cc/Trek_CN
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity
cb425fb397
Trek_CN/server/package.json

71 lines
1.9 KiB
JSON
Raw Normal View History

Initial commit — NOMAD (Navigation Organizer for Maps, Activities & Destinations) Self-hosted travel planner with Express.js, SQLite, React & Tailwind CSS.
2026-03-19 06:58:08 +08:00
{
v2.6.2 — TREK Rebrand, OSM Enrichment, File Management, Hotel Bookings & Bug Fixes Rebrand: - NOMAD → TREK branding across all UI, translations, server, PWA manifest - New TREK logos (dark/light, with/without icon) - Liquid glass toast notifications Bugs Fixed: - HTTPS redirect now opt-in only (FORCE_HTTPS=true), fixes #33 #43 #52 #54 #55 - PDF export "Tag" fallback uses i18n, fixes #15 - Vacay sharing color collision detection, fixes #25 - Backup settings import fix (PR #47) - Atlas country detection uses smallest bounding box, fixes #31 - JPY and zero-decimal currencies formatted correctly, fixes #32 - HTML lang="en" instead of hardcoded "de", fixes #34 - Duplicate translation keys removed - setSelectedAssignmentId crash fixed New Features: - OSM enrichment: Overpass API for opening hours, Wikimedia Commons for photos - Reverse geocoding on map right-click to add places - OIDC config via environment variables (OIDC_ISSUER, OIDC_CLIENT_ID, etc.), fixes #48 - Multi-arch Docker build (ARM64 + AMD64), fixes #11 - File management: star, trash/restore, upload owner, assign to places/bookings, notes - Markdown rendering in Collab Notes with expand modal, fixes #17 - Type-specific booking fields (flight: airline/number/airports, hotel: check-in/out/days, train: number/platform/seat), fixes #35 - Hotel bookings auto-create accommodations, bidirectional sync - Multiple hotels per day with check-in/check-out color coding - Ko-fi and Buy Me a Coffee support cards - GitHub releases proxy with server-side caching
2026-03-28 23:38:08 +08:00
"name": "trek-server",
chore: bump version to 3.0.8 [skip ci]
2026-04-24 01:49:49 +08:00
"version": "3.0.8",
refactoring: TypeScript migration, security fixes,
2026-03-28 01:40:18 +08:00
"main": "src/index.ts",
Initial commit — NOMAD (Navigation Organizer for Maps, Activities & Destinations) Self-hosted travel planner with Express.js, SQLite, React & Tailwind CSS.
2026-03-19 06:58:08 +08:00
"scripts": {
refactoring: TypeScript migration, security fixes,
2026-03-28 01:40:18 +08:00
"start": "node --import tsx src/index.ts",
Add comprehensive backend test suite (#339) * add test suite, mostly covers integration testing, tests are only backend side * workflow runs the correct script * workflow runs the correct script * workflow runs the correct script * unit tests incoming * Fix multer silent rejections and error handler info leak - Revert cb(null, false) to cb(new Error(...)) in auth.ts, collab.ts, and files.ts so invalid uploads return an error instead of silently dropping the file - Error handler in app.ts now always returns 500 / "Internal server error" instead of forwarding err.message to the client * Use statusCode consistently for multer errors and error handler - Error handler in app.ts reads err.statusCode to forward the correct HTTP status while keeping the response body generic
2026-04-03 19:17:53 +08:00
"dev": "tsx watch src/index.ts",
"test": "vitest run",
"test:watch": "vitest",
"test:unit": "vitest run tests/unit",
"test:integration": "vitest run tests/integration",
"test:ws": "vitest run tests/websocket",
"test:coverage": "vitest run --coverage"
Initial commit — NOMAD (Navigation Organizer for Maps, Activities & Destinations) Self-hosted travel planner with Express.js, SQLite, React & Tailwind CSS.
2026-03-19 06:58:08 +08:00
},
"dependencies": {
feat: mcp server
2026-03-30 09:53:45 +08:00
"@modelcontextprotocol/sdk": "^1.28.0",
Initial commit — NOMAD (Navigation Organizer for Maps, Activities & Destinations) Self-hosted travel planner with Express.js, SQLite, React & Tailwind CSS.
