What this repository exposes

Generated from the route manifest by @nasa-gcn/remix-seo; routes opt out with `handle.getSitemapEntries: () => null`, which is why auth and settings routes export that handle.

Creates the Session row first, then handleNewSession decides: users with 2FA get the session id parked in en_verification and a redirect to /verify?type=2fa, everyone else gets en_session.

Unlike the page, the action does not call requireAnonymous; it rejects an email that already has an account, emails a ten-minute onboarding code and redirects to /verify.

Answers 'No user exists with this username or email' for unknown accounts, unlike the reset handler that deliberately hides it, and sits outside the strongest rate-limit tier although every valid request sends an email.

The single endpoint behind onboarding, password reset, email change and 2FA login: it checks a TOTP code against the Verification row for the submitted type and target and dispatches to that flow's handler in verify.server.ts.

Starts the OAuth redirect (github is the only provider); signed-in users post here from settings to link an account. With MOCK_ GitHub credentials it skips GitHub and redirects straight to the callback with a fake code.

A GET that writes: it links a connection, signs in, or starts onboarding depending on whether the visitor is signed in and the GitHub account or email is already known, so it calls ensurePrimary() first.

Passkey sign-in as JSON: the GET issues options and stores the challenge in a cookie, the POST verifies the signed response against the stored public key and passes the new session through handleNewSession, so 2FA still applies.

User search runs prisma/sql/searchUsers.sql through TypedSQL: a LIKE match on username or name, ordered by each user's most recently updated note and capped at 50.

Shares its action with the edit route; a new note is always owned by the signed-in user, whatever `:username` is in the URL.

Loads the note filtered by `ownerId`, so the admin role's seeded `update:note:any` permission is never consulted — even though admins see the Edit button, because the toolbar renders whenever they can delete.

One action with three intents chosen by the `intent` field: update-profile, sign-out-of-sessions and delete-data.

Only the page's loader demands recent 2FA verification; the action checks for a session, rejects an email already in use and starts a change-email verification that completes through /verify.

Confirms the code from the authenticator app and renames the pending `2fa-verify` Verification row to `2fa`, which is what turns two-factor on for every later login.

The openimg optimiser: `objectKey` fetches from Tigris with a signed request, `src` fetches an allowlisted URL or a local file, and resized results are cached on disk and served with a one-year immutable Cache-Control.

Polled by the http_check in fly.toml every 10 seconds: it runs SELECT 1 and a HEAD request to the app's own host, returning 500 if either fails.

Not for people: the action runs only on the primary and only for `Authorization: Bearer INTERNAL_COMMAND_TOKEN`, a value the Dockerfile generates per image; any other caller is redirected to an external video.

Fingerprinted build output served by express.static with a one-year immutable cache and no fallthrough, so a missing asset is a 404 rather than a rendered page.

Registered before express.static even though its comment assumes the opposite order, so it answers 404 for the Android icons that public/site.webmanifest references.