Hartmut/Nexus
1
0
Fork 0
Code Issues 11 Pull Requests 2 Actions Packages Projects Releases Wiki Activity
517 Commits 9 Branches 1 Tag
3d8a256d524d70b006a6d4f8ea9596df2ba1ea5b
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Hartmutandclaude-flow 3d8a256d52 fix(auth): use token.sid to avoid Auth.js jti claim conflict 
Auth.js v5 manages token.jti internally and overwrites it after the jwt
callback. Storing our session UUID in token.sid ensures the value we
persist in active_sessions matches what the signed cookie carries.

- jwt callback: token.sid = jti (was token.jti)
- session callback: read from token.sid
- signOut event: falls back to token.jti for backward compat with any
  sessions created before this change

Also adds Playwright dev-system test suite (playwright.dev.config.ts +
e2e/dev-system/) that validates login, session registry health, and
RBAC enforcement against the running localhost:3100 dev server.

Co-Authored-By: claude-flow <ruv@ruv.net>
 2026-04-01 19:00:44 +02:00
Hartmut a867672afa Merge remote-tracking branch 'origin/main' 
# Conflicts:
#	apps/web/src/components/allocations/AllocationsClient.tsx
 2026-04-01 18:41:54 +02:00
Hartmutandclaude-flow 5bc7cace26 fix(auth): make active-session check fail-open; add missing DB migration 
The active_sessions table was never migrated to production — the model
was added to the Prisma schema via db push only. prisma migrate deploy
was a no-op because no migration directories existed.

Without the table, prisma.activeSession.findUnique() throws P2021,
crashing the tRPC handler with 500 on every authenticated request.
This silently emptied all admin pages (users, system-roles, etc.).

Changes:
- Wrap the jti ActiveSession lookup in try-catch so the tRPC handler
  degrades gracefully (fail-open) if the table is temporarily missing
- Add packages/db/prisma/migrations/20260401000000_active_sessions/
  so prisma migrate deploy creates the table on next production deploy
  (idempotent via IF NOT EXISTS — safe if table already exists)

Co-Authored-By: claude-flow <ruv@ruv.net>
 2026-04-01 18:38:05 +02:00
Hartmutandclaude-flow 0e119cfe73 security: close audit findings #19–#23 and harden Docker setup (#24) 
#19 MFA QR code: render locally via qrcode package, remove external qrserver.com request
#20 Webhook SSRF: add ssrf-guard.ts with DNS-verified IP blocklist; enforce on create/update/test/dispatch
#21 /api/perf: fail-closed when CRON_SECRET missing; remove query-string token auth
#22 CSP: remove unsafe-eval and unsafe-inline from script-src in production builds
#23 Active session registry: forward jti into session object; validate against ActiveSession on every tRPC request

#24 Docker: add missing packages/application to Dockerfile.dev; fix pnpm-lock.yaml glob;
    run db:migrate:deploy on container start so a fresh checkout boots without manual steps

Also: fix pre-existing TS error in e2e/allocations.spec.ts (args.length literal type overlap)

