passlib is unmaintained and incompatible with bcrypt 5.0.0 due to its
internal wrap-bug detection test exceeding bcrypt's 72-byte password limit.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Lock accounts for 15 minutes after 5 consecutive failed login attempts
- Send urgent ntfy notification when an account is locked
- Send high-priority ntfy notification on login attempt against a locked account
- Auto-reset lockout on expiry; reset counter on successful login
- Add v2.4 migration for failed_login_attempts and locked_until columns
- Add ALLOWED_ORIGINS and SECURE_COOKIES to .env.example
- Update README: lockout row in security table, new ntfy events
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Sends alerts on admin login, new registrations, user disable/delete, and
impersonation. NTFY_URL and NTFY_TOKEN are optional — leave blank to disable.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds a green footer (matching nav colour) to all authenticated pages
with a "Created by: CHNS.tech" link and a styled BMC button. CSP updated
to allow buymeacoffee CDN domains.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Two bugs:
1. Python 3.12 name collision in schemas.py: `date: Optional[date] = None`
caused get_type_hints() to resolve the `date` type annotation to NoneType
(Optional[None]) because the field name shadowed the datetime.date import.
All *Update schemas were rejecting any PUT with a valid date. Fixed by
aliasing the import: `from datetime import date as Date`.
2. FastAPI validation errors return detail as a list of objects, not a string.
Passing that list to new Error() produced "Error: [object Object]". Fixed
in api.js to map the detail array to msg strings before throwing.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- JWT stored in HttpOnly, Secure, SameSite=Strict cookie — JS cannot
read the token at all; SameSite=Strict prevents CSRF without tokens
- Non-sensitive user payload returned in response body and stored in
localStorage for UI purposes only (not usable for auth)
- Add POST /api/auth/logout endpoint that clears the cookie server-side
- Add SECURE_COOKIES env var (default true) for local HTTP testing
- Extract login.html inline script to login.js (CSP compliance)
- Remove Authorization: Bearer header from API calls; add credentials:
include so cookies are sent automatically
- CSP script-src includes unsafe-inline to support existing onclick
handlers throughout the app
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Embed admin_id claim in impersonation JWTs and add a backend
/api/admin/unimpersonate endpoint that re-issues the admin token
from that claim. The admin token no longer needs to be stored in
sessionStorage, eliminating the risk of token theft via XSS.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Lock down CORS to ALLOWED_ORIGINS env var (was wildcard)
- Fix admin panel XSS: use data-username attributes instead of
interpolating usernames into onclick handlers
- Add rate limiting to /api/auth/register (3r/m) and /api/admin/*
(10r/m); set limit_req_status 429
- Add Content-Security-Policy header restricting scripts to self
and cdn.jsdelivr.net
- Add Subresource Integrity hash to Chart.js CDN script tag
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- models.py: add UniqueConstraint(user_id, date) to flock_history so
duplicate flock entries for the same day are rejected at the DB level
- main.py: v2.3 migration applies the new unique constraint to existing
installs at startup
- login.html: update register form minlength and placeholder from 6 to 10
characters to match backend; add specific 429 error message so rate-
limited users see "Too many attempts — please wait a minute" instead of
a generic failure
- auth.js: update settings modal password input minlength from 6 to 10
- summary.js: fix CSV export truncation — pass limit=10000 so users with
more than 500 days of data get a complete export; read chart border color
from --green CSS variable instead of hardcoded hex
- All HTML files: bump JS version params to ?v=4 so browsers discard
cached copies of files changed across recent sessions (api.js, auth.js,
dashboard.js, history.js, log.js, flock.js, budget.js, summary.js,
admin.js)
- .env.example: add password strength guidance for MySQL and admin vars
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- admin.py: remove unused get_current_user import
- feed.py, flock.py, other.py: add IntegrityError handling on POST/PUT
endpoints; duplicate submissions now return 409 instead of crashing with
a 500 error
- stats.py: extract magic numbers into named module-level constants
(DAYS_ROLLING, DAYS_SHORT, PRECISION_AVG, PRECISION_HEN, PRECISION_COST);
add return type annotations to _total_feed_cost and _total_other_cost;
normalize both helpers to always return Decimal so budget_stats no longer
needs Decimal(str(...)) workarounds; simplify _cpe/_cpd helpers
- dashboard.js: read --green CSS variable at runtime instead of hardcoding
