cc/Trek_CN
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity
c4e6c12282
Trek_CN/server/package.json

63 lines
1.7 KiB
JSON
Raw Normal View History

Initial commit — NOMAD (Navigation Organizer for Maps, Activities & Destinations) Self-hosted travel planner with Express.js, SQLite, React & Tailwind CSS.
2026-03-19 06:58:08 +08:00
{
v2.6.2 — TREK Rebrand, OSM Enrichment, File Management, Hotel Bookings & Bug Fixes Rebrand: - NOMAD → TREK branding across all UI, translations, server, PWA manifest - New TREK logos (dark/light, with/without icon) - Liquid glass toast notifications Bugs Fixed: - HTTPS redirect now opt-in only (FORCE_HTTPS=true), fixes #33 #43 #52 #54 #55 - PDF export "Tag" fallback uses i18n, fixes #15 - Vacay sharing color collision detection, fixes #25 - Backup settings import fix (PR #47) - Atlas country detection uses smallest bounding box, fixes #31 - JPY and zero-decimal currencies formatted correctly, fixes #32 - HTML lang="en" instead of hardcoded "de", fixes #34 - Duplicate translation keys removed - setSelectedAssignmentId crash fixed New Features: - OSM enrichment: Overpass API for opening hours, Wikimedia Commons for photos - Reverse geocoding on map right-click to add places - OIDC config via environment variables (OIDC_ISSUER, OIDC_CLIENT_ID, etc.), fixes #48 - Multi-arch Docker build (ARM64 + AMD64), fixes #11 - File management: star, trash/restore, upload owner, assign to places/bookings, notes - Markdown rendering in Collab Notes with expand modal, fixes #17 - Type-specific booking fields (flight: airline/number/airports, hotel: check-in/out/days, train: number/platform/seat), fixes #35 - Hotel bookings auto-create accommodations, bidirectional sync - Multiple hotels per day with check-in/check-out color coding - Ko-fi and Buy Me a Coffee support cards - GitHub releases proxy with server-side caching
2026-03-28 23:38:08 +08:00
"name": "trek-server",
chore: bump version to 2.9.9 [skip ci]
2026-04-06 17:32:20 +08:00
"version": "2.9.9",
refactoring: TypeScript migration, security fixes,
2026-03-28 01:40:18 +08:00
"main": "src/index.ts",
Initial commit — NOMAD (Navigation Organizer for Maps, Activities & Destinations) Self-hosted travel planner with Express.js, SQLite, React & Tailwind CSS.
2026-03-19 06:58:08 +08:00
"scripts": {
refactoring: TypeScript migration, security fixes,
2026-03-28 01:40:18 +08:00
"start": "node --import tsx src/index.ts",
Add comprehensive backend test suite (#339) * add test suite, mostly covers integration testing, tests are only backend side * workflow runs the correct script * workflow runs the correct script * workflow runs the correct script * unit tests incoming * Fix multer silent rejections and error handler info leak - Revert cb(null, false) to cb(new Error(...)) in auth.ts, collab.ts, and files.ts so invalid uploads return an error instead of silently dropping the file - Error handler in app.ts now always returns 500 / "Internal server error" instead of forwarding err.message to the client * Use statusCode consistently for multer errors and error handler - Error handler in app.ts reads err.statusCode to forward the correct HTTP status while keeping the response body generic
2026-04-03 19:17:53 +08:00
"dev": "tsx watch src/index.ts",
"test": "vitest run",
"test:watch": "vitest",
"test:unit": "vitest run tests/unit",
"test:integration": "vitest run tests/integration",
"test:ws": "vitest run tests/websocket",
"test:coverage": "vitest run --coverage"
Initial commit — NOMAD (Navigation Organizer for Maps, Activities & Destinations) Self-hosted travel planner with Express.js, SQLite, React & Tailwind CSS.
