codegirl007/plumber
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Harden sessions, uploads, admin demotion, and HTTP timeouts.

Browse Source 
Address PR review findings: renew session tokens on auth, sniff/re-encode avatars, serialize last-admin checks, bound server timeouts, rune-safe truncation, and TEST_DATABASE_URL-only integration tests.
This commit is contained in:
codegirl007
2026-08-22 07:24:39 -07:00
parent 247fb05281
commit afd2476f3c
11 changed files with 113 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.example
+2
View File
@@ -3,6 +3,8 @@ LISTEN=:8080
# Required: PlanetScale Postgres URI (port 5432 so the app can create tables on boot).
# Switch to 6432 (PgBouncer) later if you need pooling.
DATABASE_URL=postgresql://user:password@host.example.com:5432/postgres?sslmode=verify-full
# Required for integration tests (do not point at the runtime DATABASE_URL).
# TEST_DATABASE_URL=postgresql://user:password@host.example.com:5432/plumber_test?sslmode=verify-full
# Optional: first matching registrant becomes admin only if no admin exists yet.
# Later promote/demote via /admin/users (admins only).
ADMIN_USERNAME=yourusername