5 Commits

Author	SHA1	Message	Date
Josh Creek	4c268ba15c	feat(pokedex): add opt-in Server-Timing for the pokédex load ... POKEDEX_PERFORMANCE=true reports auth, ownership, scopes, entries and catches with fixed labels only: no IDs, query strings, cookies or entry content ever reach the header. Auth is measured in the hook, where the session is actually resolved, and handed to the page load through locals.	2026-09-15 17:46:07 +01:00
Josh Creek	3aa716b941	fix(#55): implement user data isolation to prevent cross-user data access ... - Add server-side authentication validation for all protected API endpoints - Create auth utility with requireAuth() function for session validation - Update CombinedDataRepository to filter data by authenticated user ID - Add findByUserId() method to CatchRecordRepository for user-specific queries - Replace client-side userId parameters with server-side session extraction - Use MongoDB aggregation with $lookup and $expr for secure user filtering - Return 401 errors for unauthenticated requests - Fix critical security vulnerability where users could see others' catch records Fixes: User data isolation bug where one user's catch records were used for everyone Security: Prevents unauthorized access to other users' Pokemon tracking data	2025-07-26 16:34:19 +01:00
Josh Creek	5285d5d84d	chore(*): Add workbox service worker	2024-04-14 16:03:01 +01:00
Josh Creek	49e39c2742	chore(#4): Add a database connection to mongodb	2024-04-06 15:04:53 +01:00
Josh Creek	e3420d6e02	chore(*): Add base sveltekit files	2024-03-09 21:28:07 +00:00