cc/Trek_CN
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity
2b162a8cc7
Trek_CN/server/package.json

71 lines
1.9 KiB
JSON
Raw Normal View History

Initial commit — NOMAD (Navigation Organizer for Maps, Activities & Destinations) Self-hosted travel planner with Express.js, SQLite, React & Tailwind CSS.
2026-03-19 06:58:08 +08:00
{
v2.6.2 — TREK Rebrand, OSM Enrichment, File Management, Hotel Bookings & Bug Fixes Rebrand: - NOMAD → TREK branding across all UI, translations, server, PWA manifest - New TREK logos (dark/light, with/without icon) - Liquid glass toast notifications Bugs Fixed: - HTTPS redirect now opt-in only (FORCE_HTTPS=true), fixes #33 #43 #52 #54 #55 - PDF export "Tag" fallback uses i18n, fixes #15 - Vacay sharing color collision detection, fixes #25 - Backup settings import fix (PR #47) - Atlas country detection uses smallest bounding box, fixes #31 - JPY and zero-decimal currencies formatted correctly, fixes #32 - HTML lang="en" instead of hardcoded "de", fixes #34 - Duplicate translation keys removed - setSelectedAssignmentId crash fixed New Features: - OSM enrichment: Overpass API for opening hours, Wikimedia Commons for photos - Reverse geocoding on map right-click to add places - OIDC config via environment variables (OIDC_ISSUER, OIDC_CLIENT_ID, etc.), fixes #48 - Multi-arch Docker build (ARM64 + AMD64), fixes #11 - File management: star, trash/restore, upload owner, assign to places/bookings, notes - Markdown rendering in Collab Notes with expand modal, fixes #17 - Type-specific booking fields (flight: airline/number/airports, hotel: check-in/out/days, train: number/platform/seat), fixes #35 - Hotel bookings auto-create accommodations, bidirectional sync - Multiple hotels per day with check-in/check-out color coding - Ko-fi and Buy Me a Coffee support cards - GitHub releases proxy with server-side caching
2026-03-28 23:38:08 +08:00
"name": "trek-server",
chore: reset to 3.0.9
2026-04-27 06:22:09 +08:00
"version": "3.0.8",
refactoring: TypeScript migration, security fixes,
2026-03-28 01:40:18 +08:00
"main": "src/index.ts",
Initial commit — NOMAD (Navigation Organizer for Maps, Activities & Destinations) Self-hosted travel planner with Express.js, SQLite, React & Tailwind CSS.
2026-03-19 06:58:08 +08:00
"scripts": {
refactoring: TypeScript migration, security fixes,
2026-03-28 01:40:18 +08:00
"start": "node --import tsx src/index.ts",
Add comprehensive backend test suite (#339) * add test suite, mostly covers integration testing, tests are only backend side * workflow runs the correct script * workflow runs the correct script * workflow runs the correct script * unit tests incoming * Fix multer silent rejections and error handler info leak - Revert cb(null, false) to cb(new Error(...)) in auth.ts, collab.ts, and files.ts so invalid uploads return an error instead of silently dropping the file - Error handler in app.ts now always returns 500 / "Internal server error" instead of forwarding err.message to the client * Use statusCode consistently for multer errors and error handler - Error handler in app.ts reads err.statusCode to forward the correct HTTP status while keeping the response body generic
2026-04-03 19:17:53 +08:00
"dev": "tsx watch src/index.ts",
"test": "vitest run",
"test:watch": "vitest",
"test:unit": "vitest run tests/unit",
"test:integration": "vitest run tests/integration",
"test:ws": "vitest run tests/websocket",
"test:coverage": "vitest run --coverage"
Initial commit — NOMAD (Navigation Organizer for Maps, Activities & Destinations) Self-hosted travel planner with Express.js, SQLite, React & Tailwind CSS.
2026-03-19 06:58:08 +08:00
},
"dependencies": {
feat: mcp server
2026-03-30 09:53:45 +08:00
"@modelcontextprotocol/sdk": "^1.28.0",
Initial commit — NOMAD (Navigation Organizer for Maps, Activities & Destinations) Self-hosted travel planner with Express.js, SQLite, React & Tailwind CSS.
