julien beb8abb2bc fix(session): use dedicated SESSION_SECRET instead of JWT secret ...

Sharing the JWT secret with express-session means a single leaked
secret compromises both auth mechanisms. SESSION_SECRET is now read
from its own env var, falling back to SECRET only if not set.

2026-04-26 20:43:13 +02:00

..

config

fix(auth): replace fixed-salt bcrypt with HMAC-SHA256 for API key hashing

2026-04-26 20:31:06 +02:00

controllers

fix(herowars): replace Object.assign with explicit field whitelists

2026-04-26 20:42:29 +02:00

database

feat(auth): migrate Application model from MongoDB to MySQL

2026-04-26 18:26:58 +02:00

middlewares

fix(auth): replace fixed-salt bcrypt with HMAC-SHA256 for API key hashing

2026-04-26 20:31:06 +02:00

routes

feat(auth): migrate Application model from MongoDB to MySQL

2026-04-26 18:26:58 +02:00

services

fix(skydive): migrate author field from ObjectId to UUID string

2026-04-26 04:27:47 +02:00

swagger

docs: add migration documentation, finalization scripts, and update Swagger paths

2026-04-24 00:50:34 +02:00

utils

Mise à jour et ajout de controllers, routes, services et utilities

2025-11-30 17:54:01 +01:00

validations

Ajout de la base de données MySQL

2025-08-13 21:51:07 +02:00

createApp.js

fix(session): use dedicated SESSION_SECRET instead of JWT secret

2026-04-26 20:43:13 +02:00