Oliver/dow-prod-tracker
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
No description
109 commits 1 branch 0 tags 2.6 MiB
Find a file
DJP 26c766cf43 Security hardening: fix critical auth, RBAC, and injection vulnerabilities 
- C1: Add authentication to file serving route + canonical path traversal check + nosniff header
- C2: DEV_BYPASS_AUTH now only works when Entra ID credentials are not configured
- H1: Add requireAuth() + assertOrgAccess() to 9 unprotected routes (upload, feedback, annotations, color-probes, reviews)
- H2: Add org-scoping to 4 routes (automations, users, skills)
- H3: SSRF protection on webhook URLs — HTTPS only, private/internal IPs blocked
- H6: API key uses timingSafeEqual, phantom fallback removed, supports X-Org-Id header
- M1: CRON_SECRET moved from query string to Authorization Bearer header
- Extend assertOrgAccess() to support 10 model types (was 3)
- npm audit fix: 17 vulnerabilities reduced to 4
- Add SECURITY-REVIEW.md with full findings report

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-07 20:48:05 -04:00
.agents/skills Initial scaffold: Next.js 16, TypeScript, Tailwind CSS 4, ESLint, Prettier 2026-02-28 20:58:48 -06:00
.claude feat(calendar): implement calendar view with event filtering and detail display 2026-03-12 21:20:11 -05:00
assets/temp chore: remove Promptfoo integration plan and related configuration files 2026-03-12 22:00:25 -05:00
docker feat: Implement automation event bus and rule engine 2026-03-12 11:20:21 -05:00
docs Document SSO seed-user linking pattern for next-auth v5 2026-04-06 17:25:58 -05:00
prisma Security hardening: fix critical auth, RBAC, and injection vulnerabilities 2026-04-07 20:48:05 -04:00
public Dev server deployment: port conflicts, auth bypass, API key, UI fixes 2026-04-07 17:17:54 -04:00
scripts Database cleanup pre rollout 2026-04-06 14:35:56 -05:00
src Security hardening: fix critical auth, RBAC, and injection vulnerabilities 2026-04-07 20:48:05 -04:00
tests/llm feat(calendar): implement calendar view with event filtering and detail display 2026-03-12 21:20:11 -05:00
.dockerignore feat: add Smart Search Panel with semantic search capabilities 2026-03-06 16:13:36 -06:00
.env.example Clean up deployment config: remove Docker Hub refs, Cloudflare Tunnel 2026-04-07 13:44:09 -05:00
.gitignore Clean up deployment config: remove Docker Hub refs, Cloudflare Tunnel 2026-04-07 13:44:09 -05:00
.nvmrc Initial scaffold: Next.js 16, TypeScript, Tailwind CSS 4, ESLint, Prettier 2026-02-28 20:58:48 -06:00
.prettierignore Initial scaffold: Next.js 16, TypeScript, Tailwind CSS 4, ESLint, Prettier 2026-02-28 20:58:48 -06:00
.prettierrc Initial scaffold: Next.js 16, TypeScript, Tailwind CSS 4, ESLint, Prettier 2026-02-28 20:58:48 -06:00
CLAUDE.md Fix video review bugs: playback, annotations, coordinates, timeline markers 2026-04-03 12:44:02 -05:00
components.json Add shadcn/ui components and TooltipProvider 2026-02-28 21:00:51 -06:00
docker-compose.yml Dev server deployment: port conflicts, auth bypass, API key, UI fixes 2026-04-07 17:17:54 -04:00
Dockerfile Dev server deployment: port conflicts, auth bypass, API key, UI fixes 2026-04-07 17:17:54 -04:00
EXECUTIVE_OVERVIEW.md feat: implement stage date override and scheduling features 2026-03-12 23:13:29 -05:00
next.config.ts Add standalone output for Docker deployment, gitignore deploy dir 2026-04-06 16:49:58 -05:00
package-lock.json Security hardening: fix critical auth, RBAC, and injection vulnerabilities 2026-04-07 20:48:05 -04:00
package.json Database cleanup pre rollout 2026-04-06 14:35:56 -05:00
pinecone-research.md feat(pinecone): add research document assessing relevance of Pinecone for HP Prod Tracker 2026-03-06 15:25:52 -06:00
postcss.config.mjs Initial scaffold: Next.js 16, TypeScript, Tailwind CSS 4, ESLint, Prettier 2026-02-28 20:58:48 -06:00
prisma.config.ts feat: add validators for PowerPoint and Word documents, and Excel recalculation script 2026-03-02 12:23:09 -06:00
PRODUCER_GUIDE.md feat: implement stage date override and scheduling features 2026-03-12 23:13:29 -05:00
ROADMAP.md Switch from db push to versioned Prisma migrations 2026-04-06 14:45:36 -05:00
SECURITY-REVIEW.md Security hardening: fix critical auth, RBAC, and injection vulnerabilities 2026-04-07 20:48:05 -04:00
SETUP.md Switch from db push to versioned Prisma migrations 2026-04-06 14:45:36 -05:00
skills-lock.json Initial scaffold: Next.js 16, TypeScript, Tailwind CSS 4, ESLint, Prettier 2026-02-28 20:58:48 -06:00
tsconfig.json Add Prisma 7 schema with full data model and seed script 2026-02-28 21:06:17 -06:00