alexei.dolgolyov
f1cfb61d13
Security hardening (CRITICAL/HIGH from production-readiness audit):
- Require strong JWT_SECRET + separate INTEGRATION_ENCRYPTION_KEY at boot;
refuse placeholder defaults. Integration key now derived via HKDF.
- SSRF guard (src/lib/server/utils/safeFetch.ts): DNS-resolves and rejects
RFC1918/loopback/link-local/IPv4-mapped IPv6/decimal-IP/cloud-metadata.
Manual redirect handling re-validates each 3xx Location hop. Applied to
healthcheck, RSS, calendar, metric, system-stats, camera, notifications,
discovery, apps/preview, and all integration clients.
- API tokens, session refresh tokens, invite tokens, password-reset tokens
switched from bcrypt to sha256 with @unique indexed lookup (O(1) instead
of O(N) bcrypt-compares; eliminates a trivial DoS).
- Refresh-token reuse detection via Session.previousTokenHash.
- Permission checks on App PATCH/DELETE and Widget/Section endpoints.
- /api/integrations/alerts now requires auth.
- SVG uploads sanitized through DOMPurify (svg profile, scheme allow-list).
- Custom CSS sanitizer + selector scoping (decodes CSS unicode escapes
before pattern match, drops forbidden at-rules incl. @import without
whitespace, strips dangerous url() args). Scoped to .custom-css-scope.
- Backup restore validates SQLite magic header, takes a safety snapshot,
uses atomic rename, re-applies pragmas.
- SQLite WAL + busy_timeout + foreign_keys + synchronous=NORMAL at startup.
- Healthcheck scheduler was dead code; wired in hooks.server.ts with
HMR-safe singleton, concurrency cap, overlap prevention, retention jobs
for AppClick/Notification/AuditLog. Composite indexes added on hot paths.
- Security headers (CSP, HSTS-on-https, X-Frame-Options, Permissions-Policy)
emitted on every response.
- Account-enumeration mitigation on login (dummy bcrypt on no-user/oauth
branches) + rate limiting on login/register/onboarding/refresh/invite/
password-reset.
- OAuth callback sanitizes IdP error_description before echoing.
New features:
- Custom +error.svelte pages (root + boards + admin) via shared
ErrorState component. Inverted hierarchy (status as label, title as hero).
- /forgot-password + /reset-password + admin-mediated /admin/password-resets
page. SHA256 tokens, 24h TTL, all sessions revoked on apply.
- /invite page for manual invite-token redemption.
- /api/metrics Prometheus exposition with optional METRICS_TOKEN bearer
auth. Counters for login/healthcheck/notification/integration; gauges
for users/boards/apps + per-status app counts.
- Webhook HMAC-SHA256 signing for HTTP notification channels (optional
shared secret + configurable signature header, default X-Signature-256).
- PATCH /api/users/me/password for self-service password change.
- Persistent uploads at /app/data/uploads with served-from-volume handler
at /uploads/[...path]. SVGs served with CSP: sandbox.
- /api/health does a DB ping; returns 503 on disconnect.
- Public /status filtered to guest-accessible-board apps when unauthenticated.
- Audit log coverage: LOGIN_SUCCESS/FAILED, LOGOUT, OAUTH_LOGIN,
OAUTH_USER_PROVISIONED, SESSION_REVOKED, API_TOKEN_*, INVITE_*,
APP_UPDATED, PASSWORD_CHANGED, PASSWORD_RESET_*.
Performance:
- Board page: removed double findAll() over-fetch; include links + appTags
in board query; widgets lazy-loaded via dynamic imports (marked,
DOMPurify, hls.js, integration renderers).
- uptimeService.getAllAppsUptime: single batched query instead of N+1.
- 30s in-memory user-locals cache; invalidated on user mutation.
- pruneOldStatuses: single window-function DELETE instead of N+1.
Code quality:
- Typed error classes (NotFoundError, PermissionError, RateLimitError,
IntegrationError) with toHttpError mapper.
- Locals.user shape exposes avatarUrl and narrows role via guard.
- App input types derived from Zod schemas via z.infer.
- 274 tests passing (up from 212); 62 new tests covering SSRF guard,
CSS sanitizer, SVG sanitizer, rate limiter.
CI / Docker / config:
- Test workflow adds build, docker-build, audit jobs. Release workflow
uses buildx multi-arch (amd64+arm64) with provenance + SBOM.
- Dockerfile uses tini, multi-stage prune, persistent uploads dir, single
prisma migrate deploy (no destructive db push fallback).