2026-03-19 06:58:08 +08:00
"archiver": "^6.0.1",
"bcryptjs": "^2.4.3",
Stabilize core: better-sqlite3, versioned migrations, graceful shutdown - Replace experimental node:sqlite with better-sqlite3 (stable API) - Replace try/catch migration pattern with schema_version tracking - Add SIGTERM/SIGINT handler for clean shutdown (DB flush, scheduler stop) - Fix BudgetPanel crash: remove undefined setShowAddCategory call - Update Dockerfile: remove --experimental-sqlite, add native build tools
2026-03-23 00:52:24 +08:00
"better-sqlite3": "^12.8.0",
feat(auth): migrate JWT storage from localStorage to httpOnly cookies Eliminates XSS token theft risk by storing session JWTs in an httpOnly cookie (trek_session) instead of localStorage, making them inaccessible to JavaScript entirely. - Add cookie-parser middleware and setAuthCookie/clearAuthCookie helpers - Set trek_session cookie on login, register, demo-login, MFA verify, OIDC exchange - Auth middleware reads cookie first, falls back to Authorization: Bearer (MCP unchanged) - Add POST /api/auth/logout to clear the cookie server-side - Remove all localStorage auth_token reads/writes from client - Axios uses withCredentials; raw fetch calls use credentials: include - WebSocket ws-token exchange uses credentials: include (no JWT param) - authStore initialises isLoading: true so ProtectedRoute waits for /api/auth/me Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-01 17:02:45 +08:00
"cookie-parser": "^1.4.7",
Initial commit — NOMAD (Navigation Organizer for Maps, Activities & Destinations) Self-hosted travel planner with Express.js, SQLite, React & Tailwind CSS.
2026-03-19 06:58:08 +08:00
"cors": "^2.8.5",
"dotenv": "^16.4.1",
"express": "^4.18.3",
fix(gpx): replace regex parsing with fast-xml-parser and import tracks alongside waypoints GPX files containing both <wpt> and <trk> elements would only import waypoints, silently discarding track geometry. The fallback chain only parsed <trkpt> when no waypoints were found. Replaced all regex-based XML parsing helpers with fast-xml-parser for correctness (namespaces, CDATA, attribute ordering). Tracks are now always parsed independently of waypoints, with each <trk> element becoming its own place with route geometry. Fixes #427.
2026-04-05 21:54:26 +08:00
"fast-xml-parser": "^5.5.10",
Security hardening, backup restore fix & restore warning modal - Fix backup restore: try/finally ensures DB always reopens after closeDb - Fix EBUSY on uploads during restore (in-place overwrite instead of rmSync) - Add DB proxy null guard for clearer errors during restore window - Add red warning modal before backup restore (DE/EN, dark mode support) - JWT secret: empty docker-compose default so auto-generation kicks in - OIDC: pass token via URL fragment instead of query param (no server logs) - Block SVG uploads on photos, files and covers (stored XSS prevention) - Add helmet for security headers (HSTS, X-Frame, nosniff, etc.) - Explicit express.json body size limit (100kb) - Fix XSS in Leaflet map markers (escape image_url in HTML) - Remove verbose WebSocket debug logging from client
2026-03-21 22:09:41 +08:00
"helmet": "^8.1.0",
Fix exit code 132 on old CPUs by replacing sharp with jimp (issue #888) (#895) sharp's prebuilt Linux x64 binary requires SSE4.2 (x86-64-v2), causing a SIGILL crash on older hardware (e.g. AMD A6-3420M). Replace with jimp, a pure-JS image library with no native binaries. Also skip thumbnail generation entirely when the Journey addon is disabled (the default), preventing the issue for most installs regardless of the image library used.
2026-04-26 19:26:09 +08:00
"jimp": "^1.6.1",
Initial commit — NOMAD (Navigation Organizer for Maps, Activities & Destinations) Self-hosted travel planner with Express.js, SQLite, React & Tailwind CSS.
2026-03-19 06:58:08 +08:00
"jsonwebtoken": "^9.0.2",
security: upgrade multer 1.4.5 → 2.1.1 — fixes CVE-2025-47944, CVE-2025-47935, CVE-2025-48997, CVE-2025-7338
2026-03-29 07:35:16 +08:00
"multer": "^2.1.1",
Initial commit — NOMAD (Navigation Organizer for Maps, Activities & Destinations) Self-hosted travel planner with Express.js, SQLite, React & Tailwind CSS.
