Emily/UniversalGamingApp-Backend
Watch
1
0
Fork
You've already forked UniversalGamingApp-Backend
 0
Code Issues Pull requests Projects Releases 11 Packages Wiki Activity Actions
11 releases 12 tags
  • v1.4.0 b7cf3d4951

    Universal Gaming Backend 1.4.0
    Some checks failed
    Publish backend container / backend (push) Has been cancelled
    Details
    Stable

    Emily released this 2026-11-04 21:55:38 +01:00 | 6 commits to main since this release

    Universal Gaming Backend 1.4.0

    SMTP TLS fix

    • Fixes error:0A00010B:SSL routines:tls_validate_record_header:wrong version number.
    • TLS mode is inferred from the port: 465 = implicit TLS; 25/587/2525 = STARTTLS.
    • SMTP_SECURE=true on a STARTTLS port is corrected automatically with a warning.
    • New optional SMTP_REQUIRE_TLS override.
    • Startup logs the effective SMTP mode without credentials.

    Password reset

    • New POST /api/v1/auth/forgot-password and POST /api/v1/auth/reset-password.
    • Only accounts with an assigned and confirmed e-mail can reset a password.
    • Forgot-password always returns HTTP 202 to prevent account enumeration.
    • One-time tokens are stored as SHA-256 hashes and expire after 30 minutes by default (PASSWORD_RESET_TTL_MINUTES).
    • Resetting a password increments auth_version, invalidating every existing session.
    • New APP_PUBLIC_URL controls the app reset link (/account?reset=…).

    Database

    • PostgreSQL migration version 2 adds auth_version and password-reset token columns.
    • Applied automatically by ./update.sh or node src/migrate.js.

    Upgrade

    • Deploy with ./update.sh; it takes a pre-update pg_dump backup and applies migration 2.
    • Existing accounts, scores and chess matches are preserved.
    Downloads
  • v1.3.0 36e03eb573

    Universal Gaming Backend 1.3.0
    Some checks failed
    Publish backend container / backend (push) Has been cancelled
    Details
    Stable

    Emily released this 2026-11-04 20:35:35 +01:00 | 7 commits to main since this release

    Versioned PostgreSQL migrations (schema_migrations), a migration runner (node src/migrate.js), and an update.sh that takes a pre-update pg_dump backup before pulling, rebuilding and migrating.

    Downloads
  • v1.2.2 dfa9804f1a

    Universal Gaming Accounts 1.2.2
    Some checks failed
    Publish backend container / backend (push) Has been cancelled
    Details
    Stable

    Emily released this 2026-11-04 19:46:50 +01:00 | 10 commits to main since this release

    Universal Gaming Accounts 1.2.2

    Adds request and authentication logging for troubleshooting.

    • One [http] line per request: status, method, path, duration, client IP, peer IP and user agent.
    • Query strings are omitted, so verification tokens and other query parameters are not logged.
    • Request bodies, passwords and bearer tokens are never logged.
    • Failed logins emit [auth] login failed ip=... without logging the username or e-mail.
    • REQUEST_LOGGING=true by default; set it to false to disable.
    • Docker log retention remains capped at 10 MB × 3 files.
    • Tests: 35 passing; npm audit --omit=dev reports 0 vulnerabilities.

    Container image

    docker pull git.emilyh.de/emily/universal-gaming-backend:1.2.2
docker pull git.emilyh.de/emily/universal-gaming-backend:latest
    Downloads
  • v1.2.1 c512b92bea

    Universal Gaming Accounts 1.2.1
    Some checks failed
    Publish backend container / backend (push) Has been cancelled
    Details
    Stable

    Emily released this 2026-11-04 17:59:48 +01:00 | 11 commits to main since this release

    Universal Gaming Accounts 1.2.1

    Fixes PostgreSQL connection handling when database credentials contain URL-reserved characters.

