4 Commits

Include renames

Author	SHA1	Message	Date
Krystie	fef7e07b49	DC-026/027/028: close 3 more auth security holes + rate limit /auth/* + audit credential exposures ... [DC-026] routes/auth/sso-gate.js — fix sessionDuration='never' bypass Both /auth/gate/:serviceId and /auth/app-token/:serviceId had a session check gated on `sessionDuration !== 'never'`. An admin setting TOTP to never-expire accidentally created an authentication-free path to credential injection (Basic Auth, X-Api-Key, Plex/Prowlarr tokens). Patched: session required whenever TOTP is enabled, period. Added 8 regression tests. [DC-027] src/utilities/middleware.js — rate limit /auth/* New authLimiter (20 req / 15 min) on /auth/keys, /auth/jwt, /auth/gate, /auth/app-token. These endpoints expose credentials and were unmetered. Without this, an attacker with a guessed session cookie could burn through every credential-touching endpoint. Added 5 tests. [DC-028] src/security/audit-logger.js — log credential exposures /auth/gate and /auth/app-token were in SKIP_PATHS, silently dropping every credential-exposure event from the audit log. Combined with the GET-skip rule, NONE of these events were being recorded. Now logged with named actions: auth.credential-injection, auth.app-token-issue, auth.api-key-generate, auth.api-key-revoke, auth.jwt-mint. Added 9 tests. [start.sh] Disable in-container self-updater DASHCADDY_UPDATE_ENABLED=false. Without this, the container kept writing trigger.json every 30 min and clobbered my in-progress host edits. The path unit on the host is still active for manual triggers, but the container won't auto-update itself — only when an admin clicks the update button or a new release is manually published. [package.json] Bump to 1.14.7 Test results: 1066/1066 passing across 39 suites (added 22 new tests).	2026-07-01 04:20:57 -07:00
Hermes	8ec6c0ca6a	DC-012: Add Kubernetes-style /healthz + /readyz probe aliases ... Fresh users copy-pasting healthcheck blocks from k8s/Docker docs need the standard short aliases. Without /healthz and /readyz they get connection refused. This commit: 1. Adds /healthz + /readyz as root-level aliases for /health/live + /health/ready in src/app.js. Handler bodies DRYed into named functions (livenessHandler, readinessHandler) so a probe semantics change updates all five paths at once. 2. Removes the dead /api/v1/health*, /api/v1/health/live, /api/v1/health/ready registrations from PUBLIC_ROUTES and CSRF exclusion list — those routes were never actually mounted on the apiRouter (only root paths existed). Anyone probing /api/v1/health now gets a clean 404 instead of being routed through to a duplicate root handler. 3. Adds bypass for the 5 probe paths in three places where it matters: - PUBLIC_ROUTES (no auth) - csrf-protection.js excludedPaths (no CSRF check) - middleware.js request-logging exclusion (k8s polling every 10s doesn't flood the audit log) - middleware.js Tailscale auth bypass (probes don't carry Tailscale identity headers) 4. Adds __tests__/health-probe-aliases.test.js (19 tests): - Alias equivalence (/healthz == /health/live, /readyz == /health/ready) - Back-compat (/health == /health/live) - Path consolidation (all 3 /api/v1/health* return 404) - Source-of-truth PUBLIC_ROUTES allowlist sync check - Source-of-truth src/app.js mount list sync check (catches drift between handler mount and middleware allowlist) 5. Documents probes in README (copy-paste docker-compose.yml + Kubernetes blocks) and user-guide (Health Probes section + System API table updated). Post-fix: 941/941 tests pass (+19 new). Zero new ESLint warnings introduced. The pre-existing warnings/errors in src/app.js line 906 ('os' is not defined) and the empty blocks in logging.test.js are not regressions from this commit.	2026-06-25 17:16:16 -07:00
Hermes	283121edba	Merge krystie-improvements into main ... Resolves 24 conflicts between Hermes (DC-008/009/010 + response-helper envelope standardization) and Krystie (DC-005 src/ refactor path fixes, DC-006 TOTP integration, DC-007 new test suites, cloud backup destinations). Conflict resolutions: - src/utils/logging.js: took ours (consumers depend on logError/ safeErrorMessage/createLogger exports) - src/config/site.js: merged (her factored validateAndLogConfig + applyConfigFields helpers) - src/context/dns.js: took hers (admin/readonly role iteration for write operations) - src/utilities/backup- manager.js: took hers (Dropbox/WebDAV/SFTP cloud feature) - status/dist/*, status/ sw.js: took hers (minified bundles + newer SW cache) Additional fix (post-merge regression): - src/monitoring/health-checker.js: fixed DC-005 path miss — 'require(./platform-paths)' → 'require(../../platform-paths)' Test status: 921/922 passing. One known failure in logging.test.js (async file-handle timing) tracked as follow-up.	2026-06-25 16:43:10 -07:00
Hermes	7bc2a207f3	DC-005: Fix all 138 broken test paths after src/ refactor ... After the DC-005 module reorganization (41 files moved into src/ subdirs), 138 test suites failed because the refactor script's path-rewrite logic missed three categories: 1. Files inside src/ doing 'require("./src/...")' — should be 'require("../...")' 2. Files in src/X/Y/ doing 'require("../../../src/...")' — should be 'require("../../...")' 3. Test files in __tests__/ with leftover 'require("../../../src/...")' paths Root cause: the original refactor script ran before all files were moved, so it computed relative paths against stale filesystem state. Result: - 30/30 test suites pass - 879/879 tests pass (was: 18/30 suites, 614/687 tests) Also fixed: - routes/apps/restore.js: wrong responses import path - routes/*/*.js: '../../src/utilities/X' → '../src/utilities/X' (depth 2 routes)	2026-06-13 12:16:56 -07:00