dashcaddy/DC-PRODUCTION-GRADE-BACKLOG.md

DashCaddy Production-Grade Repair Backlog

Autonomous agent: work through these IN ORDER. Mark each [ ] as [x] when shipped. If an item is too big for one tick, implement a sub-part, push that, and note progress.

P0 — Security & Correctness

• P0-1: npm audit fix — Done (commit 3a0a5bc, grade A). Resolved 3 high CVEs via minimatch 9.0.9 in webdav transitive. 4 remaining vulns are semver-major-only (sharp→0.35.3, dockerode→5.0.1, nodemailer→9.0.5, uuid→11.1.1) — deferred per backlog note. All 1498 jest tests pass. URN urn:ump:hlju4hixg3tijbghncigm5gesoemupuczrzmkykumh7xbgkq3d2q.
• P0-2: Command injection in ca.js:210 — Done (commit 66e4460, grade A). Replaced execSync(\openssl pkcs12 ... -password "pass:${password}"`)withexecFileSync('openssl', [..., '-password', `pass:${password}`])`. No shell parsing. All 1498 tests pass.
• P0-3: Unvalidated req.body in backup config — Done (commit b3488f1, grade A). POST /backups/config now destructures only {backups, defaultRetention} instead of passing req.body wholesale. All 1498 tests pass.
• P0-4: Asset upload buffer size check — Done (commit 57ed09f, grade A). POST /assets/upload now uses decodeImageData(data) helper which enforces MIME whitelist (png/jpeg/jpg/svg+xml/webp/ico/x-icon) and 5 MB cap. (Prior partial fix had the helper but never wired it.) All 1498 tests pass.
• P0-5: Error message leaking internals — Done (commit 609ccd3, grade A). apps-revert catch now logs err.message+stack via log.error server-side and returns generic Revert failed to client. All 1498 tests pass.

P1 — Architecture & Input Validation

• P1-1: Add Joi validation library — Done in commit a667de7 (DC-059, codex-graded B). npm install joi@^18, src/utilities/validate.js exporting validateBody(schema, opts) middleware + 9 schemas (backupConfigUpdate, backupScheduleCreate, backupRestore, backupRestoreFile, appDeploy, appRestore, appRevert, assetUpload, logoUpload). Every exported schema has direct unit tests (41 total in __tests__/unit/validate.test.js) covering middleware semantics — not just schema.validate. Applied to 8 destructive routes: backups (schedule/restore/config), apps (deploy/restore/revert), assets (upload/logo). Used Joi's authoritative CIDR validator (rejects malformed IPv6 like ::::/64 that the previous hex/colon regex would have accepted). 1539/1539 Jest tests pass (was 1498, +41 new). ESLint warnings unchanged (416 total, all pre-existing — zero new introduced).
• P1-2: Console→logger sweep (update-manager.js) — Done in commit e8b9dd5 (DC-060, codex-graded A). All 49 console.* calls in src/managers/update-manager.js now route through log.info/log.warn/log.error from src/utils/logging (tag = 'update'). Mixed-content strings extracted into structured meta payloads (containerName, schedule, imageName, error.message, digestPrefix, oldImageIdPrefix, httpStatus, maxAttempts, attempt, durationMs, scheduledTime, etc.) so fields are queryable. Errors go through log.error(ctx, errObj) so they land in error.log with full stack trace + context. 1539/1539 Jest tests pass (78/78 update-manager tests still pass). ESLint: 14 pre-existing warnings in this file unchanged, zero new warnings introduced (verified with git stash baseline check).
• P1-3: Console→logger sweep (backup-manager.js) — Replace all 36 console.* calls in src/utilities/backup-manager.js with structured logger.
• P1-4: Console→logger sweep (resource-monitor.js) — Replace all 32 console.* calls in src/managers/resource-monitor.js with structured logger.
• P1-5: Console→logger sweep (credential-manager.js) — Replace all 20 console.* calls in src/managers/credential-manager.js with structured logger.
• P1-6: Console→logger sweep (auth-manager.js) — Replace all 20 console.* calls in src/managers/auth-manager.js with structured logger.
• P1-7: Console→logger sweep (bundled-workflows.js) — Replace all 18 console.* calls in src/recipes/bundled-workflows.js with structured logger.
• P1-8: Console→logger sweep (remaining files) — Sweep remaining files with < 20 console calls each: crypto-utils.js (16), docker-security.js (15), port-lock-manager.js (16), self-updater.js (10), event-workers.js (5), keychain-manager.js (4), log-digest.js (3), csrf-protection.js (3). One commit for all small files.

P2 — Code Quality & Technical Debt

• P2-1: Version drift fix — Update VERSION file from 1.14.9 to 1.15.0. Update CLAUDE.md line 247 from 1.13.4 to 1.15.0.
• P2-2: Delete dead legacy files — git rm dashcaddy-api/scripts/legacy/comprehensive-test.js dashcaddy-api/scripts/legacy/test-security-fixes.js status/api/test-api.js. Verify zero references first.
• P2-3: ESLint no-empty fix — Add { allow: 'catch' } to the no-empty rule in .eslintrc.js, OR add // intentionally ignored comments. Goal: npx eslint src/ routes/ exits 0 errors.
• P2-4: Fix no-useless-escape — routes/auth/session-handlers.js:39 — \- inside character class → - (at end of class to avoid range).
• P2-5: Test handle leaks — Run npx jest --detectOpenHandles --silent 2>&1 | grep -i leak and add teardown (afterEach(() => clearInterval/clearTimeout)) to tests that leave open handles. Focus on totp.routes.test.js (22s) and containers.routes.test.js (28s).
• P2-6: Refactor config-schema.js validateConfig — Complexity 44 → extract sub-validators for each config section. Behavior-preserving refactor only.
• P2-7: Refactor middleware.js auth function — Complexity 24, nesting depth 6 → extract auth-logic branches into named helper functions.

Completion Criteria

When all items above are [x], report "All backlog items complete" and stop.