Co-Authored-By: claude-flow <ruv@ruv.net>
 2026-04-01 18:19:21 +02:00
Hartmut 57ea9d8310 fix(allocations): recover from fully filtered empty state 2026-04-01 15:18:08 +02:00
Hartmut b841cc9127 fix(allocations): expand grouped rows by default 2026-04-01 15:18:07 +02:00
Hartmut fd75628e9d fix(allocations): recover from fully filtered empty state 2026-04-01 15:16:57 +02:00
Hartmut 7df751d5eb fix(allocations): expand grouped rows by default 2026-04-01 15:13:24 +02:00
Hartmut 4b14db9dc6 fix(timeline): pause sse while hidden 2026-04-01 15:05:34 +02:00
Hartmut 3258b59e21 fix(timeline): resync after sse reconnect 2026-04-01 15:04:00 +02:00
Hartmut d4652b7a42 fix(timeline): cancel stranded drag interactions 2026-04-01 14:57:56 +02:00
Hartmut a71bbeb640 fix(timeline): stabilize overlay lifecycle 2026-04-01 14:41:03 +02:00
Hartmut fa5e654739 fix(timeline): harden project view interactions 2026-04-01 14:10:28 +02:00
Hartmut e103174d39 refactor(web): extract preview target setup 2026-04-01 11:59:10 +02:00
Hartmut 2a7769a0de refactor(web): extract range release resolution 2026-04-01 11:53:11 +02:00
Hartmut 1e2bd3d4eb refactor(web): extract project drag finalize 2026-04-01 11:49:14 +02:00
Hartmut 463caedcfd refactor(web): extract touch event forwarding 2026-04-01 11:39:39 +02:00
Hartmut 37c6e03d23 refactor(web): extract allocation release effects 2026-04-01 11:35:17 +02:00
Hartmut f4e9831dea refactor(web): extract allocation drag session 2026-04-01 11:27:03 +02:00
Hartmut 510459fbff refactor(web): extract allocation multi-drag session 2026-04-01 11:22:18 +02:00
Hartmut 5402189158 refactor(web): extract drag position helpers 2026-04-01 11:18:31 +02:00
Hartmut 3fe3a5fb2a refactor(web): extract project drag session 2026-04-01 11:16:15 +02:00
Hartmut 0181f2b304 refactor(web): extract multi-select session 2026-04-01 11:14:28 +02:00
Hartmut b14be80e32 refactor(web): extract timeline drag cleanup 2026-04-01 11:12:20 +02:00
Hartmut 922394c56a refactor(web): split touch canvas adapters 2026-04-01 11:09:26 +02:00
Hartmut a4789d718b refactor(web): centralize multi-select release handling 2026-04-01 10:50:21 +02:00
Hartmut ca947befde refactor(web): extract allocation release classification 2026-04-01 10:48:47 +02:00
Hartmut 0ab1374853 refactor(web): centralize touch mouse adapters 2026-04-01 10:43:38 +02:00
Hartmut eda8722d83 refactor(web): extract document drag listeners 2026-04-01 10:39:28 +02:00
Hartmut 84c5760392 refactor(web): extract range selection bootstrap 2026-04-01 10:17:39 +02:00
Hartmut c941b1e5cf refactor(web): extract allocation drag action plans 2026-04-01 10:15:54 +02:00
Hartmut 203bb8751d refactor(web): extract allocation drag bootstrap 2026-04-01 10:10:06 +02:00
Hartmut 892a9c5ccf refactor(web): extract project drag helpers 2026-04-01 10:06:32 +02:00
Hartmut c32f56ba89 refactor(web): extract allocation multi-drag helpers 2026-04-01 10:03:16 +02:00
Hartmut e23b502dd9 test(repo): guard allocation drag helper boundaries 2026-04-01 09:58:20 +02:00
Hartmut 6dac993521 refactor(web): extract allocation drag finalize helpers 2026-04-01 09:57:29 +02:00
Hartmut 54c6cf2e2d refactor(web): extract optimistic timeline reconciliation 2026-04-01 09:53:40 +02:00
Hartmut ea4074af8f test(repo): guard timeline drag helper boundaries 2026-04-01 09:52:23 +02:00
Hartmut 848797b4d2 refactor(web): extract timeline range selection helpers 2026-04-01 09:51:18 +02:00
Hartmut 43f04d66c8 refactor(web): extract timeline multi-select helpers 2026-04-01 09:50:03 +02:00
Hartmut 3abb3bc865 refactor(web): extract timeline touch helpers 2026-04-01 09:48:04 +02:00
Hartmut 167eec31de test(repo): guard timeline live preview boundaries 2026-04-01 09:43:14 +02:00
Hartmut 5e8babd1e6 test(web): cover timeline live preview render edges 2026-04-01 09:41:43 +02:00
Hartmut 5011d071b8 refactor(web): extract timeline live preview helpers 2026-04-01 09:40:07 +02:00
Hartmut 2855567456 test(web): cover timeline project row layout 2026-04-01 09:29:43 +02:00
Hartmut 85744d1879 test(web): cover timeline render helper edges 2026-04-01 09:26:44 +02:00
Hartmut 1f71b345ee test(web): cover allocation visual state helpers 2026-04-01 09:24:38 +02:00
Hartmut f70ce9480d test(web): cover timeline drag math guards 2026-04-01 09:23:45 +02:00
Hartmut 403d59ad73 fix(web): stabilize timeline hover date matching 2026-04-01 09:15:24 +02:00
Hartmut 71c4e61735 test(web): cover timeline sse edge paths 2026-04-01 09:10:45 +02:00
Hartmut 6c138964ca docs(repo): sync quality guardrail references 2026-04-01 09:05:23 +02:00
Hartmut 01e116ce99 test(repo): guard critical ownership surfaces 2026-04-01 09:04:29 +02:00