2026-03-19 06:58:08 +08:00
"archiver": "^6.0.1",
"bcryptjs": "^2.4.3",
Stabilize core: better-sqlite3, versioned migrations, graceful shutdown - Replace experimental node:sqlite with better-sqlite3 (stable API) - Replace try/catch migration pattern with schema_version tracking - Add SIGTERM/SIGINT handler for clean shutdown (DB flush, scheduler stop) - Fix BudgetPanel crash: remove undefined setShowAddCategory call - Update Dockerfile: remove --experimental-sqlite, add native build tools
2026-03-23 00:52:24 +08:00
"better-sqlite3": "^12.8.0",
feat(auth): migrate JWT storage from localStorage to httpOnly cookies Eliminates XSS token theft risk by storing session JWTs in an httpOnly cookie (trek_session) instead of localStorage, making them inaccessible to JavaScript entirely. - Add cookie-parser middleware and setAuthCookie/clearAuthCookie helpers - Set trek_session cookie on login, register, demo-login, MFA verify, OIDC exchange - Auth middleware reads cookie first, falls back to Authorization: Bearer (MCP unchanged) - Add POST /api/auth/logout to clear the cookie server-side - Remove all localStorage auth_token reads/writes from client - Axios uses withCredentials; raw fetch calls use credentials: include - WebSocket ws-token exchange uses credentials: include (no JWT param) - authStore initialises isLoading: true so ProtectedRoute waits for /api/auth/me Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-01 17:02:45 +08:00
"cookie-parser": "^1.4.7",
Initial commit — NOMAD (Navigation Organizer for Maps, Activities & Destinations) Self-hosted travel planner with Express.js, SQLite, React & Tailwind CSS.
2026-03-19 06:58:08 +08:00
"cors": "^2.8.5",
"dotenv": "^16.4.1",
"express": "^4.18.3",
fix(gpx): replace regex parsing with fast-xml-parser and import tracks alongside waypoints GPX files containing both <wpt> and <trk> elements would only import waypoints, silently discarding track geometry. The fallback chain only parsed <trkpt> when no waypoints were found. Replaced all regex-based XML parsing helpers with fast-xml-parser for correctness (namespaces, CDATA, attribute ordering). Tracks are now always parsed independently of waypoints, with each <trk> element becoming its own place with route geometry. Fixes #427.
2026-04-05 21:54:26 +08:00
"fast-xml-parser": "^5.5.10",
Security hardening, backup restore fix & restore warning modal - Fix backup restore: try/finally ensures DB always reopens after closeDb - Fix EBUSY on uploads during restore (in-place overwrite instead of rmSync) - Add DB proxy null guard for clearer errors during restore window - Add red warning modal before backup restore (DE/EN, dark mode support) - JWT secret: empty docker-compose default so auto-generation kicks in - OIDC: pass token via URL fragment instead of query param (no server logs) - Block SVG uploads on photos, files and covers (stored XSS prevention) - Add helmet for security headers (HSTS, X-Frame, nosniff, etc.) - Explicit express.json body size limit (100kb) - Fix XSS in Leaflet map markers (escape image_url in HTML) - Remove verbose WebSocket debug logging from client
2026-03-21 22:09:41 +08:00
"helmet": "^8.1.0",
Initial commit — NOMAD (Navigation Organizer for Maps, Activities & Destinations) Self-hosted travel planner with Express.js, SQLite, React & Tailwind CSS.
2026-03-19 06:58:08 +08:00
"jsonwebtoken": "^9.0.2",
security: upgrade multer 1.4.5 → 2.1.1 — fixes CVE-2025-47944, CVE-2025-47935, CVE-2025-48997, CVE-2025-7338
2026-03-29 07:35:16 +08:00
"multer": "^2.1.1",
Initial commit — NOMAD (Navigation Organizer for Maps, Activities & Destinations) Self-hosted travel planner with Express.js, SQLite, React & Tailwind CSS.
2026-03-19 06:58:08 +08:00
"node-cron": "^4.2.1",
merge: resolve conflicts with dev, fix 7 Snyk security issues - Resolve translation conflicts (keep both journey + OAuth scope keys) - Resolve migrations.ts (dev OAuth migrations + journey migrations) - Fix hono directory traversal, response splitting, input validation (CVE-2026-39407/08/09/10) - Fix @hono/node-server directory traversal (CVE-2026-39406) - Fix nodemailer CRLF injection (upgrade to 8.0.5)
2026-04-12 01:11:21 +08:00
"nodemailer": "^8.0.5",
feat/mfa: Added multifactor authentication.
