sami7777/dashcaddy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

[grade=pending] QA sprint: commit 103 at-risk files from multi-agent sprint work

Browse Source 
Committed by Hermes autonomous QA sprint 2026-08-13.
These files were modified during the Aug 12 sprint but never committed.
This commit is contained in:
Krystie
2026-08-12 17:34:10 -07:00
parent 0bf4406253
commit 503de258b8
105 changed files with 14057 additions and 2632 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dashcaddy-api/src/security/docker-security.js
+16 -15
View File
@@ -9,6 +9,7 @@ const path = require('path');
const https = require('https');
const Docker = require('dockerode');
const platformPaths = require('../../platform-paths');
const { log } = require('../utils/logging');
const docker = new Docker();
@@ -19,7 +20,7 @@ class DockerSecurity {
constructor() {
this.config = this.loadConfig();
this.mode = VERIFICATION_MODE;
console.log(`[DockerSecurity] Initialized in ${this.mode} mode`);
log.info('security', 'Docker security initialized', { mode: this.mode });
}
/**
@@ -32,7 +33,7 @@ class DockerSecurity {
return JSON.parse(data);
}
} catch (error) {
console.warn(`[DockerSecurity] Failed to load config: ${error.message}`);
log.warn('security', 'Failed to load config', { error: error.message });
}
// Default configuration
@@ -51,7 +52,7 @@ class DockerSecurity {
try {
fs.writeFileSync(SECURITY_CONFIG_FILE, JSON.stringify(this.config, null, 2));
} catch (error) {
console.error(`[DockerSecurity] Failed to save config: ${error.message}`);
log.error('security', error, { operation: 'saveConfig' });
}
}
@@ -110,7 +111,7 @@ class DockerSecurity {
repository = repository.split(':')[0];
}
console.log(`[DockerSecurity] Fetching manifest for ${registry}/${repository}:${tag}`);
log.info('security', 'Fetching manifest', { registry, repository, tag });
return new Promise((resolve, reject) => {
const isDockerHub = registry === 'registry-1.docker.io';
@@ -216,7 +217,7 @@ class DockerSecurity {
if (this.config.updateTrustedOnPull) {
this.config.trustedDigests[imageName] = actualDigest;
this.saveConfig();
console.log(`[DockerSecurity] Added trusted digest for ${imageName}`);
log.info('security', 'Added trusted digest', { imageName });
}
}
} else if (actualDigest === trustedDigest) {
@@ -250,26 +251,26 @@ class DockerSecurity {
* @returns {Promise<object>} Verification result
*/
async verifyPulledImage(imageName) {
console.log(`[DockerSecurity] Verifying image: ${imageName}`);
log.info('security', 'Verifying image', { imageName });
try {
const actualDigest = await this.getImageDigest(imageName);
const result = await this.verifyImageDigest(imageName, actualDigest);
if (result.action === 'reject') {
console.error(`[DockerSecurity] REJECTED: ${result.reason}`);
log.error('security', 'Image REJECTED', { imageName, reason: result.reason });
throw new Error(`Image verification failed: ${result.reason}`);
} else if (result.action === 'warn') {
console.warn(`[DockerSecurity] WARNING: ${result.reason}`);
console.warn(`[DockerSecurity] Expected: ${result.trustedDigest}`);
console.warn(`[DockerSecurity] Actual: ${result.actualDigest}`);
log.warn('security', 'Image WARNING', { imageName, reason: result.reason });
log.warn('security', 'Expected digest', { imageName, digest: result.trustedDigest });
log.warn('security', 'Actual digest', { imageName, digest: result.actualDigest });
} else {
console.log(`[DockerSecurity] ACCEPTED: ${result.reason}`);
log.info('security', 'Image ACCEPTED', { imageName, reason: result.reason });
}
return result;
} catch (error) {
console.error(`[DockerSecurity] Verification error: ${error.message}`);
log.error('security', error, { imageName, operation: 'verify' });
if (this.mode === 'strict') {
throw error;
@@ -294,7 +295,7 @@ class DockerSecurity {
setTrustedDigest(imageName, digest) {
this.config.trustedDigests[imageName] = digest;
this.saveConfig();
console.log(`[DockerSecurity] Updated trusted digest for ${imageName}`);
log.info('security', 'Updated trusted digest', { imageName });
}
/**
@@ -304,7 +305,7 @@ class DockerSecurity {
removeTrustedDigest(imageName) {
delete this.config.trustedDigests[imageName];
this.saveConfig();
console.log(`[DockerSecurity] Removed trusted digest for ${imageName}`);
log.info('security', 'Removed trusted digest', { imageName });
}
/**
@@ -325,7 +326,7 @@ class DockerSecurity {
this.mode = mode;
this.config.verificationMode = mode;
this.saveConfig();
console.log(`[DockerSecurity] Verification mode set to: ${mode}`);
log.info('security', 'Verification mode set', { mode });
}
/**