Full code-review remediation: security (P0–P1), maintainability (P2), quality systems (P3) - #13
Merged
Merged
Conversation
… maintainability, quality systems) Implements the complete remediation roadmap from the technical audit in CODE_REVIEW.md (all 5 Criticals, 12 Majors, P3 quality systems), plus the pre-review design-system fixes and the Unsplash->Pexels codemod. Phase 0 — Stop the bleeding: - C3: GitHub webhook HMAC (timing-safe, raw body); unknown repoIds rejected - C2: client identity headers untrusted; constant-time cat_live_ API-key allowlist - C1: /api/payments/verify fails closed; payment webhooks HMAC-verified - C4: /api/state/sync* 401 without a verified token - C5: SSRF DNS pinning (anti-rebinding), fail-closed, TLS verification on Phase 1 — Structural hardening: - firebase-admin ID-token verification; tiers server-derived only - CSP: production drops 'unsafe-inline' (inline-script hashing), no 'unsafe-eval' - per-route body limits + zod validation (telemetry/engines/state) - root + route error boundaries; JSON-LD escaping Phase 2 — Maintainability: - server.ts (2,958 lines) decomposed into server/app.ts + routes/* + core/* - dependency cleanup (dup animation libs, dead editor stack, orphans) - strict: true with 0 tsc errors Phase 3 — Quality systems: - pino structured logging + request IDs + redaction (server); client logger facade -> validated /api/client-logs sink; 43 files off console.* - server-route suite: 168 tests total incl. all Critical flows; coverage gate server/** >=70% lines (72.06%), 94% functions; fixed webhookSecret leak found by the suite (toPublicRepo redaction) - README + docs/ARCHITECTURE.md + docs/ENGINES.md (python-engines decision record; Firebase web config public-by-design note) - bundle-budget ratchet (check:bundle) + Lighthouse config NOTE: .github/workflows/* (CI gate with hard tsc typecheck + Lighthouse job) are authored locally and will follow in an immediate follow-up commit — the GitHub App token requires the 'workflows' permission to push workflow files. Verification: tsc strict 0 | eslint 0 warnings | vitest 168/168 | build ~12s | bundle budgets green | 18-endpoint live smoke green. Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements the complete remediation roadmap from the full-codebase technical audit (review artifacts in
CODE_REVIEW.md). All 5 Criticals, 12 Majors, and the P3 quality-system items are closed, plus the pre-review design-system fixes and the Unsplash→Pexels codemod with its hardened, testedscripts/replace_images.py.Phase 0 — Stop the bleeding
crypto.timingSafeEqualover the raw body; unknownrepoIds rejected (no auto-provisioning); demo secret moved to env.cat_live_API keys validated against a constant-time env allowlist./api/payments/verifyfails closed (503); both payment webhooks verify HMAC signatures./api/state/sync*return401without a verified token supplyingownerId.rejectUnauthorized: true.Phase 1 — Structural hardening
firebase-adminID-token verification middleware (src/lib/serverAuth.ts); tiers derived server-side from verified identity + Firestore entitlements only.'unsafe-inline'in production;'unsafe-eval'removed;frame-ancestorsallowlisted.<escaping.Phase 2 — Maintainability
server.tsmonolith decomposed intoserver/app.ts+ 11server/routes/*+server/core/*modules.strict: truecompiles with 0 tsc errors.Phase 3 — Quality systems
src/lib/logger.tsfacade batching redacted/deduped errors to a validated, rate-limited/api/client-logssink; 43 files off rawconsole.*.server/**(72% lines, 94% functions). Found and fixed a livewebhookSecretleak in the GitHub repos list/connect responses.docs/ARCHITECTURE.md,docs/ENGINES.md(incl. thepython-engines/decision record and Firebase-public-config note).npm run check:bundle) + Lighthouse CI config.Verification
tsc --noEmit(strict): 0 errors · ESLint: 0 warnings · vitest: 168/168 ·vite build: ~12s · bundle budgets: all ✓visitor, JSON 404s,x-request-idissuance, no secret echo).Notes
.github/workflows/ci.yml(CI gate with the hard tsc typecheck + bundle-budget step) and.github/workflows/lighthouse.yml— the GitHub App token needs theworkflowspermission to push workflow files. The commit is authored and ready; it will land on this branch and update this PR automatically once the connection is re-granted.api/*serverless twins remain dormant (Express server is canonical) per the M4 decision.CODE_REVIEW.md:noUncheckedIndexedAccessramp, initial-chunk splitting (entry ~1 MB), hashed persisted API keys.