mirror of https://github.com/johannesjo/super-productivity.git synced 2026-07-20 18:08:55 +00:00

History

Johannes Millan 70414145a3 fix(sync): prevent magic link prefetch failures and improve auth resilience (#7175 ) * fix(sync): prevent magic link prefetch failures and improve auth resilience - Make /magic-login prefetch-immune: GET now renders a confirmation page instead of consuming the single-use token. A "Log In" button triggers POST /api/login/magic-link/verify which does the actual verification. This prevents email client link prefetchers (Outlook SafeLinks, Gmail) from consuming magic link tokens before users click them. - Increase rate limits on auth endpoints for shared-IP scenarios (e.g. university NAT). Global: 100→500, register: 10→50, login: 5→30, verify: 10→50, magic-login page: 10→50. - Add trustProxy to Fastify so req.ip uses X-Forwarded-For behind reverse proxies instead of collapsing all clients to one rate bucket. - Clear stale SuperSync auth tokens after 3 consecutive AuthFailSPErrors instead of never clearing them. Prevents persistent failure loops where an invalid token keeps retrying indefinitely until app reinstall. - Improve registration-to-login UX messaging to emphasize email verification is required before login links will work. https://claude.ai/code/session_01WkbLzvhguQwRDtk7ht38aY * chore: update package-lock.json from npm install https://claude.ai/code/session_01WkbLzvhguQwRDtk7ht38aY * fix(sync): address review feedback for auth resilience - Remove conflicting style.css link from magic-login page - Change trustProxy from true to 1 (trust single hop only) - Increase /login/magic-link rate limit from 30 to 50 per 15min - Delete dead magic-login-redirect.js (replaced by magic-login-confirm.js) - Reset auth failure counter on non-auth errors (truly consecutive) - Add test for counter reset on non-auth error between auth errors https://claude.ai/code/session_01WkbLzvhguQwRDtk7ht38aY * fix(sync): increase passkey rate limits and fix CSP inline script violations - Increase passkey endpoint rate limits to match magic-link equivalents (50/15min) - Extract inline scripts from /reset-password and /recover-passkey pages into external JS files to comply with CSP scriptSrc: ["'self'"] - Remove dead safeJsonForScript helper (no longer needed) - Increase /recover-passkey page rate limit to 50/15min for consistency https://claude.ai/code/session_01WkbLzvhguQwRDtk7ht38aY * fix(sync): update security tests for escapeHtml and fix recover/passkey rate limit - Update server-security.spec.ts: tests now check for escapeHtml output (<, ") instead of safeJsonForScript output (\u003c), matching the new data-token attribute approach - Increase /recover/passkey rate limit from 30 to 50 per 15min to match /login/magic-link (both send email with a secret link) https://claude.ai/code/session_01WkbLzvhguQwRDtk7ht38aY * fix(sync): reset auth failure counter after successful download Move the counter reset from the final InSync return to right after downloadRemoteOps() succeeds. This ensures early returns (cancelled, LWW pending, payload rejected) also break the consecutive-failure chain, since a successful download confirms auth is working. https://claude.ai/code/session_01WkbLzvhguQwRDtk7ht38aY --------- Co-authored-by: Claude <noreply@anthropic.com>		2026-04-10 14:46:57 +02:00
..
plugin-api	feat(calendar): add CalDAV Calendar plugin with time-blocking support	2026-03-28 23:10:08 +01:00
plugin-dev	chore(deps): bump the npm_and_yarn group across 8 directories with 2 updates (#7159 )	2026-04-09 20:34:47 +02:00
shared-schema	fix(sync): preserve own vector clock counter across full-state op resets	2026-04-01 15:41:13 +02:00
super-sync-server	fix(sync): prevent magic link prefetch failures and improve auth resilience (#7175 )	2026-04-10 14:46:57 +02:00
vite-plugin	feat(plugins): add i18n support to boilerplate-solid-js	2026-01-16 22:34:50 +01:00
build-packages.js	fix(plugins): style form inputs to match main app and copy i18n for simple plugins	2026-03-20 21:36:30 +01:00
README.md	feat: cleanup and update plugins 2	2025-06-29 06:36:02 +02:00

README.md

Super Productivity Packages

This directory contains plugin packages and the plugin API for Super Productivity.

Structure

plugin-api/ - TypeScript definitions for the plugin API
plugin-dev/ - Plugin development examples and tools
- api-test-plugin/ - Basic API test plugin
- procrastination-buster/ - Example SolidJS-based plugin
- yesterday-tasks-plugin/ - Simple plugin showing yesterday's tasks
- boilerplate-solid-js/ - Template for creating new SolidJS plugins (not built)
- sync-md/ - Markdown sync plugin (not built)

Building Packages

All packages are built automatically when running the main build process:

npm run build:packages

This command:

Builds the plugin-api TypeScript definitions
Builds plugins that require compilation (e.g., procrastination-buster)
Copies plugin files to src/assets/ for inclusion in the app

Development

To work on a specific plugin:

cd plugin-dev/[plugin-name]
npm install
npm run dev

Adding a New Plugin

Create a new directory in plugin-dev/
Add the plugin configuration to /packages/build-packages.js
Run npm run build:packages to test the build

Notes

The boilerplate-solid-js and sync-md plugins are development templates and are not included in production builds
Plugin files are automatically copied to src/assets/ during the build process
The build script handles dependency installation automatically