Matt 27f8db4c67 fix(P1): rate-limit auth endpoints — F7 ...

Pre-audit: 20 rapid wrong-password attempts all returned 401 with no
lockout. Brute-force open.

Post-fix: better-auth's built-in rate limiter caps /sign-in/email at
5 attempts per 60s. Verified live — attempts 1-5 return 401, attempt 6+
returns 429 "Too many requests".

Same tight cap applied to /sign-up/email, /forget-password,
/reset-password. Default 120/min for everything else so legitimate
multi-widget dashboards aren't hampered.

Memory storage in this commit (resets on restart). Production multi-replica
swap to `storage: 'database'` planned for a follow-up once the
rateLimit migration is run.

Also: in production, trust X-Forwarded-For / X-Real-IP so the IP that
rate-limit + audit logging see is the real client, not the proxy.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-14 22:41:47 +02:00

.gitea/workflows

Remove deploy job from CI - build and push only

2026-03-26 12:19:36 +01:00

.husky

Fix Docker build and production server infrastructure

2026-04-08 15:31:33 -04:00

assets

fix(audit-wave-9): PDF correctness + brand asset hardening (pdf-auditor)

2026-05-13 12:07:57 +02:00

competing-plans/blessed

Initial commit: Port Nimara CRM (Layers 0-4)

2026-03-26 11:52:51 +01:00

docker/postgres

Initial commit: Port Nimara CRM (Layers 0-4)

2026-03-26 11:52:51 +01:00

docs

docs: capture post-audit fix plan from two-round Playwright sweep

2026-05-14 22:38:02 +02:00

messages

feat(deps): next-intl scaffold (English-only, future locale-add ready)

2026-05-12 22:47:18 +02:00

nginx

fix(security): tier-0 audit blockers (next CVE, role gate, perm traps, key validation, rate limits)

2026-05-05 18:33:13 +02:00

public

fix(ux): popover collision padding, PWA manifest, webhook toasts, portal toast, dashboard error boundary, GDPR poll backoff, empty-state CTA

2026-05-06 14:59:27 +02:00

scripts

feat(documenso-phase-4): recipient configurator + field placement UI

2026-05-13 14:03:27 +02:00

src

fix(P1): rate-limit auth endpoints — F7

2026-05-14 22:41:47 +02:00

tests

feat(schema): berths.archived_at + clients.source_inquiry_id + email_bounces

2026-05-14 15:33:20 +02:00

.dockerignore

audit: Tier 1/3/6/7 batch — PII redaction, mobile safe-area, perf, build hardening

2026-05-12 17:18:35 +02:00

.env.example

chore(env): document DOCUMENSO/MINIO vars + fix InMemoryBackend test stub

2026-05-11 14:04:28 +02:00

.gitattributes

chore: add .gitattributes to normalize line endings to LF

2026-04-22 02:02:46 +02:00

.gitignore

feat(ui): broad consistency sweep — sources, dates, comboboxes, milestones

2026-05-12 14:50:58 +02:00

.lintstagedrc.json

feat(deps): pre-commit type-check on staged TS files

2026-05-12 22:00:43 +02:00

.prettierrc

Initial commit: Port Nimara CRM (Layers 0-4)

2026-03-26 11:52:51 +01:00

01-CONSOLIDATED-SYSTEM-SPEC.md

Initial commit: Port Nimara CRM (Layers 0-4)

2026-03-26 11:52:51 +01:00

02-FEATURE-INVENTORY.md

Initial commit: Port Nimara CRM (Layers 0-4)

2026-03-26 11:52:51 +01:00

03-ARCHITECTURE-DECISIONS.md

Initial commit: Port Nimara CRM (Layers 0-4)

2026-03-26 11:52:51 +01:00

04-ARCHITECTURE-COMPARISON.md

Initial commit: Port Nimara CRM (Layers 0-4)

2026-03-26 11:52:51 +01:00

05-FINAL-ARCHITECTURE-DECISIONS.md

Initial commit: Port Nimara CRM (Layers 0-4)

2026-03-26 11:52:51 +01:00

06-MASTER-FEATURE-SPEC.md

Initial commit: Port Nimara CRM (Layers 0-4)

2026-03-26 11:52:51 +01:00

07-DATABASE-SCHEMA.md

docs: reflect data-model refactor in CLAUDE.md + DB schema overview

2026-04-26 14:14:34 +02:00

08-API-ENDPOINT-CATALOG.md

Initial commit: Port Nimara CRM (Layers 0-4)

2026-03-26 11:52:51 +01:00

09-BUSINESS-RULES.md

Initial commit: Port Nimara CRM (Layers 0-4)

2026-03-26 11:52:51 +01:00

10-AUTH-AND-PERMISSIONS.md

Initial commit: Port Nimara CRM (Layers 0-4)

2026-03-26 11:52:51 +01:00

11-REALTIME-AND-BACKGROUND-JOBS.md

Initial commit: Port Nimara CRM (Layers 0-4)

2026-03-26 11:52:51 +01:00

12-IMPLEMENTATION-SEQUENCE.md

Initial commit: Port Nimara CRM (Layers 0-4)

