()
   }
 
   return uploadChunk(event, {

package/layers/base/server/api/files/index.get.ts

@@ -12,8 +12,6 @@ const querySchema = z.object({
 })
 
 export default defineEventHandler(async (event) => {
-  const query = getQuery(event)
-
-  const { path, isPrivate = false } = querySchema.parse(query)
+  const { path, isPrivate = false } = await getValidatedQuery(event, querySchema.parse)
   return listFolder(event, path, isPrivate)
 })

package/layers/base/server/api/files/index.post.ts

@@ -1,5 +1,5 @@
 export default defineEventHandler(async (event) => {
-  const body = await readMultipartFormData(event)
+  const body = await readUploadBody(event, Number(useRuntimeConfig().public.files.maxSize))
   if (!body) {
     throw createError({ status: 400, message: 'No file uploaded' })
   }

package/layers/base/server/database/defaults/db.ts

@@ -2,4 +2,12 @@ import { drizzle } from 'drizzle-orm/node-postgres'
 import { relations } from '#database/relations'
 import { authRelations } from '../relations'
 
-export const db = drizzle(useRuntimeConfig().db, { relations: { ...relations, ...authRelations } })
+// defineRelations gives every table an entry, empty ones included: only the project's tables
+// with relations override the layer's, so an empty entry never erases them
+const own = Object.fromEntries(
+  Object.entries(relations).filter(([, table]) => Object.keys(table.relations).length),
+)
+
+export const db = drizzle(useRuntimeConfig().db, {
+  relations: { ...relations, ...authRelations, ...own } as typeof relations & typeof authRelations,
+})

package/layers/base/server/database/relations.ts

@@ -2,7 +2,7 @@ import * as schema from '#server/database/schema'
 import { defineRelationsPart } from 'drizzle-orm'
 
 // Built from the project schema, so they also apply to a table the project overrides.
-// Spread after the project's relations, so they replace any the project defines on these tables.
+// A project entry for one of these tables replaces the layer's, see defaults/db.ts.
 export const authRelations = defineRelationsPart(schema, (r) => ({
   auth: {
     refreshTokens: r.many.refreshTokens({

package/layers/base/server/middleware/0.rateLimit.ts

@@ -4,7 +4,7 @@ export default defineEventHandler(async (event) => {
   const config = useRuntimeConfig()
   if (!config.rateLimit.enabled) return
 
-  const path = getRequestURL(event).pathname
+  const path = event.path.split('?')[0]!
   const routes = config.rateLimit.routes as Record<string, RateLimitRule>
 
   let matchedRoute = ''

package/layers/base/server/routes/auth/microsoft.get.ts

@@ -1,21 +1,34 @@
-export default defineOAuthMicrosoftEventHandler({
-  async onSuccess(event, { user }) {
-    if (!user.mail) {
-      throw createError({
-        status: 401,
-        message: 'This Microsoft account has no email address',
-      })
-    }
+import type { H3Event } from 'h3'
 
-    const auth = await getAuth(event, user.mail).catch((error) => {
-      const config = useRuntimeConfig()
+const scope = ['openid', 'email', 'User.Read']
 
-      if (error.statusCode === 404 && config.autoSignup) {
-        return createAuth({ email: user.mail })
-      }
-      throw error
+async function onSuccess(event: H3Event, { tokens }: { tokens: any }) {
+  const claims = JSON.parse(Buffer.from(tokens.id_token.split('.')[1], 'base64url').toString())
+  if (!claims.email || ![true, '1'].includes(claims.xms_edov)) {
+    throw createError({
+      status: 401,
+      message: 'This Microsoft account has no verified email address',
     })
-    await setSession(event, auth)
-    return sendRedirect(event, '/')
-  },
+  }
+
+  const auth = await getAuth(event, claims.email).catch((error) => {
+    const config = useRuntimeConfig()
+
+    if (error.statusCode === 404 && config.autoSignup) {
+      return createAuth({ email: claims.email })
+    }
+    throw error
+  })
+  await setSession(event, auth)
+  return sendRedirect(event, '/')
+}
+
+const signIn = defineOAuthMicrosoftEventHandler({ config: { scope }, onSuccess })
+const selectAccount = defineOAuthMicrosoftEventHandler({
+  config: { scope, authorizationParams: { prompt: 'select_account' } },
+  onSuccess,
 })
+
+export default defineEventHandler((event) =>
+  getQuery(event).prompt === 'select_account' ? selectAccount(event) : signIn(event),
+)

