meiliNG v0.9.0

[Alex4386]

This is a milestone for meiliNG 0.9.0.
Version codename: Flow (流)

This update contains:

• Major rewrite on how errors are handled.
• you can now use throw instead of sendError
• node internal errors are now handled properly via custom error handler! (no more fastify default errors!)
• detailed stacktrace when you enable developer mode
• An experimental "Swagger"/"OpenAPI" support.
• /v1/admin/sessions/count is now a thing!
• Fixed OpenID id_token not providing signing key id to client.
• user-land CRUD Operation on e-mail address and phone number
• Fixed isPrimary was not properly handled via addPhone function call.
• TOTP Support
• Even faster rate limiting for session issuing without DB Searching
• administrative login to specific session with /v1/admin/auth/login. This can be used for custom login flows such as oAuth2/SAML2 integration with third-party.
• Experimental WebAuthn support (Getting ready for Passkeys)
• Mitigated potential prisma query injection vulnerability that @kjsman pointed out
• Mitigated potential prototype pollution vulnerability that @kjsman pointed out
• Fixed admin endpoints can not process GET queries if the query contains numeric characters only
• Fixed /v1/admin/users/:userId/phones and /v1/admin/users/:userId/phones/:phoneId endpoints not working properly (no response, querying wrong db)
• Fixed a bug that "Deleted" users could not be looked up via User.getDetailInfo.
• Fixed a bug that /v1/admin endpoints return undefined on /v1/admin/users endpoint when deleted user occurrs
• Fixed a bug that lead to unable to lookup any "Deleted" users via admin endpoints
• Fixed obsolete eslint version
• Updated Target Typescript version to 4.7.4
• Updated Prisma to 4.1.1 (#48)
• Added Sentry Support

[Alex4386]

TODO: Remove dependency for Stella IT's proprietary NotificationAPI.
Actually Notification API does nothing at this moment since Stella IT uses custom extended signup process (will document later).

[Alex4386]

Two Factor Authentication has just reached Stella IT Accounts.

[Alex4386]

TOTP still requires client-side implementation for now

[Alex4386]

Client-side Implementation of 2FA is now deployed on Stella IT Accounts