senlinai/agent
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: complete audit security and frontend gaps

Browse Source
This commit is contained in:
yanweidong
2026-07-18 18:02:29 +08:00
parent 79feb20688
commit b7a84d31ea
28 changed files with 576 additions and 88 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
docs/superpowers/plans/2026-07-18-project-workbench-mvp.md
View File

@@ -676,3 +676,17 @@ Verification evidence from the latest run:
- `apps/web`: `npm run build` passed.
- `apps/web`: `npx playwright test` passed.
- `apps/desktop`: `npm run build` is blocked before compilation by incomplete Rust stable toolchain.
## 2026-07-18 Full Audit Follow-Up
- [x] Backend API startup now wires PostgreSQL, AutoMigrate, project routes, and inbox routes through `/api`.
- [x] Auth sessions are signed and expiring; legacy forgeable `user:<id>` tokens are rejected.
- [x] Project and inbox HTTP handlers use the authenticated bearer-token user instead of a hard-coded user ID.
- [x] Project dashboard reads are owner-scoped before counters are returned.
- [x] Search now covers projects, tasks, notes, sources, inbox items, and AI sessions.
- [x] Inbox confirmation keeps provenance through `source_inbox_item_id` on generated tasks, notes, and sources.
- [x] Task sharing rejects note/source objects from a different project.
- [x] AI user keys are encrypted at rest and gateway rate-limit checks are covered by tests.
- [x] Svelte web client calls the backend `/api` prefix, passes type checking, and has Playwright coverage for inbox suggestion confirmation.
- [x] Current Markdown docs no longer include the live PostgreSQL test credential; integration tests must receive it through `DATABASE_URL`.
- [ ] Desktop binary build remains blocked on this machine because Cargo/Rust is not available to the shell. Install a complete Rust stable toolchain, then rerun `npm run build` from `apps/desktop`.