Previously the frontend hashed passwords with MD5 + a hardcoded salt
before sending to the backend. This exposed the salt in client-side JS
and used an insecure hash algorithm.
Backend changes:
- Setup: accepts plain password, bcrypt hashes it, generates UUID apiKey
- Signin: accepts plain password, bcrypt verifies, returns stored apiKey
- Status: checks passwordHash instead of apiKey
- AppStore: new passwordHash field
- Middleware: add X-API-Key header support (was only reading Authorization)
- CORS: allow X-API-Key header
Frontend changes:
- Signin page: send plain password, receive apiKey from response
- Remove md5/crypto-js dependency and APIKEY_SALT_KEY constant
- api/download-task: auto-inject localPath/deleteSegments from store
(was lost during go-adapter migration, caused EOF errors)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The packaged app failed to launch because mediago-core was missing from
Resources/bin/. The asarUnpack approach relied on platform-specific npm
optional deps that pnpm workspace hoisting never installed in app/node_modules/.
Fix: copy locally-built binaries (core, player, deps) into app/build/bin
and app/build/deps during the pack step, then expose them via extraResources
so electron-builder places them at the expected Resources/bin/ and
Resources/deps/ paths at runtime.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
caorushizi