7 Commits

Author	SHA1	Message	Date
David Nguyen	8671f269e8	fix: lint project (#2693)	2026-05-08 16:04:22 +10:00
Lucas Smith	653ab3678a	feat: better ratelimiting (#2520) ... Replace hono-rate-limiter with a Prisma/PostgreSQL bucketed counter approach that works correctly across multiple instances without sticky sessions. - Add RateLimit model with composite PK (key, action, bucket) and atomic upsert - Create rate limit factory with window parsing, bucket computation, and fail-open - Define auth-tier and API-tier rate limit instances - Add Hono middleware, rateLimitResponse helper, and tRPC assertRateLimit helper - Wire rate limit headers through AppError constructor (was declared but never assigned) - Apply rate limits to auth routes (email-password, passkey), tRPC routes (2FA email, link org account), API routes, and file upload endpoints - Add cleanup cron job for expired rate limit rows (batched delete every 15 min) - Remove hono-rate-limiter dependency	2026-02-20 12:23:02 +11:00
Lucas Smith	2e3d22c856	fix: use instance-specific emails for service accounts (#2502)	2026-02-16 11:52:19 +11:00
Lucas Smith	fabd69bd62	build: upgrade simplewebauthn packages from v9 to v13 (#2389) ... The v9 packages are deprecated. This updates to v13 which includes breaking API changes: optionsJSON wrapper for auth functions, renamed properties (authenticator→credential), and base64 encoding for credential IDs via isoBase64URL helper.	2026-01-15 14:22:37 +11:00
David Nguyen	e6dc237ad2	feat: add organisations (#1820)	2025-06-10 11:49:52 +10:00
David Nguyen	1ed1cb0773	chore: refactor sessions	2025-02-16 00:44:01 +11:00
David Nguyen	383b5f78f0	feat: migrate nextjs to rr7	2025-02-13 14:10:38 +11:00