feat(security): use bcrypt hashes and safe paths for boxes

- Replace legacy salted password hashing with bcrypt and store hash alg
- Accept existing bcrypt hashes while keeping legacy verification fallback
- Validate box IDs and use SafeChildPath for box/file operations to prevent traversal
- Refactor download flow to share zip writer logic and correctly handle one-time deletes and optional renew-on-download only after a successful zip writefeat(security): use bcrypt hashes and safe paths for boxes

- Replace legacy salted password hashing with bcrypt and store hash alg
- Accept existing bcrypt hashes while keeping legacy verification fallback
- Validate box IDs and use SafeChildPath for box/file operations to prevent traversal
- Refactor download flow to share zip writer logic and correctly handle one-time deletes and optional renew-on-download only after a successful zip write

lib/metastore/models.go

@@ -46,6 +46,7 @@ type TagPermissions struct {
 
 type Session struct {
 	Token     string    `json:"token"`
+	CSRFToken string    `json:"csrf_token"`
 	UserID    string    `json:"user_id"`
 	CreatedAt time.Time `json:"created_at"`
 	ExpiresAt time.Time `json:"expires_at"`

lib/metastore/sessions.go

@@ -23,9 +23,14 @@ func (store *Store) CreateSession(userID string, ttl time.Duration) (Session, er
 	if err != nil {
 		return Session{}, err
 	}
+	csrfToken, err := helpers.RandomHexID(32)
+	if err != nil {
+		return Session{}, err
+	}
 	now := time.Now().UTC()
 	session := Session{
 		Token:     token,
+		CSRFToken: csrfToken,
 		UserID:    userID,
 		CreatedAt: now,
 		ExpiresAt: now.Add(ttl),