2026-03-19 06:58:08 +08:00
},
"dependencies": {
feat: mcp server
2026-03-30 09:53:45 +08:00
"@modelcontextprotocol/sdk": "^1.28.0",
Initial commit — NOMAD (Navigation Organizer for Maps, Activities & Destinations) Self-hosted travel planner with Express.js, SQLite, React & Tailwind CSS.
2026-03-19 06:58:08 +08:00
"archiver": "^6.0.1",
"bcryptjs": "^2.4.3",
Stabilize core: better-sqlite3, versioned migrations, graceful shutdown - Replace experimental node:sqlite with better-sqlite3 (stable API) - Replace try/catch migration pattern with schema_version tracking - Add SIGTERM/SIGINT handler for clean shutdown (DB flush, scheduler stop) - Fix BudgetPanel crash: remove undefined setShowAddCategory call - Update Dockerfile: remove --experimental-sqlite, add native build tools
2026-03-23 00:52:24 +08:00
"better-sqlite3": "^12.8.0",
feat(auth): migrate JWT storage from localStorage to httpOnly cookies Eliminates XSS token theft risk by storing session JWTs in an httpOnly cookie (trek_session) instead of localStorage, making them inaccessible to JavaScript entirely. - Add cookie-parser middleware and setAuthCookie/clearAuthCookie helpers - Set trek_session cookie on login, register, demo-login, MFA verify, OIDC exchange - Auth middleware reads cookie first, falls back to Authorization: Bearer (MCP unchanged) - Add POST /api/auth/logout to clear the cookie server-side - Remove all localStorage auth_token reads/writes from client - Axios uses withCredentials; raw fetch calls use credentials: include - WebSocket ws-token exchange uses credentials: include (no JWT param) - authStore initialises isLoading: true so ProtectedRoute waits for /api/auth/me Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-01 17:02:45 +08:00
"cookie-parser": "^1.4.7",
Initial commit — NOMAD (Navigation Organizer for Maps, Activities & Destinations) Self-hosted travel planner with Express.js, SQLite, React & Tailwind CSS.
2026-03-19 06:58:08 +08:00
"cors": "^2.8.5",
"dotenv": "^16.4.1",
"express": "^4.18.3",
fix(gpx): replace regex parsing with fast-xml-parser and import tracks alongside waypoints GPX files containing both <wpt> and <trk> elements would only import waypoints, silently discarding track geometry. The fallback chain only parsed <trkpt> when no waypoints were found. Replaced all regex-based XML parsing helpers with fast-xml-parser for correctness (namespaces, CDATA, attribute ordering). Tracks are now always parsed independently of waypoints, with each <trk> element becoming its own place with route geometry. Fixes #427.
2026-04-05 21:54:26 +08:00
"fast-xml-parser": "^5.5.10",
Security hardening, backup restore fix & restore warning modal - Fix backup restore: try/finally ensures DB always reopens after closeDb - Fix EBUSY on uploads during restore (in-place overwrite instead of rmSync) - Add DB proxy null guard for clearer errors during restore window - Add red warning modal before backup restore (DE/EN, dark mode support) - JWT secret: empty docker-compose default so auto-generation kicks in - OIDC: pass token via URL fragment instead of query param (no server logs) - Block SVG uploads on photos, files and covers (stored XSS prevention) - Add helmet for security headers (HSTS, X-Frame, nosniff, etc.) - Explicit express.json body size limit (100kb) - Fix XSS in Leaflet map markers (escape image_url in HTML) - Remove verbose WebSocket debug logging from client
2026-03-21 22:09:41 +08:00
"helmet": "^8.1.0",
Initial commit — NOMAD (Navigation Organizer for Maps, Activities & Destinations) Self-hosted travel planner with Express.js, SQLite, React & Tailwind CSS.