Hartmut b2568a3cb4 test(repo): cover worktree hygiene guardrails 2026-04-01 09:02:37 +02:00
Hartmut e75f69bcf5 refactor(web): extract timeline sse invalidation policy 2026-04-01 08:59:25 +02:00
Hartmut 4edf3a32ac fix(web): keep segmented timeline allocations actionable 2026-04-01 08:54:15 +02:00
Hartmut 6249f61ce1 chore(repo): add parallel worktree hygiene guardrail 2026-04-01 08:53:14 +02:00
Hartmut 90f2f3c123 docs(backlog): add showcase quality working backlog 2026-04-01 08:36:26 +02:00
Hartmut 7277e60691 test(api): widen resource capacity edge coverage 2026-04-01 07:52:40 +02:00
Hartmut 6370c8acef chore(e2e): ignore playwright runtime env 2026-04-01 07:47:18 +02:00
Hartmut 071ea13cc4 test(api): stabilize chargeability stats regression 2026-04-01 07:45:02 +02:00
Hartmut 8c5be51251 feat(platform): checkpoint current implementation state 2026-04-01 07:42:03 +02:00
Hartmut 3e53471f05 refactor(api): split resource read models 2026-04-01 07:38:03 +02:00
Hartmut 41916a4e46 refactor(api): share owned resource read access 2026-04-01 07:35:34 +02:00
Hartmut a0c98cf24d test(api): close assistant split regression gaps 2026-04-01 07:33:00 +02:00
Hartmut 6929482eb0 docs(api): note assistant split test gaps 2026-04-01 00:53:12 +02:00
Hartmut 60681eded7 ci(api): run assistant split regression 2026-04-01 00:52:31 +02:00
Hartmut f2d65d3cd4 test(api): add assistant split regression runner 2026-04-01 00:51:23 +02:00
Hartmut 254f2caa94 test(api): cover assistant timeline resource selection 2026-04-01 00:44:53 +02:00
Hartmut 3d9d3dd5a7 test(api): cover assistant system role configs 2026-04-01 00:44:42 +02:00
Hartmut 9c58952170 test(api): cover assistant import export tools 2026-04-01 00:44:29 +02:00
Hartmut 67f57e2791 test(api): cover ai client helpers 2026-04-01 00:44:16 +02:00
Hartmut ef282e5e00 test(api): add assistant master data mutation helpers 2026-04-01 00:42:49 +02:00
Hartmut ed021947ad test(api): add assistant timeline allocation mutation helpers 2026-04-01 00:42:43 +02:00
Hartmut 0039a9997a test(api): cover assistant project computation views 2026-04-01 00:42:02 +02:00
Hartmut 22ead3ca3d test(api): cover assistant project cover tools 2026-04-01 00:41:55 +02:00
Hartmut 30b202c391 test(api): cover assistant change history queries 2026-04-01 00:41:46 +02:00
Hartmut 740ef0ecdb test(api): cover assistant master data rate lookup 2026-04-01 00:41:40 +02:00
Hartmut 43c4ad37f3 test(api): cover assistant auth guard 2026-04-01 00:41:31 +02:00
Hartmut f52380dc53 test(api): cover assistant chargeability report 2026-04-01 00:41:26 +02:00
Hartmut 95940f005b test(api): cover assistant budget status 2026-04-01 00:41:17 +02:00
Hartmut 1d4e5c62b0 test(api): cover assistant insights and scenarios 2026-04-01 00:41:09 +02:00
Hartmut 38a7826326 test(api): cover assistant advanced timeline views 2026-04-01 00:38:55 +02:00
Hartmut 8349c5e0b3 test(api): cover assistant advanced resource ranking 2026-04-01 00:38:49 +02:00
Hartmut 248973c87d test(api): cover assistant estimate version status errors 2026-04-01 00:38:15 +02:00
Hartmut c65ae132d3 test(api): cover assistant estimate revision export errors 2026-04-01 00:38:10 +02:00
Hartmut f1427a3f85 test(api): cover assistant estimate planning handoff errors 2026-04-01 00:38:03 +02:00
Hartmut a07057438e test(api): cover assistant estimate weekly phasing errors 2026-04-01 00:37:59 +02:00
Hartmut 7b6a4f6436 test(api): cover assistant estimate commercial term errors 2026-04-01 00:37:45 +02:00
Hartmut 276751c4ca test(api): cover assistant estimate draft errors 2026-04-01 00:37:45 +02:00
Hartmut 0b535a6a5f test(api): cover assistant estimate clone paths 2026-04-01 00:37:45 +02:00
Hartmut 80c31cc53f test(api): cover assistant estimate reads 2026-04-01 00:37:38 +02:00
Hartmut c510eeae37 test(api): cover assistant dispo import tools 2026-04-01 00:36:26 +02:00
Hartmut ef9ec798ed test(api): cover assistant dispo staged resolution 2026-04-01 00:36:22 +02:00
Hartmut 542d61bed3 test(api): cover assistant dispo staged reads 2026-04-01 00:36:17 +02:00
Hartmut e76b4b2cfe test(api): cover assistant timeline project shifts 2026-04-01 00:35:28 +02:00
Hartmut 7949aeb2e4 test(api): cover assistant timeline inline allocation update 2026-04-01 00:35:16 +02:00
Hartmut 3607d73b84 test(api): cover assistant timeline allocation shifts 2026-04-01 00:35:16 +02:00
Hartmut adf25f328f test(api): cover assistant timeline batch quick assign 2026-04-01 00:34:25 +02:00
Hartmut 705b570684 test(api): cover assistant timeline quick assign 2026-04-01 00:34:18 +02:00
Hartmut 2b8e1a1bf1 test(api): cover assistant allocation mutations 2026-04-01 00:33:28 +02:00