mirror of
https://github.com/screentinker/screentinker.git
synced 2026-06-19 04:32:31 -06:00
33eaef826c
Self-review follow-ups, kept as a separate commit so the review trail is honest. - Spec drift: POST /widgets/preview was documented scope 'read' but the method-based tokenScopeGate enforces 'write' for any POST, so a read-token integrator following the published docs would hit a surprise 403. The code is right; fix the SPEC to match it. - Guard it forever: test/openapi-contract.test.js cross-checks every spec operation's x-required-scope against the enforcement rule, and that every documented path is a public (token-reachable) router - both derived from the same config/api-surface.js. Adds js-yaml (devDep) to parse the spec. Spec/enforcement drift now fails CI. - Vendored Redoc: add frontend/vendor/README.md (library, version 2.3.9, source, update steps) and drop the dangling //# sourceMappingURL line so /docs doesn't 404 in devtools. Remaining (non-security) test-coverage gaps tracked in #92. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
34 lines
869 B
JSON
34 lines
869 B
JSON
{
|
|
"name": "screentinker",
|
|
"version": "1.9.0",
|
|
"description": "ScreenTinker - Digital Signage Management Server",
|
|
"main": "server.js",
|
|
"scripts": {
|
|
"start": "node --env-file-if-exists=.env server.js",
|
|
"dev": "node --watch --env-file-if-exists=.env server.js",
|
|
"test": "node --test"
|
|
},
|
|
"dependencies": {
|
|
"@azure/msal-node": "^5.2.1",
|
|
"archiver": "^7.0.1",
|
|
"bcryptjs": "^3.0.3",
|
|
"better-sqlite3": "^9.4.3",
|
|
"cors": "^2.8.5",
|
|
"express": "^4.18.2",
|
|
"express-rate-limit": "^8.3.1",
|
|
"google-auth-library": "^10.6.2",
|
|
"helmet": "^8.1.0",
|
|
"jsonwebtoken": "^9.0.3",
|
|
"multer": "^1.4.5-lts.1",
|
|
"sharp": "^0.33.2",
|
|
"socket.io": "^4.7.2",
|
|
"stripe": "^20.4.1",
|
|
"unzipper": "^0.12.3",
|
|
"uuid": "^14.0.0"
|
|
},
|
|
"devDependencies": {
|
|
"js-yaml": "^4.2.0",
|
|
"socket.io-client": "^4.8.3"
|
|
}
|
|
}
|