package/layers/base/server/tasks/clean.ts

@@ -1,7 +1,7 @@
 export default defineTask({
   meta: {
     name: 'clean',
-    description: 'Clean old backups and logs',
+    description: 'Clean old backups, logs and unfinished uploads',
   },
   async run() {
     const config = useRuntimeConfig()
@@ -21,6 +21,7 @@ export default defineTask({
         )
       }
       await cleanLogs()
+      await cleanTempUploads()
 
       return {
         result: {

package/layers/base/server/utils/auth.ts

@@ -1,6 +1,6 @@
 import { auth, refreshTokens } from '#server/database/schema'
 import { eq, lte } from 'drizzle-orm'
-import { randomBytes } from 'crypto'
+import { createHash, randomBytes } from 'crypto'
 import type { H3Event } from 'h3'
 
 type AuthUser = typeof auth.$inferSelect
@@ -17,6 +17,21 @@ export async function mfaSetupFlag(user: SessionUser) {
   return { requiresMfaSetup: !row?.totp && !row?.credentials.length }
 }
 
+export function requireSecondFactor(user: Pick<AuthUser, 'totp'> & { credentials?: unknown[] }) {
+  if (user.totp) {
+    throw createError({
+      status: 401,
+      message: 'TOTP required',
+    })
+  }
+  if (useRuntimeConfig().forceMfa && user.credentials?.length) {
+    throw createError({
+      status: 401,
+      message: 'Passkey required',
+    })
+  }
+}
+
 export async function createAuth(user: Pick<AuthUser, 'email'>) {
   const insertedUsers = await db
     .insert(auth)
@@ -112,7 +127,7 @@ export async function setSession(event: H3Event, user: SessionUser, refresh = tr
 export async function requireRecentAuth(event: H3Event) {
   const session = await requireUserSession(event)
 
-  if (session.user.isAnonymous || session.user.requiresMfaSetup) return session
+  if (session.user.isAnonymous) return session
 
   const maxAge = useRuntimeConfig().public.recentAuth.maxAge * 1000
   if (!session.authenticatedAt || Date.now() - session.authenticatedAt > maxAge) {
@@ -130,12 +145,16 @@ export function generateRefreshToken(): string {
   return randomBytes(32).toString('base64url')
 }
 
+export function hashRefreshToken(token: string) {
+  return createHash('sha256').update(token).digest('base64url')
+}
+
 export async function createRefreshToken(userId: string, event: H3Event) {
   const token = generateRefreshToken()
 
   await db.insert(refreshTokens).values({
     userId,
-    token,
+    token: hashRefreshToken(token),
   })
 
   const config = useRuntimeConfig()
@@ -158,7 +177,9 @@ export async function verifyRefreshToken(event: H3Event) {
     })
   }
 
-  const refreshToken = await db.query.refreshTokens.findFirst({ where: { token: existingToken } })
+  const refreshToken = await db.query.refreshTokens.findFirst({
+    where: { token: hashRefreshToken(existingToken) },
+  })
   if (!refreshToken) {
     deleteCookie(event, 'refresh_token')
     throw createError({
@@ -194,8 +215,9 @@ export async function verifyRefreshToken(event: H3Event) {
   return { refreshToken, user }
 }
 