2026-03-19 06:58:08 +08:00
"jsonwebtoken": "^9.0.2",
security: upgrade multer 1.4.5 → 2.1.1 — fixes CVE-2025-47944, CVE-2025-47935, CVE-2025-48997, CVE-2025-7338
2026-03-29 07:35:16 +08:00
"multer": "^2.1.1",
Initial commit — NOMAD (Navigation Organizer for Maps, Activities & Destinations) Self-hosted travel planner with Express.js, SQLite, React & Tailwind CSS.
2026-03-19 06:58:08 +08:00
"node-cron": "^4.2.1",
refactor(server): replace node-fetch with native fetch + undici, fix photo integrations Replace node-fetch v2 with Node 22's built-in fetch API across the entire server. Add undici as an explicit dependency to provide the dispatcher API needed for DNS pinning (SSRF rebinding prevention) in ssrfGuard.ts. All seven service files that used a plain `import fetch from 'node-fetch'` are updated to use the global. The ssrfGuard safeFetch/createPinnedAgent is rewritten as createPinnedDispatcher using an undici Agent, with correct handling of the `all: true` lookup callback required by Node 18+. The collabService dynamic require() and notifications agent option are updated to use the dispatcher pattern. Test mocks are migrated from vi.mock('node-fetch') to vi.stubGlobal('fetch'), and streaming test fixtures are updated to use Web ReadableStream instead of Node Readable. Fix several bugs in the Synology and Immich photo integrations: - pipeAsset: guard against setting headers after stream has already started - _getSynologySession: clear stale SID and re-login when decrypt_api_key returns null instead of propagating success(null) downstream - _requestSynologyApi: return retrySession error (not stale session) on retry failure; also retry on error codes 106 (timeout) and 107 (duplicate login), not only 119 - searchSynologyPhotos: fix incorrect total field type (Synology list_item returns no total); hasMore correctly uses allItems.length === limit - _splitPackedSynologyId: validate cache_key format before use; callers return 400 - getImmichCredentials / _getSynologyCredentials: treat null from decrypt_api_key as a missing-credentials condition rather than casting null to string - Synology size param: enforce allowlist ['sm', 'm', 'xl'] per API documentation
2026-04-06 03:11:43 +08:00
"undici": "^7.0.0",
feat: email notifications, webhook support, ICS export — closes #110 Email Notifications: - SMTP configuration in Admin > Settings (host, port, user, pass, from) - App URL setting for email CTA links - Webhook URL support (Discord, Slack, custom) - Test email button with SMTP validation - Beautiful HTML email template with TREK logo, slogan, red heart footer - All notification texts translated in 8 languages (en/de/fr/es/nl/ru/zh/ar) - Emails sent in each user's language preference Notification Events: - Trip invitation (member added) - Booking created (new reservation) - Vacay fusion invite - Photos shared (Immich) - Collab chat message - Packing list category assignment User Notification Preferences: - Per-user toggle for each event type in Settings - Addon-aware: Vacay/Collab/Photos toggles hidden when addon disabled - Webhook opt-in per user ICS Calendar Export: - Download button next to PDF in day plan header - Exports trip dates + all reservations with details - Compatible with Google Calendar, Apple Calendar, Outlook Technical: - Nodemailer for SMTP - notification_preferences DB table with per-event columns - GET/PUT /auth/app-settings for admin config persistence - POST /notifications/test-smtp for validation - Dynamic imports for non-blocking notification sends
2026-03-30 23:07:33 +08:00
"nodemailer": "^8.0.4",
feat/mfa: Added multifactor authentication.
2026-03-28 10:29:37 +08:00
"otplib": "^12.0.1",
"qrcode": "^1.5.4",
refactoring: TypeScript migration, security fixes,
2026-03-28 01:40:18 +08:00
"tsx": "^4.21.0",
"typescript": "^6.0.2",
Initial commit — NOMAD (Navigation Organizer for Maps, Activities & Destinations) Self-hosted travel planner with Express.js, SQLite, React & Tailwind CSS.
