[PR #28] [MERGED] overhaul auth and futureproof it with argon2 #178

New Issue

2026-02-17T17:06:22-05:00

yindo commented

2026-02-17 17:06:22 -05:00

📋 Pull Request Information

Original PR: https://github.com/Drop-OSS/drop/pull/28
Author: @Huskydog9988
Created: 3/22/2025
Status: ✅ Merged
Merged: 3/23/2025
Merged by: @DecDuck

Base: develop ← Head: auth-overhaul

📝 Commits (10+)

6ed7e76 move auth pages into auth dir
e08a13f add sharp for ipx
2027c69 fix signout
2c9fdeb new accounts use argon2
257cdac make signup less error prone in db
c1272dc use arktype for clientside validation
690aa04 switch back to json
f9e6702 Merge branch 'develop' into auth-overhaul
1f30960 address some issues
5704289 move register to auth path

📊 Changes

17 files changed (+381 additions, -133 deletions)

View changed files

📝 .vscode/settings.json (+19 -16)
📝 README.md (+5 -3)
📝 components/UserHeader/UserWidget.vue (+1 -1)
📝 error.vue (+1 -1)
📝 middleware/require-user.global.ts (+5 -2)
📝 package.json (+3 -0)
📝 pages/auth/register.vue (+14 -7)
📝 pages/auth/signin.vue (+0 -0)
📝 pages/auth/signout.vue (+2 -2)
📝 server/api/v1/auth/signin/simple.post.ts (+53 -16)
📝 server/api/v1/auth/signup/simple.post.ts (+55 -72)
📝 server/internal/security/simple.ts (+18 -7)
📝 server/plugins/redirect.ts (+1 -1)
📝 server/routes/signout.get.ts (+1 -1)
📝 server/tsconfig.json (+4 -1)
📝 tsconfig.json (+4 -1)
📝 yarn.lock (+195 -2)

📄 Description

Main item of concern rn for me is if the credentials field on LinkedAuthMec should remain. Removing it would require a more complex migration strategy, but we could also just drop it and tell people to re-setup the server. If the later route is used, a few options open up, such as trimming down the number of migrations (iirc you should only generate these before a release), plus it would make the publisher and developer to company metadata source much easier.

If the later option is not chosen, getting a reset password screen down should be moved up on the timetable so users can be moved to argon2 when they signin.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Drop-OSS/drop/pull/28 **Author:** [@Huskydog9988](https://github.com/Huskydog9988) **Created:** 3/22/2025 **Status:** ✅ Merged **Merged:** 3/23/2025 **Merged by:** [@DecDuck](https://github.com/DecDuck) **Base:** `develop` ← **Head:** `auth-overhaul` --- ### 📝 Commits (10+) - [`6ed7e76`](https://github.com/Drop-OSS/drop/commit/6ed7e76b173a0a8503be7f9a128785fb8ea45d16) move auth pages into auth dir - [`e08a13f`](https://github.com/Drop-OSS/drop/commit/e08a13f2c3be1fb3c46b1ba435a5b038f7d961b6) add sharp for ipx - [`2027c69`](https://github.com/Drop-OSS/drop/commit/2027c69c0ef899b42a56669c85afbcf2765f6890) fix signout - [`2c9fdeb`](https://github.com/Drop-OSS/drop/commit/2c9fdebf25fc359f9eb8c8fb903fefe2d047073d) new accounts use argon2 - [`257cdac`](https://github.com/Drop-OSS/drop/commit/257cdacad47aaec89ea5e4349345d9069fc99b9c) make signup less error prone in db - [`c1272dc`](https://github.com/Drop-OSS/drop/commit/c1272dc7a7d890798b5d4007190fdcfa940c3548) use arktype for clientside validation - [`690aa04`](https://github.com/Drop-OSS/drop/commit/690aa042df26f3699114af8ee905d30f1fda95f2) switch back to json - [`f9e6702`](https://github.com/Drop-OSS/drop/commit/f9e6702d40cd8c7865cd71747296724d5672ff40) Merge branch 'develop' into auth-overhaul - [`1f30960`](https://github.com/Drop-OSS/drop/commit/1f309606c94184b1c96bc0e6ba00125539eb6272) address some issues - [`5704289`](https://github.com/Drop-OSS/drop/commit/57042892c4ffa22fad2a485617332313c0c32f62) move register to auth path ### 📊 Changes **17 files changed** (+381 additions, -133 deletions) <details> <summary>View changed files</summary> 📝 `.vscode/settings.json` (+19 -16) 📝 `README.md` (+5 -3) 📝 `components/UserHeader/UserWidget.vue` (+1 -1) 📝 `error.vue` (+1 -1) 📝 `middleware/require-user.global.ts` (+5 -2) 📝 `package.json` (+3 -0) 📝 `pages/auth/register.vue` (+14 -7) 📝 `pages/auth/signin.vue` (+0 -0) 📝 `pages/auth/signout.vue` (+2 -2) 📝 `server/api/v1/auth/signin/simple.post.ts` (+53 -16) 📝 `server/api/v1/auth/signup/simple.post.ts` (+55 -72) 📝 `server/internal/security/simple.ts` (+18 -7) 📝 `server/plugins/redirect.ts` (+1 -1) 📝 `server/routes/signout.get.ts` (+1 -1) 📝 `server/tsconfig.json` (+4 -1) 📝 `tsconfig.json` (+4 -1) 📝 `yarn.lock` (+195 -2) </details> ### 📄 Description Main item of concern rn for me is if the credentials field on LinkedAuthMec should remain. Removing it would require a more complex migration strategy, but we could also just drop it and tell people to re-setup the server. If the later route is used, a few options open up, such as trimming down the number of migrations (iirc you should only generate these before a release), plus it would make the publisher and developer to company metadata source much easier. If the later option is not chosen, getting a reset password screen down should be moved up on the timetable so users can be moved to argon2 when they signin. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

yindo added the pull-request label 2026-02-17 17:06:22 -05:00

yindo closed this issue

2026-02-17 17:06:22 -05:00

yindo referenced this issue

2026-06-05 14:21:21 -04:00

[GH-ISSUE #178] [Bug] Game Fails to Import Due to Foreign Key Constraint #90

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Drop-OSS/drop#178