2026-03-28 10:29:37 +08:00
"otplib": "^12.0.1",
"qrcode": "^1.5.4",
feat(notices): add system notice infrastructure Server-side notice registry with per-user condition evaluation (firstLogin, existingUserBeforeVersion, addonEnabled, dateWindow, role, custom). Notices are sorted by priority then severity, filtered against dismissals stored in a new user_notice_dismissals table, and served via GET /api/system-notices/active + POST /api/system-notices/:id/dismiss. Client renders notices through a host component that partitions by display type (modal / banner / toast). The modal renderer supports multi-page pagination with directional slide transitions, keyboard navigation, and correct dismiss-all semantics on CTA / X / ESC. Dismissals are optimistic with a single background retry. Includes 3.0.0 upgrade notices (v3-photos, v3-journey, v3-features), onboarding welcome modal, and full i18n coverage across 15 languages. The /journey route is addon-gated on both client and server. Also includes: unit + integration test suites, registry integrity test that validates action CTA IDs against client source, and technical documentation in docs/system-notices.md.
2026-04-16 20:36:33 +08:00
"semver": "^7.7.4",
fix: serve real thumbnails for local photos instead of full-resolution originals (#822) Add thumbnailService that lazy-generates a WebP thumbnail (800px max, q80) on first GET /api/photos/:id/thumbnail request using sharp. The generated file is stored at uploads/journey/thumbs/<sha1>.webp and the path is persisted to trek_photos.thumbnail_path so subsequent requests are served directly from disk. Also populates width/height as a side-effect. streamPhoto now branches on kind for local file_path rows — thumbnail requests use the stored/generated thumb path; original requests (and fallback when thumb generation fails) continue to serve the full file. Remote providers (Immich, Synology) are unaffected.
2026-04-22 21:56:34 +08:00
"sharp": "^0.34.5",
refactoring: TypeScript migration, security fixes,
2026-03-28 01:40:18 +08:00
"tsx": "^4.21.0",
"typescript": "^6.0.2",
feat(notices): add system notice infrastructure Server-side notice registry with per-user condition evaluation (firstLogin, existingUserBeforeVersion, addonEnabled, dateWindow, role, custom). Notices are sorted by priority then severity, filtered against dismissals stored in a new user_notice_dismissals table, and served via GET /api/system-notices/active + POST /api/system-notices/:id/dismiss. Client renders notices through a host component that partitions by display type (modal / banner / toast). The modal renderer supports multi-page pagination with directional slide transitions, keyboard navigation, and correct dismiss-all semantics on CTA / X / ESC. Dismissals are optimistic with a single background retry. Includes 3.0.0 upgrade notices (v3-photos, v3-journey, v3-features), onboarding welcome modal, and full i18n coverage across 15 languages. The /journey route is addon-gated on both client and server. Also includes: unit + integration test suites, registry integrity test that validates action CTA IDs against client source, and technical documentation in docs/system-notices.md.
2026-04-16 20:36:33 +08:00
"undici": "^7.0.0",
Initial commit — NOMAD (Navigation Organizer for Maps, Activities & Destinations) Self-hosted travel planner with Express.js, SQLite, React & Tailwind CSS.
2026-03-19 06:58:08 +08:00
"unzipper": "^0.12.3",
[Snyk] Security upgrade uuid from 9.0.1 to 14.0.0 (#849) * fix: server/package.json & server/package-lock.json to reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-UUID-16133035 * fix: bump fast-xml-parser version --------- Co-authored-by: snyk-bot <snyk-bot@snyk.io> Co-authored-by: jubnl <jgunther021@gmail.com>
2026-04-23 17:07:25 +08:00
"uuid": "^14.0.0",
feat: mcp server
2026-03-30 09:53:45 +08:00
"ws": "^8.19.0",
"zod": "^4.3.6"
Initial commit — NOMAD (Navigation Organizer for Maps, Activities & Destinations) Self-hosted travel planner with Express.js, SQLite, React & Tailwind CSS.