2026-03-19 06:58:08 +08:00
"unzipper": "^0.12.3",
v2.1.0 — Real-time collaboration, performance & security overhaul Real-Time Collaboration (WebSocket): - WebSocket server with JWT auth and trip-based rooms - Live sync for all CRUD operations (places, assignments, days, notes, budget, packing, reservations, files) - Socket-based exclusion to prevent duplicate updates - Auto-reconnect with exponential backoff - Assignment move sync between days Performance: - 16 database indexes on all foreign key columns - N+1 query fix in places, assignments and days endpoints - Marker clustering (react-leaflet-cluster) with configurable radius - List virtualization (react-window) for places sidebar - useMemo for filtered places - SQLite WAL mode + busy_timeout for concurrent writes - Weather API: server-side cache (1h forecast, 15min current) + client sessionStorage - Google Places photos: persisted to DB after first fetch - Google Details: 3-tier cache (memory → sessionStorage → API) Security: - CORS auto-configuration (production: same-origin, dev: open) - API keys removed from /auth/me response - Admin-only endpoint for reading API keys - Path traversal prevention in cover image deletion - JWT secret persisted to file (survives restarts) - Avatar upload file extension whitelist - API key fallback: normal users use admin's key without exposure - Case-insensitive email login Dark Mode: - Fixed hardcoded colors across PackingList, Budget, ReservationModal, ReservationsPanel - Mobile map buttons and sidebar sheets respect dark mode - Cluster markers always dark UI/UX: - Redesigned login page with animated planes, stars and feature cards - Admin: create user functionality with CustomSelect - Mobile: day-picker popup for assigning places to days - Mobile: touch-friendly reorder buttons (32px targets) - Mobile: responsive text (shorter labels on small screens) - Packing list: index-based category colors - i18n: translated date picker placeholder, fixed German labels - Default map tile: CartoDB Light
2026-03-19 19:44:22 +08:00
"uuid": "^9.0.0",
feat: mcp server
2026-03-30 09:53:45 +08:00
"ws": "^8.19.0",
"zod": "^4.3.6"
Initial commit — NOMAD (Navigation Organizer for Maps, Activities & Destinations) Self-hosted travel planner with Express.js, SQLite, React & Tailwind CSS.
2026-03-19 06:58:08 +08:00
},
"devDependencies": {
refactoring: TypeScript migration, security fixes,
2026-03-28 01:40:18 +08:00
"@types/archiver": "^7.0.0",
"@types/bcryptjs": "^2.4.6",
"@types/better-sqlite3": "^7.6.13",
feat(auth): migrate JWT storage from localStorage to httpOnly cookies Eliminates XSS token theft risk by storing session JWTs in an httpOnly cookie (trek_session) instead of localStorage, making them inaccessible to JavaScript entirely. - Add cookie-parser middleware and setAuthCookie/clearAuthCookie helpers - Set trek_session cookie on login, register, demo-login, MFA verify, OIDC exchange - Auth middleware reads cookie first, falls back to Authorization: Bearer (MCP unchanged) - Add POST /api/auth/logout to clear the cookie server-side - Remove all localStorage auth_token reads/writes from client - Axios uses withCredentials; raw fetch calls use credentials: include - WebSocket ws-token exchange uses credentials: include (no JWT param) - authStore initialises isLoading: true so ProtectedRoute waits for /api/auth/me Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-01 17:02:45 +08:00
"@types/cookie-parser": "^1.4.10",
refactoring: TypeScript migration, security fixes,
2026-03-28 01:40:18 +08:00
"@types/cors": "^2.8.19",
fix: align @types/express to v4 to match express runtime The project uses express@^4.18.3 at runtime but had @types/express@^5.0.6 as type definitions. The v5 types widened ParamsDictionary from string to string | string[], causing 115 type errors across all route handlers. Fix: downgrade @types/express to ^4.17.25 (latest v4), which correctly types req.params as string — matching Express 4 runtime behaviour. Removes the StringParams = Record<string, string> workaround from types.ts and the Request<StringParams> annotations from all 15 route files that were introduced as a workaround for the type mismatch.
