feat: production hardening + password reset, metrics, signed webhooks

Security hardening (CRITICAL/HIGH from production-readiness audit): - Require strong JWT_SECRET + separate INTEGRATION_ENCRYPTION_KEY at boot; refuse placeholder defaults. Integration key now derived via HKDF. - SSRF guard (src/lib/server/utils/safeFetch.ts): DNS-resolves and rejects RFC1918/loopback/link-local/IPv4-mapped IPv6/decimal-IP/cloud-metadata. Manual redirect handling re-validates each 3xx Location hop. Applied to healthcheck, RSS, calendar, metric, system-stats, camera, notifications, discovery, apps/preview, and all integration clients. - API tokens, session refresh tokens, invite tokens, password-reset tokens switched from bcrypt to sha256 with @unique indexed lookup (O(1) instead of O(N) bcrypt-compares; eliminates a trivial DoS). - Refresh-token reuse detection via Session.previousTokenHash. - Permission checks on App PATCH/DELETE and Widget/Section endpoints. - /api/integrations/alerts now requires auth. - SVG uploads sanitized through DOMPurify (svg profile, scheme allow-list). - Custom CSS sanitizer + selector scoping (decodes CSS unicode escapes before pattern match, drops forbidden at-rules incl. @import without whitespace, strips dangerous url() args). Scoped to .custom-css-scope. - Backup restore validates SQLite magic header, takes a safety snapshot, uses atomic rename, re-applies pragmas. - SQLite WAL + busy_timeout + foreign_keys + synchronous=NORMAL at startup. - Healthcheck scheduler was dead code; wired in hooks.server.ts with HMR-safe singleton, concurrency cap, overlap prevention, retention jobs for AppClick/Notification/AuditLog. Composite indexes added on hot paths. - Security headers (CSP, HSTS-on-https, X-Frame-Options, Permissions-Policy) emitted on every response. - Account-enumeration mitigation on login (dummy bcrypt on no-user/oauth branches) + rate limiting on login/register/onboarding/refresh/invite/ password-reset. - OAuth callback sanitizes IdP error_description before echoing. New features: - Custom +error.svelte pages (root + boards + admin) via shared ErrorState component. Inverted hierarchy (status as label, title as hero). - /forgot-password + /reset-password + admin-mediated /admin/password-resets page. SHA256 tokens, 24h TTL, all sessions revoked on apply. - /invite page for manual invite-token redemption. - /api/metrics Prometheus exposition with optional METRICS_TOKEN bearer auth. Counters for login/healthcheck/notification/integration; gauges for users/boards/apps + per-status app counts. - Webhook HMAC-SHA256 signing for HTTP notification channels (optional shared secret + configurable signature header, default X-Signature-256). - PATCH /api/users/me/password for self-service password change. - Persistent uploads at /app/data/uploads with served-from-volume handler at /uploads/[...path]. SVGs served with CSP: sandbox. - /api/health does a DB ping; returns 503 on disconnect. - Public /status filtered to guest-accessible-board apps when unauthenticated. - Audit log coverage: LOGIN_SUCCESS/FAILED, LOGOUT, OAUTH_LOGIN, OAUTH_USER_PROVISIONED, SESSION_REVOKED, API_TOKEN_*, INVITE_*, APP_UPDATED, PASSWORD_CHANGED, PASSWORD_RESET_*. Performance: - Board page: removed double findAll() over-fetch; include links + appTags in board query; widgets lazy-loaded via dynamic imports (marked, DOMPurify, hls.js, integration renderers). - uptimeService.getAllAppsUptime: single batched query instead of N+1. - 30s in-memory user-locals cache; invalidated on user mutation. - pruneOldStatuses: single window-function DELETE instead of N+1. Code quality: - Typed error classes (NotFoundError, PermissionError, RateLimitError, IntegrationError) with toHttpError mapper. - Locals.user shape exposes avatarUrl and narrows role via guard. - App input types derived from Zod schemas via z.infer. - 274 tests passing (up from 212); 62 new tests covering SSRF guard, CSS sanitizer, SVG sanitizer, rate limiter. CI / Docker / config: - Test workflow adds build, docker-build, audit jobs. Release workflow uses buildx multi-arch (amd64+arm64) with provenance + SBOM. - Dockerfile uses tini, multi-stage prune, persistent uploads dir, single prisma migrate deploy (no destructive db push fallback). - docker-compose: JWT_SECRET + INTEGRATION_ENCRYPTION_KEY required at startup, log rotation, resource limits. - README documents breaking-change upgrade path. Bug fixes from UI/UX review: - ~55 missing i18n keys added to en/ru (auth flows, error pages, admin nav, register invite banner, settings.card_style). - Hardcoded English on login replaced with $t('auth.remember_me'). - Admin nav uses i18n keys; mobile horizontal-scroll layout. - Page <title> tags standardized. - Password-resets: separated error/info/success surfaces, ConfirmDialog replaces window.confirm. - Auth pages have matching lucide icon badges. - Webhook secret has eye toggle and monospace input. - text-green-500 → text-emerald-500 to match codebase convention. Pre-existing CI lint failures cleaned up (31 errors → 0): each-key attributes added, unused-svelte-ignore comments removed, two any casts typed, dead skeleton components removed, /boards/[id]/edit redirect to inline edit mode. Tests: 274 / 274 passing Type check: 0 errors / 0 warnings Build: green
2026-05-26 19:51:21 +03:00
parent 38335e925b
commit f1cfb61d13
144 changed files with 5586 additions and 2284 deletions
@@ -17,7 +17,6 @@ jobs:
          TAG="${{ gitea.ref_name }}"
          VERSION="${TAG#v}"
          REGISTRY="${{ gitea.server_url }}"
-          # Strip https:// for registry address
          REGISTRY="${REGISTRY#https://}"
          REGISTRY="${REGISTRY#http://}"
          IMAGE="${REGISTRY}/${{ gitea.repository }}"
@@ -25,23 +24,34 @@ jobs:
          echo "image=${IMAGE}" >> "$GITHUB_OUTPUT"
          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"

