You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Built OTP capabilities. Built session expiration handling. Made session data saving automatic, and work across API tokens and cookie sessions. Moved CSRF secret storage, to utilize Sails' built-in encryption handling. Fixed some README quirks. Changed how API tokens are handled; again for encryption purposes.
* Built 2FA (2-Factor Authentication) capabilities.
7
+
* Added `createdBy` to the [`User`](api/models/User.js) model.
8
+
* Built session expiration handling.
9
+
* Built password changing modal / API.
10
+
* Made session data saving automatic, and work with both sessions / API tokens.
11
+
* Fixed some README quirks.
12
+
* Updated React links to use their new domain.
13
+
* Updated dependencies.
14
+
15
+
### Breaking Changes
16
+
17
+
* Moved CSRF secret storage from the `data` column, to its own column, so it can easily be encrypted/decrypted in the [`Session`](api/models/Session.js) model.
18
+
* Changed how API tokens are handled. So now, when using an API token, the ID must be given first, then the token, seperated by a colon.<br />Example: `Authorization` header is: `tokenID:apiToken` (or `Bearer tokenID:apiToken`).
19
+
* Renamed `sails.helpers.updateCsrf` -> `sails.helpers.updateCsrfAndExpiry` to reflect the session expiry update.
* Updated to React v18. See: [the upgrade guide to React 18](https://reactjs.org/blog/2022/03/08/react-18-upgrade-guide.html).
141
+
* Updated to React v18. See: [the upgrade guide to React 18](https://react.dev/blog/2022/03/08/react-18-upgrade-guide).
123
142
* Updated to React Router DOM v6. See: [the v5 -> v6 migration guide](https://reactrouter.com/docs/en/v6/upgrading/v5). This requires a **MAJOR** overhaul of how routes are handled.
124
143
* Moved some controllers into a "common" folder, instead of the "admin" folder (as they could be used outside of admin controls).
Copy file name to clipboardExpand all lines: README.md
+48-20Lines changed: 48 additions & 20 deletions
Original file line number
Diff line number
Diff line change
@@ -3,7 +3,7 @@
3
3
[](https://app.travis-ci.com/github/neonexus/sails-react-bootstrap-webpack)
4
4
5
5
This is an opinionated base [Sails v1](https://sailsjs.com) application, using [Webpack](https://webpack.js.org) to handle [Bootstrap](https://getbootstrap.com) (using [SASS](https://sass-lang.com))
6
-
and [React](https://reactjs.org) builds. It is designed such that, one can build multiple React frontends (an admin panel, and a customer site maybe), that use the same API backend. This allows
6
+
and [React](https://react.dev) builds. It is designed such that, one can build multiple React frontends (an admin panel, and a customer site maybe), that use the same API backend. This allows
7
7
developers to easily share React components across different frontends / applications. Also, because the backend and frontend are in the same repo (and the frontend is compiled before it is handed to
8
8
the end user), they can share [NPM](http://npmjs.com) libraries, like [Moment.js](https://momentjs.com)
9
9
@@ -46,6 +46,7 @@ Gitter: [. See [schema validation and enforcement](#schema-validation-and-enforcement) for more info.
47
47
* New passwords will be checked against the [PwnedPasswords API](https://haveibeenpwned.com/API/v3#PwnedPasswords). If there is a single hit for the password, an error will be given, and the user will
48
48
be forced to choose another. See [PwnedPasswords integration](#pwnedpasswordscom-integration) for more info.
49
+
* Google Authenticator-style OTP (One-Time Password) functionality.
49
50
50
51
## Branch Warning
51
52
@@ -58,25 +59,25 @@ the [`releases section`](https://github.com/neonexus/sails-react-bootstrap-webpa
See the [`package.json` for more details](package.json).
69
70
70
71
## How to Use
71
72
72
-
This repo is not installable via `npm`. Instead, GitHub provides a handy "Use this template" (green) button at the top of this page. That will create a special fork of this repo (so there is a single,
73
+
This repo is not installable via `npm`. Instead, GitHub provides a handy "Use this template" (green) button at the top of this page. That will create a special clone of this repo (so there is a single,
73
74
init commit, instead of the commit history from this repo).
74
75
75
76
## Configuration
76
77
77
78
In the `config` folder, there is the [`local.js.sample`](config/local.js.sample) file, which is meant to be copied to `local.js`. This file (`local.js`, not the sample) is ignored by Git, and intended
78
79
for use in local development, NOT remote servers. Generally one would use environment variables for remote server configuration (and this repo is already setup to handle environment variable
79
-
configuration for both DEV and PROD). See: [config/env/development.js](config/env/development.js) and [config/env/production.js](config/env/production.js).
80
+
configuration for both DEV and PROD). See[Environment Variables](#environment-variables) for more.
80
81
81
82
### Custom Configuration Options
82
83
@@ -94,11 +95,40 @@ option. If the option path is `sails.config.security.checkPwnedPasswords`, then
94
95
95
96
... to your `config/local.js` to overwrite the option on your local machine only.
96
97
97
-
| Option Name (`sails.config.`) | Initially Defined In | Default | Description |
|`models.validateOnBootstrap`|[`config/bootstrap.js`](config/bootstrap.js)|`true`| When enabled, and `models.migrate === 'safe'` (aka PRODUCTION), then the SQL schemas of the default datastore will be validated against the model definitions. <br /><br />See [schema validation and enforcement](#schema-validation-and-enforcement) for more info. |
100
-
|`security.checkPwnedPasswords`|[`config/security.js`](config/security.js)|`true`| When enabled, [`sails.helpers.isPasswordValid()`](api/helpers/is-password-valid.js) will run it's normal checks, before checking with the PwnedPasswords.com API to verify the password has not been found in a known security breach. If it has, it will consider the password invalid. |
101
-
|`security.requestLogger.logSensitiveData`|[`config/security.js`](config/security.js) <br /> [`config/env/development.js`](config/env/development.js) <br /> [`config/env/production.js`](config/env/production.js)|`false`| If enabled, and NOT a PRODUCTION environment, the [request logger](#request-logging) will log sensitive info, such as passwords. <br /><br /> This will ALWAYS be false on PRODUCTION. It is in the PRODUCTION configuration file only as a reminder. |
<td>When enabled, and <code>models.migrate === 'safe'</code> (aka PRODUCTION), then the SQL schemas of the default datastore will be validated against the model definitions. <br><br>See <a href="#schema-validation-and-enforcement">schema validation and enforcement</a> for more info.</td>
<td>When enabled, <a href="/neonexus/sails-react-bootstrap-webpack/blob/release/api/helpers/is-password-valid.js"><code>sails.helpers.isPasswordValid()</code></a> will run it's normal checks, before checking with the PwnedPasswords.com API to verify the password has not been found in a known security breach. If it has, it will consider the password invalid.</td>
<td>If enabled, and NOT a PRODUCTION environment, the <a href="#request-logging">request logger</a> will log sensitive info, such as passwords. <br><br> This will ALWAYS be false on PRODUCTION. It is in the PRODUCTION configuration file only as a reminder.</td>
Here is where all of our API actions live. A controller in this context is a folder, and an action of the controller is an individual file. Each action is using the new "actions2" style, as opposed to the classic.
0 commit comments