security: pre-release hardening, automated testing, and production readiness

SECURITY (critical fixes): - Add authMiddleware to /api/system/console-token (was publicly accessible) - Validate api_url on node create/update to prevent SSRF (rejects localhost/loopback) - Add rate limiting (5 req/15 min/IP) to /api/auth/login and /api/auth/setup - Fix path traversal in env_file resolution — absolute/escaping paths rejected - Add stack name validation to GET routes (was only on PUT/POST) - Add helmet security headers middleware - Restrict CORS to FRONTEND_URL in production PRODUCTION READINESS: - Add GET /api/health public endpoint + HEALTHCHECK in Dockerfile - Add SIGTERM/SIGINT graceful shutdown handler (drains connections, closes DB) - Run container as non-root sencho user in Dockerfile QUALITY: - Fix 4 silent empty catch{} blocks in EditorLayout (now show toast.error) - Connect ErrorBoundary to root App in main.tsx - Replace WebSocket.Server with named WebSocketServer import (ESM compat) TESTING (new automated test suite): - Install Vitest; 38 backend tests across 4 suites covering validation utilities, health endpoint, auth middleware, login flows, SSRF protection, and path traversal - Extract isValidStackName/isValidRemoteUrl/isPathWithinBase to utils/validation.ts - Playwright E2E scaffolding: auth, stacks, nodes specs + shared login helper - CI: run Vitest + ESLint on every PR
2026-08-18 14:33:19 +00:00 · 2026-03-21 21:59:44 -04:00
parent 94d6c8fc0f
commit ce50db0fde
22 changed files with 2445 additions and 30 deletions
@@ -0,0 +1,49 @@
+/**
+ * Authentication E2E tests.
+ * Tests login, logout, and unauthenticated redirect.
+ */
+import { test, expect } from '@playwright/test';
+import { loginAs, TEST_USERNAME, TEST_PASSWORD } from './helpers';
+
+test.describe('Authentication', () => {
+  test('login with valid credentials shows the dashboard', async ({ page }) => {
+    await loginAs(page);
+    // Should see the main editor/dashboard — not a login page
+    await expect(page).not.toHaveURL(/login/i);
+    await expect(page.getByRole('main')).toBeVisible();
+  });
+
+  test('login with wrong password shows an error', async ({ page }) => {
+    await page.goto('/');
+    // Skip setup if needed
+    const isSetup = await page.getByRole('heading', { name: /setup/i }).isVisible().catch(() => false);
+    if (isSetup) {
+      // Must complete setup before we can test wrong password
+      await loginAs(page);
+      await page.goto('/login');
+    }
+
+    await page.getByLabel(/username/i).fill(TEST_USERNAME);
+    await page.getByLabel(/password/i).fill('definitly-wrong-password');
+    await page.getByRole('button', { name: /login|sign in/i }).click();
+
+    await expect(page.getByText(/invalid|incorrect|wrong/i)).toBeVisible();
+  });
+
+  test('visiting a protected page without auth redirects to login', async ({ page }) => {
+    // Clear cookies to simulate logged-out state
+    await page.context().clearCookies();
+    await page.goto('/');
+    await expect(page).toHaveURL(/login|setup/i);
+  });
+
+  test('logout redirects to login', async ({ page }) => {
+    await loginAs(page);
+    // Find and click the logout button (varies by UI — adjust selector as needed)
+    const logoutBtn = page.getByRole('button', { name: /logout|sign out/i });
+    if (await logoutBtn.isVisible()) {
+      await logoutBtn.click();
+      await expect(page).toHaveURL(/login/i);
+    }
+  });
+});
@@ -0,0 +1,36 @@
+/**
+ * Shared helpers for E2E tests.
+ *
+ * The dev backend must be running at localhost:3000 and seeded via the setup flow,
+ * OR use a fixed set of test credentials.
+ */
+import { Page, expect } from '@playwright/test';
+
+export const TEST_USERNAME = process.env.E2E_USERNAME ?? 'admin';
+export const TEST_PASSWORD = process.env.E2E_PASSWORD ?? 'password123';
+
+/** Navigate to app, complete setup if needed, then log in. */
+export async function loginAs(page: Page, username = TEST_USERNAME, password = TEST_PASSWORD) {
+  await page.goto('/');
+
+  // If setup page is shown, complete it first
+  const isSetup = await page.getByRole('heading', { name: /setup/i }).isVisible().catch(() => false);
+  if (isSetup) {
+    await page.getByLabel(/username/i).fill(username);
+    await page.getByLabel(/^password$/i).fill(password);
+    const confirmInput = page.getByLabel(/confirm password/i);
+    if (await confirmInput.isVisible()) await confirmInput.fill(password);
+    await page.getByRole('button', { name: /create account|setup|submit/i }).click();
+    await page.waitForURL(/login|dashboard|\//);
+  }
+
+  // Login if redirected to login page
+  const isLogin = await page.getByRole('heading', { name: /login|sign in/i }).isVisible().catch(() => false);
+  if (isLogin) {
+    await page.getByLabel(/username/i).fill(username);
+    await page.getByLabel(/password/i).fill(password);
+    await page.getByRole('button', { name: /login|sign in/i }).click();
+    // Wait for the dashboard to load
+    await expect(page.getByRole('main')).toBeVisible({ timeout: 10_000 });
+  }
+}
@@ -0,0 +1,54 @@
+/**
+ * Node management E2E tests.
