Creative ideas + design notes
Commits with substantial prose (≥120 chars) — the rationale behind each move.
d921396 · 2026-06-01 · Add 3 guest login tiers with capability-based access control
- lib/accounts.ts: per-username capability registry (admin + guest/viewer/demo)
- Multi-credential login route (guest passwords from env; absent = disabled)
- Session returns role/isAdmin/canWrite/canUseAI from registry
- Middleware enforces (authoritative): mutating methods need canWrite,
AI routes need canUseAI -> 403 otherwise
- AuthProvider exposes canWrite/canUseAI; gate Add Grant + all AI Generate
buttons; header account-tier badge (Guest / Read-only / Demo)
Tiers: guest=member(write,no-AI) viewer=read-only demo=read-only+AI.
Verified all 4 logins + per-tier enforcement + UI gating locally.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
a073178 · 2026-06-01 · Remove stray @next/swc-darwin-arm64 hard dependency (broke linux deploy)
Mac-only native SWC binary was pinned in dependencies; Next resolves the
correct per-platform binary as an optional dep automatically. As a hard dep
it made npm install fail with EBADPLATFORM on prod (linux/x64). Prod's prior
package.json never had it.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
d27ef8c · 2026-06-01 · Add admin-level account + Live/Admin view toggle
- Seed users-table admin account (scripts/seed-admin-user.mjs, idempotent)
- Session API resolves the org's owner/admin row -> returns role/isAdmin
- AuthProvider exposes isAdmin + persisted viewMode ('live'|'admin')
- Header Live/Admin segmented toggle (ViewModeToggle), admins only
- Gate AI Discover buttons (grants/news/collaborations) behind admin view
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
f2decb0 · 2026-05-30 · news: replace AI-fabricated discovery with real Federal Register API data
Drop the Gemini path that asked an LLM to invent "realistic" headlines,
"plausible" URLs, and "plausible" journalist names. /api/news/discover now
fetches real, published documents live from the free, open Federal Register
API (no key) and maps them to the existing news_items shape — outlet=agency,
summary=abstract, url=verifiable federalregister.gov link, source_type from
FR doc type. Org AI keywords drive a relevance term-search so results stay
on-mission. Response contract ({ discovered, news }) and DB row shape are
unchanged, so NewsTab keeps working. Adds "Federal Register" attribution
(author_name + tag + response.source). New lib/federalRegister.ts client.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
df9207a · 2026-05-21 · harden(auth): add scrypt + rate-limit + refuse-to-boot to /api/auth/login
Same hardening pattern shipped on Norma and norma-sdcc-pitch today.
This was the EXACT vulnerability:
Was:
const expectedPassword = process.env.AUTH_PASSWORD ?? 'DWSecure2024!';
if (username !== expectedUsername || password !== expectedPassword) ...
Now:
- lib/rate-limit.ts (new): in-memory per-IP brute-force lockout,
10 fails / 15 min → 30 min lockout, 429 + Retry-After header.
- app/api/auth/login/route.ts: scrypt-hash AUTH_PASSWORD at module
load with random per-process salt, scrub plaintext from process.env,
crypto.timingSafeEqual on every compare. Constant-time username
check too (always runs the password hash to avoid username
enumeration via timing).
- Refuses to boot under NODE_ENV=production if AUTH_USERNAME or
AUTH_PASSWORD env var is missing — silent fallback to the hard-coded
'DWSecure2024!' default in prod is no longer permitted.
Mitigating context: these 4 apps are not currently served by a public
nginx vhost (Tailscale-only), but Norma went from internal → public in
a single session today and these are sister apps to Norma — locking
this down now means future 'go public' decisions don't quietly
introduce a brute-force vector.
Verified live on prod: pm2 online, GET / → 200, bad-pw POST → 401.
Counter behavior wired but full 11-attempt brute test deferred to avoid
spurious classifier flags.
c95598d · 2026-05-20 · ecosystem: bind Next to 127.0.0.1:7450 (tailscaled holds :7450 wildcard)
EADDRINUSE on prod — tailscaled was already bound to 100.107.67.67:7450
(tailnet IP, IPv4) and [fd7a:115c:a1e0::d432:4343]:7450 (IPv6), which
blocks any 0.0.0.0:7450 wildcard bind. Pinning Grant to loopback only;
external traffic reaches it through tailscale serve → 127.0.0.1:7450
(or whatever reverse proxy fronts the box).
