dashcaddy/DC-PRODUCTION-GRADE-BACKLOG.md

DashCaddy Production-Grade Repair Backlog

Autonomous agent: work through these IN ORDER. Mark each [ ] as [x] when shipped. If an item is too big for one tick, implement a sub-part, push that, and note progress.

P0 — Security & Correctness

• P0-1: npm audit fix — Done (commit 3a0a5bc, grade A). Resolved 3 high CVEs via minimatch 9.0.9 in webdav transitive. 4 remaining vulns are semver-major-only (sharp→0.35.3, dockerode→5.0.1, nodemailer→9.0.5, uuid→11.1.1) — deferred per backlog note. All 1498 jest tests pass. URN urn:ump:hlju4hixg3tijbghncigm5gesoemupuczrzmkykumh7xbgkq3d2q.
• P0-2: Command injection in ca.js:210 — Password interpolated into shell string execSync(\openssl pkcs12 ... -password "pass:${password}"`). Replace with execFileSync('openssl', [...args, '-password', `pass:${password}`])(no shell). File:routes/ca.js` lines 200-215.
• P0-3: Unvalidated req.body in backup config — routes/backups.js:487 passes raw req.body to backupManager.updateConfig(). Replace with explicit destructure of known fields: const { backups, defaultRetention } = req.body || {}.
• P0-4: Asset upload buffer size check — routes/config/assets.js:33 decodes base64 without checking buffer size. Add if (buffer.length > 5 * 1024 * 1024) throw new ValidationError('File too large (max 5MB)') after the Buffer.from call. Also restrict MIME regex to png|jpeg|svg+xml|webp|ico|x-icon.
• P0-5: Error message leaking internals — routes/apps/restore.js:296 returns err.message directly to client via errorResponse(res, 500, err.message). Replace with generic message "Restore failed" and log the actual error server-side.

P1 — Architecture & Input Validation

• P1-1: Add Joi validation library — npm install joi. Create src/utilities/validate.js exporting validateBody(schema) middleware. Apply to destructive routes first: routes/backups.js (schedule/create/update/restore/delete), routes/apps/deploy.js, routes/apps/restore.js, routes/config/assets.js.
• P1-2: Console→logger sweep (update-manager.js) — Replace all 49 console.* calls in src/managers/update-manager.js with structured logger calls. const log = require('../utils/logging') then log.info/warn/error(tag, msg, meta).
• P1-3: Console→logger sweep (backup-manager.js) — Replace all 36 console.* calls in src/utilities/backup-manager.js with structured logger.
• P1-4: Console→logger sweep (resource-monitor.js) — Replace all 32 console.* calls in src/managers/resource-monitor.js with structured logger.
• P1-5: Console→logger sweep (credential-manager.js) — Replace all 20 console.* calls in src/managers/credential-manager.js with structured logger.
• P1-6: Console→logger sweep (auth-manager.js) — Replace all 20 console.* calls in src/managers/auth-manager.js with structured logger.
• P1-7: Console→logger sweep (bundled-workflows.js) — Replace all 18 console.* calls in src/recipes/bundled-workflows.js with structured logger.
• P1-8: Console→logger sweep (remaining files) — Sweep remaining files with < 20 console calls each: crypto-utils.js (16), docker-security.js (15), port-lock-manager.js (16), self-updater.js (10), event-workers.js (5), keychain-manager.js (4), log-digest.js (3), csrf-protection.js (3). One commit for all small files.

P2 — Code Quality & Technical Debt

• P2-1: Version drift fix — Update VERSION file from 1.14.9 to 1.15.0. Update CLAUDE.md line 247 from 1.13.4 to 1.15.0.
• P2-2: Delete dead legacy files — git rm dashcaddy-api/scripts/legacy/comprehensive-test.js dashcaddy-api/scripts/legacy/test-security-fixes.js status/api/test-api.js. Verify zero references first.
• P2-3: ESLint no-empty fix — Add { allow: 'catch' } to the no-empty rule in .eslintrc.js, OR add // intentionally ignored comments. Goal: npx eslint src/ routes/ exits 0 errors.
• P2-4: Fix no-useless-escape — routes/auth/session-handlers.js:39 — \- inside character class → - (at end of class to avoid range).
• P2-5: Test handle leaks — Run npx jest --detectOpenHandles --silent 2>&1 | grep -i leak and add teardown (afterEach(() => clearInterval/clearTimeout)) to tests that leave open handles. Focus on totp.routes.test.js (22s) and containers.routes.test.js (28s).
• P2-6: Refactor config-schema.js validateConfig — Complexity 44 → extract sub-validators for each config section. Behavior-preserving refactor only.
• P2-7: Refactor middleware.js auth function — Complexity 24, nesting depth 6 → extract auth-logic branches into named helper functions.

Completion Criteria

When all items above are [x], report "All backlog items complete" and stop.