- docker-compose: JWT_SECRET + INTEGRATION_ENCRYPTION_KEY required at
startup, log rotation, resource limits.
- README documents breaking-change upgrade path.
Bug fixes from UI/UX review:
- ~55 missing i18n keys added to en/ru (auth flows, error pages, admin
nav, register invite banner, settings.card_style).
- Hardcoded English on login replaced with $t('auth.remember_me').
- Admin nav uses i18n keys; mobile horizontal-scroll layout.
- Page <title> tags standardized.
- Password-resets: separated error/info/success surfaces, ConfirmDialog
replaces window.confirm.
- Auth pages have matching lucide icon badges.
- Webhook secret has eye toggle and monospace input.
- text-green-500 → text-emerald-500 to match codebase convention.
Pre-existing CI lint failures cleaned up (31 errors → 0): each-key
attributes added, unused-svelte-ignore comments removed, two any casts
typed, dead skeleton components removed, /boards/[id]/edit redirect to
inline edit mode.
Tests: 274 / 274 passing
Type check: 0 errors / 0 warnings
Build: green
78 lines
2.1 KiB
JSON
78 lines
2.1 KiB
JSON
{
|
|
"name": "web-app-launcher",
|
|
"version": "0.1.0",
|
|
"private": true,
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "vite dev",
|
|
"build": "vite build",
|
|
"preview": "vite preview",
|
|
"check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
|
|
"check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest",
|
|
"test:coverage": "vitest run --coverage",
|
|
"lint": "eslint .",
|
|
"format": "prettier --write .",
|
|
"format:check": "prettier --check .",
|
|
"audit:prod": "npm audit --omit=dev --audit-level=high",
|
|
"db:generate": "prisma generate",
|
|
"db:push": "prisma db push",
|
|
"db:migrate": "prisma migrate dev",
|
|
"db:studio": "prisma studio"
|
|
},
|
|
"dependencies": {
|
|
"@prisma/client": "^6.2.0",
|
|
"@sveltejs/adapter-node": "^5.2.0",
|
|
"@sveltejs/kit": "^2.16.0",
|
|
"bcryptjs": "^2.4.3",
|
|
"bits-ui": "^1.3.0",
|
|
"clsx": "^2.1.0",
|
|
"hls.js": "^1.6.15",
|
|
"isomorphic-dompurify": "^3.7.1",
|
|
"jsonwebtoken": "^9.0.2",
|
|
"lucide-svelte": "^0.469.0",
|
|
"marked": "^17.0.5",
|
|
"node-cron": "^3.0.3",
|
|
"openid-client": "^6.8.2",
|
|
"prisma": "^6.2.0",
|
|
"simple-icons": "^13.0.0",
|
|
"svelte": "^5.0.0",
|
|
"svelte-dnd-action": "^0.9.69",
|
|
"svelte-i18n": "^4.0.1",
|
|
"sveltekit-superforms": "^2.22.0",
|
|
"tailwind-merge": "^2.6.0",
|
|
"zod": "^3.24.0"
|
|
},
|
|
"prisma": {
|
|
"seed": "npx tsx prisma/seed.ts"
|
|
},
|
|
"devDependencies": {
|
|
"@eslint/js": "^9.18.0",
|
|
"@sveltejs/package": "^2.3.0",
|
|
"@sveltejs/vite-plugin-svelte": "^5.0.0",
|
|
"@tailwindcss/typography": "^0.5.19",
|
|
"@tailwindcss/vite": "^4.0.0",
|
|
"@testing-library/svelte": "^5.2.0",
|
|
"@types/bcryptjs": "^2.4.6",
|
|
"@types/jsonwebtoken": "^9.0.7",
|
|
"@types/marked": "^6.0.0",
|
|
"@types/node-cron": "^3.0.11",
|
|
"eslint": "^9.18.0",
|
|
"eslint-config-prettier": "^10.0.0",
|
|
"eslint-plugin-svelte": "^3.0.0",
|
|
"globals": "^16.0.0",
|
|
"prettier": "^3.4.0",
|
|
"prettier-plugin-svelte": "^3.3.0",
|
|
"prettier-plugin-tailwindcss": "^0.6.0",
|
|
"svelte-check": "^4.0.0",
|
|
"tailwindcss": "^4.0.0",
|
|
"tsx": "^4.21.0",
|
|
"tw-animate-css": "^1.2.0",
|
|
"typescript": "^5.7.0",
|
|
"typescript-eslint": "^8.20.0",
|
|
"vite": "^6.0.0",
|
|
"vitest": "^3.0.0"
|
|
}
|
|
}
|