the hex value so chart color stays in sync with the stylesheet
- docker-compose.yml: add healthcheck to api service (polls /api/health
every 30s) so Docker knows when the API is unhealthy; add password
strength guidance comment above the db service
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- api.js: add exponential backoff retry (3 attempts, 500/1000/2000ms) for
GET requests on network errors and 5xx responses; mutating methods are
not retried since they are not idempotent
- api.js: add offline indicator — fixed pill banner appears at bottom of
page when navigator goes offline, disappears when back online
- style.css: add styles for offline banner and session expiry warning
- auth.js: show amber warning banner below nav when session expires within
24 hours (with exact hours remaining); dismissible with X button
- auth.js: fix password min-length client-side check from 6 to 10 to
match the backend
- log.js, flock.js, budget.js: disable submit button during async request
and re-enable in finally block to prevent double-submits and make loading
state visible
- dashboard.js: fix chart date labels to use user's configured timezone
instead of the browser's local timezone
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- models.py: add composite (user_id, date) indexes to flock_history,
feed_purchases, and other_purchases for faster date-filtered queries
(egg_collections already had one via its unique constraint)
- main.py: add v2.2 migration to create the three composite indexes on
existing installs at startup
- stats.py: fix N+1 query in monthly_stats — flock history is now fetched
once and looked up per month using bisect_right instead of one DB query
per month row; also remove unnecessary Decimal(str(...)) round-trips
since SQLAlchemy already returns Numeric columns as Decimal
- eggs.py: add limit parameter (default 500, max 1000) to list_eggs to
cap unbounded fetches on large datasets
- dashboard.js: pass start= (30 days ago) when fetching eggs so the
dashboard only loads the data it actually needs for the chart and
recent collections list
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- nginx: add X-Content-Type-Options, X-Frame-Options, X-XSS-Protection,
and Referrer-Policy headers on all responses; rate limit /api/auth/login
to 5 req/min per IP (burst 3) to prevent brute force
- frontend: add escHtml() utility to api.js; use it on all notes fields
across dashboard, log, history, flock, and budget pages to prevent XSS
- log.js: fix broken loadRecent() call referencing removed #recent-body
element; replaced with loadHistory() from history.js
- schemas.py: raise minimum password length from 6 to 10 characters
- admin.py: add audit logging for password reset, disable, delete, and
impersonate actions; fix impersonate to use named admin param for logging
- main.py: add startup env validation — exits with clear error if any
required env var is missing; configure structured logging to stdout
- docker-compose.yml: add log rotation (10 MB / 3 files) to all services
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Removed standalone History page (history.html); full collection history
(date filter, edit, delete, totals footer) is now embedded in the Log
Eggs page below the log form
- Removed History nav link from all pages
- Reordered dashboard stat cards: egg counts → averages → Flock Size →
cost cards
- Egg count and average cards now use green; Flock Size card uses orange
- Updated README to reflect removed History page, merged log/history
feature, dashboard card changes, and project structure
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Rename app from Eggtracker to Yolkbook throughout
- Add JWT-based authentication (python-jose, passlib/bcrypt)
- Add users table; all data tables gain user_id FK for full data isolation
- Super admin credentials sourced from ADMIN_USERNAME/ADMIN_PASSWORD env vars,
synced on every startup; orphaned rows auto-assigned to admin post-migration
- Login page with self-registration; JWT stored in localStorage (30-day expiry)
- Admin panel (/admin): list users, reset passwords, disable/enable, delete,
and impersonate (Login As) with Return to Admin banner
- Settings modal (gear icon in nav): timezone selector and change password
- Timezone stored per-user; stats date windows computed in user's timezone;
date input setToday() respects user timezone via Intl API
- migrate_v2.sql for existing single-user installs
- Auto-migration adds timezone column to users on startup
- Updated README with full setup, auth, admin, and migration docs
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- New other_purchases table (date, total, notes)
- /api/other CRUD endpoints
- Budget stats now include other costs in cost/egg and cost/dozen math
- Budget page: new Log Other Purchases form, stat cards for other costs,
combined Purchase History table showing feed and other entries together
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
derekc