2026-03-29 04:36:09 +08:00
"@types/express": "^4.17.25",
refactoring: TypeScript migration, security fixes,
2026-03-28 01:40:18 +08:00
"@types/jsonwebtoken": "^9.0.10",
"@types/multer": "^2.1.0",
"@types/node": "^25.5.0",
"@types/node-cron": "^3.0.11",
feat: email notifications, webhook support, ICS export — closes #110 Email Notifications: - SMTP configuration in Admin > Settings (host, port, user, pass, from) - App URL setting for email CTA links - Webhook URL support (Discord, Slack, custom) - Test email button with SMTP validation - Beautiful HTML email template with TREK logo, slogan, red heart footer - All notification texts translated in 8 languages (en/de/fr/es/nl/ru/zh/ar) - Emails sent in each user's language preference Notification Events: - Trip invitation (member added) - Booking created (new reservation) - Vacay fusion invite - Photos shared (Immich) - Collab chat message - Packing list category assignment User Notification Preferences: - Per-user toggle for each event type in Settings - Addon-aware: Vacay/Collab/Photos toggles hidden when addon disabled - Webhook opt-in per user ICS Calendar Export: - Download button next to PDF in day plan header - Exports trip dates + all reservations with details - Compatible with Google Calendar, Apple Calendar, Outlook Technical: - Nodemailer for SMTP - notification_preferences DB table with per-event columns - GET/PUT /auth/app-settings for admin config persistence - POST /notifications/test-smtp for validation - Dynamic imports for non-blocking notification sends
2026-03-30 23:07:33 +08:00
"@types/nodemailer": "^7.0.11",
feat/mfa: Added multifactor authentication.
2026-03-28 10:29:37 +08:00
"@types/qrcode": "^1.5.5",
Add comprehensive backend test suite (#339) * add test suite, mostly covers integration testing, tests are only backend side * workflow runs the correct script * workflow runs the correct script * workflow runs the correct script * unit tests incoming * Fix multer silent rejections and error handler info leak - Revert cb(null, false) to cb(new Error(...)) in auth.ts, collab.ts, and files.ts so invalid uploads return an error instead of silently dropping the file - Error handler in app.ts now always returns 500 / "Internal server error" instead of forwarding err.message to the client * Use statusCode consistently for multer errors and error handler - Error handler in app.ts reads err.statusCode to forward the correct HTTP status while keeping the response body generic
2026-04-03 19:17:53 +08:00
"@types/supertest": "^6.0.3",
refactoring: TypeScript migration, security fixes,
2026-03-28 01:40:18 +08:00
"@types/unzipper": "^0.10.11",
"@types/uuid": "^10.0.0",
"@types/ws": "^8.18.1",
Add comprehensive backend test suite (#339) * add test suite, mostly covers integration testing, tests are only backend side * workflow runs the correct script * workflow runs the correct script * workflow runs the correct script * unit tests incoming * Fix multer silent rejections and error handler info leak - Revert cb(null, false) to cb(new Error(...)) in auth.ts, collab.ts, and files.ts so invalid uploads return an error instead of silently dropping the file - Error handler in app.ts now always returns 500 / "Internal server error" instead of forwarding err.message to the client * Use statusCode consistently for multer errors and error handler - Error handler in app.ts reads err.statusCode to forward the correct HTTP status while keeping the response body generic
2026-04-03 19:17:53 +08:00
"@vitest/coverage-v8": "^3.2.4",
"nodemon": "^3.1.0",
"supertest": "^7.2.2",
"vitest": "^3.2.4"
Initial commit — NOMAD (Navigation Organizer for Maps, Activities & Destinations) Self-hosted travel planner with Express.js, SQLite, React & Tailwind CSS.
2026-03-19 06:58:08 +08:00
}
}
Reference in New Issue Copy Permalink