Skip to content
Open
Show file tree
Hide file tree
Changes from 14 commits
Commits
Show all changes
28 commits
Select commit Hold shift + click to select a range
cea25d0
feat: add multi-user authentication, role-based access control, and a…
stanleyau-xx Apr 12, 2026
0823a0d
docs: update clone URLs to point to this fork
stanleyau-xx Apr 12, 2026
f8d0321
chore: use node:24.4.0-slim as base image (match upstream)
stanleyau-xx Apr 12, 2026
b65b15d
chore: remove troubleshooting/debug screenshots
stanleyau-xx Apr 12, 2026
6e9561f
chore: remove troubleshooting/debug screenshots
stanleyau-xx Apr 12, 2026
4a8f44f
fix: handle undefined selectedSection in SettingsDialogue
stanleyau-xx Apr 12, 2026
59e7f93
fix: show all discover results regardless of thumbnail presence
stanleyau-xx Apr 12, 2026
4dc2121
revert: restore thumbnail filter (SearXNG proxy issue was the cause)
stanleyau-xx Apr 12, 2026
9d5a890
feat: add Change Password section in Settings
stanleyau-xx Apr 12, 2026
3a607e6
chore: extend session cookie maxAge to 1 year
stanleyau-xx Apr 12, 2026
ebc0722
feat: add warm theme support
stanleyau-xx Apr 12, 2026
43c0ab5
fix: revert darkMode change (caused theme styling issues)
stanleyau-xx Apr 12, 2026
1882118
Remediated browser OOM issue
stanleyau-xx Apr 13, 2026
26f772e
[Security/bugfix] Fix 15 issues from PR #1107: JWT secret enforcement…
stanleyau-xx Apr 13, 2026
fd7f97c
[Bugfix/security/robustness] Fix remaining 4 issues flagged by review…
stanleyau-xx Apr 13, 2026
d1ac6d4
[fix] UploadManager now requires userId param (type & logic enforced)…
stanleyau-xx Apr 13, 2026
b7e243b
[buildfix] Set ENV JWT_SECRET=dummy in Dockerfile to allow Next.js pr…
stanleyau-xx Apr 13, 2026
3e41c12
[fix] Resolve Brainstorming hang, stream parser, and search reliabili…
stanleyau-xx Apr 14, 2026
dd6c4b6
Restore searxng/settings.yml to default (use_default_settings: true)
stanleyau-xx Apr 14, 2026
89ea8b2
[Security] Address PR review feedback: JWT hardening, rate limiting, …
stanleya-ctrl Apr 14, 2026
bc509be
[Tests] Add comprehensive auth/middleware/unit tests (22 passing)
stanleya-ctrl Apr 14, 2026
512a5f1
Fix setup flow UX: auto-redirect to /setup, fix Finish 404
stanleya-ctrl Apr 14, 2026
ae67e5b
[Tests] Add DB migration smoke tests (25 passing)
stanleya-ctrl Apr 14, 2026
e97ab8a
[Tests] Replace migration text-check with real execution tests (28 pa…
stanleya-ctrl Apr 14, 2026
45ac1db
Revert Dockerfile builder to node:24.5.0-slim (latest patch)
stanleya-ctrl Apr 16, 2026
bd42c00
docs: add Original Vane architecture link and clarify JWT_SECRET enfo…
stanleya-ctrl Apr 16, 2026
12d6043
test: add auth unit tests (password hashing, JWT, session expiry)
stanleya-ctrl Apr 16, 2026
ad8e06f
docs: clarify JWT_SECRET enforcement with production example command
stanleya-ctrl Apr 16, 2026
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Dockerfile
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM node:24.5.0-slim AS builder
FROM node:24.4.0-slim AS builder

RUN apt-get update && apt-get install -y python3 python3-pip sqlite3 && rm -rf /var/lib/apt/lists/*

Expand Down
317 changes: 101 additions & 216 deletions README.md

Large diffs are not rendered by default.

15 changes: 15 additions & 0 deletions drizzle/0003_add_users_sessions.sql
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
-- Migration: Add users and sessions tables for multi-user auth
CREATE TABLE IF NOT EXISTS `users` (
`id` text PRIMARY KEY NOT NULL,
`username` text NOT NULL UNIQUE,
`password_hash` text NOT NULL,
`role` text DEFAULT 'user' NOT NULL,
Copy link
Copy Markdown
Contributor

@cubic-dev-ai cubic-dev-ai bot Apr 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: RBAC role is stored as unrestricted text in migration, allowing invalid role values and weakening authorization data integrity.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At drizzle/0003_add_users_sessions.sql, line 6:

<comment>RBAC role is stored as unrestricted text in migration, allowing invalid role values and weakening authorization data integrity.</comment>

<file context>
@@ -0,0 +1,15 @@
+  `id` text PRIMARY KEY NOT NULL,
+  `username` text NOT NULL UNIQUE,
+  `password_hash` text NOT NULL,
+  `role` text DEFAULT 'user' NOT NULL,
+  `createdAt` text NOT NULL
+);
</file context>
Fix with Cubic

`createdAt` text NOT NULL
);

CREATE TABLE IF NOT EXISTS `sessions` (
`id` text PRIMARY KEY NOT NULL,
`userId` text NOT NULL,
`expiresAt` text NOT NULL,
`createdAt` text NOT NULL
);
2 changes: 2 additions & 0 deletions drizzle/0004_add_userid_to_chats.sql
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
-- Migration: Add userId column to chats table for multi-user support
ALTER TABLE `chats` ADD COLUMN `userId` text NOT NULL DEFAULT 'anonymous';
7 changes: 7 additions & 0 deletions drizzle/meta/_journal.json
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,13 @@
"when": 1763732708332,
"tag": "0002_daffy_wrecker",
"breakpoints": true
},
{
"idx": 3,
"version": "6",
"when": 1744400000000,
"tag": "0003_add_users_sessions",
"breakpoints": true
}
]
}
2 changes: 1 addition & 1 deletion next-env.d.ts
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
/// <reference types="next" />
/// <reference types="next/image-types/global" />
import './.next/dev/types/routes.d.ts';
import "./.next/dev/types/routes.d.ts";

// NOTE: This file should not be edited
// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.
1 change: 1 addition & 0 deletions next.config.mjs
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ import pkg from './package.json' with { type: 'json' };

/** @type {import('next').NextConfig} */
const nextConfig = {
allowedDevOrigins: ['10.0.0.54', '141.147.96.213', 'localhost'],
output: 'standalone',
images: {
remotePatterns: [
Expand Down
Loading