ScreenTinker 792013e36c Record auth rate-limit rejections so they can be measured ... The auth limiters are app.use middleware that return 429 before the handler that writes activity_log, so a rejection left no trace anywhere — the limit suppressed the record of itself. Four production IPs sit at exactly ten logins a minute and there was no way to tell whether that is one attacker or an office whose staff share an egress address, which is the difference between the limiter working and the limiter locking out customers. The rejection count does not answer that. The number of distinct accounts per IP does: one account hammered is the limiter doing its job, several accounts each denied a few times is a shared egress. Both are now recorded, and a platform-admin-only endpoint reads the tally back. Identifiers are salted-hashed with a per-process salt and only ever counted, so this cannot accumulate into a roster of a customer's addresses. Memory is bounded per key and overall, and says when a count was capped rather than silently undercounting. Behaviour is unchanged: same status, same body, and the recording is wrapped so telemetry can never break the limiter. A test asserts ten through then 429 with the identical response shape, since a diagnostic that alters what it measures is worse than none. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Uaeo9MvzKoyXuN6ZsbhtkL		2026-07-28 14:01:00 -05:00
..
agency-layouts.js	feat: agency zone-grant issuance UI + reactive placement card (#73)	2026-06-14 15:12:55 -05:00
agency-targets.js	feat(agency): per-token upload folder — auto-created, subtree-confined (#158) (#171)	2026-07-12 21:23:25 -05:00
apk-cache.js	fix(#146) C: OTA hardening under SNAT — no per-request fs, global download caps	2026-06-30 21:05:32 -05:00
apk-signature.js	feat(device-owner): tier foundation + QR provisioning + content-expiry & device enhancements (#168)	2026-07-12 19:41:07 -05:00
app-settings.js	feat(#146): always-on devices_connected + admin-toggleable /api/status debug block	2026-07-01 18:45:40 -05:00
billing-token.js	feat(#146): owner-only CLI to mint billing:read tokens (scripts/mint-billing-token.js)	2026-07-01 21:31:11 -05:00
billing.js	feat(#146): usage metering + admin-gated Billable Screens report (contract system-of-record)	2026-07-01 20:45:27 -05:00
bounded-snapshot-store.js	fix(widgets): bound the unauthenticated telemetry store, and stop it writing rows	2026-07-26 10:36:09 -05:00
branding.js	fix(security): patch quick-win findings from the codebase review	2026-06-08 19:02:19 -05:00
chunked-prune.js	fix(#146) A: non-blocking maintenance — chunked+yield+band-gate all sweeps	2026-06-30 20:55:05 -05:00
command-queue.js	feat(socket): delivery queue for offline-device emits	2026-05-14 13:06:43 -05:00
content-ack-limiter.js	fix(#146) E: log/write self-protection — coalesced logs, batched telemetry, bounded maps	2026-06-30 21:34:01 -05:00
content-ingest.js	fix(uploads): derive stored type from file content, and never serve uploads as documents	2026-07-25 11:47:09 -05:00
device-identity.js	fix(#146) P1.1: resolveIdentity short-circuits on device_id (zero-lookup hot path)	2026-06-30 21:57:55 -05:00
device-sanitize.js	Scope device serialization to what each endpoint actually needs	2026-07-27 20:40:40 -05:00
device-settings.js	feat(#150): preserve per-device settings across delete+re-pair (fingerprint-keyed)	2026-07-07 12:40:47 -05:00
device-timezone.js	Store a schedule in the timezone its screen runs in	2026-07-28 09:43:46 -05:00
emailVerify.js	feat(auth,tizen): TOTP 2FA UI, email verification on signup, Tizen SSSP install	2026-07-22 21:08:50 -05:00
flap-limiter.js	fix(#148) Item 1: exempt paired+authenticated devices from the flap-limiter quarantine	2026-07-02 14:59:25 -05:00
ghcr-check.js	feat(dashboard): version indicator + GHCR update check (#165)	2026-07-10 22:40:06 -05:00
image-gen.js	feat(ai): generate background + foreground images for signs (#41 Phase 2)	2026-06-09 13:40:14 -05:00
incident-classify.js	feat(diagnostics): device incident log — offline cause, network-vs-reboot, display-sleep (#175)	2026-07-13 11:26:04 -05:00
limiter-telemetry.js	Record auth rate-limit rejections so they can be measured	2026-07-28 14:01:00 -05:00
