mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-08-11 03:06:54 +00:00
SaelixCode
ce50db0fde
SECURITY (critical fixes):
- Add authMiddleware to /api/system/console-token (was publicly accessible)
- Validate api_url on node create/update to prevent SSRF (rejects localhost/loopback)
- Add rate limiting (5 req/15 min/IP) to /api/auth/login and /api/auth/setup
- Fix path traversal in env_file resolution — absolute/escaping paths rejected
- Add stack name validation to GET routes (was only on PUT/POST)
- Add helmet security headers middleware
- Restrict CORS to FRONTEND_URL in production
PRODUCTION READINESS:
- Add GET /api/health public endpoint + HEALTHCHECK in Dockerfile
- Add SIGTERM/SIGINT graceful shutdown handler (drains connections, closes DB)
- Run container as non-root sencho user in Dockerfile
QUALITY:
- Fix 4 silent empty catch{} blocks in EditorLayout (now show toast.error)
- Connect ErrorBoundary to root App in main.tsx
- Replace WebSocket.Server with named WebSocketServer import (ESM compat)
TESTING (new automated test suite):
- Install Vitest; 38 backend tests across 4 suites covering validation utilities,
health endpoint, auth middleware, login flows, SSRF protection, and path traversal
- Extract isValidStackName/isValidRemoteUrl/isPathWithinBase to utils/validation.ts
- Playwright E2E scaffolding: auth, stacks, nodes specs + shared login helper
- CI: run Vitest + ESLint on every PR
37 lines
1.5 KiB
TypeScript
37 lines
1.5 KiB
TypeScript
/**
|
|
* Shared helpers for E2E tests.
|
|
*
|
|
* The dev backend must be running at localhost:3000 and seeded via the setup flow,
|
|
* OR use a fixed set of test credentials.
|
|
*/
|
|
import { Page, expect } from '@playwright/test';
|
|
|
|
export const TEST_USERNAME = process.env.E2E_USERNAME ?? 'admin';
|
|
export const TEST_PASSWORD = process.env.E2E_PASSWORD ?? 'password123';
|
|
|
|
/** Navigate to app, complete setup if needed, then log in. */
|
|
export async function loginAs(page: Page, username = TEST_USERNAME, password = TEST_PASSWORD) {
|
|
await page.goto('/');
|
|
|
|
// If setup page is shown, complete it first
|
|
const isSetup = await page.getByRole('heading', { name: /setup/i }).isVisible().catch(() => false);
|
|
if (isSetup) {
|
|
await page.getByLabel(/username/i).fill(username);
|
|
await page.getByLabel(/^password$/i).fill(password);
|
|
const confirmInput = page.getByLabel(/confirm password/i);
|
|
if (await confirmInput.isVisible()) await confirmInput.fill(password);
|
|
await page.getByRole('button', { name: /create account|setup|submit/i }).click();
|
|
await page.waitForURL(/login|dashboard|\//);
|
|
}
|
|
|
|
// Login if redirected to login page
|
|
const isLogin = await page.getByRole('heading', { name: /login|sign in/i }).isVisible().catch(() => false);
|
|
if (isLogin) {
|
|
await page.getByLabel(/username/i).fill(username);
|
|
await page.getByLabel(/password/i).fill(password);
|
|
await page.getByRole('button', { name: /login|sign in/i }).click();
|
|
// Wait for the dashboard to load
|
|
await expect(page.getByRole('main')).toBeVisible({ timeout: 10_000 });
|
|
}
|
|
}
|