5 Commits

Include renames

Author	SHA1	Message	Date
Hermes	7bc2a207f3	DC-005: Fix all 138 broken test paths after src/ refactor ... After the DC-005 module reorganization (41 files moved into src/ subdirs), 138 test suites failed because the refactor script's path-rewrite logic missed three categories: 1. Files inside src/ doing 'require("./src/...")' — should be 'require("../...")' 2. Files in src/X/Y/ doing 'require("../../../src/...")' — should be 'require("../../...")' 3. Test files in __tests__/ with leftover 'require("../../../src/...")' paths Root cause: the original refactor script ran before all files were moved, so it computed relative paths against stale filesystem state. Result: - 30/30 test suites pass - 879/879 tests pass (was: 18/30 suites, 614/687 tests) Also fixed: - routes/apps/restore.js: wrong responses import path - routes/*/*.js: '../../src/utilities/X' → '../src/utilities/X' (depth 2 routes)	2026-06-13 12:16:56 -07:00
Hermes	11cfb8c26a	Consolidate response helpers and error logger to single modules ... Two cleanups in one pass for the v1.14.0 'works on any platform' theme: 1. Response helpers — merged src/utils/responses.js and the root-level response-helpers.js into a single module at src/utils/responses.js. The old module had a richer set (created, noContent, validationError, unauthorized, forbidden, notFound, conflict) and is now re-exported from the new location. Updated 15 routes to import from src/utils/responses and deleted the root response-helpers.js. 2. Error logger — error-handler.js now uses the unified src/utils/logging.js#logError (same one src/app.js uses), so all errors go to one log file with one rotation policy. Removed the dead asyncHandler export (the real one is in src/utils/async-handler.js and is used everywhere). Deleted the legacy error-logger.js. Both are invisible to users — same HTTP response shapes, same log file path, same error format. Internal-only refactor.	2026-06-10 21:37:55 -07:00
Krystie	51d6c37e4a	refactor(routes): Phase 3.6-10 - standardize 5 utility routes ... - credentials.js (2 deps: credentialManager, asyncHandler) - backups.js (2 deps: backupManager, asyncHandler) - license.js (2 deps: licenseManager, asyncHandler) - errorlogs.js (3 deps: ERROR_LOG_FILE, auditLogger, asyncHandler) - themes.js (0 deps! Standalone route) Total: 9 routes refactored so far	2026-03-28 19:32:01 -07:00
SamiandClaude Opus 4.6	59b6d7d360	Fix 16 HIGH/MEDIUM security bugs across API ... HIGH fixes: - TOTP disable now requires valid code verification - TOTP secret removed from plaintext file storage - Container ID validated before update/check-update/logs operations - DNS server parameter restricted to configured servers (SSRF prevention) - Backup export no longer includes encryption key - Backup restore of sensitive files requires TOTP re-authentication MEDIUM fixes: - Session cookie Secure flag added - Caddy reload errors no longer leaked to client - saveConfig uses atomic locked updates via configStateManager - Log file path traversal prevented via symlink resolution - Credential cache entries now expire after 5 minutes - _httpFetch enforces 10MB response size limit - External URL path injection into Caddyfile blocked - Custom volume host paths validated against allowed roots - Error logs endpoint no longer returns stack traces - Logo delete path traversal prevented via path.basename() Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-07 00:15:28 -08:00
Sami	f61e85d9a7	Initial commit: DashCaddy v1.0 ... Full codebase including API server (32 modules + routes), dashboard frontend, DashCA certificate distribution, installer script, and deployment skills.	2026-03-05 02:26:12 -08:00