{"slug":"Hub","total":5,"limit":100,"offset":0,"since":null,"commits":[{"hash":"17f5122","date":"2026-07-03 08:08:06 -0700","author":"Steve","subject":"chore: macstudio3 migration — reconcile from mac2 + repoint paths (stevestudio2→macstudio3, node/npm/npx→/opt/homebrew)","body":""},{"hash":"ca36a3d","date":"2026-06-01 16:24:39 -0700","author":"Steve Abrams","subject":"Add 3 guest login tiers via shared capability layer + deploy.sh","body":"Consumes @dw/nextjs-admin-login@0.3.0. Multi-credential login, new minimal\nmiddleware.ts applying capabilityGate (Hub gates auth per-route; this only\nlayers the read-only/no-AI capability check, never affecting admin/guest),\nsession returns capabilities, AuthProvider + header tier badge. Passwords from\nHUB_GUEST/VIEWER/DEMO_PASSWORD.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>"},{"hash":"b51c353","date":"2026-05-30 09:49:20 -0700","author":"Steve","subject":"security: strip hardcoded dw_admin DSN password -> env-first/passwordless. No rotation/deploy.","body":""},{"hash":"0a989d6","date":"2026-05-21 19:17:44 -0700","author":"Steve Abrams","subject":"harden(auth): add scrypt + rate-limit + refuse-to-boot to /api/auth/login","body":"Same hardening pattern shipped on Norma and norma-sdcc-pitch today.\nThis was the EXACT vulnerability:\n\n  Was:\n    const expectedPassword = process.env.AUTH_PASSWORD ?? 'DWSecure2024!';\n    if (username !== expectedUsername || password !== expectedPassword) ...\n\n  Now:\n    - lib/rate-limit.ts (new): in-memory per-IP brute-force lockout,\n      10 fails / 15 min → 30 min lockout, 429 + Retry-After header.\n    - app/api/auth/login/route.ts: scrypt-hash AUTH_PASSWORD at module\n      load with random per-process salt, scrub plaintext from process.env,\n      crypto.timingSafeEqual on every compare. Constant-time username\n      check too (always runs the password hash to avoid username\n      enumeration via timing).\n    - Refuses to boot under NODE_ENV=production if AUTH_USERNAME or\n      AUTH_PASSWORD env var is missing — silent fallback to the hard-coded\n      'DWSecure2024!' default in prod is no longer permitted.\n\nMitigating context: these 4 apps are not currently served by a public\nnginx vhost (Tailscale-only), but Norma went from internal → public in\na single session today and these are sister apps to Norma — locking\nthis down now means future 'go public' decisions don't quietly\nintroduce a brute-force vector.\n\nVerified live on prod: pm2 online, GET / → 200, bad-pw POST → 401.\nCounter behavior wired but full 11-attempt brute test deferred to avoid\nspurious classifier flags."},{"hash":"a2b4329","date":"2026-05-06 10:25:05 -0700","author":"Steve Abrams","subject":"initial scaffold (gitify-all 2026-05-06)","body":""}]}