+// Takes the token from the cookie, never the stored value
 export async function revokeRefreshToken(token: string) {
-  await db.delete(refreshTokens).where(eq(refreshTokens.token, token))
+  await db.delete(refreshTokens).where(eq(refreshTokens.token, hashRefreshToken(token)))
 }
 
 export async function revokeExpiredRefreshToken(creationExpiredAt: Date) {

package/layers/base/server/utils/backup.ts

@@ -37,7 +37,7 @@ function waitForExit(child: ChildProcess, name: string) {
 export async function createDatabaseBackup(
   backupName: string,
   dbUrl: string,
-  dumpArgs: string = '-F c',
+  dumpArgs: string,
   agePublicKey?: string,
 ) {
   const { conn, env } = splitCredentials(dbUrl)

package/layers/base/server/utils/files.ts

@@ -8,6 +8,7 @@ import {
   appendFile,
   rename,
   readFile as fsReadFile,
+  copyFile as fsCopyFile,
 } from 'fs/promises'
 import {
   S3Client,
@@ -21,6 +22,7 @@ import {
   UploadPartCommand,
   CompleteMultipartUploadCommand,
   AbortMultipartUploadCommand,
+  ListMultipartUploadsCommand,
 } from '@aws-sdk/client-s3'
 import { getSignedUrl } from '@aws-sdk/s3-request-presigner'
 import type { CompletedPart } from '@aws-sdk/client-s3'
@@ -31,6 +33,21 @@ import type { Readable } from 'stream'
 import type { H3Event, MultiPartData } from 'h3'
 import { createHash } from 'crypto'
 
+const MB = 1024 * 1024
+
+function fileTooLarge() {
+  const { maxSize } = useRuntimeConfig().public.files
+  return createError({ statusCode: 413, message: `File too large, max ${maxSize} MB` })
+}
+
+export async function readUploadBody(event: H3Event, maxMB: number) {
+  await requireUserSession(event)
+  const length = getRequestHeader(event, 'content-length')
+  if (!length) throw createError({ statusCode: 411, message: 'Content-Length required' })
+  if (Number(length) > (maxMB + 1) * MB) throw fileTooLarge()
+  return readMultipartFormData(event)
+}
+
 export async function uploadFile(
   event: H3Event,
   file: MultiPartData,
@@ -39,9 +56,7 @@ export async function uploadFile(
 ) {
   await checkFileAccess(event, path)
   path = getSecurePath(path, isPrivate)
-  if (file.filename && !/[^/]\.[^.]+$/.test(path) && basename(path) !== basename(file.filename)) {
-    path = join(path, basename(file.filename))
-  }
+  path = appendFilename(path, file.filename)
 
   let url
   if (useS3()) {
@@ -73,9 +88,7 @@ export async function uploadStream(
 ) {
   await checkFileAccess(event, path)
   path = getSecurePath(path, isPrivate)
-  if (file.filename && !/[^/]\.[^.]+$/.test(path) && basename(path) !== basename(file.filename)) {
-    path = join(path, basename(file.filename))
-  }
+  path = appendFilename(path, file.filename)
 
   if (useS3()) {
     return uploadStreamToS3(
@@ -135,12 +148,15 @@ export async function uploadChunk(
   if (chunkIndex < 0 || chunkIndex >= totalChunks || totalChunks < 1) {
     throw createError({ statusCode: 400, message: 'Invalid chunk index' })
   }
+  const { chunkSize, maxSize } = useRuntimeConfig().public.files
+  const chunkBytes = (Number(chunkSize) || 1) * MB
+  if (totalChunks > Math.ceil((Number(maxSize) * MB) / chunkBytes)) {
+    throw fileTooLarge()
+  }
 
   await checkFileAccess(event, path)
   path = getSecurePath(path, isPrivate)
-  if (filename && !/[^/]\.[^.]+$/.test(path) && basename(path) !== basename(filename)) {
-    path = join(path, basename(filename))
-  }
+  path = appendFilename(path, filename)
 
   if (useS3()) {
     if (!uploadId) {
@@ -190,9 +206,69 @@ export async function uploadChunk(
   return getFileURL(path, isPrivate)
 }
 
