Changeset 9e27d64 in Klonkt for src/views/pages/auth-reset.ejs

Timestamp:

06/14/2026 07:31:23 AM (3 months ago)

Author:

roboburr <roboburr@…>

Branches:

main

Children:

6351545

Parents:

32cc601

Message:

auth: password admin + per-instance Google for listeners (no broker)

Robin's choice: every self-hoster has their own password admin account,
and can optionally let listeners log in to comment using their OWN Google
client. No central broker (that would tie every customer site to Robin's
Google Cloud -> systemic risk on abuse).

• Admin = username/password (bcrypt). First-time setup via /auth/register (only when there are 0 users); closed afterwards. No public registration.
• Forgot password: /auth/reset-request -> email (if SMTP configured) with reset link; CLI break-glass npm run reset-admin always works (no email needed).
• Change password (logged in) restored in /account.
• Google = per-instance own credentials, OPTIONAL, listeners only -> always role member, never admin (god/admin email is rejected; google_sub mismatch too).
• config/google.js back to direct Google OAuth; config/mailer.js new (nodemailer).
• jose removed from deps; nodemailer added.

Security review (workflow) incorporated:

• Reset token no longer in production logs (dev only).
• Reset link from PUBLIC_BASE_URL instead of X-Forwarded-Host (host poisoning).
• Reset tokens stored SHA-256-hashed in the DB.
• Same-origin check on all state-modifying POSTs (CSRF layer on top of sameSite-lax).
• Login always runs one bcrypt comparison (no timing enumeration).

Co-Authored-By: Claude <noreply@…>

File:

• src/views/pages/auth-reset.ejs (modified) (2 diffs)

src/views/pages/auth-reset.ejs

@@ -1 +1 @@
 <div class="container auth-page">
-  <h1>Reset password</h1>
+  <h1>Wachtwoord resetten</h1>
 
   <% if (!token) { %>
     <% if (error) { %><div class="alert alert-error"><%= error %></div><% } %>
     <p class="auth-link">
-      <a href="/auth/reset-request">Request a new reset link</a>
+      <a href="/auth/reset-request">Vraag een nieuwe reset-link aan</a>
       &middot;
-      <a href="/auth/login">Back to login</a>
+      <a href="/auth/login">Terug naar inloggen</a>
     </p>
   <% } else { %>
-    <p class="auth-tagline">Set a new password for <strong><%= username %></strong>.</p>
+    <p class="auth-tagline">Stel een nieuw wachtwoord in voor <strong><%= username %></strong>.</p>
 
     <% if (error) { %><div class="alert alert-error"><%= error %></div><% } %>
@@ -16 +16 @@
     <form method="post" action="/auth/reset/<%= token %>" class="auth-form">
       <label>
-        <span>New password (min 8 chars)</span>
+        <span>Nieuw wachtwoord (min 8 tekens)</span>
         <input type="password" name="new_password" required minlength="8" autofocus autocomplete="new-password">
       </label>
       <label>
-        <span>Confirm new password</span>
+        <span>Bevestig nieuw wachtwoord</span>
         <input type="password" name="confirm" required minlength="8" autocomplete="new-password">
       </label>
-      <button type="submit" class="btn btn-primary">Set password</button>
+      <button type="submit" class="btn btn-primary">Wachtwoord instellen</button>
     </form>
   <% } %>