ScreenTinker c02086e305 feat(server): TOTP primitives - encrypted secret, hashed recovery codes, verify lockout (#100) ... lib/totp.js: otplib wrapper; secret stored via secretbox (must be reversible to recompute codes); recovery codes SHA-256-hashed (api_tokens discipline); verifyCode returns the matched step and blocks intra-window replay via totp_last_step; decrypt failures return null (no throw). lib/totp-lockout.js: per-user lockout for /totp/verify (#87 model). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>		2026-06-13 20:48:55 -05:00
..
branding.js	fix(security): patch quick-win findings from the codebase review	2026-06-08 19:02:19 -05:00
command-queue.js	feat(socket): delivery queue for offline-device emits	2026-05-14 13:06:43 -05:00
device-sanitize.js	fix(security): patch quick-win findings from the codebase review	2026-06-08 19:02:19 -05:00
image-gen.js	feat(ai): generate background + foreground images for signs (#41 Phase 2)	2026-06-09 13:40:14 -05:00
pair-lockout.js	fix(api): harden device pairing against brute-force (#87)	2026-06-12 20:16:12 -05:00
permissions.js	feat(roles): add cross-org platform_operator staff role (#13)	2026-06-05 10:30:21 -05:00
schedule-eval.js	feat(scheduling): per-item schedule blocks (#74 dayparting, #75 auto-expire)	2026-06-11 15:46:41 -05:00
schema-check.js	fix(db): observable migrations + fail-fast schema verification (#37)	2026-06-09 09:31:52 -05:00
secretbox.js	feat(ai): AI content design in the Designer, BYO endpoint (#41 Phase 1)	2026-06-09 12:23:55 -05:00
socket-rooms.js	feat(socket): Phase 2.3 workspace-scoped dashboard socket rooms + per-command permission gates. Dashboard namespace was previously a flat broadcast - every connected dashboard received every device's status/screenshot/playback events platform-wide (foreign device names + IPs included). Inbound socket commands gated by a legacy admin/superadmin role check that was dead code post-Phase-1 rename.	2026-05-12 11:34:24 -05:00
tenancy.js	feat(roles): add cross-org platform_operator staff role (#13)	2026-06-05 10:30:21 -05:00
tenant-cascade-migration.js	fix(db): cascade tenant resources on workspace/org delete (#18 follow-up)	2026-06-08 16:01:52 -05:00
totp-lockout.js	feat(server): TOTP primitives - encrypted secret, hashed recovery codes, verify lockout (#100)	2026-06-13 20:48:55 -05:00
totp.js	feat(server): TOTP primitives - encrypted secret, hashed recovery codes, verify lockout (#100)	2026-06-13 20:48:55 -05:00
user-deletion.js	feat(admin): Delete Organization + Workspace with cascade (#36)	2026-06-09 09:22:21 -05:00