6023ebf9d0
- Custom SQLite task manager replacing TickTick wrapper - 73 tasks migrated from TickTick across 15 projects - RRULE recurrence engine with lazy materialization - Dashboard tasks widget (desktop sidebar + mobile card) - Tasks page with project tabs, add/edit/complete/delete - Security: locked ports to localhost, removed old containers - Gitea Actions runner configured and all 3 CI jobs passing - Fixed mobile overflow on dashboard cards - iOS Capacitor app shell (Second Brain) - Frontend/backend guide docs for adding new services - TickTick Google Calendar sync re-authorized Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
105 lines
4.2 KiB
Plaintext
105 lines
4.2 KiB
Plaintext
Platform Security & Readiness Remediation — Final Status
|
||
=========================================================
|
||
Date: 2026-03-29
|
||
|
||
ISSUE TRACKER: Gitea yusiboyz/platform Issues #1–#10
|
||
|
||
COMPLETED ISSUES
|
||
================
|
||
|
||
#2 Auth Boundary: Registration and Default Credentials
|
||
- /api/auth/register disabled (403)
|
||
- Gateway admin seeded from ADMIN_USERNAME/ADMIN_PASSWORD env vars only
|
||
- Trips USERNAME/PASSWORD have no default fallback
|
||
- Fitness user seed requires env vars (no "changeme" default)
|
||
- All passwords use bcrypt
|
||
|
||
#3 Trips Sharing Security
|
||
- handle_share_api enforces password via X-Share-Password header + bcrypt
|
||
- share_password stored as bcrypt hash
|
||
- All plaintext password logging removed
|
||
- Existing plaintext passwords invalidated by migration
|
||
- Dead hash_password function removed
|
||
|
||
#4 Fitness Authorization
|
||
- All user_id query params enforced to authenticated user's own ID
|
||
- /api/users returns only current user
|
||
- Wildcard CORS removed
|
||
|
||
#5 Gateway Trust Model
|
||
- Inventory and budget require API keys (X-API-Key middleware)
|
||
- Token validation uses protected endpoints per service type
|
||
- /debug-nocodb removed from inventory
|
||
- /test removed from inventory
|
||
- NocoDB search filter sanitized (strips operator injection chars)
|
||
- SERVICE_LEVEL_AUTH renamed to GATEWAY_KEY_SERVICES
|
||
- Trust model documented in docs/trust-model.md
|
||
- Per-user vs gateway-key services clearly distinguished
|
||
- Known limitations documented (no per-user isolation on shared services)
|
||
|
||
#6 Repository Hygiene
|
||
- No .env or .db files tracked in git
|
||
- .gitignore covers: .env*, *.db*, services/**/.env, data/, test-results/
|
||
- .env.example updated with all current env vars (no secrets)
|
||
|
||
#7 Transport Security
|
||
- Gateway: _internal_ssl_ctx removed entirely (internal services use plain HTTP)
|
||
- Gateway: ssl import removed from config.py
|
||
- Gateway: proxy.py uses urlopen() without context parameter
|
||
- Gateway: logout cookie includes HttpOnly, Secure, SameSite=Lax
|
||
- Gateway: image proxy uses default TLS + domain allowlist + content-type validation
|
||
- Trips: all 5 CERT_NONE sites removed (OpenAI, Gemini, Google Places, Geocode)
|
||
- Inventory: permissive cors() removed
|
||
- Budget: permissive cors() removed
|
||
|
||
#9 Performance Hardening
|
||
- Inventory /issues: server-side NocoDB WHERE filter (no full scan)
|
||
- Inventory /needs-review-count: server-side filter + pageInfo.totalRows
|
||
- Budget /summary: 1-minute cache
|
||
- Budget /transactions/recent: 30-second cache
|
||
- Budget /uncategorized-count: 2-minute cache
|
||
- Budget buildLookups: 2-minute cache
|
||
- Gateway /api/dashboard: 30-second per-user cache
|
||
- Actual Budget per-account API constraint documented
|
||
|
||
#10 Deployment Hardening
|
||
- All 6 containers run as non-root (appuser/node)
|
||
- Health checks on gateway, trips, fitness, inventory, budget, frontend
|
||
- PYTHONUNBUFFERED=1 on all Python services
|
||
- Trips Dockerfile only copies server.py (not whole context)
|
||
- Frontend uses multi-stage build
|
||
|
||
PARTIAL ISSUES
|
||
==============
|
||
|
||
#8 Dependency Security
|
||
- Budget path-to-regexp vulnerability fixed
|
||
- .gitea/workflows/security.yml committed:
|
||
- dependency-audit (npm audit for budget + frontend)
|
||
- secret-scanning (tracked .env/.db, hardcoded patterns)
|
||
- dockerfile-lint (USER instruction, HEALTHCHECK)
|
||
- Runner dependency documented in .gitea/README.md
|
||
- BLOCKED: Requires Gitea Actions runner to be configured operationally
|
||
|
||
OTHER FIXES (not tied to specific issues)
|
||
- Disconnect confirmation dialog added to Settings
|
||
- App nav visibility documented as cosmetic-only
|
||
- Stale /test startup log removed from inventory
|
||
- Frontend cookie vulnerability (4 low-severity) documented as not safe to fix
|
||
(requires breaking @sveltejs/kit downgrade)
|
||
|
||
MANUAL OPS ACTIONS REQUIRED
|
||
============================
|
||
1. Configure a Gitea Actions runner to activate CI workflows
|
||
2. Store admin password securely (set via ADMIN_PASSWORD env var)
|
||
3. Clean up local untracked .env files with real credentials if needed
|
||
4. Monitor @sveltejs/kit for a non-breaking cookie fix in future releases
|
||
|
||
ARCHITECTURE REFERENCE
|
||
======================
|
||
- Trust model: docs/trust-model.md
|
||
- CI workflows: .gitea/workflows/security.yml
|
||
- Runner setup: .gitea/README.md
|
||
- Design system: frontend-v2/DESIGN_SYSTEM.md
|
||
- Env var reference: .env.example
|