2026-03-19 06:58:08 +08:00
"node-cron": "^4.2.1",
merge: resolve conflicts with dev, fix 7 Snyk security issues - Resolve translation conflicts (keep both journey + OAuth scope keys) - Resolve migrations.ts (dev OAuth migrations + journey migrations) - Fix hono directory traversal, response splitting, input validation (CVE-2026-39407/08/09/10) - Fix @hono/node-server directory traversal (CVE-2026-39406) - Fix nodemailer CRLF injection (upgrade to 8.0.5)
2026-04-12 01:11:21 +08:00
"nodemailer": "^8.0.5",
feat/mfa: Added multifactor authentication.
2026-03-28 10:29:37 +08:00
"otplib": "^12.0.1",
"qrcode": "^1.5.4",
feat(notices): add system notice infrastructure Server-side notice registry with per-user condition evaluation (firstLogin, existingUserBeforeVersion, addonEnabled, dateWindow, role, custom). Notices are sorted by priority then severity, filtered against dismissals stored in a new user_notice_dismissals table, and served via GET /api/system-notices/active + POST /api/system-notices/:id/dismiss. Client renders notices through a host component that partitions by display type (modal / banner / toast). The modal renderer supports multi-page pagination with directional slide transitions, keyboard navigation, and correct dismiss-all semantics on CTA / X / ESC. Dismissals are optimistic with a single background retry. Includes 3.0.0 upgrade notices (v3-photos, v3-journey, v3-features), onboarding welcome modal, and full i18n coverage across 15 languages. The /journey route is addon-gated on both client and server. Also includes: unit + integration test suites, registry integrity test that validates action CTA IDs against client source, and technical documentation in docs/system-notices.md.
2026-04-16 20:36:33 +08:00
"semver": "^7.7.4",
refactoring: TypeScript migration, security fixes,
2026-03-28 01:40:18 +08:00
"tsx": "^4.21.0",
"typescript": "^6.0.2",
feat(notices): add system notice infrastructure Server-side notice registry with per-user condition evaluation (firstLogin, existingUserBeforeVersion, addonEnabled, dateWindow, role, custom). Notices are sorted by priority then severity, filtered against dismissals stored in a new user_notice_dismissals table, and served via GET /api/system-notices/active + POST /api/system-notices/:id/dismiss. Client renders notices through a host component that partitions by display type (modal / banner / toast). The modal renderer supports multi-page pagination with directional slide transitions, keyboard navigation, and correct dismiss-all semantics on CTA / X / ESC. Dismissals are optimistic with a single background retry. Includes 3.0.0 upgrade notices (v3-photos, v3-journey, v3-features), onboarding welcome modal, and full i18n coverage across 15 languages. The /journey route is addon-gated on both client and server. Also includes: unit + integration test suites, registry integrity test that validates action CTA IDs against client source, and technical documentation in docs/system-notices.md.
2026-04-16 20:36:33 +08:00
"undici": "^7.0.0",
Initial commit — NOMAD (Navigation Organizer for Maps, Activities & Destinations) Self-hosted travel planner with Express.js, SQLite, React & Tailwind CSS.
2026-03-19 06:58:08 +08:00
"unzipper": "^0.12.3",
[Snyk] Security upgrade uuid from 9.0.1 to 14.0.0 (#849) * fix: server/package.json & server/package-lock.json to reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-UUID-16133035 * fix: bump fast-xml-parser version --------- Co-authored-by: snyk-bot <snyk-bot@snyk.io> Co-authored-by: jubnl <jgunther021@gmail.com>
2026-04-23 17:07:25 +08:00
"uuid": "^14.0.0",
feat: mcp server
2026-03-30 09:53:45 +08:00
"ws": "^8.19.0",
"zod": "^4.3.6"
Initial commit — NOMAD (Navigation Organizer for Maps, Activities & Destinations) Self-hosted travel planner with Express.js, SQLite, React & Tailwind CSS.
