Claude
619515db96
Two hardening changes beyond just a password: - The admin panel no longer uses stored credentials at all. The backend generates a random API key on every startup and prints it to its own console (never through the DB-backed logger, since that's only reachable from inside the panel this key protects). Every /api/admin/* request must carry it as an X-Api-Key header, checked with a timing-safe comparison on every call — there's no session to create or steal, and restarting the backend invalidates the previous key immediately. The old admin_users and sessions tables, scrypt password hashing, and cookie-based session plumbing are removed entirely (dropped via migration for existing installs, not left behind unused). The login page keeps its existing layout but now asks for this key and explains where to find it, storing it in the browser's localStorage rather than relying on a server session. - The admin panel (the masthead's cog icon and the /admin/* pages themselves) is now disabled by default on every deployment, gated by a new frontend-only ADMIN_PANEL_ENABLED env var. This is a separate, UI-only visibility control — the API key above is what actually protects the backend regardless of this flag.
25 lines
640 B
JSON
25 lines
640 B
JSON
{
|
|
"name": "frontend",
|
|
"private": true,
|
|
"version": "0.0.1",
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "vite dev",
|
|
"build": "vite build",
|
|
"preview": "vite preview",
|
|
"prepare": "svelte-kit sync || echo ''",
|
|
"check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
|
|
"check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch"
|
|
},
|
|
"devDependencies": {
|
|
"@sveltejs/adapter-auto": "^7.0.1",
|
|
"@sveltejs/kit": "^2.63.0",
|
|
"@sveltejs/vite-plugin-svelte": "^7.1.2",
|
|
"@types/node": "^26.1.1",
|
|
"svelte": "^5.56.1",
|
|
"svelte-check": "^4.6.0",
|
|
"typescript": "^6.0.3",
|
|
"vite": "^8.0.16"
|
|
}
|
|
}
|