+const TEMP_UPLOAD_MAX_AGE_MS = 24 * 60 * 60 * 1000
+
+// Removes chunked uploads that were started but never finished
+export async function cleanTempUploads(maxAgeMs = TEMP_UPLOAD_MAX_AGE_MS) {
+  const cutoff = Date.now() - maxAgeMs
+
+  const tempDir = join(process.cwd(), 'files', 'temp')
+  const uploadIds = await readdir(tempDir).catch(() => [])
+  await Promise.all(
+    uploadIds.map(async (uploadId) => {
+      const uploadDir = join(tempDir, uploadId)
+      const stats = await stat(uploadDir)
+      if (!stats.isDirectory()) return
+      // A retried chunk overwrites its file without touching the folder's mtime
+      const chunks = await readdir(uploadDir)
+      const chunkTimes = await Promise.all(
+        chunks.map(async (chunk) => (await stat(join(uploadDir, chunk))).mtimeMs),
+      )
+      if (Math.max(stats.mtimeMs, ...chunkTimes) < cutoff) {
+        await rm(uploadDir, { recursive: true, force: true })
+      }
+    }),
+  )
+
+  const client = useS3()
+  if (!client) return
+
+  const config = useRuntimeConfig()
+  const buckets = [...new Set([config.s3.privateBucket, config.s3.publicBucket])].filter(Boolean)
+  for (const Bucket of buckets) {
+    let KeyMarker: string | undefined
+    let UploadIdMarker: string | undefined
+    do {
+      const response = await client.send(
+        new ListMultipartUploadsCommand({ Bucket, KeyMarker, UploadIdMarker }),
+      )
+      await Promise.all(
+        (response.Uploads || [])
+          .filter((upload) => upload.Initiated && upload.Initiated.getTime() < cutoff)
+          .map((upload) =>
+            client.send(
+              new AbortMultipartUploadCommand({
+                Bucket,
+                Key: upload.Key,
+                UploadId: upload.UploadId,
+              }),
+            ),
+          ),
+      )
+      KeyMarker = response.IsTruncated ? response.NextKeyMarker : undefined
+      UploadIdMarker = response.IsTruncated ? response.NextUploadIdMarker : undefined
+    } while (KeyMarker)
+  }
+}
+
+// A name can hold %, # or ?, which would end or break the URL unencoded
+function encodePath(path: string) {
+  return path.split('/').map(encodeURIComponent).join('/')
+}
+
 export function getFileURL(path: string, isPrivate = true) {
   const config = useRuntimeConfig()
-  const url = removeRoot(path, isPrivate)
+  const url = encodePath(removeRoot(path, isPrivate))
 
   if (isPrivate) {
     return config.public.url + join('/', 'api/files', url) + '?isPrivate=true'
@@ -235,6 +311,8 @@ export async function getFile(
 ) {
   await checkFileAccess(event, path)
   path = getSecurePath(path, isPrivate)
+  setHeader(event, 'X-Content-Type-Options', 'nosniff')
+  setHeader(event, 'Content-Security-Policy', 'sandbox')
 
   const range = getRequestHeader(event, 'range')
 
@@ -299,6 +377,8 @@ export async function getFile(
 export async function deletePath(event: H3Event, path: string, isPrivate = true) {
   await checkFileAccess(event, path)
   path = getSecurePath(path, isPrivate)
+  // An empty path resolves to the root folder, deleting it would wipe every file
+  if (path === getSecurePath('', isPrivate)) throw invalidPath()
   if (useS3()) await deleteFromS3(path, isPrivate)
   else {
     const localPath = join(process.cwd(), path)
@@ -371,13 +451,19 @@ export async function copyFile(
   await checkFileAccess(event, dest)
   src = getSecurePath(src, isPrivate)
   dest = getSecurePath(dest, isPrivate)
+  // A copy onto itself would truncate the file, and a move would then delete it
+  if (src === dest) return
 
