senlinai/agent
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: complete audit security and frontend gaps

Browse Source
This commit is contained in:
yanweidong
2026-07-18 18:02:29 +08:00
parent 79feb20688
commit b7a84d31ea
28 changed files with 576 additions and 88 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
docs/mvp-verification.md
View File

@@ -32,12 +32,13 @@ Run:
```powershell
Set-Location apps/web
npx tsc --noEmit -p tsconfig.app.json
npm test -- --run
npm run build
npx playwright test
```
Expected: component tests, production build, and smoke test pass.
Expected: TypeScript check, component tests, production build, and Playwright smoke/E2E tests pass.
## Desktop
@@ -54,8 +55,29 @@ Expected: Tauri desktop bundle builds when Rust/Cargo is installed and the stabl
Current machine status:
- `rustup` was installed through winget.
- The stable toolchain install repeatedly timed out and currently reports `Missing manifest in toolchain 'stable-x86_64-pc-windows-msvc'`.
- Desktop verification remains blocked until `rustup toolchain install stable-x86_64-pc-windows-msvc --profile minimal --force` completes successfully.
- The latest desktop build attempt fails before project compilation because `cargo` is not available on PATH: `program not found`.
- Desktop verification remains blocked until Rust/Cargo is installed and visible to the shell. Then run `npm run build` from `apps/desktop`.
## Latest Audit Verification
Last audited: 2026-07-18.
- `backend`: `go test ./... -v` passed.
- `apps/web`: `npx tsc --noEmit -p tsconfig.app.json` passed.
- `apps/web`: `npm test -- --run` passed.
- `apps/web`: `npm run build` passed.
- `apps/web`: `npx playwright test` passed.
- `apps/desktop`: `npm run build` blocked by missing Cargo/Rust toolchain on the current machine.
Audit fixes included:
- Signed expiring auth session tokens replaced forgeable `user:<id>` tokens.
- Project and inbox HTTP handlers now read the authenticated user from bearer middleware instead of hard-coding user `1`.
- Project dashboard loading now checks project ownership before returning counters.
- Inbox confirmation preserves provenance with `source_inbox_item_id` on generated tasks, notes, and sources.
- Task sharing now rejects note/source links from another project.
- AI user keys are encrypted before storage, decrypted on selection, and can be checked with a per-user action rate limit.
- Web API calls now use the backend `/api` prefix and the Svelte shell includes an inbox suggestion confirmation E2E path.
## Manual MVP Flow