+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
      - name: Login to Gitea Container Registry
        run: |
          echo "${{ secrets.DEPLOY_TOKEN }}" | docker login "${{ gitea.server_url }}" -u "${{ gitea.repository_owner }}" --password-stdin

-      - name: Build and push Docker image
-        run: |
-          IMAGE="${{ steps.meta.outputs.image }}"
-          VERSION="${{ steps.meta.outputs.version }}"
-          docker build \
-            --label "org.opencontainers.image.source=${{ gitea.server_url }}/${{ gitea.repository }}" \
-            --label "org.opencontainers.image.description=Self-hosted web app launcher dashboard" \
-            --label "org.opencontainers.image.version=${VERSION}" \
-            -t "${IMAGE}:${VERSION}" \
-            -t "${IMAGE}:latest" \
-            .
-          docker push "${IMAGE}:${VERSION}"
-          docker push "${IMAGE}:latest"
+      - name: Build and push multi-arch Docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          provenance: true
+          sbom: true
+          build-args: |
+            VERSION=${{ steps.meta.outputs.version }}
+          tags: |
+            ${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.version }}
+            ${{ steps.meta.outputs.image }}:latest
+          labels: |
+            org.opencontainers.image.source=${{ gitea.server_url }}/${{ gitea.repository }}
+            org.opencontainers.image.description=Self-hosted web app launcher dashboard
+            org.opencontainers.image.version=${{ steps.meta.outputs.version }}
+            org.opencontainers.image.licenses=MIT

  release:
    runs-on: ubuntu-latest
@@ -61,28 +71,37 @@ jobs:
          VERSION="${TAG#v}"
          BASE_URL="${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}"

-          # Detect pre-release (alpha/beta/rc)
          IS_PRE="false"
          if echo "$TAG" | grep -qE '(alpha|beta|rc)'; then
            IS_PRE="true"
          fi

