文件
jw-beauty/server/package.json
T
Guoguo 2eb38195f1 fix: address critical security and data integrity issues from cross-audit
- Add expire_time > NOW() filter to findActive() preventing stale subscriptions
- Add express-rate-limit on login endpoints (user: 10/15min, admin: 5/15min)
- Add production guard for default admin credentials
- Fix BLE bindDevice userId encoding (uint32 instead of hexToBytes on numeric)
- Wrap adminCreate in transaction to prevent race condition
- Add settings cache invalidation after admin saves
- Read trial_days from settings instead of hardcoding 7
- Fix double JSON.stringify in commandDao.finish call
- Cancel stale pending bindings before creating new ones
- Reduce token refresh grace period from 3 days to 1 day
- Fix subscribe-success to fetch expiry from server (correct for renewals)
- Add keep-alive name property to DashboardView and SettingsView
- Fix BLE disconnect() to preserve listener registrations across reconnects
2026-05-05 02:33:25 -07:00

21 行
500 B
JSON

{
"name": "hox-scf-api",
"version": "1.0.0",
"private": true,
"description": "Tencent Cloud SCF Node.js API for Hox beauty device",
"main": "src/index.js",
"scripts": {
"start": "node scripts/local-server.js",
"db:init": "node scripts/init-db.js"
},
"dependencies": {
"bcryptjs": "^2.4.3",
"cos-nodejs-sdk-v5": "^2.14.7",
"dotenv": "^16.4.5",
"express": "^5.2.1",
"express-rate-limit": "^8.5.0",
"jsonwebtoken": "^9.0.2",
"mysql2": "^3.11.3"
}
}