senlinai/agent
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: complete audit security and frontend gaps

Browse Source
This commit is contained in:
yanweidong
2026-07-18 18:02:29 +08:00
parent 79feb20688
commit b7a84d31ea
28 changed files with 576 additions and 88 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
docs/mvp-verification.md
View File

@@ -32,12 +32,13 @@ Run:
```powershell
Set-Location apps/web
npx tsc --noEmit -p tsconfig.app.json
npm test -- --run
npm run build
npx playwright test
```
Expected: component tests, production build, and smoke test pass.
Expected: TypeScript check, component tests, production build, and Playwright smoke/E2E tests pass.
## Desktop
@@ -54,8 +55,29 @@ Expected: Tauri desktop bundle builds when Rust/Cargo is installed and the stabl
Current machine status:
- `rustup` was installed through winget.
- The stable toolchain install repeatedly timed out and currently reports `Missing manifest in toolchain 'stable-x86_64-pc-windows-msvc'`.
- Desktop verification remains blocked until `rustup toolchain install stable-x86_64-pc-windows-msvc --profile minimal --force` completes successfully.
- The latest desktop build attempt fails before project compilation because `cargo` is not available on PATH: `program not found`.
- Desktop verification remains blocked until Rust/Cargo is installed and visible to the shell. Then run `npm run build` from `apps/desktop`.
## Latest Audit Verification
Last audited: 2026-07-18.
- `backend`: `go test ./... -v` passed.
- `apps/web`: `npx tsc --noEmit -p tsconfig.app.json` passed.
- `apps/web`: `npm test -- --run` passed.
- `apps/web`: `npm run build` passed.
- `apps/web`: `npx playwright test` passed.
- `apps/desktop`: `npm run build` blocked by missing Cargo/Rust toolchain on the current machine.
Audit fixes included:
- Signed expiring auth session tokens replaced forgeable `user:<id>` tokens.
- Project and inbox HTTP handlers now read the authenticated user from bearer middleware instead of hard-coding user `1`.
- Project dashboard loading now checks project ownership before returning counters.
- Inbox confirmation preserves provenance with `source_inbox_item_id` on generated tasks, notes, and sources.
- Task sharing now rejects note/source links from another project.
- AI user keys are encrypted before storage, decrypted on selection, and can be checked with a per-user action rate limit.
- Web API calls now use the backend `/api` prefix and the Svelte shell includes an inbox suggestion confirmation E2E path.
## Manual MVP Flow

14
docs/superpowers/plans/2026-07-18-project-workbench-mvp.md
View File

@@ -676,3 +676,17 @@ Verification evidence from the latest run:
- `apps/web`: `npm run build` passed.
- `apps/web`: `npx playwright test` passed.
- `apps/desktop`: `npm run build` is blocked before compilation by incomplete Rust stable toolchain.
## 2026-07-18 Full Audit Follow-Up
- [x] Backend API startup now wires PostgreSQL, AutoMigrate, project routes, and inbox routes through `/api`.
- [x] Auth sessions are signed and expiring; legacy forgeable `user:<id>` tokens are rejected.
- [x] Project and inbox HTTP handlers use the authenticated bearer-token user instead of a hard-coded user ID.
- [x] Project dashboard reads are owner-scoped before counters are returned.
- [x] Search now covers projects, tasks, notes, sources, inbox items, and AI sessions.
- [x] Inbox confirmation keeps provenance through `source_inbox_item_id` on generated tasks, notes, and sources.
- [x] Task sharing rejects note/source objects from a different project.
- [x] AI user keys are encrypted at rest and gateway rate-limit checks are covered by tests.
- [x] Svelte web client calls the backend `/api` prefix, passes type checking, and has Playwright coverage for inbox suggestion confirmation.
- [x] Current Markdown docs no longer include the live PostgreSQL test credential; integration tests must receive it through `DATABASE_URL`.
- [ ] Desktop binary build remains blocked on this machine because Cargo/Rust is not available to the shell. Install a complete Rust stable toolchain, then rerun `npm run build` from `apps/desktop`.