vrr/liseur-sync
2
0
Fork 0
mirror of https://github.com/chmouel/liseur-sync.git synced 2026-08-29 17:31:42 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2
liseur-sync/internal/webui
History
Exact
Chmouel Boudjnah 0b35367200
Some checks are pending
build / binary (push) Waiting to run
Details
build / container (push) Waiting to run
Details
test / test (push) Waiting to run
Details
test / lint-openapi (push) Waiting to run
Details
fix: Store pairing codes as hash of MD5-derived key clients send 
KOReader and Readest kosync clients never transmit the raw pairing
code: they compute `md5(password)` locally and send that digest as
both the registration password and the `x-auth-key` credential on
every subsequent request. The adapter was hashing the raw code for
storage and then hashing `md5(code)` for the device slot key, so
redemption could never match what a real client actually sent,
causing every pairing attempt to return 403.

- Introduced `KosyncUserKey` (MD5 derivation) and `KosyncPairingHash`
  (SHA-256 of the derived key) in the auth package so pairing codes
  are stored under the hash of what the client will actually present
- Removed the server-side `md5hex` helper that re-derived the key
  after registration; the received value is already the derived key
- Normalized the received key to lowercase before hashing to match
  canonical hex encoding
- Updated all pairing code creation sites (admin CLI, web UI,
  self-service) to use `KosyncPairingHash`
- Added `TestClientSendsMD5DerivedKeyNotTheCode` regression test
  verifying that the raw code is rejected and the derived key works
- Updated tests to send the derived key on the wire, matching real
  client behavior

Signed-off-by: Chmouel Boudjnah <chmouel@chmouel.com>
2026-08-29 09:54:01 +02:00
..
static fix: Add copy button for flash secrets to prevent transcription errors 2026-08-29 08:51:18 +02:00
testdata fix: refuse a position that cannot be read instead of storing it as zero 2026-08-26 23:46:58 +02:00
admin.go fix: harden credential enrolment 2026-08-20 06:10:51 +02:00
admin.templ feat: Consolidate account controls into unified settings hub 2026-08-19 11:10:43 +02:00
adminexpanded_test.go fix: redirect after a settings mutation instead of rendering in place 2026-08-22 11:59:49 +02:00
adminfolders.go fix: redirect after a settings mutation instead of rendering in place 2026-08-22 11:59:49 +02:00
adminfolders.templ feat: Consolidate account controls into unified settings hub 2026-08-19 11:10:43 +02:00
adminfolders_watch_test.go feat: scope catalog access to explicit per-user folder grants 2026-08-22 10:43:41 +02:00
adminmaintenance.go fix: resolve web UI lint issues 2026-08-19 11:22:15 +02:00
adminmaintenance.templ feat: Consolidate account controls into unified settings hub 2026-08-19 11:10:43 +02:00
adminusers.go fix: Store pairing codes as hash of MD5-derived key clients send 2026-08-29 09:54:01 +02:00
adminusers.templ fix: Add copy button for flash secrets to prevent transcription errors 2026-08-29 08:51:18 +02:00
adminusers_test.go feat: scope catalog access to explicit per-user folder grants 2026-08-22 10:43:41 +02:00
annotations_webui_test.go feat: sync annotations across devices (ADR-0028) 2026-08-25 12:04:15 +02:00
baseurl.go feat(ui): show the OPDS address, and stop printing <host> 2026-08-16 10:00:06 +02:00
books.go feat: scope catalog access to explicit per-user folder grants 2026-08-22 10:43:41 +02:00
books.templ feat: refresh reading library UI 2026-08-21 15:57:09 +02:00
books_ext_test.go feat: Separate OPDS rate limiter from authentication limits 2026-08-28 23:08:28 +02:00
cards.templ feat(catalog): reader-editable series, library-wide entities 2026-08-16 17:37:12 +02:00
cover.go feat: scope catalog access to explicit per-user folder grants 2026-08-22 10:43:41 +02:00
cover_ext_test.go feat!: watch a folder, not a pipeline 2026-08-16 09:47:18 +02:00
csp_ext_test.go fix: resolve web UI lint issues 2026-08-19 11:22:15 +02:00
dashboard.templ feat: Show custom device names in dashboard reading sessions 2026-08-24 16:04:05 +02:00
dashboardchart.go fix: keep the dashboard's span honest at both of its edges 2026-08-24 02:11:00 +02:00
dashboardspan_ext_test.go feat: Show custom device names in dashboard reading sessions 2026-08-24 16:04:05 +02:00
delete.go feat: scope catalog access to explicit per-user folder grants 2026-08-22 10:43:41 +02:00
delete_ext_test.go feat: scope catalog access to explicit per-user folder grants 2026-08-22 10:43:41 +02:00
