ScreenTinker b938fce368 feat(auth,tizen): TOTP 2FA UI, email verification on signup, Tizen SSSP install ... Three features from this session, full server suite green (535/535). TOTP 2FA (#100) — backend shipped without a UI; add it: - Login: mfa_required -> 6-digit challenge (recovery codes accepted) -> /totp/verify. - Settings > Account: enable (QR + confirm -> recovery codes once), regenerate, disable; SSO accounts see "managed by your identity provider". - /totp/setup returns a server-rendered qr_data_url (bundled qrcode dep). keyuri folds the request Host into the issuer so multi-instance accounts are distinguishable in the authenticator app. Email verification on signup — hosted HARD-block / self-host SOFT-nudge: - email_verified column; existing users asked on first login (SSO + platform admins grandfathered); single-use 24h tokens (SHA-256 hashed). - Gate engages only when email is configured (never locks out a no-mail instance). GET /verify-email + POST /resend-verification (generic, no account enumeration). - Client: "confirm your email" flow + resend, verified/error toasts, self-host banner; onAuthSuccess refuses a tokenless response (defensive). Tizen SSSP URL-Launcher install — Fusion-style one-URL native install: - Server hosts /tizen/sssp_config.xml (dynamic <size>, always matches the served .wgt) + /tizen/ScreenTinker.wgt + a human landing. lib/wgt-cache.js resolves the signed .wgt (/data mount wins, mirroring the APK). - build-wgt.sh also emits a static sssp_config.xml for CDN hosting. - Retail panels require a Samsung Partner cert; dev-mode is SDB self-signed only. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>		2026-07-22 21:08:50 -05:00
..
activationNudge.js	feat(signup): T+3 activation nudge for users with zero paired screens	2026-05-30 20:28:24 -05:00
activity.js	feat(workspaces): rename via switcher dropdown - new PATCH /api/workspaces/:id route, per-row pencil affordance in switcher (visible only when caller can_admin), small rename modal with name + slug fields, validation (name <=80 chars, slug ^[a-z0-9]+(?:-[a-z0-9]+)*$ <=60 chars, blank slug -> NULL), 409 on per-org slug collision. Permission gating via new canAdminWorkspace(db, user, ws) helper in lib/permissions.js - reused-ready for future Phase 3 admin actions. /me query now joins organization_members to compute can_admin per accessible_workspaces entry. Drive-by fixes surfaced: (1) activityLogger method filter was missing PATCH, added; (2) routes that operate on a target workspace by URL param need to stamp req.workspaceId from the param so activityLogger captures the right tenant attribution - documented in the route. Smoke fixture: switcher-test@local.test is workspace_admin of Studio A and workspace_editor of Field Crew (no org_owner) so the can_admin true/false split is exercised in one login.	2026-05-12 11:06:55 -05:00
agency-digest.js	feat(api): batched email digest for agency uploads (#73)	2026-06-14 13:59:37 -05:00
alerts.js	feat(email): Microsoft Graph send + alert spam protection + preferences UI	2026-05-12 18:16:40 -05:00
content-expiry.js	feat(device-owner): tier foundation + QR provisioning + content-expiry & device enhancements (#168)	2026-07-12 19:41:07 -05:00
email.js	feat(email): SMTP transport as an alternative to Microsoft Graph [#173] (#179)	2026-07-13 15:56:22 -05:00
heartbeat.js	feat(diagnostics): device incident log — offline cause, network-vs-reboot, display-sleep (#175)	2026-07-13 11:26:04 -05:00
loop-lag.js	fix(#146) P3.7: coalescer carries the PEAK numeric over the window	2026-06-30 22:10:45 -05:00
scheduler.js	feat(device-owner): tier foundation + QR provisioning + content-expiry & device enhancements (#168)	2026-07-12 19:41:07 -05:00
signupEmails.js	feat(auth,tizen): TOTP 2FA UI, email verification on signup, Tizen SSSP install	2026-07-22 21:08:50 -05:00