ZhenYi
bdb5393835
fix: resolve 30+ bugs from security audit
...
Critical:
- CORS: replace allow_any_origin + credentials with env-configured origins
- XSS: escape HTML before dangerouslySetInnerHTML in search results
- Path traversal: sanitize storage keys to reject ".." components
- Auth missing: add Session requirement to git init/open/is-repo endpoints
- Transaction: wrap issue cascade delete in DB transaction
High:
- Mutex poisoning: replace unwrap() with poison-recovering guards
- Drop tokio::spawn: use runtime handle or fallback thread for lock release
- Redis KEYS: replace with non-blocking SCAN for typing events
- SSH panic: handle missing stdin/stdout/stderr gracefully
- LFS auth: remove x-user-uid header injection vector, generate per-request tokens
Medium:
- Memory leak: remove Box::leak in provider normalization
- Race conditions: query closed count directly instead of subtraction
- Silent failures: add tracing::warn for AI tasks, room events, activity logs
- Frontend nav: sync activeRoomId when initialRoomId prop changes
- Duplicate nav: remove redundant setActiveRoom in delete handler
- Callback conflict: skip undefined values in updateCallbacks merge
- Stale closure: use wsClient state instead of wsClientRef.current in useMemo
Low:
- Captcha: validate captcha not empty before login submission
- Broadcast capacity: reduce from 100K to 1000
- Error handling: add try/catch for removeMember and updateMemberRole
- Loading state: show placeholder instead of null in RepositoryContextProvider
- WebSocket: add heartbeat ping and jitter to reconnect backoff
2026-04-27 10:57:23 +08:00
ZhenYi
773da34fab
refactor(service): migrate auth, git service, agent from slog to tracing
...
- Remove all use slog::* imports and slog::Logger fields/parameters
- Replace slog::info!/warn!/error! with tracing::info!/warn!/error!
- AppService: remove pub logs: slog::Logger field, update callers of
AppEmail::init(), MessageProducer::new(), RoomService::new(),
start_email_worker(), start_room_workers()
- auth/: captcha, email, login, logout, password, register, rsa, totp
- git/: archive, blame, blob, branch, commit, contributors, diff,
refs, star, tag, tree, watch
- agent/: billing (ai_usage_recorded), code_review, pr_summary, sync
- project/activity.rs, workspace/alert.rs
2026-04-21 22:28:33 +08:00
ZhenYi
fb91f5a6c5
feat(admin): add admin panel with billing alerts and model sync
...
- Add libs/api/admin with admin API endpoints:
sync models, workspace credit, billing alert check
- Add workspace_alert_config model and alert service
- Add Session::no_op() for background tasks without user context
- Add admin/ Next.js admin panel (AI models, billing, workspaces, audit)
- Start billing alert background task every 30 minutes
2026-04-19 20:48:59 +08:00