description_ext_test.go feat!: watch a folder, not a pipeline 2026-08-16 09:47:18 +02:00
devices.go feat: Show custom device names in dashboard reading sessions 2026-08-24 16:04:05 +02:00
devices.templ fix: Add copy button for flash secrets to prevent transcription errors 2026-08-29 08:51:18 +02:00
devices_test.go feat: Show custom device names in dashboard reading sessions 2026-08-24 16:04:05 +02:00
entities.go feat: scope catalog access to explicit per-user folder grants 2026-08-22 10:43:41 +02:00
entities.templ feat(catalog): reader-editable series, library-wide entities 2026-08-16 17:37:12 +02:00
handlers.go fix: Store pairing codes as hash of MD5-derived key clients send 2026-08-29 09:54:01 +02:00
helpers.go feat: Show custom device names in dashboard reading sessions 2026-08-24 16:04:05 +02:00
layout.templ feat: refresh reading library UI 2026-08-21 15:57:09 +02:00
library.go feat: scope catalog access to explicit per-user folder grants 2026-08-22 10:43:41 +02:00
library.templ feat: refresh reading library UI 2026-08-21 15:57:09 +02:00
library_ext_test.go feat: group web series across the library 2026-08-24 02:38:09 +02:00
librarydelete.go feat: scope catalog access to explicit per-user folder grants 2026-08-22 10:43:41 +02:00
librarydelete_ext_test.go feat: scope catalog access to explicit per-user folder grants 2026-08-22 10:43:41 +02:00
libraryseries.go fix: fall back for cross-folder series piles 2026-08-24 02:38:09 +02:00
libraryupload.go feat: scope catalog access to explicit per-user folder grants 2026-08-22 10:43:41 +02:00
libraryupload_ext_test.go feat: scope catalog access to explicit per-user folder grants 2026-08-22 10:43:41 +02:00
prefs.go feat: let the web dashboard ask about any span of reading 2026-08-24 02:11:00 +02:00
reader.go feat: scope catalog access to explicit per-user folder grants 2026-08-22 10:43:41 +02:00
reader.templ feat: sync annotations across devices (ADR-0028) 2026-08-25 12:04:15 +02:00
reader_test.go feat!: watch a folder, not a pipeline 2026-08-16 09:47:18 +02:00
readerbrowser_ext_test.go fix: refuse a position that cannot be read instead of storing it as zero 2026-08-26 23:46:58 +02:00
readerfirefox_ext_test.go feat!: watch a folder, not a pipeline 2026-08-16 09:47:18 +02:00
readerorigin.go feat: scope catalog access to explicit per-user folder grants 2026-08-22 10:43:41 +02:00
readerorigin_ext_test.go feat: Separate OPDS rate limiter from authentication limits 2026-08-28 23:08:28 +02:00
readerpage_ext_test.go feat!: watch a folder, not a pipeline 2026-08-16 09:47:18 +02:00
readertokens_test.go feat: Consolidate account controls into unified settings hub 2026-08-19 11:10:43 +02:00
readingstatus.go feat: scope catalog access to explicit per-user folder grants 2026-08-22 10:43:41 +02:00
sanitize.go fix(webui): render book descriptions as sanitized html 2026-08-15 20:22:04 +02:00
sanitize_test.go fix(webui): render book descriptions as sanitized html 2026-08-15 20:22:04 +02:00
search.go feat: scope catalog access to explicit per-user folder grants 2026-08-22 10:43:41 +02:00
search.templ feat!: watch a folder, not a pipeline 2026-08-16 09:47:18 +02:00
search_ext_test.go feat: scope catalog access to explicit per-user folder grants 2026-08-22 10:43:41 +02:00
series.go feat: scope catalog access to explicit per-user folder grants 2026-08-22 10:43:41 +02:00
series.templ feat: refresh reading library UI 2026-08-21 15:57:09 +02:00
series_ext_test.go fix: make read status visible 2026-08-21 12:00:12 +02:00
seriesmerge_ext_test.go feat: scope catalog access to explicit per-user folder grants 2026-08-22 10:43:41 +02:00
server.go feat: let the web dashboard ask about any span of reading 2026-08-24 02:11:00 +02:00
settings.templ feat: Consolidate account controls into unified settings hub 2026-08-19 11:10:43 +02:00
settingsview.go fix: redirect after a settings mutation instead of rendering in place 2026-08-22 11:59:49 +02:00
setup.go refactor(store): a library's source, storage and refresh are three things 2026-08-15 20:22:05 +02:00
setup_test.go feat: Consolidate account controls into unified settings hub 2026-08-19 11:10:43 +02:00
shell_test.go feat: group library books by series 2026-08-21 10:47:21 +02:00
webui_test.go fix: Add copy button for flash secrets to prevent transcription errors 2026-08-29 08:51:18 +02:00
works.templ feat: sync annotations across devices (ADR-0028) 2026-08-25 12:04:15 +02:00