mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-26 11:49:16 +00:00
SaelixCode
ce50db0fde
SECURITY (critical fixes):
- Add authMiddleware to /api/system/console-token (was publicly accessible)
- Validate api_url on node create/update to prevent SSRF (rejects localhost/loopback)
- Add rate limiting (5 req/15 min/IP) to /api/auth/login and /api/auth/setup
- Fix path traversal in env_file resolution — absolute/escaping paths rejected
- Add stack name validation to GET routes (was only on PUT/POST)
- Add helmet security headers middleware
- Restrict CORS to FRONTEND_URL in production
PRODUCTION READINESS:
- Add GET /api/health public endpoint + HEALTHCHECK in Dockerfile
- Add SIGTERM/SIGINT graceful shutdown handler (drains connections, closes DB)
- Run container as non-root sencho user in Dockerfile
QUALITY:
- Fix 4 silent empty catch{} blocks in EditorLayout (now show toast.error)
- Connect ErrorBoundary to root App in main.tsx
- Replace WebSocket.Server with named WebSocketServer import (ESM compat)
TESTING (new automated test suite):
- Install Vitest; 38 backend tests across 4 suites covering validation utilities,
health endpoint, auth middleware, login flows, SSRF protection, and path traversal
- Extract isValidStackName/isValidRemoteUrl/isPathWithinBase to utils/validation.ts
- Playwright E2E scaffolding: auth, stacks, nodes specs + shared login helper
- CI: run Vitest + ESLint on every PR
80 lines
2.2 KiB
JSON
80 lines
2.2 KiB
JSON
{
|
|
"name": "sencho",
|
|
"version": "1.0.0",
|
|
"lockfileVersion": 3,
|
|
"requires": true,
|
|
"packages": {
|
|
"": {
|
|
"name": "sencho",
|
|
"version": "1.0.0",
|
|
"license": "ISC",
|
|
"devDependencies": {
|
|
"@playwright/test": "^1.58.2"
|
|
}
|
|
},
|
|
"node_modules/@playwright/test": {
|
|
"version": "1.58.2",
|
|
"resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.58.2.tgz",
|
|
"integrity": "sha512-akea+6bHYBBfA9uQqSYmlJXn61cTa+jbO87xVLCWbTqbWadRVmhxlXATaOjOgcBaWU4ePo0wB41KMFv3o35IXA==",
|
|
"dev": true,
|
|
"license": "Apache-2.0",
|
|
"dependencies": {
|
|
"playwright": "1.58.2"
|
|
},
|
|
"bin": {
|
|
"playwright": "cli.js"
|
|
},
|
|
"engines": {
|
|
"node": ">=18"
|
|
}
|
|
},
|
|
"node_modules/fsevents": {
|
|
"version": "2.3.2",
|
|
"resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
|
|
"integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
|
|
"dev": true,
|
|
"hasInstallScript": true,
|
|
"license": "MIT",
|
|
"optional": true,
|
|
"os": [
|
|
"darwin"
|
|
],
|
|
"engines": {
|
|
"node": "^8.16.0 || ^10.6.0 || >=11.0.0"
|
|
}
|
|
},
|
|
"node_modules/playwright": {
|
|
"version": "1.58.2",
|
|
"resolved": "https://registry.npmjs.org/playwright/-/playwright-1.58.2.tgz",
|
|
"integrity": "sha512-vA30H8Nvkq/cPBnNw4Q8TWz1EJyqgpuinBcHET0YVJVFldr8JDNiU9LaWAE1KqSkRYazuaBhTpB5ZzShOezQ6A==",
|
|
"dev": true,
|
|
"license": "Apache-2.0",
|
|
"dependencies": {
|
|
"playwright-core": "1.58.2"
|
|
},
|
|
"bin": {
|
|
"playwright": "cli.js"
|
|
},
|
|
"engines": {
|
|
"node": ">=18"
|
|
},
|
|
"optionalDependencies": {
|
|
"fsevents": "2.3.2"
|
|
}
|
|
},
|
|
"node_modules/playwright-core": {
|
|
"version": "1.58.2",
|
|
"resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.58.2.tgz",
|
|
"integrity": "sha512-yZkEtftgwS8CsfYo7nm0KE8jsvm6i/PTgVtB8DL726wNf6H2IMsDuxCpJj59KDaxCtSnrWan2AeDqM7JBaultg==",
|
|
"dev": true,
|
|
"license": "Apache-2.0",
|
|
"bin": {
|
|
"playwright-core": "cli.js"
|
|
},
|
|
"engines": {
|
|
"node": ">=18"
|
|
}
|
|
}
|
|
}
|
|
}
|