2026-03-19 06:58:08 +08:00
},
merge: resolve conflicts with dev, fix 7 Snyk security issues - Resolve translation conflicts (keep both journey + OAuth scope keys) - Resolve migrations.ts (dev OAuth migrations + journey migrations) - Fix hono directory traversal, response splitting, input validation (CVE-2026-39407/08/09/10) - Fix @hono/node-server directory traversal (CVE-2026-39406) - Fix nodemailer CRLF injection (upgrade to 8.0.5)
2026-04-12 01:11:21 +08:00
"overrides": {
"hono": "^4.12.12",
"@hono/node-server": "^1.19.13"
},
Initial commit — NOMAD (Navigation Organizer for Maps, Activities & Destinations) Self-hosted travel planner with Express.js, SQLite, React & Tailwind CSS.
2026-03-19 06:58:08 +08:00
"devDependencies": {
refactoring: TypeScript migration, security fixes,
2026-03-28 01:40:18 +08:00
"@types/archiver": "^7.0.0",
"@types/bcryptjs": "^2.4.6",
"@types/better-sqlite3": "^7.6.13",
feat(auth): migrate JWT storage from localStorage to httpOnly cookies Eliminates XSS token theft risk by storing session JWTs in an httpOnly cookie (trek_session) instead of localStorage, making them inaccessible to JavaScript entirely. - Add cookie-parser middleware and setAuthCookie/clearAuthCookie helpers - Set trek_session cookie on login, register, demo-login, MFA verify, OIDC exchange - Auth middleware reads cookie first, falls back to Authorization: Bearer (MCP unchanged) - Add POST /api/auth/logout to clear the cookie server-side - Remove all localStorage auth_token reads/writes from client - Axios uses withCredentials; raw fetch calls use credentials: include - WebSocket ws-token exchange uses credentials: include (no JWT param) - authStore initialises isLoading: true so ProtectedRoute waits for /api/auth/me Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-01 17:02:45 +08:00
"@types/cookie-parser": "^1.4.10",
refactoring: TypeScript migration, security fixes,
2026-03-28 01:40:18 +08:00
"@types/cors": "^2.8.19",
fix: align @types/express to v4 to match express runtime The project uses express@^4.18.3 at runtime but had @types/express@^5.0.6 as type definitions. The v5 types widened ParamsDictionary from string to string | string[], causing 115 type errors across all route handlers. Fix: downgrade @types/express to ^4.17.25 (latest v4), which correctly types req.params as string — matching Express 4 runtime behaviour. Removes the StringParams = Record<string, string> workaround from types.ts and the Request<StringParams> annotations from all 15 route files that were introduced as a workaround for the type mismatch.
2026-03-29 04:36:09 +08:00
"@types/express": "^4.17.25",
refactoring: TypeScript migration, security fixes,
2026-03-28 01:40:18 +08:00
"@types/jsonwebtoken": "^9.0.10",
"@types/multer": "^2.1.0",
"@types/node": "^25.5.0",
"@types/node-cron": "^3.0.11",
feat: email notifications, webhook support, ICS export — closes #110 Email Notifications: - SMTP configuration in Admin > Settings (host, port, user, pass, from) - App URL setting for email CTA links - Webhook URL support (Discord, Slack, custom) - Test email button with SMTP validation - Beautiful HTML email template with TREK logo, slogan, red heart footer - All notification texts translated in 8 languages (en/de/fr/es/nl/ru/zh/ar) - Emails sent in each user's language preference Notification Events: - Trip invitation (member added) - Booking created (new reservation) - Vacay fusion invite - Photos shared (Immich) - Collab chat message - Packing list category assignment User Notification Preferences: - Per-user toggle for each event type in Settings - Addon-aware: Vacay/Collab/Photos toggles hidden when addon disabled - Webhook opt-in per user ICS Calendar Export: - Download button next to PDF in day plan header - Exports trip dates + all reservations with details - Compatible with Google Calendar, Apple Calendar, Outlook Technical: - Nodemailer for SMTP - notification_preferences DB table with per-event columns - GET/PUT /auth/app-settings for admin config persistence - POST /notifications/test-smtp for validation - Dynamic imports for non-blocking notification sends
2026-03-30 23:07:33 +08:00
"@types/nodemailer": "^7.0.11",
feat/mfa: Added multifactor authentication.