+ * Tests the SSRF validation we added (C2 fix) is surfaced in the UI.
+ */
+import { test, expect } from '@playwright/test';
+import { loginAs } from './helpers';
+
+test.describe('Node management', () => {
+  test.beforeEach(async ({ page }) => {
+    await loginAs(page);
+    // Navigate to the nodes section (Settings / Node Manager)
+    const nodesBtn = page.getByRole('button', { name: /nodes|manage nodes|settings/i }).first();
+    if (await nodesBtn.isVisible()) await nodesBtn.click();
+  });
+
+  test('adding a node with localhost api_url shows a validation error', async ({ page }) => {
+    // Open "add node" dialog
+    const addBtn = page.getByRole('button', { name: /add node|new node|\+/i });
+    if (!await addBtn.isVisible()) {
+      test.skip();
+      return;
+    }
+    await addBtn.click();
+
+    await page.getByLabel(/node name/i).fill('bad-node');
+    // Select "remote" type if there's a type selector
+    const typeSelect = page.getByLabel(/type/i);
+    if (await typeSelect.isVisible()) await typeSelect.selectOption('remote');
+
+    await page.getByLabel(/api url/i).fill('http://localhost:6379');
+    await page.getByRole('button', { name: /add|save|create/i }).click();
+
+    // Should see an error about loopback/localhost
+    await expect(page.getByText(/loopback|localhost/i)).toBeVisible({ timeout: 3_000 });
+  });
+
+  test('adding a node with an invalid URL shows an error', async ({ page }) => {
+    const addBtn = page.getByRole('button', { name: /add node|new node|\+/i });
+    if (!await addBtn.isVisible()) {
+      test.skip();
+      return;
+    }
+    await addBtn.click();
+
+    await page.getByLabel(/node name/i).fill('bad-url-node');
+    const typeSelect = page.getByLabel(/type/i);
+    if (await typeSelect.isVisible()) await typeSelect.selectOption('remote');
+
+    await page.getByLabel(/api url/i).fill('not-a-url-at-all');
+    await page.getByRole('button', { name: /add|save|create/i }).click();
+
+    await expect(page.getByText(/valid url|invalid url|url/i)).toBeVisible({ timeout: 3_000 });
+  });
+});
@@ -0,0 +1,71 @@
+/**
+ * Stack management E2E tests — happy path CRUD.
+ *
+ * NOTE: These tests require Docker Compose to be installed on the host, because
+ * actual stack operations (up/down) spawn docker-compose processes.
+ * The create/edit/delete tests work without Docker being connected.
+ */
+import { test, expect } from '@playwright/test';
+import { loginAs } from './helpers';
+
+const TEST_STACK = `e2e-test-stack-${Date.now()}`;
+const SIMPLE_COMPOSE = `services:\n  web:\n    image: nginx:alpine\n`;
+
+test.describe('Stack management', () => {
+  test.beforeEach(async ({ page }) => {
+    await loginAs(page);
+  });
+
+  test('create a new stack', async ({ page }) => {
+    // Find and click the "new stack" / "+" button
+    const newStackBtn = page.getByRole('button', { name: /new stack|create stack|\+/i }).first();
+    await newStackBtn.click();
+
+    // Fill in the stack name in the dialog
+    const nameInput = page.getByLabel(/stack name/i);
+    await nameInput.fill(TEST_STACK);
+
+    // Confirm
+    await page.getByRole('button', { name: /create|confirm|ok/i }).click();
+
+    // Stack should now appear in the list
+    await expect(page.getByText(TEST_STACK)).toBeVisible({ timeout: 5_000 });
+  });
+
+  test('edit the compose file of an existing stack', async ({ page }) => {
+    // Click on the test stack in the sidebar/list
+    await page.getByText(TEST_STACK).click();
+
+    // Wait for the editor to appear and type some content
+    const editor = page.locator('.monaco-editor').first();
+    await editor.click();
+    await page.keyboard.selectAll();
+    await page.keyboard.type(SIMPLE_COMPOSE);
+
+    // Save
+    const saveBtn = page.getByRole('button', { name: /save/i });
+    await saveBtn.click();
+
+    // Should show success indication (no error toast)
+    await expect(page.getByText(/error/i)).not.toBeVisible({ timeout: 3_000 }).catch(() => {
+      // If error text is already not there that's fine
+    });
+  });
+
+  test('delete the test stack', async ({ page }) => {
+    // Find the test stack and open its context menu / delete button
+    const stackRow = page.locator(`[data-testid="stack-${TEST_STACK}"], li:has-text("${TEST_STACK}")`).first();
+
+    // Hover to reveal action buttons
+    await stackRow.hover();
+    const deleteBtn = stackRow.getByRole('button', { name: /delete|remove/i });
+    await deleteBtn.click();
+
+    // Confirm deletion in dialog
+    const confirmBtn = page.getByRole('button', { name: /confirm|delete|yes/i });
+    if (await confirmBtn.isVisible()) await confirmBtn.click();
+
+    // Stack should no longer appear
+    await expect(page.getByText(TEST_STACK)).not.toBeVisible({ timeout: 5_000 });
+  });
+});