-          # Read release notes if present
+          # Extract release notes for THIS version only. Falls back to whole file
+          # if the markers aren't found.
          if [ -f RELEASE_NOTES.md ]; then
-            BODY_JSON=$(jq -Rs '.' < RELEASE_NOTES.md)
-            echo "Found RELEASE_NOTES.md"
+            BODY=$(awk -v v="$VERSION" '
+              BEGIN {capture = 0}
+              /^## (v?)/ {
+                if (capture) {exit}
+                if ($0 ~ "## v?"v"([^0-9]|$)") {capture = 1; next}
+              }
+              capture {print}
+            ' RELEASE_NOTES.md)
+            if [ -z "$BODY" ]; then
+              BODY=$(cat RELEASE_NOTES.md)
+            fi
+            BODY_JSON=$(printf '%s' "$BODY" | jq -Rs '.')
+            echo "Found RELEASE_NOTES.md (extracted section for $VERSION)"
          else
            BODY_JSON='""'
            echo "No RELEASE_NOTES.md found — release will have no body"
          fi

-          # Check if release already exists for this tag
          EXISTING=$(curl -s -o /dev/null -w "%{http_code}" \
            "$BASE_URL/releases/tags/$TAG" \
            -H "Authorization: token $DEPLOY_TOKEN")

          if [ "$EXISTING" = "200" ]; then
-            # Update existing release
            RELEASE_ID=$(curl -s "$BASE_URL/releases/tags/$TAG" \
              -H "Authorization: token $DEPLOY_TOKEN" | jq -r '.id')
            curl -s -X PATCH "$BASE_URL/releases/$RELEASE_ID" \
@@ -96,7 +115,6 @@ jobs:
              }"
            echo "Updated existing release $RELEASE_ID for $TAG"
          else
-            # Create new release
            curl -s -X POST "$BASE_URL/releases" \
              -H "Authorization: token $DEPLOY_TOKEN" \
              -H "Content-Type: application/json" \
@@ -6,50 +6,81 @@ on:
  pull_request:
    branches: [master, main]

+env:
+  NODE_VERSION: '22'
+
 jobs:
  lint-and-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
+      - uses: actions/setup-node@v4
        with:
-          node-version: '22'
+          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Generate Prisma client
-        run: npx prisma generate
-
-      - name: Lint
-        run: npm run lint
-
-      - name: Format check
-        run: npm run format:check
-
-      - name: Type check
-        run: npm run check
+      - run: npm ci
+      - run: npx prisma generate
+      - run: npm run lint
+      - run: npm run format:check
+      - run: npm run check

  test:
    runs-on: ubuntu-latest
    needs: lint-and-check
+    env:
+      # Deterministic test secrets so the env validator at module import doesn't trip.
+      JWT_SECRET: 'test-secret-must-be-at-least-32-characters-long-for-validation'
+      INTEGRATION_ENCRYPTION_KEY: 'integration-test-key-must-be-at-least-32-characters'
+      ORIGIN: 'http://localhost:3000'
+      DATABASE_URL: 'file:./test.db'
+      NODE_ENV: 'test'
+      RUN_SCHEDULERS: 'false'
    steps:
      - uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
+      - uses: actions/setup-node@v4
        with:
-          node-version: '22'
+          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
+      - run: npm ci
+      - run: npx prisma generate
+      - run: npx prisma migrate deploy
+      - run: npm test

-      - name: Install dependencies
-        run: npm ci
+  build:
+    runs-on: ubuntu-latest
+    needs: lint-and-check
+    env:
+      JWT_SECRET: 'build-secret-must-be-at-least-32-characters-long-for-validation'
+      INTEGRATION_ENCRYPTION_KEY: 'integration-build-key-must-be-at-least-32-characters'
+      DATABASE_URL: 'file:./build.db'
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: 'npm'
+      - run: npm ci
+      - run: npx prisma generate
+      - run: npm run build

-      - name: Generate Prisma client
-        run: npx prisma generate
+  docker-build:
+    runs-on: ubuntu-latest
+    needs: lint-and-check
+    steps:
+      - uses: actions/checkout@v4
+      - name: Smoke-test Dockerfile build
+        run: docker build -t web-app-launcher:ci-smoke --build-arg VERSION=ci .

-      - name: Run tests
-        run: npm test
+  audit:
+    runs-on: ubuntu-latest
+    needs: lint-and-check
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: 'npm'
+      - run: npm ci
+      # Production-only audit. devDeps regularly carry low-severity advisories
+      # we accept; only block on production-shipped CVEs.
+      - run: npm audit --omit=dev --audit-level=high