9016ce02e4
Off by default. Once a PIN is set in Settings -> System & backup, every non-GET /api/* request (plus GET /api/ammc/config) needs a signed 30-day HttpOnly cookie, which also closes the unauthenticated /api/update/run restart trigger. A 401 opens a PIN dialog and the pending save is retried after login. Reads stay open because the public overlay hydrates through GET /api/state. Optional RC_ADMIN_ALLOWED_CIDRS restricts the same routes by client address. The PIN hash and signing secret live in data/, outside the app_state blob, so they never leak through GET /api/state, exports or backups. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
35 lines
1.2 KiB
JSON
35 lines
1.2 KiB
JSON
{
|
|
"name": "rc-racecore",
|
|
"version": "1.22.0",
|
|
"private": true,
|
|
"description": "RC RaceCore live timing and race control with AMMC ingest and SQLite persistence",
|
|
"engines": {
|
|
"node": ">=22 <27",
|
|
"npm": ">=10"
|
|
},
|
|
"allowScripts": {
|
|
"better-sqlite3": true
|
|
},
|
|
"scripts": {
|
|
"preinstall": "node scripts/preinstall.js",
|
|
"postinstall": "node scripts/verify-install.js",
|
|
"start": "node scripts/serverctl.js start",
|
|
"start:fg": "node server.js",
|
|
"stop": "node scripts/serverctl.js stop",
|
|
"status": "node scripts/serverctl.js status",
|
|
"restart": "node scripts/serverctl.js restart",
|
|
"update": "node scripts/serverctl.js update",
|
|
"verify": "node scripts/verify-install.js",
|
|
"backup:restore": "node scripts/restore-backup.js",
|
|
"audit:prod": "npm audit --omit=dev",
|
|
"test": "node --experimental-default-type=module tests/run.js",
|
|
"test:browser": "node --experimental-default-type=module tests/browser_smoke.js",
|
|
"setup:windows": "powershell -NoProfile -ExecutionPolicy Bypass -File windows/setup.ps1"
|
|
},
|
|
"dependencies": {
|
|
"better-sqlite3": "^12.11.1",
|
|
"express": "5.2.1",
|
|
"qrcode": "^1.5.4"
|
|
}
|
|
}
|