2026-03-19 06:58:08 +08:00
},
merge: resolve conflicts with dev, fix 7 Snyk security issues - Resolve translation conflicts (keep both journey + OAuth scope keys) - Resolve migrations.ts (dev OAuth migrations + journey migrations) - Fix hono directory traversal, response splitting, input validation (CVE-2026-39407/08/09/10) - Fix @hono/node-server directory traversal (CVE-2026-39406) - Fix nodemailer CRLF injection (upgrade to 8.0.5)
2026-04-12 01:11:21 +08:00
"overrides": {
"hono": "^4.12.12",
"@hono/node-server": "^1.19.13"
},
Initial commit — NOMAD (Navigation Organizer for Maps, Activities & Destinations) Self-hosted travel planner with Express.js, SQLite, React & Tailwind CSS.
2026-03-19 06:58:08 +08:00
"devDependencies": {
refactoring: TypeScript migration, security fixes,
2026-03-28 01:40:18 +08:00
"@types/archiver": "^7.0.0",
"@types/bcryptjs": "^2.4.6",
"@types/better-sqlite3": "^7.6.13",
feat(auth): migrate JWT storage from localStorage to httpOnly cookies Eliminates XSS token theft risk by storing session JWTs in an httpOnly cookie (trek_session) instead of localStorage, making them inaccessible to JavaScript entirely. - Add cookie-parser middleware and setAuthCookie/clearAuthCookie helpers - Set trek_session cookie on login, register, demo-login, MFA verify, OIDC exchange - Auth middleware reads cookie first, falls back to Authorization: Bearer (MCP unchanged) - Add POST /api/auth/logout to clear the cookie server-side - Remove all localStorage auth_token reads/writes from client - Axios uses withCredentials; raw fetch calls use credentials: include - WebSocket ws-token exchange uses credentials: include (no JWT param) - authStore initialises isLoading: true so ProtectedRoute waits for /api/auth/me Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-01 17:02:45 +08:00
"@types/cookie-parser": "^1.4.10",
refactoring: TypeScript migration, security fixes,
2026-03-28 01:40:18 +08:00
"@types/cors": "^2.8.19",
fix: align @types/express to v4 to match express runtime The project uses express@^4.18.3 at runtime but had @types/express@^5.0.6 as type definitions. The v5 types widened ParamsDictionary from string to string | string[], causing 115 type errors across all route handlers. Fix: downgrade @types/express to ^4.17.25 (latest v4), which correctly types req.params as string — matching Express 4 runtime behaviour. Removes the StringParams = Record<string, string> workaround from types.ts and the Request<StringParams> annotations from all 15 route files that were introduced as a workaround for the type mismatch.
2026-03-29 04:36:09 +08:00
"@types/express": "^4.17.25",
refactoring: TypeScript migration, security fixes,
2026-03-28 01:40:18 +08:00
"@types/jsonwebtoken": "^9.0.10",
"@types/multer": "^2.1.0",
"@types/node": "^25.5.0",
"@types/node-cron": "^3.0.11",
feat: email notifications, webhook support, ICS export — closes #110 Email Notifications: - SMTP configuration in Admin > Settings (host, port, user, pass, from) - App URL setting for email CTA links - Webhook URL support (Discord, Slack, custom) - Test email button with SMTP validation - Beautiful HTML email template with TREK logo, slogan, red heart footer - All notification texts translated in 8 languages (en/de/fr/es/nl/ru/zh/ar) - Emails sent in each user's language preference Notification Events: - Trip invitation (member added) - Booking created (new reservation) - Vacay fusion invite - Photos shared (Immich) - Collab chat message - Packing list category assignment User Notification Preferences: - Per-user toggle for each event type in Settings - Addon-aware: Vacay/Collab/Photos toggles hidden when addon disabled - Webhook opt-in per user ICS Calendar Export: - Download button next to PDF in day plan header - Exports trip dates + all reservations with details - Compatible with Google Calendar, Apple Calendar, Outlook Technical: - Nodemailer for SMTP - notification_preferences DB table with per-event columns - GET/PUT /auth/app-settings for admin config persistence - POST /notifications/test-smtp for validation - Dynamic imports for non-blocking notification sends
2026-03-30 23:07:33 +08:00
"@types/nodemailer": "^7.0.11",
feat/mfa: Added multifactor authentication.
