danvics/pediatric-ai-scribe-v3
1
0
Fork 0
Code Issues Pull requests Projects Releases 16 Packages Wiki Activity Actions

16 releases 172 tags

RSS feed
  • v3.14 9d63625987

    AI panel context-aware options, delete wording, httpOnly cookie auth

    Ghost released this 2026-03-24 06:46:07 +01:00 | 468 commits to main since this release

    AI Generate panel:

    • Content type synced from editor on open
    • Article/Pearl: optional word count field
    • Presentation: optional slide count field
    • Questions row: checkbox toggle for article/pearl (optional), always on for quiz,
      hidden for presentation; count input shown only when enabled
    • Backend: passes wordCount/slideCount to prompt; questionCount=0 skips questions

    Delete confirmation:

    • Wording built dynamically from content type
    • Presentation: no mention of questions
    • Quiz: "All quiz questions will be permanently removed"
    • Article/pearl: "Any quiz questions attached will also be removed"

    Auth refactor — JWT → httpOnly cookie:

    • Backend: setAuthCookie() sets ped_auth as httpOnly, Secure, SameSite=Lax, 7d
    • Backend: clearAuthCookie() on POST /api/auth/logout (new endpoint)
    • Backend: auth middleware reads ped_auth cookie first, falls back to Bearer header
    • Login/register: no longer return token in JSON body; cookie is the session
    • Frontend: getAuthHeaders() returns only Content-Type (no Authorization header)
    • Frontend: session check uses /api/auth/me via cookie (no localStorage token)
    • Frontend: clearSession() calls /api/auth/logout to clear cookie server-side
    • Frontend: no token in localStorage; window.AUTH_TOKEN removed
    • All FormData fetches use credentials:'same-origin' (cookie sent automatically)
    • index.html: optimistic auth-screen hide (removed localStorage token check)

    Tested: login, logout, /api/auth/me, admin routes, FormData uploads, cookie httpOnly
    flag, 401 without cookie, cookie cleared on logout.

    Downloads