SQLite WAL mode (start9/0.4/docker_entrypoint.sh)
- Switches journal_mode to WAL on every boot. WAL persists in the DB
header so this is effectively a one-shot but rerunning is harmless.
- Crucial for the "background StartOS Backup while users are using the
app" case: under the default rollback journal, a long backup can
capture an inconsistent snapshot. WAL keeps readers and the writer
from blocking each other.
- synchronous=NORMAL paired with WAL: still crash-consistent at every
checkpoint, ~10x faster than FULL.
Security headers (proof-of-work/next.config.js)
- Content-Security-Policy with frame-ancestors 'none', base-uri 'self',
form-action 'self', object-src 'none'. Keeps 'unsafe-inline' for
script/style because Next.js emits inline bootstrap; tightening to
nonce-based CSP is a follow-up.
- Strict-Transport-Security: max-age=31536000; includeSubDomains.
- Referrer-Policy: strict-origin-when-cross-origin (don't leak workout
IDs etc. to third-party sites).
- Permissions-Policy: deny camera, mic, geolocation, USB, etc. across
the board (none of those APIs are used today; explicit deny means
vulnerability scanners have one less thing to flag).
Last-login tracking
- New User.lastLoginAt column. createSession stamps it inside the same
transaction as the new Session row.
- Compat ALTER in entrypoint adds the column to legacy snapshots.
- Admin Users table now shows a relative-age cell (today / Nd ago /
Nmo ago / Ny ago / "never" if the user hasn't signed in since the
column was added). Hover reveals the exact ISO timestamp.
Self-serve delete-my-account (Settings -> Danger Zone)
- Requires both the user's current password AND typing the literal
phrase "delete my account" (defense against a stolen-session
attacker nuking the account in one click).
- Refused for the last admin (instance can't be left with no admin —
the user is told to promote someone first).
- Cascades through Prisma onDelete: Cascade on every relation owned by
User, so workouts, exercises, sessions, preferences all go in one
shot. Session cookie cleared, redirected to /auth/login.
Keysat
d51400c2a9