2026-03-28 10:29:37 +08:00
"@types/qrcode": "^1.5.5",
feat(notices): add system notice infrastructure Server-side notice registry with per-user condition evaluation (firstLogin, existingUserBeforeVersion, addonEnabled, dateWindow, role, custom). Notices are sorted by priority then severity, filtered against dismissals stored in a new user_notice_dismissals table, and served via GET /api/system-notices/active + POST /api/system-notices/:id/dismiss. Client renders notices through a host component that partitions by display type (modal / banner / toast). The modal renderer supports multi-page pagination with directional slide transitions, keyboard navigation, and correct dismiss-all semantics on CTA / X / ESC. Dismissals are optimistic with a single background retry. Includes 3.0.0 upgrade notices (v3-photos, v3-journey, v3-features), onboarding welcome modal, and full i18n coverage across 15 languages. The /journey route is addon-gated on both client and server. Also includes: unit + integration test suites, registry integrity test that validates action CTA IDs against client source, and technical documentation in docs/system-notices.md.
2026-04-16 20:36:33 +08:00
"@types/semver": "^7.7.1",
Add comprehensive backend test suite (#339) * add test suite, mostly covers integration testing, tests are only backend side * workflow runs the correct script * workflow runs the correct script * workflow runs the correct script * unit tests incoming * Fix multer silent rejections and error handler info leak - Revert cb(null, false) to cb(new Error(...)) in auth.ts, collab.ts, and files.ts so invalid uploads return an error instead of silently dropping the file - Error handler in app.ts now always returns 500 / "Internal server error" instead of forwarding err.message to the client * Use statusCode consistently for multer errors and error handler - Error handler in app.ts reads err.statusCode to forward the correct HTTP status while keeping the response body generic
2026-04-03 19:17:53 +08:00
"@types/supertest": "^6.0.3",
refactoring: TypeScript migration, security fixes,
2026-03-28 01:40:18 +08:00
"@types/unzipper": "^0.10.11",
"@types/uuid": "^10.0.0",
"@types/ws": "^8.18.1",
Add comprehensive backend test suite (#339) * add test suite, mostly covers integration testing, tests are only backend side * workflow runs the correct script * workflow runs the correct script * workflow runs the correct script * unit tests incoming * Fix multer silent rejections and error handler info leak - Revert cb(null, false) to cb(new Error(...)) in auth.ts, collab.ts, and files.ts so invalid uploads return an error instead of silently dropping the file - Error handler in app.ts now always returns 500 / "Internal server error" instead of forwarding err.message to the client * Use statusCode consistently for multer errors and error handler - Error handler in app.ts reads err.statusCode to forward the correct HTTP status while keeping the response body generic
2026-04-03 19:17:53 +08:00
"@vitest/coverage-v8": "^3.2.4",
"nodemon": "^3.1.0",
"supertest": "^7.2.2",
feat(bookings): show transport routes on map (#384, #587) Adds from/to endpoints to flight/train/cruise/car reservations with live map rendering. Flights use geodesic arcs and a curved duration + distance badge; train/car/cruise render as straight or geodesic lines with endpoint markers. Airports come from an embedded OurAirports database (~3200 airports, offline-capable); train/cruise/car locations via Nominatim. Per-trip connection toggle sits in the day plan sidebar, persisted in localStorage. Clicking a map endpoint opens the existing transport detail popup. New display setting toggles endpoint labels on the map. Migration 105 adds the reservation_endpoints table plus needs_review flag; existing flights are backfilled from their IATA metadata on server startup.
2026-04-17 20:04:40 +08:00
"tz-lookup": "^6.1.25",
Add comprehensive backend test suite (#339) * add test suite, mostly covers integration testing, tests are only backend side * workflow runs the correct script * workflow runs the correct script * workflow runs the correct script * unit tests incoming * Fix multer silent rejections and error handler info leak - Revert cb(null, false) to cb(new Error(...)) in auth.ts, collab.ts, and files.ts so invalid uploads return an error instead of silently dropping the file - Error handler in app.ts now always returns 500 / "Internal server error" instead of forwarding err.message to the client * Use statusCode consistently for multer errors and error handler - Error handler in app.ts reads err.statusCode to forward the correct HTTP status while keeping the response body generic
2026-04-03 19:17:53 +08:00
"vitest": "^3.2.4"
Initial commit — NOMAD (Navigation Organizer for Maps, Activities & Destinations) Self-hosted travel planner with Express.js, SQLite, React & Tailwind CSS.
2026-03-19 06:58:08 +08:00
}
}
Reference in New Issue Copy Permalink