bizzle/coastal_timesheet
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
9 Commits 2 Branches 0 Tags
main
Commit Graph
7 Commits
Author SHA1 Message Date
rootandClaude Opus 4.6 490082a0c9 feat: user profile self-service + admin password reset 
- Add PUT /api/auth/profile for users to change their own email/password
- Add POST /api/admin/users/:id/reset-password for admin password resets
- Add updateProfileSchema and resetPasswordSchema validation (Zod)
- Create Profile.jsx page with email change and password change forms
- Add Reset Password button with inline form to ManageUsers in Admin panel
- Add /profile route and Account nav link in Layout

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-04 21:07:08 +00:00
BizzleBot 814520f8cc Upgrade nodemailer 6.x→8.x (2 CVEs fixed) 2026-02-19 11:10:00 +00:00
BizzleBot c8021495a1 security: add future date guard to entry validation 
- Zod refine rejects dates beyond today in createEntrySchema
- Per-day 24h hour cap already in entries.js (prev commit)
- totalHours populated in history endpoint (prev commit)
- Removed duplicate security headers from nginx (Caddy handles)
 2026-02-19 06:19:05 +00:00
BizzleBot a0234cdd31 production hardening: future-date guard, per-day hour cap, totalHours in history, header cleanup 2026-02-19 04:48:43 +00:00
BizzleBot 47c35c1e3a security: QA Council audit fixes 
- Remove JWT secret fallbacks (fail on startup if missing)
- Hash refresh tokens with SHA-256 before DB storage
- Add Zod validation to bulk-approve, bulk-reject, update-user, copy-week
- Add global API rate limiting (100 req/15min per IP)
- Fix nginx X-XSS-Protection header (align with Helmet)
- Remove --accept-data-loss from Dockerfile CMD
- Create .gitignore to protect secrets from commits
- Secure .env file permissions (chmod 600)
 2026-02-17 02:09:26 +00:00
BizzleBot 70ed672381 Fix: ManageUsers component missing useAuth() - caused blank admin page 
The ManageUsers sub-component referenced user?.role for conditional
role dropdown options but didn't call useAuth() to get the user object.
This caused 'user is not defined' JS errors and blank admin pages.

Browser E2E: 20/20 tests pass.
 2026-02-16 20:24:34 +00:00
BizzleBot f718a76153 Coastal Timesheet v2 — full feature buildout 
Features:
- Copy Previous Week (entries duplication)
- Bulk Approve/Reject (admin workflow)
- Overtime tracking (employee + admin views)
- DayCard component with auto-save
- PDF generation, email notifications
- React + Tailwind frontend, Prisma + PostgreSQL backend
- Docker deployment (3 containers)
 2026-02-16 10:01:39 +00:00