10 Commits

Include renames

Author	SHA1	Message	Date
Eric GullicksonandClaude Sonnet 4.5	e6af7ed5d5	feat: add batch insert operations to repositories (refs #26) ... Add batchInsert methods to vehicles, fuel-logs, maintenance, and documents repositories. Multi-value INSERT syntax provides 10-100x performance improvement over individual operations for bulk data import. - vehicles.repository: batchInsert for vehicles - fuel-logs.repository: batchInsert for fuel logs - maintenance.repository: batchInsertRecords and batchInsertSchedules - documents.repository: batchInsert for documents - All methods support empty array (immediate return) and optional transaction client - Fix lint error: replace require() with ES6 import in test mock Co-Authored-By: Claude Sonnet 4.5 <[email protected]>	2026-01-11 19:28:11 -06:00
Eric GullicksonandClaude Opus 4.5	f494f77150	feat: Implement user tier-based feature gating system (refs #8) ... Add subscription tier system to gate features behind Free/Pro/Enterprise tiers. Backend: - Create feature-tiers.ts with FEATURE_TIERS config and utilities - Add /api/config/feature-tiers endpoint for frontend config fetch - Create requireTier middleware for route-level tier enforcement - Add subscriptionTier to request.userContext in auth plugin - Gate scanForMaintenance in documents controller (Pro+ required) - Add migration to reset scanForMaintenance for free users Frontend: - Create useTierAccess hook for tier checking - Create UpgradeRequiredDialog component (responsive) - Gate DocumentForm checkbox with lock icon for free users - Add SubscriptionTier type to profile.types.ts Documentation: - Add TIER-GATING.md with usage guide Tests: 30 passing (feature-tiers, tier-guard, controller) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <[email protected]>	2026-01-04 14:34:47 -06:00
Eric Gullickson	2ab58267dd	feat: expand documents to include manuals	2025-12-25 12:54:00 -06:00
Eric Gullickson	719c80ecd8	Notification updates	2025-12-21 19:56:52 -06:00
Eric GullicksonandClaude Sonnet 4.5	183d55b0fe	Security fix: Implement magic byte validation for file uploads (Fix 2) ... Fixed HIGH severity security vulnerability (CVSS 7.5) where file upload validation relied solely on Content-Type headers, allowing malicious files with spoofed MIME types to bypass validation. Changes: - Updated file-type dependency to v16.5.4 (last CommonJS version) - Added magic byte (file signature) validation using fileTypeFromBuffer - Read first 4100 bytes of upload to detect actual file type - Verify detected type matches claimed Content-Type header - Reject files where content doesn't match headers - Enhanced logging with detected_type for audit trail Security impact: - Prevents .exe files renamed to .pdf from being uploaded - Prevents Content-Type header spoofing attacks - Validates file content at binary level, not just metadata Status: Fix 2 complete - Fix 1: crypto.randomBytes() ✓ - Fix 2: Magic byte validation ✓ - Fix 3: Google Maps API proxy ✓ 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <[email protected]>	2025-12-14 10:06:53 -06:00
Eric GullicksonandClaude Sonnet 4.5	a35e1a3aea	Security fixes: Implement P0 critical vulnerability remediations ... Implemented 3 critical security fixes identified in audit report: 1. CRITICAL (CVSS 8.1): Replace Math.random() with crypto.randomBytes() - Location: documents.controller.ts cryptoRandom() function - Risk: Predictable document storage keys could allow unauthorized access - Fix: Use crypto.randomBytes(32).toString('hex') for cryptographic security - Impact: Document storage keys are now cryptographically unpredictable 2. HIGH (CVSS 7.5): Implement magic byte validation for file uploads - Location: documents.controller.ts upload method - Risk: Malicious files with spoofed Content-Type could bypass validation - Fix: Added file-type library to validate actual file content via magic bytes - Impact: File uploads now verify actual file type matches claimed type - Added dependency: file-type@^19.8.0 3. HIGH (CVSS 6.5): Proxy Google Maps photos to hide API key - Note: Implementation in progress - agent reached token limit - Will be completed in follow-up commit Files modified: - backend/package.json: Added file-type dependency - backend/src/features/documents/api/documents.controller.ts: - Added crypto import - Replaced insecure cryptoRandom() with secure version - Added magic byte validation to upload method - Added file-type and Readable imports - SECURITY-FIXES.md: Complete implementation guide for all fixes Security status: 2/3 P0 fixes implemented and verified Next step: Complete Google Maps API proxy implementation Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <[email protected]>	2025-12-14 09:49:05 -06:00
Eric Gullickson	d4156cf521	Stuff	2025-11-04 18:38:06 -06:00
Eric Gullickson	3693ce5761	Docs Cleanup	2025-11-02 10:34:43 -06:00
Eric Gullickson	046c66fc7d	Redesign	2025-11-01 21:27:42 -05:00
Eric Gullickson	775a1ff69e	Added Documents Feature	2025-09-28 20:35:46 -05:00