   if (useS3()) return copyFromS3(src, dest, isPrivate, deleteSrc)
 
   const srcPath = join(process.cwd(), src)
   const destPath = join(process.cwd(), dest)
+  const stats = await stat(srcPath).catch(() => null)
+  if (!stats?.isFile()) {
+    throw createError({ statusCode: 404, message: 'File not found' })
+  }
   await mkdir(dirname(destPath), { recursive: true })
-  await writeFile(destPath, createReadStream(srcPath))
+  await fsCopyFile(srcPath, destPath)
 
   if (deleteSrc) {
     await deletePath(event, removeRoot(src, isPrivate), isPrivate)
@@ -412,8 +498,11 @@ export function getSecurePath(path: string, isPrivate = true) {
   const root = isPrivate ? config.filesPrivateFolder : config.filesPublicFolder
   let normalizedPath = path.replace(/^\/+/, '')
 
-  if (normalizedPath.split('/').some((segment) => segment === '..' || segment === '.')) {
-    throw createError({ statusCode: 400, message: 'Invalid path' })
+  if (
+    normalizedPath.includes('..') ||
+    normalizedPath.split('/').some((segment) => segment === '.')
+  ) {
+    throw invalidPath()
   }
 
   normalizedPath = join('/', root, removeRoot(normalizedPath, isPrivate))
@@ -421,6 +510,32 @@ export function getSecurePath(path: string, isPrivate = true) {
   return normalizedPath.replace(/^\//, '').replace(/\/$/, '')
 }
 
+function invalidPath() {
+  return createError({ statusCode: 400, message: 'Invalid path' })
+}
+
+function appendFilename(path: string, filename?: string) {
+  if (!filename) return path
+  if (filename.includes('..')) throw invalidPath()
+  filename = cleanFilename(filename)
+  if (/[^/]\.[^.]+$/.test(path) || basename(path) === filename) return path
+  return join(path, filename)
+}
+
+// Keeps letters (accents too), digits, . - and _, anything else becomes a single -.
+// NFC, because macOS sends é as e + accent and the same name would not match.
+export function cleanFilename(filename: string) {
+  const name = basename(filename)
+    .normalize('NFC')
+    .replace(/[^\p{L}\p{M}\p{N}._-]+/gu, '-')
+    .replace(/-*\.-*/g, '.')
+    .replace(/\.{2,}/g, '.')
+    .replace(/-{2,}/g, '-')
+    .replace(/^-+|[-.]+$/g, '')
+  // Nothing left of the name, or a hidden file: keep the extension behind a visible name
+  return !name || name.startsWith('.') ? `file${name}` : name
+}
+
 export function removeRoot(path: string, isPrivate = true) {
   const config = useRuntimeConfig()
   const root = isPrivate ? config.filesPrivateFolder : config.filesPublicFolder
@@ -733,7 +848,7 @@ export function getS3Key(path: string) {
 
 function getS3URL(path: string) {
   const config = useRuntimeConfig()
-  return `${config.public.files.url}/${getS3Key(path)}`
+  return `${config.public.files.url}/${encodePath(getS3Key(path))}`
 }
 
 async function getS3SignedUrl(key: string, expiresIn = 3600, isPrivate = true): Promise<string> {

package/layers/base/server/utils/rateLimit.ts

@@ -27,9 +27,14 @@ async function getId(event: H3Event): Promise<string> {
   return getClientIP(event)
 }
 