liveness.js	feat: app-ending signal (exit-signal contract v1) — server + APK + .wgt + /player	2026-07-08 15:32:40 -05:00
log-coalescer.js	fix(#146) P3.7: coalescer carries the PEAK numeric over the window	2026-06-30 22:10:45 -05:00
login-lockout.js	feat(auth): bound password login per account, not only per IP	2026-07-26 14:07:16 -05:00
media-orientation.js	fix(content+android): rotation-aware media — portrait upright on dashboard AND player (#170) (#172)	2026-07-12 22:05:11 -05:00
numeric-code.js	fix(devices): generate access-gating six-digit codes with a CSPRNG	2026-07-26 14:24:03 -05:00
ota-breaker.js	Clear a device's OTA rate state when it proves its identity	2026-07-27 22:28:47 -05:00
ota-download-guard.js	feat(#146): /api/status.debug throughput counters (gauges -> gauges + work done)	2026-06-30 23:24:32 -05:00
pair-lockout.js	fix(pairing): expire a pairing code on device liveness, not row age	2026-07-27 10:59:38 -05:00
passwordReset.js	feat(auth): self-service password reset	2026-07-27 11:19:39 -05:00
permissions.js	feat(roles): add cross-org platform_operator staff role (#13)	2026-06-05 10:30:21 -05:00
player-media-health.js	fix(#146): web player — reconnect drops video to "Waiting for content" (idle reset over live playback)	2026-07-01 22:03:44 -05:00
reconnect-throttle.js	fix(#146): reconnect/heartbeat storm containment (beta5)	2026-06-29 22:12:13 -05:00
recovery-grant.js	fix(auth): back break-glass recovery with a revocable, auditable grant	2026-07-26 14:49:03 -05:00
rolling-counter.js	feat(#146): /api/status.debug throughput counters (gauges -> gauges + work done)	2026-06-30 23:24:32 -05:00
safe-socket.js	fix(#146): crash-hardening — one device's handler throw can't take down the fleet	2026-06-29 23:38:11 -05:00
schedule-eval.js	feat(scheduling): per-item schedule blocks (#74 dayparting, #75 auto-expire)	2026-06-11 15:46:41 -05:00
schema-check.js	fix(db): observable migrations + fail-fast schema verification (#37)	2026-06-09 09:31:52 -05:00
secretbox.js	feat(ai): AI content design in the Designer, BYO endpoint (#41 Phase 1)	2026-06-09 12:23:55 -05:00
session-settle.js	fix(#148) patch2: per-device session-settle debounce — absorb duplicate-socket storms	2026-07-02 19:12:46 -05:00
socket-rooms.js	feat(socket): Phase 2.3 workspace-scoped dashboard socket rooms + per-command permission gates. Dashboard namespace was previously a flat broadcast - every connected dashboard received every device's status/screenshot/playback events platform-wide (foreign device names + IPs included). Inbound socket commands gated by a legacy admin/superadmin role check that was dead code post-Phase-1 rename.	2026-05-12 11:34:24 -05:00
ssrf-guard.js	feat: transition engine — GL wipes across web, Tizen & Android (+ image↔video) (#204)	2026-07-20 16:45:32 -05:00
status-log-writer.js	feat(diagnostics): device incident log — offline cause, network-vs-reboot, display-sleep (#175)	2026-07-13 11:26:04 -05:00
tcp-keepalive.js	fix(#148) Items 2-4: mark-offline closes the socket + tighten ping + TCP keepalive	2026-07-02 14:59:25 -05:00
tenancy.js	refactor(auth): drop the unused optionalAuth middleware	2026-07-24 21:03:25 -05:00
tenant-cascade-migration.js	fix(db): cascade tenant resources on workspace/org delete (#18 follow-up)	2026-06-08 16:01:52 -05:00
totp-lockout.js	feat(server): TOTP primitives - encrypted secret, hashed recovery codes, verify lockout (#100)	2026-06-13 20:48:55 -05:00
totp.js	feat(auth,tizen): TOTP 2FA UI, email verification on signup, Tizen SSSP install	2026-07-22 21:08:50 -05:00
transition-bundle.js	feat: transition engine — GL wipes across web, Tizen & Android (+ image↔video) (#204)	2026-07-20 16:45:32 -05:00
transition-config.js	feat: transition engine — GL wipes across web, Tizen & Android (+ image↔video) (#204)	2026-07-20 16:45:32 -05:00
upload-sniff.js	fix(uploads): derive stored type from file content, and never serve uploads as documents	2026-07-25 11:47:09 -05:00
user-deletion.js	feat(#150): preserve per-device settings across delete+re-pair (fingerprint-keyed)	2026-07-07 12:40:47 -05:00
wgt-cache.js	feat(auth,tizen): TOTP 2FA UI, email verification on signup, Tizen SSSP install	2026-07-22 21:08:50 -05:00
zone-validate.js	fix: per-item mute round-trip + multi-zone orphan-zone fallback & warnings	2026-06-22 23:16:29 -05:00