2026-03-26 11:52:51 +01:00

13-UI-PAGE-MAP.md

Initial commit: Port Nimara CRM (Layers 0-4)

2026-03-26 11:52:51 +01:00

14-TECHNICAL-DECISIONS.md

Initial commit: Port Nimara CRM (Layers 0-4)

2026-03-26 11:52:51 +01:00

15-DESIGN-TOKENS.md

Initial commit: Port Nimara CRM (Layers 0-4)

2026-03-26 11:52:51 +01:00

CLAUDE.md

feat(reporting): money-math sweep — Step 1 PRE-DEPLOY-PLAN

2026-05-14 15:19:38 +02:00

components.json

Initial commit: Port Nimara CRM (Layers 0-4)

2026-03-26 11:52:51 +01:00

design-system-preview.html

Initial commit: Port Nimara CRM (Layers 0-4)

2026-03-26 11:52:51 +01:00

docker-compose.dev.yml

Initial commit: Port Nimara CRM (Layers 0-4)

2026-03-26 11:52:51 +01:00

docker-compose.prod.yml

fix(P1): GDPR export + Redis eviction policy

2026-05-14 22:39:16 +02:00

docker-compose.yml

fix(P1): GDPR export + Redis eviction policy

2026-05-14 22:39:16 +02:00

Dockerfile

fix(audit-wave-10): build-auditor fixes — CSP, server externals, healthcheck

2026-05-13 12:30:22 +02:00

Dockerfile.dev

audit: Tier 1/3/6/7 batch — PII redaction, mobile safe-area, perf, build hardening

2026-05-12 17:18:35 +02:00

Dockerfile.worker

fix(build): make prepare tolerant of missing husky + bump deps (Phase 1a)

2026-05-08 16:15:34 +02:00

drizzle.config.ts

Initial commit: Port Nimara CRM (Layers 0-4)

2026-03-26 11:52:51 +01:00

eslint.config.mjs

fix(ci): repair pnpm lint for Next 16 + cross-tree ignores

2026-05-14 16:03:37 +02:00

instrumentation.ts

feat(deps): @sentry/nextjs error tracking (DSN-gated, dormant by default)

2026-05-12 22:38:18 +02:00

mockup-A-sidebar-dark.html

Initial commit: Port Nimara CRM (Layers 0-4)

2026-03-26 11:52:51 +01:00

mockup-B-light-theme.html

Initial commit: Port Nimara CRM (Layers 0-4)

2026-03-26 11:52:51 +01:00

mockup-C-bold-modern.html

Initial commit: Port Nimara CRM (Layers 0-4)

2026-03-26 11:52:51 +01:00

next-env.d.ts

feat(deps): Next 15 → 16 (proxy.ts rename + native flat ESLint config)

2026-05-12 22:24:51 +02:00

next.config.ts

fix(audit-wave-11): CSP nonce middleware — drops 'unsafe-inline' in prod

2026-05-13 13:04:30 +02:00

NOCODB-MIGRATION-MAPPING.md

Initial commit: Port Nimara CRM (Layers 0-4)

2026-03-26 11:52:51 +01:00

package.json

fix(ci): repair pnpm lint for Next 16 + cross-tree ignores

2026-05-14 16:03:37 +02:00

playwright.config.ts

fix(test): raise mobile-audit timeout to 30min for 4-viewport runs

2026-04-29 15:15:26 +02:00

pnpm-lock.yaml

fix(audit-wave-11): asset hygiene + datetime correctness

2026-05-13 12:58:58 +02:00

postcss.config.mjs

feat(deps): Tailwind 3 → 4 + swap tailwindcss-animate for tw-animate-css

2026-05-12 22:14:38 +02:00

PROGRESS.md

docs: update PROGRESS.md with 2026-03-26 → 2026-04-22 changelog

2026-04-22 02:37:43 +02:00

SECURITY-GUIDELINES.md

Initial commit: Port Nimara CRM (Layers 0-4)

2026-03-26 11:52:51 +01:00

sentry.client.config.ts

feat(deps): @sentry/nextjs error tracking (DSN-gated, dormant by default)

2026-05-12 22:38:18 +02:00

sentry.edge.config.ts

feat(deps): @sentry/nextjs error tracking (DSN-gated, dormant by default)

2026-05-12 22:38:18 +02:00

sentry.server.config.ts

feat(deps): @sentry/nextjs error tracking (DSN-gated, dormant by default)

2026-05-12 22:38:18 +02:00

tsconfig.json

feat(deps): Next 15 → 16 (proxy.ts rename + native flat ESLint config)

2026-05-12 22:24:51 +02:00

tsconfig.server.json

Fix Docker build and production server infrastructure

2026-04-08 15:31:33 -04:00

vitest.config.ts

feat(pdf): brand kit foundation for @react-pdf/renderer

2026-05-12 20:45:28 +02:00

Description

No description provided

25 MiB

Languages

TypeScript 98.7%

HTML 1%

CSS 0.1%

Shell 0.1%