SHA256
36 lines
2.1 KiB
Markdown
36 lines
2.1 KiB
Markdown
# Upstream source audit
|
|
|
|
Inspected 2026-10-20: https://github.com/ulsklyc/yuvomi
|
|
revision `10bfef7686ed7303b4c74c7fcc55a5eb16356c9d`, package version `2.78.0`.
|
|
Source was cloned outside this repository; no upstream files were modified.
|
|
|
|
Read README, CONTRIBUTING (including AI disclosure), SECURITY, DESIGN, package
|
|
manifest, server/index.js, server/auth.js, public/sw.js, sw-register.js and
|
|
notification settings. Reviewed the latest 100 open issues/PRs via GitHub API;
|
|
that sample is not an exhaustive review of all historical reports.
|
|
|
|
Findings:
|
|
|
|
- Frontend has no framework/build step; native projects remain separate.
|
|
- Public `/api/v1/version` exposes `app_name`, `setup_required`,
|
|
`password_reset_enabled`, **not** a release number before authentication.
|
|
- `/api/v1/auth/oidc/config` exposes enabled/password-login flags.
|
|
- Sessions are HttpOnly, SameSite=Lax, persistent cookies. Operators must set
|
|
`SESSION_SECURE=true` behind TLS. Native code must not replace auth or CSRF.
|
|
- Username/password, TOTP/recovery codes, reset and logout are web features.
|
|
- OIDC stores state, nonce and PKCE in the initiating browser's server session,
|
|
and returns to the configured server callback. There is no mobile callback,
|
|
one-time session exchange, or universal-link association protocol.
|
|
- Root-relative API, assets, redirects, service-worker registration and cookie
|
|
path mean subpaths cannot be promised. Use a dedicated hostname instead.
|
|
- Service worker has versioned shell caches and allow-listed read-only API
|
|
caching; mutations and authentication remain network-only. No offline editing.
|
|
- Web Push is not native push. Optional upstream ntfy/Gotify/webhook channels
|
|
provide self-hosted alternatives through their own clients.
|
|
- Upstream uses violet `#6C3AED`, warm grouped background `#F5F3ED`, and native
|
|
system fonts. Native screens follow these tokens without changing web design.
|
|
|
|
Compatibility probing is structural, not cryptographic identification: any server
|
|
can imitate the public endpoints. Users must trust the URL they enter. Exact release
|
|
compatibility needs authenticated integration testing; no version range is inferred.
|