    • The backend now builds DATABASE_URL from POSTGRES_DB, POSTGRES_USER, POSTGRES_PASSWORD, POSTGRES_HOST and POSTGRES_PORT, percent-encoding the credentials. A password containing @, :, /, ? or # no longer produces Invalid URL.
    • DATABASE_URL remains an optional explicit override for external databases.
    • Compose no longer interpolates the raw password into DATABASE_URL.
    • Added a clear hint for PostgreSQL error 28P01 (password authentication failed) and a troubleshooting section explaining that POSTGRES_PASSWORD only initializes a new volume.
    • Tests: 34 passing; npm audit --omit=dev reports 0 vulnerabilities.

    Container image

    docker pull git.emilyh.de/emily/universal-gaming-backend:1.2.1
docker pull git.emilyh.de/emily/universal-gaming-backend:latest
    Downloads
  • v1.2.0 4ea630aada

    Universal Gaming Backend 1.2.0
    Some checks failed
    Publish backend container / backend (push) Has been cancelled
    Details
    Stable

    Emily released this 2026-11-04 16:11:44 +01:00 | 13 commits to main since this release

    Universal Gaming Backend 1.2.0

    Added

    • E-mail accounts — optional e-mail at registration, login with username or e-mail, change/remove e-mail, and confirmation links. Confirmation is opt-in via SMTP and never blocks account use; accounts remain usable while unverified.
    • Online chess — challenge another player by username, accept/decline/cancel, submit moves, resign. Every move is replayed and validated server-side with chess.js; clients are never trusted for turn order or legality. Optimistic versions reject concurrent/stale moves.
    • Management panel — read-only Basic-auth HTML at /management with account, verified e-mail, leaderboard and chess statistics. Disabled unless MANAGEMENT_PASSWORD is set; never exposes hashes, JWTs or e-mail tokens.
    • GET / — returns the backend service name and current version.
    • Prebuilt image workflow — .gitea/workflows/publish-image.yml and publish-image.sh publish git.emilyh.de/emily/universal-gaming-backend:1.2.0 (and :latest).
    • PUBLIC_BASE_URL for confirmation links, plus SMTP_*, EMAIL_CONFIRMATION_ENABLED, CHESS_ENABLED, MANAGEMENT_* configuration.

    Fixed

    • E-mail removal via PATCH /api/v1/accounts/me now actually clears the address and confirmation token.
    • Registration validation no longer loses the username when an e-mail is supplied.

    Database

    Adds e-mail columns to users and a chess_matches table. Both PostgreSQL and SQLite migrate automatically on startup (ADD COLUMN IF NOT EXISTS / CREATE TABLE IF NOT EXISTS).

    Container image

    Published and publicly pullable:

    docker pull git.emilyh.de/emily/universal-gaming-backend:1.2.0
docker pull git.emilyh.de/emily/universal-gaming-backend:latest

    Verification

    • npm test: 32/32 passing.
    • npm audit --omit=dev: 0 vulnerabilities.
    • Root, health, meta, account, e-mail, chess, leaderboard, management and release-proxy flows covered.
    Downloads
  • v1.1.0 ea2efcf900

    Universal Gaming Backend 1.1.0 Stable

    Emily released this 2026-11-04 15:18:23 +01:00 | 14 commits to main since this release

    Competitive leaderboard

    • New public endpoints: GET /api/v1/leaderboards, GET /api/v1/leaderboards/:gameId, and authenticated POST /api/v1/leaderboards/:gameId/scores.
    • Keeps one best score per user, game and mode, ranked by time, moves, then submission time.
    • Validates games, modes, times, moves and detail text; read and write endpoints are rate-limited.
    • Stores scores in PostgreSQL with a SQLite fallback for development. Deleting an account cascades to its scores.
    • New LEADERBOARD_ENABLED setting (default true). When disabled, the app falls back to its local board.
    • /api/v1/meta now reports leaderboardEnabled.

    Easier Git-based upgrades

    • Reorganized docker-compose.yml with a stable project name, image tag 1.1.0, logging limits, health checks and an ACCOUNT_PORT override.
    • Added update.sh for git pull --ff-only, database image pull, rebuild and restart. It refuses to run with local Git changes.
    • .env and docker-compose.override.yml stay ignored so pulls remain clean.
    • README now documents the upgrade flow, backup/restore, leaderboard API examples and privacy notes.

