streetwriters/notesnook-sync-server v1.0-beta.51

on GitHub

Note: This is a beta version and NOT ready for use in production.

Identity

1. Email addresses are checked more strictly at signup and when changing email. Addresses are normalized (Unicode compatibility forms, internationalized domains), malformed or mixed-script look-alike addresses are rejected, and look-alike forms of the same address now map to one account.
2. Deployments can plug in their own address checks through IEmailRiskCheck, enabled by setting EMAIL_VALIDATOR_URL and EMAIL_VALIDATOR_SECRET. Self-hosted servers without them behave as before. If the check is unreachable, signups are allowed rather than failed.
3. Password reset tokens no longer appear in logs, and the reset redirect can't be cached by browsers.
4. Suspended accounts can't reset their password, recover their account, or confirm a reset. A temporary lockout from failed sign-ins doesn't block a password reset.
5. MFA setup is rate-limited per user, and account recovery per client, instead of sharing one limit across everyone.
6. Forwarded client addresses (CF-Connecting-IP, X-Forwarded-For) are only trusted when the request comes from a private or loopback address, so clients can't pick their own rate-limit bucket.

Inbox

1. Requests are rate-limited per client (60 per minute), and are authenticated before the body is read, so unauthenticated requests can't make the server parse large bodies.
2. Managing inbox API keys requires a confirmed email address.
3. New inbox API keys must have an expiry in the future, or -1 for no expiry.

Monographs

1. A monograph's ID link serves the live, first-published copy when more than one account has published the same item, so a later copy can't replace an existing link.
2. Deleting a monograph and reading its metadata or analytics only look among your own monographs, so another account's copy can't get in the way.

Test drive

wget https://raw.githubusercontent.com/streetwriters/notesnook-sync-server/v1.0-beta.51/docker-compose.yml
wget https://raw.githubusercontent.com/streetwriters/notesnook-sync-server/v1.0-beta.51/.env
docker compose up

Make sure everything is up and running:

docker ps

All the above services must show (healthy) in the output.

Full Changelog: v1.0-beta.50...v1.0-beta.51