mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-26 11:49:16 +00:00
Anso
c6d1631afe
* feat(recovery): add safe-mode recovery surface and emergency CLI Add a read-only Recovery tab under Settings (admin-only) backed by a new GET /api/diagnostics endpoint reporting app version, database integrity, encryption-key status, Docker reachability, account and SSO counts, and non-secret configuration. The endpoint loads without Docker or live metrics so it stays available when the dashboard does not, requires a genuine admin session, and builds its config block from a non-secret allowlist so no credentials are ever exposed. Expand the emergency command-line toolkit beyond the two-factor reset with seven host-level commands: reset-password, create-emergency-admin, clear-sessions, disable-sso, diagnostics, validate-db, and backup-data. Each prints its result, exits with a meaningful status code, and writes an audit entry where it changes state. Document the toolkit in a new operator guide and link it from the recovery and two-factor pages. * feat(recovery): download the emergency command reference as a text file The recovery commands are needed exactly when the dashboard is unreachable, so reading them only in-app is a chicken-and-egg problem. Add a Download button to the command-line section that saves the full `docker compose exec sencho ...` reference as a text file, letting operators keep it on hand before they need it. Reuses a shared download helper with the existing diagnostics export. * fix(recovery): harden diagnostics, backup, and emergency-admin against edge cases Address findings from an independent review of the recovery toolkit: - DiagnosticsService now degrades instead of throwing when a queried table is missing or corrupt: each read falls back and is folded into database.ok, so a broken database reports "problem detected" rather than failing the whole endpoint or showing a misleading healthy state with zeroed counts. - backup-data refuses a destination that resolves to the live database, which would otherwise report success while producing no separate copy. - create-emergency-admin now applies the same username rule as the user- management route, extracted to a shared helper so both stay in sync. Adds tests for a missing read table, a malformed emergency-admin username, and the backup same-target rejection.
92 lines
2.7 KiB
JSON
92 lines
2.7 KiB
JSON
{
|
|
"name": "backend",
|
|
"version": "1.0.0",
|
|
"description": "",
|
|
"main": "index.js",
|
|
"scripts": {
|
|
"postinstall": "test -f scripts/generate-version.js && node scripts/generate-version.js || true",
|
|
"prebuild": "node scripts/generate-version.js",
|
|
"build": "tsc",
|
|
"start": "node dist/index.js",
|
|
"predev": "node scripts/generate-version.js",
|
|
"dev": "nodemon --watch src --ext ts,json --exec ts-node src/index.ts",
|
|
"test": "vitest run",
|
|
"lint": "eslint src",
|
|
"reset-mfa": "node dist/cli/resetMfa.js",
|
|
"reset-password": "node dist/cli/resetPassword.js",
|
|
"create-emergency-admin": "node dist/cli/createEmergencyAdmin.js",
|
|
"clear-sessions": "node dist/cli/clearSessions.js",
|
|
"disable-sso": "node dist/cli/disableSso.js",
|
|
"diagnostics": "node dist/cli/diagnostics.js",
|
|
"validate-db": "node dist/cli/validateDb.js",
|
|
"backup-data": "node dist/cli/backupData.js"
|
|
},
|
|
"keywords": [],
|
|
"author": "",
|
|
"license": "SEE LICENSE IN LICENSE",
|
|
"type": "commonjs",
|
|
"engines": {
|
|
"node": ">=26.0.0"
|
|
},
|
|
"devDependencies": {
|
|
"@eslint/js": "^10.0.1",
|
|
"@types/bcrypt": "^6.0.0",
|
|
"@types/better-sqlite3": "^7.6.13",
|
|
"@types/compression": "^1.8.1",
|
|
"@types/cookie-parser": "^1.4.10",
|
|
"@types/cors": "^2.8.19",
|
|
"@types/dockerode": "^4.0.1",
|
|
"@types/express": "^5.0.6",
|
|
"@types/http-proxy": "^1.17.17",
|
|
"@types/http-proxy-middleware": "^1.0.0",
|
|
"@types/jsonwebtoken": "^9.0.10",
|
|
"@types/multer": "^2.1.0",
|
|
"@types/node": "^25.3.0",
|
|
"@types/semver": "^7.7.1",
|
|
"@types/supertest": "^7.2.0",
|
|
"@types/tar-stream": "^3.1.4",
|
|
"@types/ws": "^8.18.1",
|
|
"@types/yaml": "^1.9.6",
|
|
"eslint": "^10.1.0",
|
|
"nodemon": "^3.1.13",
|
|
"supertest": "^7.2.2",
|
|
"ts-node": "^10.9.2",
|
|
"typescript": "^6.0.2",
|
|
"typescript-eslint": "^8.0.0",
|
|
"vitest": "^4.1.0"
|
|
},
|
|
"optionalDependencies": {
|
|
"@aws-sdk/client-ecr": "^3.1019.0",
|
|
"@aws-sdk/client-s3": "^3.1037.0"
|
|
},
|
|
"dependencies": {
|
|
"axios": "^1.15.0",
|
|
"bcrypt": "^6.0.0",
|
|
"better-sqlite3": "^12.6.2",
|
|
"composerize": "^1.7.5",
|
|
"compression": "^1.8.1",
|
|
"cookie-parser": "^1.4.7",
|
|
"cors": "^2.8.6",
|
|
"cron-parser": "^5.5.0",
|
|
"dockerode": "^5.0.0",
|
|
"express": "^5.2.1",
|
|
"express-rate-limit": "^8.3.1",
|
|
"helmet": "^8.1.0",
|
|
"http-proxy": "^1.18.1",
|
|
"http-proxy-middleware": "^4.0.0",
|
|
"isomorphic-git": "^1.37.5",
|
|
"jsonwebtoken": "^9.0.3",
|
|
"ldapts": "^8.1.7",
|
|
"multer": "^2.1.1",
|
|
"node-pty": "^1.1.0",
|
|
"openid-client": "^6.8.2",
|
|
"otplib": "^13.4.0",
|
|
"semver": "^7.7.4",
|
|
"systeminformation": "^5.31.1",
|
|
"tar-stream": "^3.1.8",
|
|
"ws": "^8.19.0",
|
|
"yaml": "^2.8.2",
|
|
"zod": "^4.3.6"
|
|
}
|
|
}
|