2GT-RichandClaude Opus 4.8
28701cfc67
Address the actionable findings from an adversarial review: - 2FA enrollment now requires the current password (/totp/setup), so a hijacked session or XSS can't enable TOTP and lock the real user out. SSO-only accounts (no local password) are told to set one first. Frontend collects the password before starting setup. - OIDC config rejects default_role='admin': auto-provisioning unmatched users straight to admin is almost never intended — admin must come from an explicit group → role mapping. - Rate limiter no longer fails fully open on a Redis outage. Redis calls are bounded by an 800ms timeout (the client uses maxRetriesPerRequest:null, so commands would otherwise hang, not throw), and on failure a per-process in-memory sliding-window fallback keeps /login and other limited endpoints throttled. Verified with Redis stopped: attempts throttle (429) instead of hanging or passing unlimited. Findings intentionally not actioned: the "API-token auth is fire-and-forget" report was a false positive (Express awaits next(), which is called inside the promise), and the webhook DB-pool and JWT-revocation items are either overstated or a separate architectural decision. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
50 lines
1.3 KiB
JSON
50 lines
1.3 KiB
JSON
{
|
|
"name": "mikrotik-manager-frontend",
|
|
"version": "0.17.3-beta",
|
|
"private": true,
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "vite",
|
|
"build": "tsc && vite build",
|
|
"preview": "vite preview",
|
|
"lint": "eslint src",
|
|
"test": "vitest run"
|
|
},
|
|
"dependencies": {
|
|
"@tanstack/react-query": "^5.101.0",
|
|
"@types/leaflet": "^1.9.21",
|
|
"@xterm/addon-fit": "^0.11.0",
|
|
"@xterm/xterm": "^6.0.0",
|
|
"@xyflow/react": "^12.11.1",
|
|
"axios": "^1.18.1",
|
|
"clsx": "^2.1.0",
|
|
"date-fns": "^3.2.0",
|
|
"leaflet": "^1.9.4",
|
|
"lucide-react": "^1.23.0",
|
|
"react": "^19.2.7",
|
|
"react-dom": "^19.2.7",
|
|
"react-router-dom": "^7.18.1",
|
|
"recharts": "^2.10.3",
|
|
"socket.io-client": "^4.7.3",
|
|
"tailwind-merge": "^3.5.0",
|
|
"zustand": "^4.4.7"
|
|
},
|
|
"devDependencies": {
|
|
"@eslint/js": "^9.39.4",
|
|
"@types/react": "^19.2.14",
|
|
"@types/react-dom": "^19.2.3",
|
|
"@vitejs/plugin-react": "^6.0.3",
|
|
"autoprefixer": "^10.4.17",
|
|
"eslint": "^9.39.4",
|
|
"eslint-plugin-react": "^7.37.5",
|
|
"eslint-plugin-react-hooks": "^7.0.1",
|
|
"eslint-plugin-security": "^4.0.0",
|
|
"postcss": "^8.5.10",
|
|
"tailwindcss": "^3.4.1",
|
|
"typescript": "^5.9.3",
|
|
"typescript-eslint": "^8.58.2",
|
|
"vite": "^8.0.16",
|
|
"vitest": "^4.1.8"
|
|
}
|
|
}
|