-export async function enforceRateLimit(event: H3Event, route: string, rule: RateLimitRule) {
+export async function enforceRateLimit(
+  event: H3Event,
+  route: string,
+  rule: RateLimitRule,
+  id?: string,
+) {
   const config = useRuntimeConfig()
-  const id = await getId(event)
+  id ??= await getId(event)
   const key = `${route}:${id}`
   const now = Date.now()
 

package/locales/en.json

@@ -1,6 +1,7 @@
 {
   "add": "Add",
   "areYouSure": "Are you sure?",
+  "authentication": "Authentication",
   "cancel": "Cancel",
   "confirm": "Confirm",
   "continue": "Continue",
@@ -11,6 +12,7 @@
   "disable": "Disable",
   "email": "Email",
   "enable": "Enable",
+  "fileTooLarge": "Too large, max {max} MB: {files}",
   "formatFailed": "Could not format or upload {files}",
   "language": "Language | Languages",
   "paste": "Paste",
@@ -27,6 +29,7 @@
     "code": "Code",
     "getCode": "Get code",
     "otpSent": "Code sent to {email}",
+    "passkey": "Use a passkey",
     "password": "Password",
     "signin": "Sign In"
   }

package/locales/fr.json

@@ -1,6 +1,7 @@
 {
   "add": "Ajouter",
   "areYouSure": "Êtes-vous sûr ?",
+  "authentication": "Authentification",
   "cancel": "Annuler",
   "confirm": "Confirmer",
   "continue": "Continuer",
@@ -11,6 +12,7 @@
   "disable": "Désactiver",
   "email": "Email",
   "enable": "Activer",
+  "fileTooLarge": "Trop volumineux, max {max} Mo : {files}",
   "formatFailed": "Impossible de formater ou téléverser {files}",
   "language": "Langue | Langues",
   "paste": "Coller",
@@ -27,6 +29,7 @@
     "code": "Code",
     "getCode": "Demander le code",
     "otpSent": "Code envoyé à {email}",
+    "passkey": "Utiliser une passkey",
     "password": "Mot de passe",
     "signin": "Se connecter"
   }

package/locales/pages/user-auth/en.json

@@ -1,6 +1,5 @@
 {
   "2fa": "Two-Factor Authentication",
-  "authentication": "Authentication",
   "authenticatorApp": "Authenticator app",
   "changeEmail": "Change email address",
   "changePassword": "Change password",

package/locales/pages/user-auth/fr.json

@@ -1,6 +1,5 @@
 {
   "2fa": "Authentification à deux facteurs",
-  "authentication": "Authentification",
   "authenticatorApp": "Application d'authentification",
   "changeEmail": "Modifier l'adresse email",
   "changePassword": "Modifier le mot de passe",

package/nuxt.config.ts

@@ -27,6 +27,7 @@ export default defineNuxtConfig({
       routes: {
         // limit: max requests per IP, window: in seconds
         '/api/log': { limit: 30, window: 60 },
+        '/api/auth/options': { limit: 10, window: 60 },
         '/api/auth/password': { limit: 5, window: 60 },
         '/api/auth/otp/get': { limit: 5, window: 900 },
         '/api/auth/email/get': { limit: 5, window: 900 },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxibase",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Nuxt layer with auth, files, logs and backups",
   "keywords": [
     "nuxt",
@@ -31,7 +31,7 @@
     "access": "public"
   },
   "engines": {
-    "node": ">=22"
+    "node": "^24.15.0 || >=26"
   },
   "packageManager": "pnpm@12.4.2+sha512.08adc6613180275c7c9edada39dcf08c9c61ad4e7eaf330a4f3461f102b0f907423454d117f98e72d47fef0616070644d7bffc973a6a57f5090a6d7c368b07c9",
   "scripts": {
@@ -44,7 +44,7 @@
     "db:seed": "npx jiti ./server/database/seed.ts",
     "db:generate": "drizzle-kit generate",
     "db:push": "drizzle-kit push",
-    "db:push-server": "./scripts/db/push-server.sh",
+    "db:push-prod": "./scripts/db/push-server.sh",
     "db:restore": "./scripts/db/restore.sh",
     "db:migrate": "npx jiti ./scripts/db/migrate.ts",
     "db:studio": "drizzle-kit studio",