bbs.profullstack/logicsrc
1
0
Fork 0
mirror of https://github.com/profullstack/logicsrc.git synced 2026-08-13 14:37:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
logicsrc/apps/pwa
History
Anthony Ettinger 898d5503b8
fix(pwa): unbreak sign-out, and stop echoing $PUBLIC_ORIGIN in the CLI hint (#108) 
Two bugs on the dashboard, both fixed by handing appBar/CLI_HINT the request.

Sign-out was broken for everyone. csrfGuard rejects any POST whose _csrf does
not match the mc_csrf cookie, and /auth/logout is a POST that is not on the
exempt list, but the sign-out form carried no hidden field -- every click
answered 403 "bad csrf token". appBar now takes the request rather than the
user, because it needs the token as well as the identity. The field is written
out instead of reusing csrfInput(): html.mjs is the view layer and imports
nothing, and pulling in session.mjs would drag the database driver with it.

The "Connect the CLI" snippet still printed $PUBLIC_ORIGIN, so users on
app.logicsrc.com were told to point LOGICSRC_API at the generated Railway
hostname. #105 added requestOrigin() for exactly this and fixed the device-flow
URLs; the dashboard hint was missed. It now follows the request too, which is
not a hardcode swap -- the same deployment answering on its Railway hostname
still self-describes correctly.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-30 10:56:36 -07:00
..
public feat(pwa): logicsrc credentials app — real auth + Turso, redesigned; retire commandboard-api credshare 2026-07-13 14:29:29 +00:00
src fix(pwa): unbreak sign-out, and stop echoing $PUBLIC_ORIGIN in the CLI hint (#108) 2026-07-30 10:56:36 -07:00
test fix(pwa): unbreak sign-out, and stop echoing $PUBLIC_ORIGIN in the CLI hint (#108) 2026-07-30 10:56:36 -07:00
.env.example feat(pwa): logicsrc credentials app — real auth + Turso, redesigned; retire commandboard-api credshare 2026-07-13 14:29:29 +00:00
.gitignore feat(pwa): logicsrc credentials app — real auth + Turso, redesigned; retire commandboard-api credshare 2026-07-13 14:29:29 +00:00
package.json feat(pwa): logicsrc credentials app — real auth + Turso, redesigned; retire commandboard-api credshare 2026-07-13 14:29:29 +00:00
Procfile feat(pwa): logicsrc credentials app — real auth + Turso, redesigned; retire commandboard-api credshare 2026-07-13 14:29:29 +00:00
railway.json feat(pwa): logicsrc credentials app — real auth + Turso, redesigned; retire commandboard-api credshare 2026-07-13 14:29:29 +00:00
README.md feat(pwa): logicsrc credentials app — real auth + Turso, redesigned; retire commandboard-api credshare 2026-07-13 14:29:29 +00:00

README.md

@logicsrc/pwa — LogicSRC credentials

Express + libSQL/Turso app for team credential sharing: auth (email/password, passkeys, CoinPay OAuth, sessions, lsk_ CLI API keys) + end-to-end-encrypted team vaults. Zero-knowledge — the server only stores ciphertext, per-member sealed vault keys, and identity public keys. Decryption happens in the logicsrc CLI.

cp .env.example .env      # set SESSION_SECRET; TURSO_* for prod (else local file db)
npm install
npm start                 # migrates on boot, serves on :8080

The CLI connects with LOGICSRC_API=<origin> logicsrc login (browser OAuth-PKCE loopback → an lsk_ key). See docs/credential-sharing.md in the repo root.