kitadmin 85ba992432 feat: server HTTP API with auth, progress, and admin routes (Tasks 6+7) ...

- server.js: Node HTTP server with all API routes, static file serving, SPA fallback
- Path traversal protection on static file serving
- Async handler wrapped with .catch() to prevent unhandled rejections
- readBody: size limit (1MB) + error handler
- letter validation: single [A-Z] char check on progress/mnemonics routes
- phrase length limit (500 chars) on POST /api/mnemonics
- requireAdmin reads ADMIN_PASSWORD at request time for testability
- logout uses session.token from requireAuth (not re-read from header)
- 51 server tests passing (auth, progress, admin routes + edge cases)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-30 02:04:57 +00:00

..

tests

feat: server HTTP API with auth, progress, and admin routes (Tasks 6+7)

2026-04-30 02:04:57 +00:00

db.js

fix(db): transactional useMagicToken, O(2) getSession, ?? for displayName

2026-04-30 01:00:20 +00:00

mailer.js

feat: mailer with magic link email (allegiance pattern, MorseQuest branding)

2026-04-30 01:02:43 +00:00

server.js

feat: server HTTP API with auth, progress, and admin routes (Tasks 6+7)

2026-04-30 02:04:57 +00:00