38 lines
4.8 KiB
Markdown
38 lines
4.8 KiB
Markdown
# DashCaddy Production-Grade Repair Backlog
|
|
|
|
Autonomous agent: work through these IN ORDER. Mark each `[ ]` as `[x]` when shipped.
|
|
If an item is too big for one tick, implement a sub-part, push that, and note progress.
|
|
|
|
## P0 — Security & Correctness
|
|
|
|
- [x] **P0-1: npm audit fix** — Done (commit 3a0a5bc, grade A). Resolved 3 high CVEs via minimatch 9.0.9 in webdav transitive. 4 remaining vulns are semver-major-only (sharp→0.35.3, dockerode→5.0.1, nodemailer→9.0.5, uuid→11.1.1) — deferred per backlog note. All 1498 jest tests pass. URN urn:ump:hlju4hixg3tijbghncigm5gesoemupuczrzmkykumh7xbgkq3d2q.
|
|
- [x] **P0-2: Command injection in ca.js:210** — Done (commit 66e4460, grade A). Replaced `execSync(\`openssl pkcs12 ... -password "pass:${password}"\`)` with `execFileSync('openssl', [..., '-password', \`pass:${password}\`])`. No shell parsing. All 1498 tests pass.
|
|
- [ ] **P0-3: Unvalidated req.body in backup config** — `routes/backups.js:487` passes raw `req.body` to `backupManager.updateConfig()`. Replace with explicit destructure of known fields: `const { backups, defaultRetention } = req.body || {}`.
|
|
- [ ] **P0-4: Asset upload buffer size check** — `routes/config/assets.js:33` decodes base64 without checking buffer size. Add `if (buffer.length > 5 * 1024 * 1024) throw new ValidationError('File too large (max 5MB)')` after the `Buffer.from` call. Also restrict MIME regex to `png|jpeg|svg+xml|webp|ico|x-icon`.
|
|
- [ ] **P0-5: Error message leaking internals** — `routes/apps/restore.js:296` returns `err.message` directly to client via `errorResponse(res, 500, err.message)`. Replace with generic message `"Restore failed"` and log the actual error server-side.
|
|
|
|
## P1 — Architecture & Input Validation
|
|
|
|
- [ ] **P1-1: Add Joi validation library** — `npm install joi`. Create `src/utilities/validate.js` exporting `validateBody(schema)` middleware. Apply to destructive routes first: `routes/backups.js` (schedule/create/update/restore/delete), `routes/apps/deploy.js`, `routes/apps/restore.js`, `routes/config/assets.js`.
|
|
- [ ] **P1-2: Console→logger sweep (update-manager.js)** — Replace all 49 `console.*` calls in `src/managers/update-manager.js` with structured logger calls. `const log = require('../utils/logging')` then `log.info/warn/error(tag, msg, meta)`.
|
|
- [ ] **P1-3: Console→logger sweep (backup-manager.js)** — Replace all 36 `console.*` calls in `src/utilities/backup-manager.js` with structured logger.
|
|
- [ ] **P1-4: Console→logger sweep (resource-monitor.js)** — Replace all 32 `console.*` calls in `src/managers/resource-monitor.js` with structured logger.
|
|
- [ ] **P1-5: Console→logger sweep (credential-manager.js)** — Replace all 20 `console.*` calls in `src/managers/credential-manager.js` with structured logger.
|
|
- [ ] **P1-6: Console→logger sweep (auth-manager.js)** — Replace all 20 `console.*` calls in `src/managers/auth-manager.js` with structured logger.
|
|
- [ ] **P1-7: Console→logger sweep (bundled-workflows.js)** — Replace all 18 `console.*` calls in `src/recipes/bundled-workflows.js` with structured logger.
|
|
- [ ] **P1-8: Console→logger sweep (remaining files)** — Sweep remaining files with < 20 console calls each: `crypto-utils.js` (16), `docker-security.js` (15), `port-lock-manager.js` (16), `self-updater.js` (10), `event-workers.js` (5), `keychain-manager.js` (4), `log-digest.js` (3), `csrf-protection.js` (3). One commit for all small files.
|
|
|
|
## P2 — Code Quality & Technical Debt
|
|
|
|
- [ ] **P2-1: Version drift fix** — Update `VERSION` file from `1.14.9` to `1.15.0`. Update `CLAUDE.md` line 247 from `1.13.4` to `1.15.0`.
|
|
- [ ] **P2-2: Delete dead legacy files** — `git rm dashcaddy-api/scripts/legacy/comprehensive-test.js dashcaddy-api/scripts/legacy/test-security-fixes.js status/api/test-api.js`. Verify zero references first.
|
|
- [ ] **P2-3: ESLint no-empty fix** — Add `{ allow: 'catch' }` to the `no-empty` rule in `.eslintrc.js`, OR add `// intentionally ignored` comments. Goal: `npx eslint src/ routes/` exits 0 errors.
|
|
- [ ] **P2-4: Fix no-useless-escape** — `routes/auth/session-handlers.js:39` — `\-` inside character class → `-` (at end of class to avoid range).
|
|
- [ ] **P2-5: Test handle leaks** — Run `npx jest --detectOpenHandles --silent 2>&1 | grep -i leak` and add teardown (`afterEach(() => clearInterval/clearTimeout)`) to tests that leave open handles. Focus on `totp.routes.test.js` (22s) and `containers.routes.test.js` (28s).
|
|
- [ ] **P2-6: Refactor config-schema.js validateConfig** — Complexity 44 → extract sub-validators for each config section. Behavior-preserving refactor only.
|
|
- [ ] **P2-7: Refactor middleware.js auth function** — Complexity 24, nesting depth 6 → extract auth-logic branches into named helper functions.
|
|
|
|
## Completion Criteria
|
|
|
|
When all items above are `[x]`, report "All backlog items complete" and stop.
|