2026-03-28 10:29:37 +08:00
"@types/qrcode": "^1.5.5",
feat(notices): add system notice infrastructure Server-side notice registry with per-user condition evaluation (firstLogin, existingUserBeforeVersion, addonEnabled, dateWindow, role, custom). Notices are sorted by priority then severity, filtered against dismissals stored in a new user_notice_dismissals table, and served via GET /api/system-notices/active + POST /api/system-notices/:id/dismiss. Client renders notices through a host component that partitions by display type (modal / banner / toast). The modal renderer supports multi-page pagination with directional slide transitions, keyboard navigation, and correct dismiss-all semantics on CTA / X / ESC. Dismissals are optimistic with a single background retry. Includes 3.0.0 upgrade notices (v3-photos, v3-journey, v3-features), onboarding welcome modal, and full i18n coverage across 15 languages. The /journey route is addon-gated on both client and server. Also includes: unit + integration test suites, registry integrity test that validates action CTA IDs against client source, and technical documentation in docs/system-notices.md.
2026-04-16 20:36:33 +08:00
"@types/semver": "^7.7.1",
Add comprehensive backend test suite (#339) * add test suite, mostly covers integration testing, tests are only backend side * workflow runs the correct script * workflow runs the correct script * workflow runs the correct script * unit tests incoming * Fix multer silent rejections and error handler info leak - Revert cb(null, false) to cb(new Error(...)) in auth.ts, collab.ts, and files.ts so invalid uploads return an error instead of silently dropping the file - Error handler in app.ts now always returns 500 / "Internal server error" instead of forwarding err.message to the client * Use statusCode consistently for multer errors and error handler - Error handler in app.ts reads err.statusCode to forward the correct HTTP status while keeping the response body generic
2026-04-03 19:17:53 +08:00
"@types/supertest": "^6.0.3",
refactoring: TypeScript migration, security fixes,
2026-03-28 01:40:18 +08:00
"@types/unzipper": "^0.10.11",
"@types/uuid": "^10.0.0",
"@types/ws": "^8.18.1",
Add comprehensive backend test suite (#339) * add test suite, mostly covers integration testing, tests are only backend side * workflow runs the correct script * workflow runs the correct script * workflow runs the correct script * unit tests incoming * Fix multer silent rejections and error handler info leak - Revert cb(null, false) to cb(new Error(...)) in auth.ts, collab.ts, and files.ts so invalid uploads return an error instead of silently dropping the file - Error handler in app.ts now always returns 500 / "Internal server error" instead of forwarding err.message to the client * Use statusCode consistently for multer errors and error handler - Error handler in app.ts reads err.statusCode to forward the correct HTTP status while keeping the response body generic
2026-04-03 19:17:53 +08:00
"@vitest/coverage-v8": "^3.2.4",
"nodemon": "^3.1.0",
"supertest": "^7.2.2",
feat(bookings): show transport routes on map (#384, #587) Adds from/to endpoints to flight/train/cruise/car reservations with live map rendering. Flights use geodesic arcs and a curved duration + distance badge; train/car/cruise render as straight or geodesic lines with endpoint markers. Airports come from an embedded OurAirports database (~3200 airports, offline-capable); train/cruise/car locations via Nominatim. Per-trip connection toggle sits in the day plan sidebar, persisted in localStorage. Clicking a map endpoint opens the existing transport detail popup. New display setting toggles endpoint labels on the map. Migration 105 adds the reservation_endpoints table plus needs_review flag; existing flights are backfilled from their IATA metadata on server startup.
2026-04-17 20:04:40 +08:00
"tz-lookup": "^6.1.25",
Add comprehensive backend test suite (#339) * add test suite, mostly covers integration testing, tests are only backend side * workflow runs the correct script * workflow runs the correct script * workflow runs the correct script * unit tests incoming * Fix multer silent rejections and error handler info leak - Revert cb(null, false) to cb(new Error(...)) in auth.ts, collab.ts, and files.ts so invalid uploads return an error instead of silently dropping the file - Error handler in app.ts now always returns 500 / "Internal server error" instead of forwarding err.message to the client * Use statusCode consistently for multer errors and error handler - Error handler in app.ts reads err.statusCode to forward the correct HTTP status while keeping the response body generic
2026-04-03 19:17:53 +08:00
"vitest": "^3.2.4"
Initial commit — NOMAD (Navigation Organizer for Maps, Activities & Destinations) Self-hosted travel planner with Express.js, SQLite, React & Tailwind CSS.
2026-03-19 06:58:08 +08:00
}
}
Reference in New Issue Copy Permalink