3 Commits

Include renames

Author	SHA1	Message	Date
Hermes	5abf385c7e	[grade=A] feat(caddy-builder): DC-106 visual reverse proxy builder (frontend) ... Backend endpoints /api/v1/caddycode/{generate,validate,templates} already shipped at commit 7f83151 (GLM grade B). This commit ships the visual builder frontend that consumes them. - status/js/caddy-builder.js — IIFE module that injects a modal with a form-driven visual builder. State → JSON payload → debounced POST /generate → preview pane. 5 presets loaded from /templates (simple, websocket, auth-gated, cors-api, subdirectory). Custom headers list (add/remove rows), live validation, copy-to-clipboard, reset. Exposes window.__caddyBuilder for testing. - status/css/caddy-builder.css — page-specific styles, themed via existing --bg/--border/--accent/--ok-fg/--warn-fg/--err-fg CSS variables. Mobile-friendly single-column layout below 880 px. - status/index.html — adds /css/caddy-builder.css link + the "🔧 Reverse Proxy Builder" button in the Tools menu. - status/build.js — registers caddy-builder.js in features.js bundle. - dashcaddy-api/__tests__/unit/caddy-builder.unit.test.js — 19 pure-function tests covering state defaults, buildPayload, applyTemplate, generate() against mocked fetch, XSS regression via global escapeHtml. Verified: - jest: 19/19 unit + 8/8 caddycode-fleet routes pass - node build.js: features.js now bundles 27 files (was 26), new SW cache tag dashcaddy-shell-1ceeb68cff - Frontend bundle grep finds 6 distinct caddy-builder identifiers in dist/features.js - Qwen stand-in judge: A (0 blocking, 0 polish). Substitute for Codex CLI quota wall. Verdict URN: urn:ump:fco2jwhmcv4tjhmfvutownqbvc6pmvln23ym5jckivvj42ykpc2a	2026-08-18 23:50:37 -07:00
Hermes	a667de7920	DC-059: Joi validation middleware + schemas for destructive routes ... [grade=B] - New src/utilities/validate.js: validateBody(schema) middleware + 9 schemas (backupConfigUpdate, backupScheduleCreate, backupRestore, backupRestoreFile, appDeploy, appRestore, appRevert, assetUpload, logoUpload) - Uses Joi's authoritative CIDR validator (rejects malformed IPv6 like ::::/64 that the previous hex/colon regex would have accepted) - appDeploy.config uses .unknown(true) for forward-compat with template-specific fields (sslType, dnsType, plexClaimToken, etc.) — preserves fields the live frontend posts, prevents a behavioural regression - appRestore uses Joi.any().custom() so the empty-body semantics hold under middleware stripUnknown (default) — body with extra keys now rejected - Wired into 8 destructive routes: backups schedule/restore/config, apps deploy/restore/revert, assets upload/logo - Duplicate legacy POST /backups/schedule handler (line 519) marked LEGACY with TODO removal note (Express only matches first registration; this handler is unreachable under normal routing) - Removed redundant manual appId check in /backups/schedule (Joi schema enforces it) - Removed unused 'mime' destructure in /assets/favicon (decodeImageData validates MIME internally) - 41 unit tests covering every exported schema + middleware integration - 1539/1539 Jest tests pass, zero new ESLint warnings	2026-08-08 15:39:48 -07:00
Hermes	c1358df0ec	DC-059: claim for Hermes	2026-08-08 15:20:09 -07:00