    Upgrade

    git pull --ff-only
docker compose build --pull accounts
docker compose up -d --remove-orphans

    Or run ./update.sh. The leaderboard_scores table is created automatically; existing accounts are preserved.

    Downloads
  • v1.0.4 ed482728f2

    Universal Gaming Accounts 1.0.4 Stable

    Emily released this 2026-11-04 12:57:45 +01:00 | 15 commits to main since this release

    Universal Gaming Accounts 1.0.4

    Security hardening from the November 2026 review:

    • Passwords longer than 72 bytes are no longer truncated. New hashes use SHA-256 pre-hashing before bcrypt; legacy bcrypt hashes are verified and upgraded automatically on the next successful sign-in.
    • Oversized request bodies return HTTP 413 instead of an internal error.
    • JWTs are pinned to HS256 in addition to the existing issuer/audience checks.
    • TRUSTED_PROXIES remains the recommended way to trust reverse proxies; TRUST_PROXY=true is still a legacy fallback.
    • Docker Compose image bumped to universal-gaming-backend:1.0.4.

    No API changes. Existing accounts continue to work.

    Downloads
  • v1.0.3 17f136b310

    Universal Gaming Accounts 1.0.3 Stable

    Emily released this 2026-11-04 12:20:23 +01:00 | 16 commits to main since this release

    Universal Gaming Accounts 1.0.3

    • New TRUSTED_PROXIES environment variable: a comma-separated list of proxy IPs, CIDR ranges, or loopback/linklocal/uniquelocal presets that are allowed to set X-Forwarded-For.
    • When TRUSTED_PROXIES is set, it takes precedence over the legacy TRUST_PROXY setting.
    • Invalid entries are rejected at startup with a clear configuration error instead of silently trusting the wrong peers.
    • TRUST_PROXY=false is now the documented default; TRUST_PROXY=true remains supported as a legacy fallback but trusts every peer.
    • Docker Compose image bumped to universal-gaming-backend:1.0.3.

    Example:

    TRUSTED_PROXIES=127.0.0.1,::1,10.0.0.0/8

    This makes rate limiting use the real client IP only when the immediate peer is one of the configured proxies.

    Downloads
  • v1.0.2 b1975d5a2a

    Universal Gaming Accounts 1.0.2 Stable

    Emily released this 2026-11-04 12:09:43 +01:00 | 17 commits to main since this release

    Universal Gaming Accounts 1.0.2

    • Account data is now stored in PostgreSQL in the Docker Compose deployment.
    • Compose starts PostgreSQL 16 with a health check and a persistent postgres-data volume.
    • Every database transaction is logged to stdout as a [db] line, visible in docker compose logs.
    • GET /healthz now reports the active database backend.
    • New DATABASE_URL setting plus POSTGRES_DB, POSTGRES_USER and POSTGRES_PASSWORD Compose variables.
    • SQLite remains available as a development/test fallback when DATABASE_URL is empty.
    • No API changes: app 2.3.0 and earlier clients keep working.

    Upgrade notes

    Existing SQLite account data is not imported automatically. Back up the old volume, then create accounts again or migrate the users table manually. Change POSTGRES_PASSWORD in .env and keep DATABASE_URL in sync before starting.

    Downloads
  • v1.0.1 626fc5f1c5

    Universal Gaming Accounts 1.0.1 Stable

    Emily released this 2026-11-04 11:44:20 +01:00 | 18 commits to main since this release

    Changed

    • The account service now defaults to port 6767 (previously 8080).
    • Docker Compose, Dockerfile, .env.example, health check and documentation use 6767.
    • Service metadata reports version 1.0.1.
    • Added config tests for the default port and overrides.

    Upgrade

    docker compose up -d --build after pulling. Existing SQLite volumes are unchanged.

    Downloads