Security: require auth on entry/photo mutations (IDOR fix) + constant-time compare + CI

[davidcjw]

Summary

Fixes a high-severity IDOR / public-write vulnerability on the memory mutation endpoints, hardens password/token comparison against timing attacks, and adds CI (the repo had none).

Vulnerability (HIGH — IDOR / unauthenticated write)

The mutation handlers acted on a caller-supplied entry id with no per-handler authorization:

• src/app/api/entries/[id]/route.ts — PATCH (edit a memory's description)
• src/app/api/entries/[id]/photos/route.ts — POST (add photo), DELETE (remove photo)

The only gate was the optional SITE_PASSWORD proxy (src/proxy.ts), which returns NextResponse.next() when the password is blank (the documented default = public read). On the default config, anyone could edit or delete any entry or photo by guessing/enumerating ids — a classic Insecure Direct Object Reference, made worse by the endpoints being fully unauthenticated.

Vulnerability (LOW — non-constant-time comparison)

src/app/api/auth/login/route.ts and src/proxy.ts compared the password / session token with !== / ===, which short-circuits and can leak length/prefix information via timing.

Fix

1. Fail-closed authorization on all writes. New requireAuth(req) helper in src/lib/auth.ts validates the owner session cookie (lj_session, the same token the login flow issues) and returns 401 when absent/invalid. Crucially, if SITE_PASSWORD is unset there is no owner session to validate, so writes are rejected (401) rather than falling open. It is called at the top of every mutation handler (entries PATCH, photos POST, photos DELETE). GET/read handlers are untouched — public reads still work.
2. Constant-time comparison. timingSafeStringEqual uses crypto.timingSafeEqual on equal-length Buffers (with an explicit length guard, since timingSafeEqual throws on unequal lengths). The login route and proxy now use it instead of !==/===.

CI

Added .github/workflows/ci.yml (lint + build + test on Node 20, plus npm audit and gitleaks secret scan). The repo previously had no CI.

Verification

• npm run build — passes (including the Proxy/Middleware edge bundle; node:crypto's timingSafeEqual builds fine there).
• npm run lint — clean.
• npm test — 38/38 pass.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BAMbBXXNhnUcztWtqTHzmu

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
life-journal	Ready	Preview, Comment	Jul 2, 2026 2:32pm